hyperprobe-agent 1.2.27.pre.1

data/lib/hyperprobe/core/quota.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+module HyperProbe
+  module Core
+    class TokenBucket
+      attr_reader :capacity, :tokens
+
+      def initialize(capacity, refill_rate_per_sec)
+        @capacity = capacity.to_f
+        @refill_rate = refill_rate_per_sec.to_f / 1000.0 # tokens per millisecond
+        @tokens = @capacity
+        @last_refill = monotonic_ms
+        @mutex = Mutex.new
+      end
+
+      def try_consume(count = 1)
+        @mutex.synchronize do
+          refill
+          if @tokens >= count
+            @tokens -= count
+            true
+          else
+            false
+          end
+        end
+      end
+
+      def reserve(count)
+        @mutex.synchronize do
+          refill
+          if @tokens >= count
+            @tokens -= count
+            BandwidthReservation.new(self, count)
+          else
+            nil
+          end
+        end
+      end
+
+      def release_tokens(count)
+        @mutex.synchronize do
+          @tokens = [@capacity, @tokens + count].min
+        end
+      end
+
+      private
+
+      def refill
+        now = monotonic_ms
+        delta = now - @last_refill
+        amount = delta * @refill_rate
+        @tokens = [@capacity, @tokens + amount].min
+        @last_refill = now
+      end
+
+      def monotonic_ms
+        Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+      end
+    end
+
+    class BandwidthReservation
+      attr_reader :tokens
+
+      def initialize(bucket, tokens)
+        @bucket = bucket
+        @tokens = tokens
+        @committed = false
+        @released = false
+        @mutex = Mutex.new
+      end
+
+      def commit
+        @mutex.synchronize do
+          @committed = true
+        end
+      end
+
+      def release
+        @mutex.synchronize do
+          return if @committed || @released
+
+          @released = true
+          @bucket.release_tokens(@tokens)
+        end
+      end
+    end
+
+    class QuotaManager
+      def initialize(hits_per_sec = 10, bytes_per_sec = 200 * 1024)
+        @eval_bucket = TokenBucket.new(hits_per_sec, hits_per_sec)
+        @bandwidth_bucket = TokenBucket.new(bytes_per_sec, bytes_per_sec)
+      end
+
+      def can_evaluate?
+        @eval_bucket.try_consume(1)
+      end
+
+      alias can_evaluate can_evaluate?
+
+      def can_send?(bytes)
+        @bandwidth_bucket.try_consume(bytes)
+      end
+
+      alias can_send can_send?
+
+      def reserve_bandwidth(bytes)
+        @bandwidth_bucket.reserve(bytes)
+      end
+    end
+  end
+end

data/lib/hyperprobe/core/safe_ast_validator.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'ripper'
+
+module HyperProbe
+  module Core
+    class SafeASTValidator
+      MAX_EXPRESSION_LENGTH = 256
+      CACHE_CAPACITY = 200
+
+      FORBIDDEN_OPERATORS = %w[
+        = += -= *= /= %= << >> |= &= ^=
+      ].freeze
+
+      FORBIDDEN_IDENTIFIERS = %w[
+        system exec spawn fork exit exit! abort
+        eval instance_eval class_eval module_eval
+        send __send__ public_send define_method
+        const_set const_get instance_variable_set remove_instance_variable
+        delete delete! delete_all destroy destroy!
+        update update! update_all save save! create create!
+        truncate drop clear write require load
+      ].freeze
+
+      FORBIDDEN_CONSTANTS = %w[
+        File Dir IO FileUtils Socket TCPSocket UDPSocket Net
+        Process Kernel ObjectSpace GC System
+      ].freeze
+
+      @cache = {}
+      @cache_mutex = Mutex.new
+
+      class << self
+        def validate!(expression)
+          return if expression.nil? || expression.strip.empty?
+
+          clean_expr = expression.strip
+          if clean_expr.length > MAX_EXPRESSION_LENGTH
+            raise SecurityError, "Expression is too long (max #{MAX_EXPRESSION_LENGTH} characters)."
