[0 BOUNTY] [Python] Add input validation and error handling to verify_diagnostics.py

README.md

@@ -1,3 +1,12 @@
+<div align="center">
+
+[![Build Status](https://img.shields.io/github/actions/workflow/status/lobster-trap/zeroeye/build.yml?branch=main&style=flat&label=build%20status)](https://github.com/lobster-trap/zeroeye/actions)
+[![Code Style](https://img.shields.io/badge/code%20style-editorconfig-blue?style=flat)](https://editorconfig.org)
+[![License](https://img.shields.io/github/license/lobster-trap/zeroeye?style=flat)](https://github.com/lobster-trap/zeroeye/blob/main/LICENSE)
+[![Languages](https://img.shields.io/badge/languages-python%20%7C%20rust%20%7C%20typescript%20%7C%20go%20%7C%20c%2B%2B-lightgrey?style=flat)](https://github.com/lobster-trap/zeroeye)
+
+</div>
+
 # Tent of Trials
 
 Trading and risk platform.

build.py

@@ -18,12 +18,49 @@
 DIAGNOSTIC_DIR = ROOT / "diagnostic"
 DIAGNOSTIC_CHUNK_SIZE = 40 * 1024 * 1024
 ENCRYPTLY_BLOCKER_MESSAGE = "encryptly could not create an archive. You may have timed out; try launching it in the background and waiting for it to finish with no timeout due to a bug in encryptly."
+TEXT_ENCODING = "utf-8"
+
+
+def configure_text_encoding() -> None:
+    """Use UTF-8 consistently for our console and captured child-process text."""
+    os.environ.setdefault("PYTHONIOENCODING", TEXT_ENCODING)
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if reconfigure is None:
+            continue
+        try:
+            reconfigure(encoding=TEXT_ENCODING, errors="replace")
+        except Exception:
+            try:
+                reconfigure(errors="replace")
+            except Exception:
+                pass
+
+
+def subprocess_env(env: Optional[dict[str, str]] = None) -> dict[str, str]:
+    merged = os.environ.copy() if env is None else env.copy()
+    merged.setdefault("PYTHONIOENCODING", TEXT_ENCODING)
+    return merged
+
+
+def run_text_process(cmd: list[str], **kwargs) -> subprocess.CompletedProcess[str]:
+    """Run a subprocess with deterministic UTF-8 text decoding."""
+    kwargs.setdefault("text", True)
+    if kwargs.get("text") is not False:
+        kwargs.setdefault("encoding", TEXT_ENCODING)
+        kwargs.setdefault("errors", "replace")
+    if kwargs.get("env") is not None:
+        kwargs["env"] = subprocess_env(kwargs["env"])
+    return subprocess.run(cmd, **kwargs)
+
+
+configure_text_encoding()
 
 
 def current_commit_id() -> str:
     """Return the first 4 bytes (8 hex chars) of HEAD for stable per-commit diagnostics."""
     try:
-        result = subprocess.run(
+        result = run_text_process(
             ["git", "rev-parse", "--verify", "HEAD"],
             cwd=str(ROOT),
             capture_output=True,
@@ -231,18 +268,20 @@ def check_encryptly_runs(timeout: int = 600) -> tuple[bool, str]:
 
