Execute bounded PHP commands in clean Playground processes

chubes4 · chubes4 · commit c41685e4f44b · 2026-07-21T13:07:38.000-04:00
diff --git a/packages/runtime-playground/src/php-bootstrap.ts b/packages/runtime-playground/src/php-bootstrap.ts
@@ -21,11 +21,15 @@ ${phpBody(code)}`
 }
 
 export function bootstrapPhpCode(spec: RuntimeCreateSpec, code: string, args: string[], wpCliBridge?: PhpBootstrapBridge, failureDiagnosticFile?: string): string {
+  const command = splitLeadingStrictTypesDeclare(code)
   if (argValue(args, "bootstrap") === "none") {
-    return code
+    return `<?php
+${command.strictTypesDeclare ? `${command.strictTypesDeclare}\n` : ""}${runtimeEnvPhp(spec, args)}
+${secretEnvPhp(spec)}
+${command.body}`
   }
 
-  const command = splitLeadingStrictTypesDeclare(code)
+  const wordpressBootstrap = argValue(args, "bootstrap-mode") === "project" ? "" : "require_once '/wordpress/wp-load.php';"
 
   const bootstrapped = `<?php
 ${command.strictTypesDeclare ? `${command.strictTypesDeclare}\n` : ""}${phpFatalDiagnosticPhp()}
@@ -36,7 +40,7 @@ ${saveQueriesBootstrapPhp(args)}
 ${runtimeEnvPhp(spec, args)}
 ${secretEnvPhp(spec)}
 ${componentManifestPhp(spec)}
-require_once '/wordpress/wp-load.php';
+${wordpressBootstrap}
 ${failureDiagnosticFile ? phpFailureDiagnosticCompletionPhp() : ""}
 ${recipeActivePluginBootstrapPhp(spec, args)}
 ${wpCliBridge ? `putenv(${JSON.stringify(`WP_CODEBOX_TERMINAL_ACTION_URL=${wpCliBridge.url}`)});
diff --git a/packages/runtime-playground/src/phpunit-command-handlers.ts b/packages/runtime-playground/src/phpunit-command-handlers.ts
@@ -843,6 +843,11 @@ function pg_run_project_bootstrap_stage(array $cfg): void {
             $bootstrap = pg_project_bootstrap_from_config($phpunit_xml);
             $from_config = $bootstrap !== '';
         }
+        if ($bootstrap === '') {
+            pg_log('NOTICE:project bootstrap not declared; continuing without one');
+            pg_stage_ok('project_bootstrap');
+            return;
+        }
         $bootstrap_real = pg_project_bootstrap_real_path($bootstrap, $phpunit_xml, $from_config);
         if ($bootstrap_real === null) {
             throw new RuntimeException('project bootstrap not found; pass project-bootstrap=<relative path> or declare phpunit bootstrap');
diff --git a/packages/runtime-playground/src/playground-cli-runner.ts b/packages/runtime-playground/src/playground-cli-runner.ts
@@ -3,7 +3,7 @@ import { PlaygroundCliExitError, type PlaygroundCliBufferedOutput } from "./play
 import { PlaygroundPreviewPortUnavailableError, assertPreviewPortAvailable, errorHasCode, withPreviewProxy, type PlaygroundCliServer } from "./preview-server.js"
 import { startProgrammaticPlaygroundServer } from "./programmatic-playground-runner.js"
 import { normalizeLiveProgressEvent, previewLease, type BrowserStartupProgressEvent, type BrowserStartupProgressPhase, type BrowserStartupProgressStatus, type MountSpec, type PreviewLease, type RuntimeCreateSpec, type RuntimePreviewLeaseProvider } from "@automattic/wp-codebox-core"
-import { randomBytes, randomInt } from "node:crypto"
+import { randomInt } from "node:crypto"
 import { existsSync } from "node:fs"
 import { createServer as createHttpServer, type Server as HttpServer } from "node:http"
 import { mkdir, readFile, rename, rm, stat, unlink, utimes, writeFile } from "node:fs/promises"
@@ -80,11 +80,6 @@ export async function startPlaygroundCliServer(spec: RuntimeCreateSpec, mounts:
     const wordpressInstallMode = spec.environment.wordpressInstallMode ?? "install-from-existing-files"
     const bootstrapIniEntries = runtimeBootstrapPhpIniEntries(spec)
     const useProgrammaticRunner = shouldUseProgrammaticPlaygroundRunner(spec, options)
-    const requestWorkerEndpoint = useProgrammaticRunner ? undefined : {
-      route: `/wp-codebox-execute-${randomBytes(12).toString("hex")}.php`,
-      token: randomBytes(32).toString("base64url"),
-      payloadDirectory: join(spec.artifactsDirectory ?? "artifacts", "playground-internal-shared"),
-    }
     usesArchiveCache = !wordpressDirectory && !spec.environment.assets?.wordpressZip
     readonlyMountStaging = await stageReadonlyPlaygroundMounts(mounts)
     const stagedMounts = readonlyMountStaging.mounts
@@ -137,7 +132,7 @@ export async function startPlaygroundCliServer(spec: RuntimeCreateSpec, mounts:
     }, Boolean(spec.preview?.port)) : await startPlaygroundCliWithDynamicPortRetry(async (port) => {
       const { runCLI } = options.cliModule ?? (await import("@wp-playground/cli")) as unknown as PlaygroundCliModule
       const localAssetServer = wordpressStartupAsset?.localPath ? await serveLocalStartupAsset(wordpressStartupAsset.localPath) : undefined
-      const bootstrapSharedMounts = await pluginRuntimeBootstrapSharedMounts(spec, requestWorkerEndpoint)
+      const bootstrapSharedMounts = await pluginRuntimeBootstrapSharedMounts(spec)
       try {
         return await runCLI({
           command: "server",
@@ -179,7 +174,7 @@ export async function startPlaygroundCliServer(spec: RuntimeCreateSpec, mounts:
       fixedPreviewPort: spec.preview?.port ?? null,
     })
 
