-
Notifications
You must be signed in to change notification settings - Fork 0
feat(cli): dispatch the three engines concurrently and merge their findings #94
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
0ad1c1e
378a1d7
65b53be
5e74df9
1774645
5d8d080
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,13 +2,11 @@ import { resolve, join, isAbsolute, relative } from "node:path"; | |
| import { stat } from "node:fs/promises"; | ||
| import { defineCommand } from "citty"; | ||
|
|
||
| import { runAstGrepScan } from "../rules/scan"; | ||
| import type { CheckResult } from "../types/check"; | ||
| import { hasValeRules, runEngines } from "../rules/dispatch"; | ||
| import { formatText } from "../util/format"; | ||
| import { resolveSgConfigPath } from "../filesystem/sgconfig"; | ||
| import { ensureTasklessDirectory } from "../filesystem/directory"; | ||
| import { | ||
| dedupeFindings, | ||
| discoverAstGrepRuleSources, | ||
| planEngineDispatch, | ||
| } from "../rules/engines"; | ||
|
|
@@ -30,7 +28,6 @@ import { | |
| selectBlessedRuntimeRules, | ||
| signRuntimeChecks, | ||
| } from "../rules/runtime/run-set"; | ||
| import { executeRuntimeRules } from "../rules/runtime/harness"; | ||
|
|
||
| async function pathExists(absolutePath: string): Promise<boolean> { | ||
| try { | ||
|
|
@@ -316,7 +313,7 @@ export const checkCommand = defineCommand({ | |
| } | ||
|
|
||
| // Rules dispatch by the engine directory that contains them. This is also | ||
| // the migration trigger: no config is generated on the check path any | ||
| // the migration trigger: no config is generated on the check path any | ||
| // more, so without this call an upgraded CLI would keep reading a stale | ||
| // layout. | ||
| // | ||
|
|
@@ -330,9 +327,11 @@ export const checkCommand = defineCommand({ | |
| const dispatch = await planEngineDispatch(cwd); | ||
|
|
||
| // Static rules (trusted ast-grep YAML) always run; runtime rules | ||
| // (untrusted check.ts) are gated separately. An engine directory this CLI | ||
| // has no executor for (vale) contributes nothing, and a directory that is | ||
| // not a known engine is ignored rather than handed to someone's parser. | ||
| // (untrusted check.ts) are gated separately. Vale is discovered below, | ||
| // in the "anything to run?" gate — every known engine now has an | ||
| // executor, so none of them can be assumed to contribute nothing. A | ||
| // directory that is not a known engine is still ignored rather than | ||
| // handed to someone's parser. | ||
| const astGrepSources = await discoverAstGrepRuleSources(cwd); | ||
| // Both halves matter: `executor` alone is read from the static layout | ||
| // table and is therefore always `runtime-harness`, so gating on it only | ||
|
|
@@ -347,7 +346,18 @@ export const checkCommand = defineCommand({ | |
| ? await discoverRuntimeRules(cwd) | ||
| : []; | ||
|
|
||
| if (astGrepSources.length === 0 && runtimeRules.length === 0) { | ||
| // "No rules configured" has to mean *no engine* has any, not just these | ||
| // two: a project whose only rules live in `.taskless/vale/rules/` would | ||
| // otherwise return here and Vale would never be dispatched, which is a | ||
| // silent skip of the engine the user actually configured. Asked last and | ||
| // short-circuited, so the ordinary project with ast-grep or runtime rules | ||
| // pays nothing and `runEngines` still owns the decision to spawn Vale. | ||
| const noRuleFiles = | ||
| astGrepSources.length === 0 && | ||
| runtimeRules.length === 0 && | ||
| !(await hasValeRules(cwd)); | ||
|
|
||
| if (noRuleFiles) { | ||
| if (args.json) { | ||
| console.log( | ||
| JSON.stringify( | ||
|
|
@@ -363,22 +373,9 @@ export const checkCommand = defineCommand({ | |
| } | ||
|
|
||
| try { | ||
| const results: CheckResult[] = []; | ||
|
|
||
| // Static rules: always scan, no verification (inert data). Each | ||
| // ast-grep source is scanned on its own — `sg/rules/` and, for an | ||
| // unmigrated checkout, the legacy `.taskless/rules/` — and identical | ||
| // findings from both are collapsed so a rule present in both layouts | ||
| // is reported once. | ||
| const staticResults: CheckResult[] = []; | ||
| for (const source of astGrepSources) { | ||
| const configPath = await resolveSgConfigPath(cwd, source); | ||
| const scan = await runAstGrepScan(cwd, existingPaths, { configPath }); | ||
| staticResults.push(...scan.results); | ||
| } | ||
| results.push(...dedupeFindings(staticResults)); | ||
|
|
||
| // Runtime rules: run only what the server validated (or forced). | ||
| // Runtime rules are planned before dispatch, not during it: planning | ||
| // consults auth and reconcile state, which is a decision about *what* | ||
| // may run rather than part of running it. | ||
| const plan = await planRuntime(cwd, runtimeRules, { | ||
