Merge remote-tracking branch 'origin/main' into garrytan/fix-wave-oct6

lib/cso/docker.ts

@@ -404,15 +404,18 @@ export function validateSingleContainerProcessOutput(output: string): void {
     );
 }
 /**
- * Names why the in-image export helper refused a prepared tree. Only the
- * helper's fixed "prepared ..." messages and filesystem errno/syscall
- * names pass through, so target-controlled paths never reach the error.
+ * Names why the in-image export helper refused a prepared tree. The helper's
+ * top-level handler prints the error message alone and exits 70; an uncaught
+ * error prints it after "error: ". Only the helper's fixed "prepared ..."
+ * sentences and filesystem errno/syscall names pass through, so
+ * target-controlled paths never reach the error.
  */
 export function preparedExportRejection(stderr: string): string {
-  const reason = stderr.match(/^error: (prepared [A-Za-z ,-]+)$/m)?.[1];
+  const reason = stderr.match(/^(?:error: )?(prepared [A-Za-z ,-]+)$/m)?.[1];
   if (reason) return reason;
-  const errno = stderr.match(/^\s*code: "(E[A-Z]+)",?$/m)?.[1],
-    syscall = stderr.match(/^\s*syscall: "([a-z]+)",?$/m)?.[1];
+  const thrown = stderr.match(/^(?:error: )?(E[A-Z]+): [a-z ]+, ([a-z]+)\b/m),
+    errno = thrown?.[1] ?? stderr.match(/^\s*code: "(E[A-Z]+)",?$/m)?.[1],
+    syscall = thrown?.[2] ?? stderr.match(/^\s*syscall: "([a-z]+)",?$/m)?.[1];
   if (errno) return `filesystem error ${errno}${syscall ? ` during ${syscall}` : ''}`;
   return 'unrecognized helper failure';
 }

lib/cso/preparation.ts

@@ -1027,8 +1027,12 @@ function inspectRails(root: string, plan: PreparationPlan) {
     BUNDLE_CACHE_PATH: '/archives',
     BUNDLE_USER_HOME: '/work/.cso-bundle',
   };
+  // One install thread. Ruby's File.umask getter sets the process umask to 0
+  // for an instant, and RubyGems calls it for every extracted file, so a second
+  // Bundler thread creating a directory in that window leaves it 0777 and the
+  // prepared-tree export correctly refuses it.
   plan.offline.push(
-    command('/usr/local/bin/bundle', ['install', '--local', '--jobs', '2', '--retry', '0'], '/work', env),
+    command('/usr/local/bin/bundle', ['install', '--local', '--jobs', '1', '--retry', '0'], '/work', env),
   );
   plan.registryHosts = ['rubygems.org', 'index.rubygems.org'];
   const declared = railsDatabaseConfiguration(read(root, 'config/database.yml', true));