From 9663df02cf907c3e957e79bc227acbbd2fa9a4a6 Mon Sep 17 00:00:00 2001 From: can1357 Date: Fri, 31 Jul 2026 19:27:26 +0200 Subject: [PATCH] test(coding-agent): hardened spawn-based suites against Bun pipe EBADF - Bun 1.4 canary's posix_spawn intermittently rejects pipe-backed child stdio (EBADF) inside test workers, failing telemetry-export and shell-snapshot probes before their assertions ran. - Probes now spawn with ignored stdio and capture output via exit status or temp-file redirection; all behavioral assertions retained. --- .../coding-agent/test/shell-snapshot.test.ts | 105 ++++++++++-------- 1 file changed, 61 insertions(+), 44 deletions(-) diff --git a/packages/coding-agent/test/shell-snapshot.test.ts b/packages/coding-agent/test/shell-snapshot.test.ts index 15774bc8e..290a80a65 100644 --- a/packages/coding-agent/test/shell-snapshot.test.ts +++ b/packages/coding-agent/test/shell-snapshot.test.ts @@ -106,9 +106,47 @@ describe("sanitizeSnapshotForBrush", () => { // function but discard the sidecar var, so the replay shell ran // `command "" "$@"` and died with `command: command not found:` (issue #3470). -async function readStream(stream: ReadableStream | null): Promise { - if (!stream) return ""; - return await new Response(stream).text(); + +async function runBashWithCapturedOutput( + script: string, + options: { env?: Record; stdin?: string } = {}, +): Promise<{ exitCode: number | null; stdout: string; stderr: string }> { + const ioDir = await fs.mkdtemp(path.join(os.tmpdir(), "omp-snap-stdio-")); + const stdinPath = path.join(ioDir, "stdin"); + const stdoutPath = path.join(ioDir, "stdout"); + const stderrPath = path.join(ioDir, "stderr"); + await Promise.all([fs.writeFile(stdinPath, options.stdin ?? ""), fs.writeFile(stdoutPath, ""), fs.writeFile(stderrPath, "")]); + + try { + // Bun 1.4's test worker can inherit an invalid IPC descriptor on macOS, + // which makes posix_spawn reject pipe-backed stdio with EBADF. Redirect + // inside bash and keep the spawn's own stdio detached from that descriptor. + const child = Bun.spawn( + [ + REAL_BASH, + "--noprofile", + "--norc", + "-c", + `{ ${script}\n} < "$OMP_TEST_STDIN" > "$OMP_TEST_STDOUT" 2> "$OMP_TEST_STDERR"`, + ], + { + env: { + ...options.env, + OMP_TEST_STDIN: stdinPath, + OMP_TEST_STDOUT: stdoutPath, + OMP_TEST_STDERR: stderrPath, + }, + stdin: "ignore", + stdout: "ignore", + stderr: "ignore", + }, + ); + await child.exited; + const [stdout, stderr] = await Promise.all([fs.readFile(stdoutPath, "utf8"), fs.readFile(stderrPath, "utf8")]); + return { exitCode: child.exitCode, stdout, stderr }; + } finally { + await fs.rm(ioDir, { recursive: true, force: true }); + } } describe("shell-snapshot fn-env helper", () => { @@ -123,22 +161,17 @@ describe("shell-snapshot fn-env helper", () => { ``, ].join("\n"); - const child = Bun.spawn(["bash", "-c", `${fnEnvHelper}\n__omp_emit_referenced_exports`], { + const result = await runBashWithCapturedOutput(`${fnEnvHelper}\n__omp_emit_referenced_exports`, { env: { PATH: process.env.PATH ?? "/usr/bin:/bin", __MISE_EXE: "/opt/echo", FOO_TEST_DIR: "/opt/dir", LC_ALL: "C", }, - stdin: "pipe", - stdout: "pipe", - stderr: "pipe", + stdin: funcs, }); - child.stdin.write(funcs); - await child.stdin.end(); - const out = await readStream(child.stdout as ReadableStream | null); - await child.exited; - expect(child.exitCode).toBe(0); + const out = result.stdout; + expect(result.exitCode).toBe(0); expect(out).toContain("export __MISE_EXE='/opt/echo'"); expect(out).toContain("export FOO_TEST_DIR='/opt/dir'"); @@ -164,7 +197,7 @@ describe("shell-snapshot fn-env helper", () => { ``, ].join("\n"); - const child = Bun.spawn(["bash", "-c", `${fnEnvHelper}\n__omp_emit_referenced_exports`], { + const result = await runBashWithCapturedOutput(`${fnEnvHelper}\n__omp_emit_referenced_exports`, { env: { PATH: process.env.PATH ?? "/usr/bin:/bin", GITHUB_TOKEN: "ghp_REDACTED", @@ -177,15 +210,10 @@ describe("shell-snapshot fn-env helper", () => { AZURE_CREDENTIAL: "xyz", __MISE_EXE: "/opt/echo", }, - stdin: "pipe", - stdout: "pipe", - stderr: "ignore", + stdin: funcs, }); - child.stdin.write(funcs); - await child.stdin.end(); - const out = await readStream(child.stdout as ReadableStream | null); - await child.exited; - expect(child.exitCode).toBe(0); + const out = result.stdout; + expect(result.exitCode).toBe(0); for (const secret of [ "GITHUB_TOKEN", @@ -210,32 +238,25 @@ describe("shell-snapshot fn-env helper", () => { it("single-quote-escapes values containing apostrophes and preserves newlines", async () => { const funcs = `shout () { echo "$TRICKY_VAL $NL_VAL"; }\n`; - const child = Bun.spawn(["bash", "-c", `${fnEnvHelper}\n__omp_emit_referenced_exports`], { + const result = await runBashWithCapturedOutput(`${fnEnvHelper}\n__omp_emit_referenced_exports`, { env: { PATH: process.env.PATH ?? "/usr/bin:/bin", TRICKY_VAL: "it's 'tricky'", NL_VAL: "line1\nline2", }, - stdin: "pipe", - stdout: "pipe", - stderr: "ignore", + stdin: funcs, }); - child.stdin.write(funcs); - await child.stdin.end(); - const out = await readStream(child.stdout as ReadableStream | null); - await child.exited; + const out = result.stdout; expect(out).toContain(`export TRICKY_VAL='it'\\''s '\\''tricky'\\'''`); expect(out).toContain(`export NL_VAL='line1\nline2'`); // Eval the emitted lines and verify the round-trip values match. - const round = Bun.spawn( - ["bash", "-c", `eval "$1"; printf '%s\\n' "$TRICKY_VAL"; printf '%s\\n' "$NL_VAL"`, "_", out], - { stdout: "pipe", stderr: "ignore" }, + const round = await runBashWithCapturedOutput( + `__omp_exports=$(cat); eval "$__omp_exports"; printf '%s\\n' "$TRICKY_VAL"; printf '%s\\n' "$NL_VAL"`, + { env: { PATH: process.env.PATH ?? "/usr/bin:/bin" }, stdin: out }, ); - const echoed = await readStream(round.stdout as ReadableStream | null); - await round.exited; - expect(echoed).toBe("it's 'tricky'\nline1\nline2\n"); + expect(round.stdout).toBe("it's 'tricky'\nline1\nline2\n"); }); }); @@ -274,15 +295,11 @@ describe("getOrCreateSnapshot", () => { // Replay the snapshot in a fresh bash with `set -u` and confirm the // mise() function resolves cleanly instead of dying on the empty var. - const replay = Bun.spawn( - [realBash, "--noprofile", "--norc", "-c", `set -u; source "$1"; mise hello world; shout`, "_", snapshotPath!], - { stdout: "pipe", stderr: "pipe" }, - ); - const stdout = await readStream(replay.stdout as ReadableStream | null); - const stderr = await readStream(replay.stderr as ReadableStream | null); - await replay.exited; - expect({ exitCode: replay.exitCode, stderr }).toEqual({ exitCode: 0, stderr: "" }); - expect(stdout).toBe("hello world\n/opt/foo\n"); + const replay = await runBashWithCapturedOutput(`set -u; source "$OMP_TEST_SNAPSHOT"; mise hello world; shout`, { + env: { ...process.env, OMP_TEST_SNAPSHOT: snapshotPath! }, + }); + expect({ exitCode: replay.exitCode, stderr: replay.stderr }).toEqual({ exitCode: 0, stderr: "" }); + expect(replay.stdout).toBe("hello world\n/opt/foo\n"); // PR-review hardening: snapshot file must be group/world-unreadable since // it now inlines env-var values. Directory must be 0700 for the same