| anonymous: args.anonymous, | ||
| dangerouslyRunScripts: Boolean(args["dangerously-run-scripts"]), | ||
|
|
@@ -389,26 +386,40 @@ export const checkCommand = defineCommand({ | |
| `Notice: runtime rule ${skipped.rule} was not run — ${skipped.reason}.` | ||
| ); | ||
| } | ||
| if (plan.execute.length > 0) { | ||
| const runtimeResults = await executeRuntimeRules(cwd, plan.execute, { | ||
| paths: existingPaths, | ||
| timeoutMs: parseTimeoutMs(args.timeout), | ||
| }); | ||
| results.push(...runtimeResults); | ||
| } | ||
|
|
||
| // Every engine runs concurrently and merges into one result set. An | ||
| // engine that cannot run reports a notice and the others still return. | ||
| const astGrepConfigPaths = await Promise.all( | ||
| astGrepSources.map((source) => resolveSgConfigPath(cwd, source)) | ||
| ); | ||
| const dispatched = await runEngines({ | ||
| cwd, | ||
| paths: existingPaths, | ||
| astGrepConfigPaths, | ||
| runtimeRules: plan.execute, | ||
| runtimeTimeoutMs: parseTimeoutMs(args.timeout), | ||
| }); | ||
| const results = dispatched.results; | ||
|
|
||
| for (const notice of dispatched.notices) warn(`Notice: ${notice}`); | ||
| for (const failure of dispatched.failures) warn(`Error: ${failure}`); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
So when an engine failure (not a finding) is why the check fails — e.g. Vale times out or its config crashes, while ast-grep/runtime produce nothing error-severity — Given |
||
|
|
||
| let errorCount = 0; | ||
| let warningCount = 0; | ||
| for (const result of results) { | ||
| if (result.severity === "error") errorCount++; | ||
| else if (result.severity === "warning") warningCount++; | ||
| } | ||
| const hasErrors = errorCount > 0; | ||
| scanCounts = { errorCount, warningCount, findings: results.length }; | ||
|
|
||
| // Computed by `runEngines`, not here: the exit code is a fact about a | ||
| // completed dispatch, and an engine failure has to fail the check even | ||
| // with no findings. | ||
| const { exitCode } = dispatched; | ||
|
|
||
| if (args.json) { | ||
| const output = checkOutputSchema.parse({ | ||
| success: !hasErrors, | ||
| success: exitCode === 0, | ||
| results, | ||
| ...(plan.skipped.length > 0 ? { skipped: plan.skipped } : {}), | ||
| }); | ||
|
|
@@ -417,9 +428,8 @@ export const checkCommand = defineCommand({ | |
| console.log(formatText(results)); | ||
| } | ||
|
|
||
| // Exit code: 1 if any errors, 0 otherwise | ||
| if (hasErrors) { | ||
| process.exitCode = 1; | ||
| if (exitCode !== 0) { | ||
| process.exitCode = exitCode; | ||
| } | ||
| } catch (error) { | ||
| const message = `Error: ${error instanceof Error ? error.message : String(error)}`; | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,224 @@ | ||
| import { readdir } from "node:fs/promises"; | ||
| import { join } from "node:path"; | ||
|
|
||
| import type { CheckResult } from "../types/check"; | ||
| import { dedupeFindings, ENGINE_LAYOUTS, type EngineName } from "./engines"; | ||
| import { executeRuntimeRules } from "./runtime/harness"; | ||
| import type { RuntimeRule } from "./runtime/discover"; | ||
| import { runAstGrepScan } from "./scan"; | ||
| import { runVale } from "./vale/run"; | ||
|
|
||
| /** Errno values that mean "the directory is not there", and nothing worse. */ | ||
| const ABSENT_DIRECTORY_CODES = new Set(["ENOENT", "ENOTDIR"]); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
|
||
|
|
||
| /** | ||
| * Whether `.taskless/vale/rules/` holds anything to run. | ||
| * | ||
| * The spec is explicit that an empty rules directory means Vale is not invoked | ||
| * at all. Worth an explicit check rather than letting Vale run and report | ||
| * nothing: a scaffolded-but-empty engine directory is the common state after | ||
| * `taskless init`, and spawning a subprocess per check to confirm it found | ||
| * nothing is pure cost. | ||
| * | ||
| * Only absence is swallowed. A blanket `catch` here would read an unreadable | ||
| * rules directory (`EACCES`, a bad mount) as "no rules" and skip Vale with no | ||
| * notice and no failure — the same silent-disable that `ValeRunOutcome`'s | ||
| * `blocking` field exists to prevent one file over. Anything that is not | ||
| * absence propagates, so `runEngines` reports it as an engine failure rather | ||
| * than a clean run. | ||
| */ | ||
| export async function hasValeRules(cwd: string): Promise<boolean> { | ||
| try { | ||
| const entries = await readdir( | ||
| join(cwd, ".taskless", ENGINE_LAYOUTS.vale.rulesDirectory) | ||
| ); | ||
| return entries.some((entry) => entry.endsWith(".yml")); | ||
| } catch (error) { | ||
| const code = (error as NodeJS.ErrnoException).code; | ||
| if (code !== undefined && ABSENT_DIRECTORY_CODES.has(code)) return false; | ||
| throw error; | ||
| } | ||
| } | ||
|
thecodedrift marked this conversation as resolved.
