chore: sync upstream e364a7ee (64 commits)

.github/dependabot.yml

@@ -64,10 +64,14 @@ updates:
           - ">= 7.0.0"
       # @cloudflare/vitest-pool-workers (0.22.0, the latest) peers on vitest
       # ^4.1.0 and runs the control-plane integration tests, so vitest 5 cannot
-      # run them. Drop this entry once pool-workers accepts vitest 5.
+      # run them. Drop this entry once pool-workers accepts vitest 5. The
+      # coverage providers peer on the exact vitest version, so hold them too.
       - dependency-name: vitest
         versions:
           - ">= 5.0.0"
+      - dependency-name: "@vitest/coverage-*"
+        versions:
+          - ">= 5.0.0"
       # Prettier tracks the version locked upstream (ColeMurray/background-agents),
       # not the latest. A newer formatter rewrites upstream-owned files, which then
       # conflict on every sync, and fails format:check on files a sync brings in

.github/workflows/ci-python.yml

@@ -195,7 +195,8 @@ jobs:
           pip install -e ".[dev]"
 
       - name: Run tests
-        run: pytest tests/ -v
+        # Dump stacks and exit stalled tests before the job timeout prevents log upload.
+        run: pytest tests/ -v --durations=20 -o faulthandler_timeout=60 -o faulthandler_exit_on_timeout=true
 
       - name: Run Node.js tests
         run: node --test tests/*.test.mjs

.github/workflows/ci.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - ".env.example"
       - ".github/workflows/ci.yml"
+      - ".github/workflows/terraform.yml"
       - ".nvmrc"
       - ".prettierignore"
       - ".prettierrc"
@@ -42,6 +43,7 @@ on:
     paths:
       - ".env.example"
       - ".github/workflows/ci.yml"
+      - ".github/workflows/terraform.yml"
       - ".nvmrc"
       - ".prettierignore"
       - ".prettierrc"