+          end
+
+          @cache_mutex.synchronize do
+            return if @cache[clean_expr]
+          end
+
+          tokens = Ripper.lex(clean_expr)
+
+          tokens.each_with_index do |tok, idx|
+            _pos, type, text, _state = tok
+
+            # 1. Reject Shell Backtick / Command Execution (`...` or %x{...})
+            if type == :on_backtick || type == :on_xstring_beg
+              raise SecurityError, 'Shell command execution is strictly forbidden in probe expressions.'
+            end
+
+            # 2. Reject Mutating Operators and Assignments (=, +=, -=, <<, etc.)
+            if type == :on_op && FORBIDDEN_OPERATORS.include?(text)
+              raise SecurityError, "Assignments and state mutations ('#{text}') are strictly forbidden in probe expressions."
+            end
+
+            # 3. Reject Forbidden System, File, and Metaprogramming Identifiers
+            if (type == :on_ident || type == :on_kw) && FORBIDDEN_IDENTIFIERS.include?(text)
+              raise SecurityError, "Method or function invocation '#{text}()' is strictly forbidden during probe evaluation."
+            end
+
+            # 4. Reject Dangerous Class Invocations (File.delete, Net::HTTP, etc.)
+            if type == :on_const && FORBIDDEN_CONSTANTS.include?(text)
+              # Check if followed by a method call like File.read or Net::HTTP.get
+              next_tokens = tokens[(idx + 1)..]
+              has_method_call = next_tokens&.any? { |t| t[1] == :on_period || t[1] == :on_op && t[2] == '::' }
+              if has_method_call
+                raise SecurityError, "Access to system constant '#{text}' is strictly forbidden in probe expressions."
+              end
+            end
+          end
+
+          @cache_mutex.synchronize do
+            @cache.shift if @cache.size >= CACHE_CAPACITY
+            @cache[clean_expr] = true
+          end
+        end
+
+        def reset_cache!
+          @cache_mutex.synchronize do
+            @cache.clear
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hyperprobe/core/safety.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+module HyperProbe
+  module Core
+    module AgentHealth
+      GREEN = :GREEN
+      YELLOW = :YELLOW
+      RED = :RED
+    end
+
+    class SafetyMonitor
+      SAMPLE_INTERVAL_SECONDS = 0.1
+      LAG_WINDOW_SIZE = 10
+      LAG_YELLOW_BREACHES = 4
+      LAG_RED_BREACHES = 7
+      SEVERE_LAG_WINDOW_SIZE = 5
+      SEVERE_LAG_RED_BREACHES = 3
+      SEVERE_LAG_MULTIPLIER = 4.0
+
+      attr_reader :health, :last_thread_lag_ms, :cumulative_pause_time, :max_lag_ms, :pause_budget_ms
+
+      def initialize(on_state_change, max_lag_ms: 50.0, pause_budget_ms: 15.0, is_ephemeral_lambda: false)
+        @on_state_change = on_state_change
+        @max_lag_ms = max_lag_ms.to_f
+        @pause_budget_ms = pause_budget_ms.to_f
+        @is_ephemeral_lambda = is_ephemeral_lambda
+
+        @health = AgentHealth::GREEN
+        @last_heartbeat = monotonic_ms
+        @last_thread_lag_ms = 0.0
+        @thread_lag_samples = []
+        @cumulative_pause_time = 0.0
+        @last_window_reset = monotonic_ms
+
+        @mutex = Mutex.new
+        @notification_mutex = Mutex.new
+        @running = false
+        @thread = nil
+      end
+
+      def start
+        @mutex.synchronize do
+          return if @running
+
+          @running = true
+          @last_heartbeat = monotonic_ms
+          @last_window_reset = monotonic_ms
+
+          @thread = Thread.new { monitor_loop }
+          @thread.name = 'hyperprobe-safety' if @thread.respond_to?(:name=)
+        end
+      end
+
+      def stop
+        @mutex.synchronize do
+          @running = false
+        end
+        @thread&.wakeup if @thread&.alive?