|
||
|
|
||
| /** One engine's contribution to a check. */ | ||
| export interface EngineOutcome { | ||
| engine: EngineName; | ||
| results: CheckResult[]; | ||
| /** | ||
| * Something the user should see that is not a finding — an engine that could | ||
| * not run. Advisory: it does not affect the exit code. | ||
| */ | ||
| notice?: string; | ||
| /** | ||
| * The engine was present and failed. Unlike a notice this must reach the exit | ||
| * code, or a broken engine reads as a clean run. | ||
| */ | ||
| failure?: string; | ||
| } | ||
|
|
||
| export interface DispatchOptions { | ||
| cwd: string; | ||
| /** Target paths, already filtered to those that exist. */ | ||
| paths: string[]; | ||
| /** | ||
| * One `--config` path per ast-grep rule source, already resolved. The source | ||
| * each was derived from is the caller's concern; dispatch only runs configs. | ||
| */ | ||
| astGrepConfigPaths: string[]; | ||
| /** Runtime rules that survived planning. Empty means the harness is skipped. */ | ||
| runtimeRules: RuntimeRule[]; | ||
| runtimeTimeoutMs?: number; | ||
| valeTimeoutMs?: number; | ||
| } | ||
|
|
||
| export interface DispatchResult { | ||
| /** Every engine's findings, merged. */ | ||
| results: CheckResult[]; | ||
| /** Advisory messages: engines that could not run. */ | ||
| notices: string[]; | ||
| /** Failures that must fail the check even with no findings. */ | ||
| failures: string[]; | ||
| /** Per-engine detail, for callers that report engine by engine. */ | ||
| outcomes: EngineOutcome[]; | ||
| /** | ||
| * The process exit code this run implies. | ||
| * | ||
| * Two independent reasons to fail, and both are needed. An error-severity | ||
| * finding is the ordinary one. An engine failure is the one that is easy to | ||
| * miss: a Vale that timed out or rejected its config produces no findings, so | ||
| * without it a broken engine exits 0 and reads exactly like a clean run. | ||
| * | ||
| * Carried on the result rather than derived by each caller. It is a fact | ||
| * about a completed dispatch, fixed the moment the engines settle, so | ||
| * computing it once here removes the chance of two callers disagreeing about | ||
| * what counts as failure. | ||
| */ | ||
| exitCode: number; | ||
| } | ||
|
|
||
| /** | ||
| * ast-grep over every source, deduped. | ||
| * | ||
| * `sg/rules/` and the legacy `.taskless/rules/` are scanned separately, so a | ||
| * rule present in both reports twice; the finding is its own identity, so | ||
| * identical matches collapse. | ||
| */ | ||
| async function runAstGrepEngine( | ||
| options: DispatchOptions | ||
| ): Promise<EngineOutcome> { | ||
| const results: CheckResult[] = []; | ||
| for (const configPath of options.astGrepConfigPaths) { | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This loops |
||
| const scan = await runAstGrepScan(options.cwd, options.paths, { | ||
| configPath, | ||
| }); | ||
| results.push(...scan.results); | ||
| } | ||
| return { engine: "sg", results: dedupeFindings(results) }; | ||
| } | ||
|
|
||
| /** | ||
| * Vale, when it has rules to run. | ||
| * | ||
| * The three non-ok outcomes divide along the line `outcome.blocking` draws: an | ||
| * absent binary is a notice, because an unsupported arch is an ordinary state | ||
| * and failing there would make `check` unrunnable on a machine where the other | ||
| * engines work; a timeout or a crash is a failure, because Vale was present and | ||
| * asked to work, and reporting that as a skip lets a broken rule file read as | ||
| * "no Vale findings". | ||
| * | ||
| * Reading the severity off the outcome rather than asking a helper is the point | ||
| * of that field: an engine reports how bad its own trouble is, and a caller | ||
| * cannot forget to ask. Every engine we add answers the same question the same | ||
| * way. | ||
| */ | ||
| async function runValeEngine(options: DispatchOptions): Promise<EngineOutcome> { | ||
| if (!(await hasValeRules(options.cwd))) { | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This duplicates the It's also an asymmetry with the other two engines: |