-    const proxiedServer = await withPreviewLeaseProvider(await withPreviewProxy({ ...server, ...(requestWorkerEndpoint ? { requestWorkerEndpoint } : {}) }, spec.preview?.port ?? 0, spec.preview?.bind), spec)
+    const proxiedServer = await withPreviewLeaseProvider(await withPreviewProxy(server, spec.preview?.port ?? 0, spec.preview?.bind), spec)
     emitProgress("preview:ready", "complete", "Preview ready", {
       localUrl: proxiedServer.serverUrl,
       upstreamUrl: server.serverUrl,
@@ -303,9 +298,10 @@ export function shouldUseProgrammaticPlaygroundRunner(spec: RuntimeCreateSpec, o
     && (Boolean(runtimeBootstrapPhpIniEntries(spec)) || Boolean(spec.environment.extensions?.length))
 }
 
-async function pluginRuntimeBootstrapSharedMounts(spec: RuntimeCreateSpec, requestWorkerEndpoint?: { route: string; token: string; payloadDirectory: string }): Promise<Array<{ hostPath: string; vfsPath: string }>> {
+async function pluginRuntimeBootstrapSharedMounts(spec: RuntimeCreateSpec): Promise<Array<{ hostPath: string; vfsPath: string }>> {
   const iniEntries = runtimeBootstrapPhpIniEntries(spec)
-  if (!iniEntries && !requestWorkerEndpoint) {
+  const externalWpConfig = externalDatabaseWpConfig(spec)
+  if (!iniEntries && !externalWpConfig) {
     return []
   }
 
@@ -315,55 +311,17 @@ async function pluginRuntimeBootstrapSharedMounts(spec: RuntimeCreateSpec, reque
     await writeFile(join(directory, "php.ini"), phpIniContent(iniEntries), "utf8")
     await writeFile(join(directory, "wp-codebox-auto-prepend.php"), runtimeAutoPrependPhp(spec), "utf8")
   }
-  if (requestWorkerEndpoint) await writeFile(join(directory, "request-worker.php"), requestWorkerPhp(requestWorkerEndpoint.token), "utf8")
-  const externalWpConfig = externalDatabaseWpConfig(spec)
   if (externalWpConfig) await writeFile(join(directory, "wp-config.php"), externalWpConfig, "utf8")
 
   return [
     ...(iniEntries ? [
       { hostPath: join(directory, "php.ini"), vfsPath: "/internal/shared/php.ini" },
       { hostPath: join(directory, "wp-codebox-auto-prepend.php"), vfsPath: "/internal/shared/wp-codebox-auto-prepend.php" },
     ] : []),
-    ...(requestWorkerEndpoint ? [
-      { hostPath: directory, vfsPath: "/internal/wp-codebox" },
-      { hostPath: join(directory, "request-worker.php"), vfsPath: `/wordpress${requestWorkerEndpoint.route}` },
-    ] : []),
     ...(externalWpConfig ? [{ hostPath: join(directory, "wp-config.php"), vfsPath: "/wordpress/wp-config.php" }] : []),
   ]
 }
 