.github/workflows/coverage.yml

@@ -0,0 +1,349 @@
+# Keep the workflow unfiltered so the aggregate Coverage check can be required
+# for merge without leaving unrelated pull requests pending. Each suite runs
+# only when its inputs change; skipped suites still report success.
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    name: Detect coverage inputs
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      control-plane: ${{ steps.changes.outputs.control-plane }}
+      web: ${{ steps.changes.outputs.web }}
+      other-ts: ${{ steps.changes.outputs.other-ts }}
+      python: ${{ steps.changes.outputs.python }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Check for changes affecting each coverage suite
+        id: changes
+        env:
+          # PRs compare from the merge base; pushes compare the complete push.
+          DIFF_RANGE: ${{ github.event_name == 'pull_request' && format('{0}...{1}', github.event.pull_request.base.sha, github.event.pull_request.head.sha) || format('{0}..{1}', github.event.before, github.sha) }}
+        run: |
+          # The coverage gate itself applies to every suite.
+          gate=(
+            .github/workflows/coverage.yml
+            .nvmrc
+            scripts/check-coverage.mjs
+            scripts/coverage-baseline.json
+            scripts/coverage-policy.ts
+          )
+          # Every TypeScript suite installs the workspace and imports the built shared package.
+          typescript=(
+            package.json
+            package-lock.json
+            packages/shared
+          )
+          # Inputs outside a suite's own packages are files its tests read or import.
+          # Keep these lists in sync with those reads. Package READMEs are not inputs.
+          detect() {
+            local suite=$1
+            shift
+            # Unknown paths and unavailable comparisons run the suite. No rename
+            # detection: moving an input out of a watched directory must run it.
+            if git diff --quiet --no-renames "$DIFF_RANGE" -- "$@" ':(exclude,glob)packages/**/*.md'; then
+              echo "$suite=false" >> "$GITHUB_OUTPUT"
+              echo "No $suite coverage inputs changed: skipping." >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "$suite=true" >> "$GITHUB_OUTPUT"
+            fi
+          }
+          detect control-plane "${gate[@]}" "${typescript[@]}" \
+            packages/control-plane \
+            packages/opencomputer-infra \
+            packages/sandbox-images \
+            packages/vercel-infra \
+            packages/sandbox-runtime/src/sandbox_runtime/runtime_manifest.json \
+            terraform/d1/migrations \
+            terraform/environments/production/workers-control-plane.tf \
+            .env.example \
+            docker-compose.yml \
+            docs/CONTROL_PLANE_CONTAINER.md
+          detect web "${gate[@]}" "${typescript[@]}" \
+            packages/web \
+            packages/control-plane/src/session/batch-archive.ts \
+            packages/control-plane/src/session/contracts.ts \
+            packages/control-plane/src/session/runtime-client.ts
+          detect other-ts "${gate[@]}" "${typescript[@]}" \
+            packages/github-bot \
+            packages/linear-bot \
+            packages/slack-bot \
+            scripts/check-coverage.test.mjs \
+            docs/AVAILABLE_MODELS.md \
+            packages/docs/content/docs/models/choosing-a-model.mdx
+          detect python "${gate[@]}" \
+            packages/modal-infra \
+            packages/sandbox-runtime \
+            packages/sandbox-images \
+            packages/control-plane/src/image-builds/timeouts.ts \
+            packages/shared/src/types/integrations.ts \
+            terraform/modules/modal-app/scripts/deploy.sh
+
+  # Control-plane coverage is CPU-bound on per-file Workers pool startup, so it is split across
+  # runners. Shards skip the full-suite floor; the merge job below enforces it on the merged report.
+  control-plane-coverage-shard:
+    name: Coverage (control-plane ${{ matrix.shard }})
+    needs: changes
+    if: needs.changes.outputs.control-plane == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: ["1/8", "2/8", "3/8", "4/8", "5/8", "6/8", "7/8", "8/8"]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - name: Install and build shared
+        run: |
+          npm ci
+          npm run build -w @open-inspect/shared
+      - name: Run control-plane coverage shard
+        env:
+          COVERAGE_SHARD: "true"
+          SHARD: ${{ matrix.shard }}
+        run: >-
+          npm run test:coverage -w @open-inspect/control-plane --
+          --shard="$SHARD"
+          --reporter=default --reporter=github-actions --reporter=blob
+          --coverage.reporter=json-summary
+      - name: Upload shard report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: control-plane-coverage-shard-${{ strategy.job-index }}
+          path: packages/control-plane/.vitest-reports/
+          include-hidden-files: true
+          if-no-files-found: error
+
+  control-plane-coverage:
+    name: Coverage (control-plane)
+    needs: control-plane-coverage-shard
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: control-plane-coverage-shard-*
+          path: packages/control-plane/.vitest-reports/
+          merge-multiple: true
+      - name: Merge and enforce control-plane coverage
+        working-directory: packages/control-plane
+        run: |
+          npx vitest run --merge-reports=.vitest-reports --config vitest.coverage.config.ts --coverage