||
| return { engine: "vale", results: [] }; | ||
| } | ||
|
|
||
| const outcome = await runVale({ | ||
| cwd: options.cwd, | ||
| paths: options.paths, | ||
| timeoutMs: options.valeTimeoutMs, | ||
| }); | ||
|
|
||
| if (outcome.status === "ok") { | ||
| return { engine: "vale", results: outcome.results }; | ||
| } | ||
| return outcome.blocking | ||
| ? { engine: "vale", results: [], failure: outcome.message } | ||
| : { engine: "vale", results: [], notice: outcome.message }; | ||
| } | ||
|
|
||
| /** The runtime harness, over rules that planning already cleared to run. */ | ||
| async function runRuntimeEngine( | ||
| options: DispatchOptions | ||
| ): Promise<EngineOutcome> { | ||
| if (options.runtimeRules.length === 0) { | ||
| return { engine: "runtime", results: [] }; | ||
| } | ||
| const results = await executeRuntimeRules(options.cwd, options.runtimeRules, { | ||
| paths: options.paths, | ||
| timeoutMs: options.runtimeTimeoutMs, | ||
| }); | ||
| return { engine: "runtime", results }; | ||
| } | ||
|
|
||
| /** | ||
| * Run every engine that has work, concurrently, and merge what they report. | ||
| * | ||
| * Concurrency is the point: the engines are independent subprocesses over the | ||
| * same paths, and running them in sequence makes a check as slow as the sum of | ||
| * its engines for no benefit. | ||
| * | ||
| * It also forces the isolation question. `allSettled`, not `all`: `all` rejects | ||
| * on the first rejection and abandons the others, so one engine throwing would | ||
| * discard results the rest had already produced — exactly the "an unavailable | ||
| * engine must not abort the others" requirement, and the shape that makes it | ||
| * true by construction rather than by everyone remembering to catch. | ||
| * | ||
| * A rejected engine becomes a failure rather than being swallowed. The engines | ||
| * themselves report expected trouble as an outcome; a thrown error is something | ||
| * unforeseen, and treating it as "no findings" would be the silent-disable | ||
| * failure again. | ||
| */ | ||
| export async function runEngines( | ||
| options: DispatchOptions | ||
| ): Promise<DispatchResult> { | ||
| const engines: Array<[EngineName, Promise<EngineOutcome>]> = [ | ||
| ["sg", runAstGrepEngine(options)], | ||
| ["vale", runValeEngine(options)], | ||
| ["runtime", runRuntimeEngine(options)], | ||
| ]; | ||
|
|
||
| const settled = await Promise.allSettled(engines.map(([, task]) => task)); | ||
|
|
||
| const outcomes: EngineOutcome[] = settled.map((entry, index) => { | ||
| const engine = engines[index]?.[0] ?? "sg"; | ||
| if (entry.status === "fulfilled") return entry.value; | ||
| const reason: unknown = entry.reason; | ||
| return { | ||
| engine, | ||
| results: [], | ||
| failure: `${engine} engine failed: ${ | ||
| reason instanceof Error ? reason.message : String(reason) | ||
| }`, | ||
| }; | ||
| }); | ||
|
|
||
| const results = outcomes.flatMap((outcome) => outcome.results); | ||
| const failures = outcomes.flatMap((outcome) => outcome.failure ?? []); | ||
|
|
||
| return { | ||
| results, | ||
| notices: outcomes.flatMap((outcome) => outcome.notice ?? []), | ||
| failures, | ||
| outcomes, | ||
| exitCode: | ||
| results.some((finding) => finding.severity === "error") || | ||
| failures.length > 0 | ||
| ? 1 | ||
| : 0, | ||
| }; | ||
| } | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Confirming this for the record since it lines up with the follow-up you already flagged in the PR thread: this
hasValeRules(cwd)call sits inside the outertry(opened at line 295) but before the innertry/catch(375/434) that builds theSCAN_FAILEDenvelope.hasValeRulesdeliberately rethrows anything that isn'tENOENT/ENOTDIR, so anEACCESon.taskless/vale/rules/here isn't caught by this function — it propagates past thefinallyto the top-level handler inindex.ts, which prints the raw error and ignores--jsonentirely. Not raising this as new (you already scoped it out), just confirming it's accurate in case the follow-up picks it up.