feat(test): run checker and interactive Test entirely in the browser

[TakalaWang]

Summary

Test on checker and interactive problems now runs entirely in the student's browser, the problem's checker or interactor included. The server half of #641 (merged, never released) is removed: the server compiles and executes nothing for Test and only serves the judge program's source. The hidden workspace file visibility is removed too.

Why

#641 ran TA-authored checkers and interactors, and on interactive problems the student's Wasm, in a server test worker. The only thing between that code and the container's object-storage keys (every problem's hidden testcases) and Redis URL was the WASM-OJ runtime. Test is the student's own run, so it belongs on the student's machine. Judge programs become readable by students; that is an accepted risk, and authors own judge programs that hold up when read (JDG-15).

What changed

Removed

• The WORKER_MODE=test worker, the worker-test Deployment, the test-judge queue and its partitions, the Test and judge-program build workflows and the build dispatch after a judge-config save.
• POST /api/problems/[id]/test-judge, its limiter and Redis lock, the test-judge-requests/ and test-judge-programs/ storage keys, and TEST_JUDGE_ENABLED, TEST_JUDGE_SLOTS and WASM_OJ_*.
• @wasm-oj/server and its patch, the worker image's WASM-OJ layers, infra/docker/wasm-oj-toolchains/ and the Renovate exclusions.
• Core's request, response and record schemas, the cache key and server identity, and the artifact wire format.
• The edit page's judge-program build status and "check samples with the checker" action, and the "Judged on the server" badge and busy notice.
• hidden workspace visibility: a migration turns any hidden file into a readonly one (production had none on 2026-10-07), and stored judge snapshots read a legacy hidden as readonly.

Added

• GET /api/problems/[id]/judge-program?context=… returns { role, language, source, sha256 }. Access is the problem page's view access for the context, and a page-locked exam session is confined to that exam. The route is exam-scoped and uses the standard API limiter.
• The editor fetches and builds the judge program when it opens, preloads its toolchain, and keeps the build per role, language and sha256 for the page session. A build still queued when the editor closes leaves the queue. A build failure disables Test and shows the diagnostics.
• Checker Test: each sample case that exits normally is checked in the browser with the sample's output as the answer, and teammessage is shown. Custom cases stay execution-only.
• Interactive Test: interact runs every sample and custom case, with the case's input as the interactor's input, and shows the transcript (64 KiB per direction) and contestant stderr. JavaScript and TypeScript contestants stay disabled.
• One FIFO queue for every browser engine operation.
• Verdicts come from core's checkerCaseVerdict and interactiveCaseVerdict only, and give the outcome Submit gives, except the broken-pipe case below. Interactive rule: a contestant stopped by a time limit (logical time, instruction budget or the wall stop) or the memory limit is TLE or MLE whatever the interactor does; otherwise an interactor failure is SE; otherwise a contestant RE wins; otherwise the interactor's AC or WA stands. The limit check comes first because the browser engine closes a stopped side's pipes, while official judging keeps draining the interactor's output and gives it EOF, so Submit gives TLE or MLE there.
• The judge tab tells editors "Students can read this program when they press Test." under the checker and interactor language. The checker and interactor help now say the program runs in the judge sandbox on Submit and in the student's browser on Test, and the interactor help says Test passes an empty judge_answer, so the secret belongs in judge_input. The interactor help and the judge examples drop set_score and score.txt: neither Python wrapper defines set_score and no judge path reads score.txt (JDG-03), so the Python interactor example died with a NameError on every correct guess.

Kept from #641: interactorInput and interactionFormat, the seed fixes, "Executed" for cases without expected output, the contest code-draft check (WEB-05), the PCH-only-with-<bits/stdc++.h> rule, and core's verdict helpers, Python wrappers, C++ shim and judgeProgramCompileInput.

Docs: JDG-15 is rewritten. JDG-26, SEC-15 and OPS-21 are withdrawn. JDG-03, JDG-05, JDG-12, PRB-01, PRB-03, PRB-09, PRB-22, WEB-05 and OPS-18 are updated. The living docs, the threat model and the runbooks are updated, and docs/features/problem-test.md is rewritten. New Quality Ledger items, all upstream: the broken-pipe verdict gap, duplicated transcript lines after a broken pipe, and WebKit's instruction meter not stopping an empty loop. The spec and plan are deleted.