-function requestWorkerPhp(token: string): string {
-  return `<?php
-if (!hash_equals(${phpLiteral(token)}, (string) ($_SERVER['HTTP_X_WP_CODEBOX_EXECUTION_TOKEN'] ?? ''))) {
-    http_response_code(404);
-    exit;
-}
-$wp_codebox_payload_id = (string) ($_SERVER['HTTP_X_WP_CODEBOX_EXECUTION_PAYLOAD'] ?? '');
-if (!preg_match('/^[a-f0-9]{32}$/', $wp_codebox_payload_id)) {
-    http_response_code(400);
-    exit;
-}
-$wp_codebox_payload = json_decode((string) file_get_contents('/internal/wp-codebox/execution-' . $wp_codebox_payload_id . '.json'), true);
-$wp_codebox_code = $wp_codebox_payload['code'] ?? null;
-$wp_codebox_environment = $wp_codebox_payload['environment'] ?? null;
-if (!is_string($wp_codebox_code) || !is_array($wp_codebox_environment)) {
-    http_response_code(400);
-    echo 'invalid execution payload';
-    exit;
-}
-foreach ($wp_codebox_environment as $wp_codebox_name => $wp_codebox_value) {
-    if (!is_string($wp_codebox_name) || !is_string($wp_codebox_value)) {
-        http_response_code(400);
-        exit;
-    }
-    putenv($wp_codebox_name . '=' . $wp_codebox_value);
-    $_ENV[$wp_codebox_name] = $wp_codebox_value;
-    $_SERVER[$wp_codebox_name] = $wp_codebox_value;
-}
-eval('?>' . $wp_codebox_code);
-`
-}
-
 function runtimeBootstrapPhpIniEntries(spec: RuntimeCreateSpec): Record<string, string> | undefined {
   const entries = pluginRuntimeBootstrapPhpIniEntries(spec) ?? {}
   if (Object.keys(entries).length === 0 && !runtimeAutoPrependPhpBody(spec)) {
diff --git a/packages/runtime-playground/src/playground-runtime.ts b/packages/runtime-playground/src/playground-runtime.ts
@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto"
 import { AsyncLocalStorage } from "node:async_hooks"
-import { mkdir, readFile, realpath, unlink, writeFile } from "node:fs/promises"
+import { mkdir, readFile, realpath, writeFile } from "node:fs/promises"
 import type { IncomingMessage, ServerResponse } from "node:http"
 import { dirname, join, resolve } from "node:path"
 import { HostToolRegistry, PREVIEW_LEASE_SCHEMA, RUNTIME_EPISODE_OBSERVATION_SCHEMA, RUNTIME_EPISODE_SNAPSHOT_SCHEMA, RuntimeActionExecutionError, assertRuntimeCommandAllowed, commandAgentRunResultJson, createCommandAgentRunResult, createHostToolRegistry, createRuntimeCommandResultEnvelope, parseCommandAgentRunRequest, previewLease, resolveArtifactPath, resolveCommandPath, runtimeCommandResultEnvelopeFromOutput, runtimeEpisodeDigest } from "@automattic/wp-codebox-core"
@@ -251,8 +251,7 @@ class PlaygroundRuntime implements Runtime {
   private cliServerPromise?: Promise<PlaygroundCliServer>
   private readonly activeExecutionAbortControllers = new Set<AbortController>()
   private readonly executionSignals = new AsyncLocalStorage<AbortSignal>()
-  private readonly requestWorkerExecutions = new AsyncLocalStorage<Record<string, string>>()
-  private requestWorkerReady?: Promise<void>
+  private readonly isolatedProcessExecutions = new AsyncLocalStorage<boolean>()
   private reviewerAuthBootstrapRouteRegistered = false
   private readonly reviewerAuthBootstraps = new Map<string, ReviewerAuthBootstrapRecord>()
 