     workspace = Path.home() / ".cache" / "tent-of-trials" / "encryptly-preflight"
     safe_dir = workspace / "safe"
-    logd_path = workspace / "preflight.logd"
+    output_dir = workspace / "out"
+    logd_path = output_dir / "preflight.logd"
     try:
         shutil.rmtree(workspace, ignore_errors=True)
         safe_dir.mkdir(parents=True, exist_ok=True)
+        output_dir.mkdir(parents=True, exist_ok=True)
         (safe_dir / "preflight.txt").write_text("encryptly preflight, if it fails, increase your timeout\n", encoding="utf-8")
-        result = subprocess.run(
+        result = run_text_process(
             [
                 str(encryptly_bin),
                 "pack",
                 str(logd_path),
                 "--include",
-                str(workspace),
+                str(safe_dir),
                 "--max-file-size",
                 "32000",
             ],
@@ -251,9 +290,9 @@ def check_encryptly_runs(timeout: int = 600) -> tuple[bool, str]:
             text=True,
             timeout=timeout,
         )
-        # if result.returncode != 0:
-        #     output = result.stderr.strip() or result.stdout.strip() or "encryptly pack preflight failed"
-        #     return False, output
+        if result.returncode != 0:
+            output = result.stderr.strip() or result.stdout.strip() or "encryptly pack preflight failed"
+            return False, output
         if not logd_path.exists():
             return False, "encryptly preflight completed without creating a .logd"
         return True, "encryptly preflight passed"
@@ -320,7 +359,7 @@ def build_module(
         if not node_modules.exists():
             print(f"       {color('npm install...', Colors.GRAY)}")
             try:
-                install_result = subprocess.run(
+                install_result = run_text_process(
                     ["npm", "install"],
                     cwd=str(module.dir),
                     capture_output=not verbose,
@@ -337,7 +376,7 @@ def build_module(
 
         build_type = "Release" if release else "Debug"
         try:
-            cfg_result = subprocess.run(
+            cfg_result = run_text_process(
                 ["cmake", "-S", ".", "-B", "build",
                  f"-DCMAKE_BUILD_TYPE={build_type}"],
                 cwd=str(module.dir),
@@ -371,7 +410,7 @@ def build_module(
             cmd.append("--release")
 
     try:
-        result = subprocess.run(
+        result = run_text_process(
             cmd,
             cwd=str(module.dir),
             capture_output=True,
@@ -400,7 +439,7 @@ def build_module(
 def clean_module(module: Module, verbose: bool = False) -> bool:
     print(f"  {color('▸', Colors.YELLOW)} Cleaning {module.name}...")
     try:
-        subprocess.run(
+        run_text_process(
             module.clean_cmd,
             cwd=str(module.dir),
             capture_output=not verbose,
@@ -430,7 +469,7 @@ def verify_binary(module: Module) -> Optional[str]:
 
 def run_cmd(cmd: list[str], **kwargs) -> tuple[bool, str]:
     try:
-        result = subprocess.run(
+        result = run_text_process(
             cmd, capture_output=True, text=True, check=False, **kwargs
         )
         output = result.stdout
@@ -551,7 +590,7 @@ def commit_diagnostic_artifacts(paths: list[Path], commit_id: str) -> bool:
         return False
 
     relpaths = [str(path.relative_to(ROOT)) for path in existing]
-    status = subprocess.run(
+    status = run_text_process(
         ["git", "status", "--porcelain", "--", *relpaths],
         cwd=str(ROOT),
         capture_output=True,
@@ -565,7 +604,7 @@ def commit_diagnostic_artifacts(paths: list[Path], commit_id: str) -> bool:
         print(f"    {color('✓', Colors.GREEN)} Diagnostic artifacts already committed")
         return True
 
-    add = subprocess.run(
+    add = run_text_process(
         ["git", "add", "--", *relpaths],
         cwd=str(ROOT),
         capture_output=True,
@@ -576,7 +615,7 @@ def commit_diagnostic_artifacts(paths: list[Path], commit_id: str) -> bool:
         print(f"    {color('✗', Colors.RED)} Could not stage diagnostic artifacts: {add.stderr.strip()}")
         return False
 
-    commit = subprocess.run(
+    commit = run_text_process(
         ["git", "commit", "-m", f"Add build diagnostics for {commit_id}", "--", *relpaths],
         cwd=str(ROOT),
         capture_output=True,
@@ -666,7 +705,7 @@ def generate_logd(
                 log_lines.append(output)
         (safe_dir / "build.log").write_text("\n".join(log_lines), encoding="utf-8")
 
-        sr = subprocess.run(
+        sr = run_text_process(
             [
                 str(encryptly_bin),
                 "pack",