thanhnvandClaude Opus 4.8
36a4812ef3
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
48 lines
1.7 KiB
Bash
Executable File
48 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN H4 tool-execution guard.
|
|
# Runs a command under a hard wall-clock timeout so a runaway/hung tool call
|
|
# cannot block the pipeline indefinitely. Portable (uses `timeout` if present,
|
|
# else a perl alarm) — macOS has no coreutils `timeout` by default.
|
|
#
|
|
# Scope (honest): this enforces a TIMEOUT only. True kernel sandboxing
|
|
# (namespaces/seccomp/network isolation) requires running the tool inside a
|
|
# container and is documented as a production requirement — it is NOT emulated
|
|
# here. Do not present this as full sandboxing.
|
|
#
|
|
# Usage: tool-exec.sh <timeout-seconds> -- <command...>
|
|
# Exit: command's exit code, or 124 on timeout.
|
|
|
|
TIMEOUT="${1:-${CASAN_TOOL_TIMEOUT_SECONDS:-30}}"
|
|
shift || true
|
|
if [[ "${1:-}" == "--" ]]; then shift; fi
|
|
if [[ "$#" -eq 0 ]]; then
|
|
echo "Usage: tool-exec.sh <timeout-seconds> -- <command...>" >&2
|
|
exit 64
|
|
fi
|
|
|
|
if command -v timeout >/dev/null 2>&1; then
|
|
timeout "$TIMEOUT" "$@"
|
|
rc=$?
|
|
elif command -v perl >/dev/null 2>&1; then
|
|
perl -e 'my $t=shift; $SIG{ALRM}=sub{exit 124}; alarm($t); exec @ARGV or exit 127;' "$TIMEOUT" "$@"
|
|
rc=$?
|
|
else
|
|
# SEC-15: no timeout backend. In enforced mode REFUSE (fail-closed) rather than
|
|
# run a command that could hang the pipeline; dev warns and proceeds.
|
|
if [[ "${CASAN_PROFILE:-}" == "prod" || "${CASAN_TOOL_EXEC_STRICT:-}" == "1" ]]; then
|
|
echo "TOOL_EXEC_NO_TIMEOUT_BACKEND refusing (fail-closed: install coreutils timeout or perl)" >&2
|
|
exit 2
|
|
fi
|
|
echo "TOOL_EXEC_NO_TIMEOUT_BACKEND (dev: running without timeout)" >&2
|
|
"$@"
|
|
rc=$?
|
|
fi
|
|
|
|
if [[ "$rc" -eq 124 || "$rc" -eq 142 ]]; then
|
|
echo "TOOL_EXEC_TIMEOUT after ${TIMEOUT}s" >&2
|
|
exit 124
|
|
fi
|
|
exit "$rc"
|