Pre-merge checklist

• The forge release containing feat(runtime): allow Python interactors in interact wasm-oj/forge#93 (Python interactors in interact), feat(web): 作答頁版面重構 + 全站動畫 + UX 功能批次 #95 (in-module metering of interactive programs), fix(web): nav 頭像同心對齊 + 題目卡片高度調低 #96 (runtime-file export stall) and feat(web): 導覽列加入圓形 V 品牌標誌(與圓角同心) #99 (interactive sides in nested Workers) is published: 0.2.4 on 2026-10-09, with fix(problems): let verified students create and author their own problems #94 too.
• @wasm-oj/browser is pinned to 0.2.4 (@wasm-oj/core and @wasm-oj/contracts follow) with a 14-line lockfile change. The @wasm-oj/toolchain-* pins stay at 0.2.0, which 0.2.4 keeps: forge versions the toolchain packages separately.
• The interactive browser checks are re-run on the release: the 4 interactive problems with AC, WA, an infinite loop and a Python contestant; a custom interactor input; checker regression.
• Production is re-checked with SELECT count(*) FROM "ProblemWorkspaceFile" WHERE visibility='hidden', and the migration comment date is updated if the count is non-zero. 0 on 2026-10-09 (editable 9, readonly 9).
• The #TBD links are replaced (feat(test): run checker and interactive Test entirely in the browser #645).
• An engine crash on the release rejects (SE) rather than hangs. A Worker killed without an error event is stopped at the 6 s wall limit and shows TLE.

Known difference from official judging: broken pipe

When the contestant exits, normally or with an error, before the interactor's next write, that write fails in the browser (a Python interactor exits 120) and Test shows SE where Submit gives RE or the interactor's verdict. It is a Quality Ledger item for upstream.

After deploy (manual admin edits)

Releases do not update seed rows. In the editor:

1. any-two-sum, course-order, shortest-route-plan: upload the updated checker from packages/db/prisma/seeds/problems.ts.
2. guess-the-number:
   • fix the literal \n\n in the body;
   • add interaction notes;
   • sample 1: first transcript line 1 1000000, new explanation, interactor input 42;
   • sample 2: interactor input 500000.
3. multi-interactive-bisect: interaction notes; interactor input 375000.
4. noisy-oracle-hunt:
   • interaction notes;
   • sample 1: interactor input 500000;
   • sample 2: replace with the seed's new transcript, interactor input 671875.
5. interactive-peak: interaction notes; interactor input 5\n1 3 2 5 4\n.

Nothing needs a backfill: nothing is precompiled.

Testing

• pnpm ci:verify: green. It covers format, lint:repo, build, typecheck, lint and typecheck:tests; unit is 431 files (4,143 passed, 2 skipped) and component is 59 files (196 passed).
• pnpm lint:helm and pnpm install --frozen-lockfile: green.
• Integration (integration project) against isolated Postgres 18 and Redis 8 containers: 110 files, 789 passed, 6 skipped.
• Dead-code checklist greps: nothing left outside history. Exceptions: migration SQL, the legacy-snapshot mapping and its tests, the withdrawn decision notes, and the kept core modules test-judge-verdict.ts and test-judge-program.ts.
• Browser checks on seeded local stacks, with locally built forge (screenshots taken during development):
  • any-two-sum with Python and C++ checkers: valid and invalid answers;
  • shortest-route-plan: shortest and longer routes;
  • a broken C++ checker disabling Test and showing its diagnostics;
  • leaving a problem while its checker builds;
  • the four interactive problems with a C++ contestant: AC;
  • guess-the-number: WA, an infinite loop, a Python contestant, a custom interactor input, and a JavaScript contestant disabled.
• Release checks on 0.2.4, seed student, crossOriginIsolated true: Chromium 153, WebKit 26.6 and Firefox 155 each pass the 4 interactive problems AC with transcript, WA, TLE in 4–6 s, a Python contestant, a custom interactor input, JavaScript disabled, both checkers AC and WA with teammessage, a standard problem, leaving a checker build, and engine crashes (SE).

🤖 Generated with Claude Code