feat: release Find-Word v0.2.3

2026-10-14 10:01:46 +00:00
parent c92660b514
commit 812540c743
531 changed files with 103693 additions and 325 deletions
@@ -0,0 +1,63 @@
+"""Run the complete Chrome suite and preserve its own descendant sandbox evidence."""
+from datetime import datetime, timezone
+import json
+import os
+from pathlib import Path
+import shlex
+import subprocess
+import sys
+import time
+
+ROOT = Path(__file__).resolve().parents[4]
+EVIDENCE = Path(__file__).resolve().parent
+
+def now(): return datetime.now(timezone.utc).isoformat()
+
+def descendants(runner_pid):
+    processes = {}
+    for directory in Path('/proc').iterdir():
+        if not directory.name.isdigit(): continue
+        try:
+            stat = (directory / 'stat').read_text().rsplit(')', 1)[1].split()
+            arguments = (directory / 'cmdline').read_bytes().decode(errors='replace').rstrip('\0').split('\0')
+            status = (directory / 'status').read_text().splitlines()
+            processes[int(directory.name)] = {'pid': int(directory.name), 'ppid': int(stat[1]),
+                'arguments': arguments, 'commandLine': shlex.join(arguments),
+                'sandboxStatus': [line for line in status if line.startswith(('NoNewPrivs:', 'Seccomp:', 'Seccomp_filters:', 'NSpid:'))]}
+        except (OSError, ValueError): continue
+    family = {runner_pid}
+    while True:
+        children = {pid for pid, record in processes.items() if record['ppid'] in family}
+        if children <= family: break
+        family |= children
+    return [record for pid, record in processes.items() if pid in family and record['arguments']
+            and record['arguments'][0].startswith('/opt/google/chrome/')
+            and 'crashpad' not in record['arguments'][0]]
+
+env = os.environ.copy()
+env.pop('PLAYWRIGHT_NO_SANDBOX', None)
+env['CHROME_PATH'] = '/usr/bin/google-chrome'
+env['PLAYWRIGHT_JSON_OUTPUT_FILE'] = str(EVIDENCE / 'browser-results.json')
+command = ['npx', 'playwright', 'test', '--reporter=line,json', '--output', str(EVIDENCE / 'browser-final')]
+started = now()
+observed = {}
+with (EVIDENCE / '06-browser.log').open('x') as log:
+    log.write('$ ' + shlex.join(command) + '\nStarted UTC: ' + started + '\nCHROME_PATH=/usr/bin/google-chrome; PLAYWRIGHT_NO_SANDBOX unset; chromiumSandbox=true\n')
+    log.flush()
+    process = subprocess.Popen(command, cwd=ROOT, env=env, stdout=log, stderr=subprocess.STDOUT)
+    while process.poll() is None:
+        for record in descendants(process.pid):
+            observed[record['pid']] = record
+        time.sleep(2)
+    log.write('\nExit code: ' + str(process.returncode) + '\nFinished UTC: ' + now() + '\n')
+assert observed, 'No suite Chrome processes observed'
+assert all('--no-sandbox' not in row['arguments'] for row in observed.values())
+report = {'startedAtUtc': started, 'completedAtUtc': now(), 'runnerPid': process.pid,
+          'command': command, 'chrome': subprocess.check_output(['/usr/bin/google-chrome', '--version'], text=True).strip(),
+          'method': 'Actual Chrome descendants of this suite runner; Playwright chromiumSandbox=true and opt-out unset.',
+          'noSandboxFlagPresent': False, 'exitCode': process.returncode,
+          'processes': list(observed.values())}
+with (EVIDENCE / 'chrome-sandbox.json').open('x') as out: out.write(json.dumps(report, indent=2) + '\n')
+print(json.dumps({'exitCode': process.returncode, 'observedChromeProcesses': len(observed), 'noSandboxFlagPresent': False}))
+print('\n'.join((EVIDENCE / '06-browser.log').read_text().splitlines()[-16:]))
+sys.exit(process.returncode)