@@ -365,9 +364,7 @@ class PlaygroundRuntime implements Runtime {
     this.activeExecutionAbortControllers.add(abortController)
     try {
       const executionSpec = executionSpecWithEnvironment(spec)
-      const output = await this.executionSignals.run(abortController.signal, async () => spec.processIdentity
-        ? await this.requestWorkerExecutions.run(spec.environment ?? {}, async () => await timeoutPlaygroundCommand(executePlaygroundCommand(this, executionSpec, this.hostTools), spec, abortController))
-        : await timeoutPlaygroundCommand(executePlaygroundCommand(this, executionSpec, this.hostTools), spec, abortController))
+      const output = await this.executionSignals.run(abortController.signal, async () => await this.isolatedProcessExecutions.run(Boolean(spec.processIdentity), async () => await timeoutPlaygroundCommand(executePlaygroundCommand(this, executionSpec, this.hostTools), spec, abortController)))
       const finishedAt = now()
       const envelope = typeof output === "string"
         ? runtimeCommandResultEnvelopeFromOutput({
@@ -1769,11 +1766,11 @@ class PlaygroundRuntime implements Runtime {
 
   private async runPlaygroundCommand(command: string, server: PlaygroundCliServer, options: { code: string } | { scriptPath: string }): Promise<PlaygroundRunResponse> {
     try {
-      const requestWorkerEnvironment = this.requestWorkerExecutions.getStore()
-      if (requestWorkerEnvironment && "code" in options && server.requestWorkerEndpoint) {
-        await this.prepareRequestWorker(server)
-        const response = await this.executeRequestWorker(server, options.code, requestWorkerEnvironment, this.executionSignals.getStore())
-        return { text: response.text, exitCode: response.ok ? 0 : 1, ...(!response.ok ? { errors: response.text } : {}) }
+      if (this.isolatedProcessExecutions.getStore() && "code" in options) {
+        if (!server.playground.runInFreshProcess) {
+          throw new Error("The Playground runtime does not support clean PHP process execution.")
+        }
+        return await abortable(server.playground.runInFreshProcess(options), this.executionSignals.getStore())
       }
       return await abortable(server.playground.run(options), this.executionSignals.getStore())
     } catch (error) {
@@ -1786,36 +1783,6 @@ class PlaygroundRuntime implements Runtime {
     }
   }
 