+          node ../../scripts/check-coverage.mjs control-plane coverage/coverage-summary.json
+      - name: Upload control-plane coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-data-control-plane
+          path: packages/control-plane/coverage/
+          if-no-files-found: error
+
+  web-coverage:
+    name: Coverage (web)
+    needs: changes
+    if: needs.changes.outputs.web == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - name: Install and build shared
+        run: |
+          npm ci
+          npm run build -w @open-inspect/shared
+      - name: Enforce web coverage
+        run: |
+          npm run test:coverage -w @open-inspect/web
+          node scripts/check-coverage.mjs web packages/web/coverage/coverage-summary.json
+      - name: Upload web coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-data-web
+          path: packages/web/coverage/
+          if-no-files-found: error
+
+  other-ts-coverage:
+    name: Coverage (shared and bots)
+    needs: changes
+    if: needs.changes.outputs.other-ts == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - name: Install and build shared
+        run: |
+          npm ci
+          npm run build -w @open-inspect/shared
+      - name: Test the coverage gate
+        run: node --test scripts/check-coverage.test.mjs
+      - name: Enforce TypeScript coverage
+        run: |
+          for package in shared slack-bot linear-bot github-bot; do
+            npm run test:coverage -w "@open-inspect/$package"
+            node scripts/check-coverage.mjs "$package" "packages/$package/coverage/coverage-summary.json"
+          done
+      - name: Upload other TypeScript coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-data-ts
+          path: |
+            packages/shared/coverage/
+            packages/slack-bot/coverage/
+            packages/linear-bot/coverage/
+            packages/github-bot/coverage/
+          if-no-files-found: error
+
+  python-coverage:
+    name: Coverage (Python)
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@v7
+        with:
+          version: "0.9.7"
+      - name: Enforce Python statement and branch coverage
+        run: |
+          for package in modal-infra sandbox-runtime; do
+            uv run --frozen --project "packages/$package" --extra dev pytest "packages/$package/tests" --cov="packages/$package/src" --cov-branch --cov-report="json:packages/$package/coverage/coverage.json"
+            node scripts/check-coverage.mjs "$package" "packages/$package/coverage/coverage.json"
+          done
+      - name: Upload Python coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-data-python
+          path: |
+            packages/modal-infra/coverage/
+            packages/sandbox-runtime/coverage/
+          if-no-files-found: error
+
+  coverage:
+    name: Coverage
+    if: ${{ always() }}
+    needs:
+      [
+        changes,
+        control-plane-coverage-shard,
+        control-plane-coverage,
+        web-coverage,
+        other-ts-coverage,
+        python-coverage,
+      ]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Require successful coverage jobs
+        env:
+          CHANGES_RESULT: ${{ needs.changes.result }}
+          CP_CHANGED: ${{ needs.changes.outputs.control-plane }}
+          WEB_CHANGED: ${{ needs.changes.outputs.web }}
+          TS_CHANGED: ${{ needs.changes.outputs.other-ts }}
+          PYTHON_CHANGED: ${{ needs.changes.outputs.python }}
+          CP_SHARD_RESULT: ${{ needs.control-plane-coverage-shard.result }}
+          CP_RESULT: ${{ needs.control-plane-coverage.result }}
+          WEB_RESULT: ${{ needs.web-coverage.result }}
+          TS_RESULT: ${{ needs.other-ts-coverage.result }}
+          PYTHON_RESULT: ${{ needs.python-coverage.result }}
+        run: |
+          status=0
+          # A job passes when it succeeded, or was skipped because none of its inputs changed.
+          require() {
+            local job=$1 result=$2 changed=$3
+            if [ "$result" = success ] || { [ "$result" = skipped ] && [ "$changed" = false ]; }; then
+              return
+            fi
+            echo "::error::$job coverage job result: $result"
+            status=1
+          }
+          require changes "$CHANGES_RESULT" true
+          require control-plane-shards "$CP_SHARD_RESULT" "$CP_CHANGED"
+          require control-plane "$CP_RESULT" "$CP_CHANGED"
+          require web "$WEB_RESULT" "$WEB_CHANGED"
+          require other-ts "$TS_RESULT" "$TS_CHANGED"
+          require python "$PYTHON_RESULT" "$PYTHON_CHANGED"
+          exit "$status"
+      - if: needs.changes.outputs.control-plane == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          name: coverage-data-control-plane
+          path: packages/control-plane/coverage/
+      - if: needs.changes.outputs.web == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          name: coverage-data-web
+          path: packages/web/coverage/
+      - if: needs.changes.outputs.other-ts == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          name: coverage-data-ts
+          path: packages/
+      - if: needs.changes.outputs.python == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          name: coverage-data-python
+          path: packages/
+      - name: Upload coverage reports
+        if: always() && contains(needs.changes.outputs.*, 'true')
+        uses: actions/upload-artifact@v7
+        with:
+          name: production-coverage
+          path: packages/*/coverage/
+          if-no-files-found: error