941b62249e
* feat(#3906): two terminators over one registry, with a versioned projection Adds terminateNow (write-then-terminate, for callers that cannot wait for the event loop) beside runMain (drain-then-exit), both projecting through one shared function so they cannot disagree - the parity the ADR makes mandatory. A failed write does not change the exit code: letting it propagate would fail a hook open, which is what the fail-closed branches exist to prevent. The projection is versioned. v1 reproduces today's integers, including keeping a payload-carried degraded result at exit 0 - ADR-2980 ratified that across 60 sites and declined normalizing it on measured blast radius. v2 applies the registry. --exit-contract=v2 or GSD_EXIT_CONTRACT=v2 selects it; an unrecognized version throws rather than silently defaulting. The registry is now emitted beside both copies of the exit module, so it resolves as a sibling in the built tree and in the committed scripts/ copy that must load on an unbuilt clone. * fix(#3906): actually restrict code 2 to terminateNow, and generate the registry's type The claim that terminateNow is the only place 2 can be produced was false: runMain's outcome arm applied no guard, so runMain(()=>'HOOK_DENY') set exitCode 2 through the drain path - and the parity matrix demonstrated it while calling it parity. runMain now refuses any outcome projecting to the hook-protocol code, gated on the code rather than the name so an alias cannot slip past, and the matrix asserts the restriction instead of contradicting it. The ambient type for the generated registry was hand-written with no gate against the generator's actual output - the declared-surface-diverges-from-runtime defect class this epic exists to close, reintroduced inside it. It is now a third generated artifact covered by the same --check. Also converts every test-body try/finally to t.after(). * test(#3906): derive the glossary fixture's dependencies instead of hand-listing them Adding a require to scripts/lib/cli-exit.cjs broke 31 tests in one suite that built its fixture from a hand-written dependency list, so the new sibling was absent and the copied script could not load. copyScriptWithDeps walks the require graph and exists for exactly this class - #3412 paid the same bill when one new require broke 82 tests across two suites. Migrating rather than adding another copyFileSync line keeps the class closed. The other nine suites referencing that path were triaged; none copies-and-spawns, so none needed migrating. * fix(#3906): enumerate the new shipped file, drop a vendor name from shipped data, and fix three test defects install: scripts/lib/exit-code-registry.cjs was missing from GSD_SCRIPTS_LIB_FILES, so it shipped to every install and orphaned on uninstall. The registry gave HOOK_DENY a meaning naming one harness, and that string ships into every runtime's tree - a guard correctly caught it leaking into the hermes and qwen installs. The registry is runtime-neutral infrastructure; the vendor name belongs in the ADR, not in shipped data. Two more fixture harnesses built their trees from hand-listed dependencies and broke on the new require; both migrated to the derived helper, and all 23 copy-and-spawn candidates were enumerated so the class is closed rather than patched. One generator test used a fixture code that collided with a real allocation, so the generator correctly reported a duplicate where the test expected drift. The large-payload test embedded a 256KB literal in the child's argv, exceeding Linux's 128KiB MAX_ARG_STRLEN so the child never started - it now builds the payload inside the child. * chore(#3906): backfill changeset pr number * docs(#3906): document the exit-code contract selector P2 is the first phase of this epic with a user-invocable surface, so the flag and env var owe a reference entry. Records what actually differs between v1 and v2 today (one outcome), that an unrecognized value is rejected rather than silently defaulted, and the fail-safe property that makes switching safe. --------- Co-authored-by: sim <sim@local>
98 lines
3.3 KiB
JavaScript
98 lines
3.3 KiB
JavaScript
'use strict';
|
|
|
|
// GENERATED FILE — DO NOT EDIT BY HAND.
|
|
// Source of truth: gsd-core/bin/shared/exit-codes.json. Regenerate with:
|
|
// node scripts/gen-exit-code-registry.cjs --write
|
|
// This exact content is emitted to TWO locations — gsd-core/bin/lib/exit-code-registry.cjs
|
|
// and scripts/lib/exit-code-registry.cjs (the latter committed so scripts/
|
|
// consumers work on an unbuilt clone) — both byte-compared by
|
|
// `npm run lint:generated-sync` (#3905 ADR-3889 Phase 1; #3906 Phase 2 added the second copy).
