update first - 84

AINative_OKR_CASAN5/.specify/scripts/bash/tool-exec.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN H4 tool-execution guard.
+# Runs a command under a hard wall-clock timeout so a runaway/hung tool call
+# cannot block the pipeline indefinitely. Portable (uses `timeout` if present,
+# else a perl alarm) — macOS has no coreutils `timeout` by default.
+#
+# Scope (honest): this enforces a TIMEOUT only. True kernel sandboxing
+# (namespaces/seccomp/network isolation) requires running the tool inside a
+# container and is documented as a production requirement — it is NOT emulated
+# here. Do not present this as full sandboxing.
+#
+# Usage: tool-exec.sh <timeout-seconds> -- <command...>
+# Exit: command's exit code, or 124 on timeout.
+
+TIMEOUT="${1:-${CASAN_TOOL_TIMEOUT_SECONDS:-30}}"
+shift || true
+if [[ "${1:-}" == "--" ]]; then shift; fi
+if [[ "$#" -eq 0 ]]; then
+  echo "Usage: tool-exec.sh <timeout-seconds> -- <command...>" >&2
+  exit 64
+fi
+
+if command -v timeout >/dev/null 2>&1; then
+  timeout "$TIMEOUT" "$@"
+  rc=$?
+elif command -v perl >/dev/null 2>&1; then
+  perl -e 'my $t=shift; $SIG{ALRM}=sub{exit 124}; alarm($t); exec @ARGV or exit 127;' "$TIMEOUT" "$@"
+  rc=$?
+else
+  echo "TOOL_EXEC_NO_TIMEOUT_BACKEND" >&2
+  "$@"
+  rc=$?
+fi
+
+if [[ "$rc" -eq 124 || "$rc" -eq 142 ]]; then
+  echo "TOOL_EXEC_TIMEOUT after ${TIMEOUT}s" >&2
+  exit 124
+fi
+exit "$rc"