-  private async prepareRequestWorker(server: PlaygroundCliServer): Promise<void> {
-    if (!server.requestWorkerEndpoint) return
-    this.requestWorkerReady ??= (async () => {
-      const response = await this.executeRequestWorker(server, "<?php echo 'ready';", {})
-      if (!response.ok || response.text !== "ready") throw new Error(`Playground request worker warmup failed with HTTP ${response.status}: ${response.text}`)
-    })()
-    await this.requestWorkerReady
-  }
-
-  private async executeRequestWorker(server: PlaygroundCliServer, code: string, environment: Record<string, string>, signal?: AbortSignal): Promise<{ ok: boolean; status: number; text: string }> {
-    const endpoint = server.requestWorkerEndpoint
-    if (!endpoint) throw new Error("Playground request worker endpoint is unavailable.")
-    const payloadId = randomBytes(16).toString("hex")
-    const payloadPath = join(endpoint.payloadDirectory, `execution-${payloadId}.json`)
-    await writeFile(payloadPath, JSON.stringify({ code, environment }), "utf8")
-    try {
-      const response = await fetch(new URL(endpoint.route, server.serverUrl), {
-        method: "POST",
-        headers: {
-          "X-WP-Codebox-Execution-Token": endpoint.token,
-          "X-WP-Codebox-Execution-Payload": payloadId,
-        },
-        signal,
-      })
-      return { ok: response.ok, status: response.status, text: await response.text() }
-    } finally {
-      await unlink(payloadPath).catch(() => undefined)
-    }
-  }
-
   async inspectMountedInputs(): Promise<string> {
     const server = await this.bootPlayground()
     const response = await server.playground.run({
diff --git a/packages/runtime-playground/src/preview-server.ts b/packages/runtime-playground/src/preview-server.ts
@@ -11,12 +11,12 @@ export interface PlaygroundServerRunResponse {
 export interface PlaygroundCliServer {
   playground: {
     run(options: { code: string } | { scriptPath: string }): Promise<PlaygroundServerRunResponse>
+    runInFreshProcess?(options: { code: string }): Promise<PlaygroundServerRunResponse>
     onMessage?(listener: (data: string) => Promise<string | void> | string | void): Promise<(() => Promise<void> | void) | void> | (() => Promise<void> | void) | void
     readFileAsText?(path: string): string | Promise<string>
     writeFile?(path: string, contents: string): Promise<void>
   }
   serverUrl: string
-  requestWorkerEndpoint?: { route: string; token: string; payloadDirectory: string }
   previewLease?: PreviewLease
   previewRoutes?: PlaygroundPreviewRouteRegistry
   previewProxyDiagnostics?: PlaygroundPreviewProxyDiagnostics
diff --git a/tests/disposable-mysql-mysqli.integration.test.ts b/tests/disposable-mysql-mysqli.integration.test.ts
@@ -77,7 +77,7 @@ if (!await dockerAvailable()) {
     await mkdir(join(plugin, "tests"), { recursive: true })
     await writeFile(join(plugin, "bounded-phpunit-fixture.php"), "<?php\n/** Plugin Name: Bounded PHPUnit Fixture */\n")
     await writeFile(join(plugin, "phpunit.xml"), "<?xml version=\"1.0\"?><phpunit bootstrap=\"tests/bootstrap.php\"><testsuites><testsuite name=\"bounded\"><directory>tests</directory></testsuite></testsuites></phpunit>\n")
-    await writeFile(join(plugin, "tests", "bootstrap.php"), "<?php\n")
+    await writeFile(join(plugin, "tests", "bootstrap.php"), "<?php\nfunction add_filter(): void {}\n")
     await writeFile(join(plugin, "tests", "BoundedMariaDbTest.php"), `<?php
 final class BoundedMariaDbTest extends PHPUnit\\Framework\\TestCase {
     public function test_database_identity(): void {
diff --git a/tests/phpunit-project-autoload.test.ts b/tests/phpunit-project-autoload.test.ts
@@ -352,6 +352,7 @@ assert.ok(projectModeCode.includes("pg_resolve_selected_test_file"))
 assert.ok(projectModeCode.includes("function pg_project_bootstrap_real_path"))
 assert.ok(projectModeCode.includes("$base_dir = dirname($xml_real);"))
 assert.ok(projectModeCode.includes("$bootstrap_real = pg_project_bootstrap_real_path($bootstrap, $phpunit_xml, $from_config);"))
+assert.ok(projectModeCode.includes("NOTICE:project bootstrap not declared; continuing without one"), "project mode permits PHPUnit configurations that do not declare a bootstrap")
 assert.ok(projectModeCode.includes("foreach ($xml->xpath('//testsuite/file') ?: array() as $file)"))
 assert.ok(projectModeCode.includes("list($directories, $suffixes, $prefixes, $excludes, $configured_files) = wp_codebox_phpunit_parse_config"))
 assert.ok(projectModeCode.includes("$test_files = wp_codebox_phpunit_discover($directories, $suffixes, $prefixes, $excludes, $configured_files);"))
@@ -431,7 +432,7 @@ await runPhpunitCommand({
 assert.ok(capturedCanonicalHarnessCode.includes('$autoload_file = "/tmp/wp-codebox-inputs/0-wp-codebox-vendor-73845ca47d2f/autoload.php";'))
 assert.ok(capturedCanonicalHarnessCode.includes('$autoload_file_role = "harness";'))
 assert.ok(capturedCanonicalHarnessCode.includes('putenv("TC_MYSQL_PORT=3306");'), "runtime service environment is passed to the PHP executed by wordpress.phpunit")
-assert.ok(capturedCanonicalHarnessCode.indexOf('putenv("TC_MYSQL_PORT=3306");') < capturedCanonicalHarnessCode.indexOf("require_once '/wordpress/wp-load.php';"), "runtime environment is available to project bootstrap code")
+assert.ok(!capturedCanonicalHarnessCode.includes("require_once '/wordpress/wp-load.php';"), "project bootstrap mode does not load the managed WordPress runtime first")
 
 let capturedExplicitCode = ""
 await runPhpunitCommand({
diff --git a/tests/playground-cli-runner-bootstrap-ini.test.ts b/tests/playground-cli-runner-bootstrap-ini.test.ts