|
|
//
|
|
// exitCodeFor(name) / nameForExitCode(code) are pure and total over this
|
|
// closed table — each throws for anything not registered here.
|
|
|
|
const EXIT_CODES = Object.freeze([
|
|
Object.freeze({
|
|
code: 2,
|
|
name: "HOOK_DENY",
|
|
meaning: "Hook protocol deny — the harness blocks the tool call",
|
|
owner: "hook-adapter",
|
|
authorizedBy: "ADR-3889",
|
|
}),
|
|
Object.freeze({
|
|
code: 64,
|
|
name: "USAGE",
|
|
meaning: "Caller error — bad argv, unknown subcommand, missing argument",
|
|
owner: "generic",
|
|
authorizedBy: "ADR-3889",
|
|
}),
|
|
Object.freeze({
|
|
code: 66,
|
|
name: "NO_INPUT",
|
|
meaning: "Ran; zero units were in scope, and that emptiness is known to be genuine",
|
|
owner: "generic",
|
|
authorizedBy: "ADR-3889",
|
|
}),
|
|
Object.freeze({
|
|
code: 69,
|
|
name: "UNAVAILABLE",
|
|
meaning: "Could not run — prerequisite absent, input unreadable, scope unestablished",
|
|
owner: "generic",
|
|
authorizedBy: "ADR-3889",
|
|
}),
|
|
Object.freeze({
|
|
code: 70,
|
|
name: "INTERNAL",
|
|
meaning: "Self-failure — crash, timeout, killed subprocess",
|
|
owner: "generic",
|
|
authorizedBy: "ADR-3889",
|
|
}),
|
|
Object.freeze({
|
|
code: 80,
|
|
name: "DEGRADED",
|
|
meaning: "Ran to completion and is reporting a condition through its result payload rather than as a process failure",
|
|
owner: "gsd-tools",
|
|
authorizedBy: "ADR-3889 + ADR-2980",
|
|
})
|
|
]);
|
|
|
|
const NAME_TO_CODE = new Map(EXIT_CODES.map((entry) => [entry.name, entry.code]));
|
|
const CODE_TO_NAME = new Map(EXIT_CODES.map((entry) => [entry.code, entry.name]));
|
|
|
|
/**
|
|
* Resolve the registered exit code for a symbolic name. Pure, total: throws
|
|
* for anything not an exact, registered, exact-case key — including
|
|
* non-strings, the empty string, untrimmed strings, wrong case, and
|
|
* prototype-chain names like `__proto__`/`constructor`/`toString` (a Map
|
|
* lookup never touches the prototype chain, so these are indistinguishable
|
|
* from any other unregistered name).
|
|
*
|
|
* @param {string} name
|
|
* @returns {number}
|
|
*/
|
|
function exitCodeFor(name) {
|
|
if (typeof name !== 'string' || name.length === 0) {
|
|
throw new Error(`exitCodeFor: name must be a non-empty string, received ${JSON.stringify(name)}`);
|
|
}
|
|
if (!NAME_TO_CODE.has(name)) {
|
|
throw new Error(`exitCodeFor: unregistered exit code name: ${JSON.stringify(name)}`);
|
|
}
|
|
return NAME_TO_CODE.get(name);
|
|
}
|
|
|
|
/**
|
|
* Reverse of exitCodeFor: resolve the symbolic name for a registered exit
|
|
* code. Pure, total: throws for anything not an exact, registered code.
|
|
*
|
|
* @param {number} code
|
|
* @returns {string}
|
|
*/
|
|
function nameForExitCode(code) {
|
|
if (!CODE_TO_NAME.has(code)) {
|
|
throw new Error(`nameForExitCode: unregistered exit code: ${JSON.stringify(code)}`);
|
|
}
|
|
return CODE_TO_NAME.get(code);
|
|
}
|
|
|
|
module.exports = { EXIT_CODES, exitCodeFor, nameForExitCode };
|