+        @thread&.join(1.0) rescue nil
+        @thread = nil
+      end
+
+      def report_pause_duration(ms)
+        callback_info = nil
+        @mutex.synchronize do
+          @cumulative_pause_time += ms.to_f
+          callback_info = evaluate_health_locked
+        end
+        trigger_callback(callback_info) if callback_info
+      end
+
+      def record_thread_lag(thread_lag_ms)
+        callback_info = nil
+        @mutex.synchronize do
+          record_thread_lag_locked(thread_lag_ms)
+          callback_info = evaluate_health_locked
+        end
+        trigger_callback(callback_info) if callback_info
+      end
+
+      def get_health
+        @mutex.synchronize { @health }
+      end
+
+      private
+
+      def monitor_loop
+        while @running
+          wait_started = monotonic_ms
+          sleep SAMPLE_INTERVAL_SECONDS
+          break unless @running
+
+          callback_info = nil
+          @mutex.synchronize do
+            now = monotonic_ms
+            # Expected interval is 100ms; excess time is lag/jitter
+            thread_lag_ms = [0.0, now - wait_started - (SAMPLE_INTERVAL_SECONDS * 1000.0)].max
+            record_thread_lag_locked(thread_lag_ms)
+
+            # Reset pause budget window every second
+            if now - @last_window_reset > 1000.0
+              @cumulative_pause_time = 0.0
+              @last_window_reset = now
+            end
+
+            callback_info = evaluate_health_locked
+          end
+
+          trigger_callback(callback_info) if callback_info
+        end
+      end
+
+      def record_thread_lag_locked(lag_ms)
+        clean_lag = [0.0, lag_ms.to_f].max
+        @last_thread_lag_ms = clean_lag
+        @thread_lag_samples << clean_lag
+        @thread_lag_samples.shift while @thread_lag_samples.length > LAG_WINDOW_SIZE
+      end
+
+      def evaluate_health_locked
+        prev_health = @health
+        reason = nil
+
+        if @is_ephemeral_lambda
+          @health = AgentHealth::GREEN
+          return nil if prev_health == AgentHealth::GREEN
+
+          return [@health, 'System stabilized in Lambda mode.']
+        end
+
+        recent_lags = @thread_lag_samples.dup
+        lag_breaches = recent_lags.count { |lag| lag > @max_lag_ms }
+        severe_lag_ms = @max_lag_ms * SEVERE_LAG_MULTIPLIER
+        severe_window = recent_lags.last(SEVERE_LAG_WINDOW_SIZE)
+        severe_lag_breaches = severe_window.count { |lag| lag > severe_lag_ms }
+
+        if severe_lag_breaches >= SEVERE_LAG_RED_BREACHES
+          @health = AgentHealth::RED
+          reason = "Severe Execution Thread Lag exceeded #{severe_lag_ms.round(1)}ms in #{severe_lag_breaches}/#{SEVERE_LAG_WINDOW_SIZE} recent readings"
+        elsif lag_breaches >= LAG_RED_BREACHES
+          @health = AgentHealth::RED
+          reason = "Execution Thread Lag exceeded #{@max_lag_ms.round(1)}ms in #{lag_breaches}/#{LAG_WINDOW_SIZE} recent readings"
+        elsif @cumulative_pause_time > @pause_budget_ms
+          @health = AgentHealth::RED
+          reason = "Cumulative Pause Budget (#{@cumulative_pause_time.round(1)}ms) exceeded limit (#{@pause_budget_ms.round(1)}ms)"
+        elsif severe_lag_breaches.positive?
+          @health = AgentHealth::YELLOW
+          reason = "Moderate impact: Severe Execution Thread Lag exceeded #{severe_lag_ms.round(1)}ms in #{severe_lag_breaches}/#{SEVERE_LAG_WINDOW_SIZE} recent readings"
+        elsif lag_breaches >= LAG_YELLOW_BREACHES
+          @health = AgentHealth::YELLOW
+          reason = "Moderate impact: Execution Thread Lag exceeded #{@max_lag_ms.round(1)}ms in #{lag_breaches}/#{LAG_WINDOW_SIZE} recent readings"
+        elsif @cumulative_pause_time > (@pause_budget_ms / 2.0)
+          @health = AgentHealth::YELLOW
+          reason = "Moderate impact: Cumulative Pause Budget (#{@cumulative_pause_time.round(1)}ms) reached 50% of limit (#{@pause_budget_ms.round(1)}ms)"
+        else
+          @health = AgentHealth::GREEN
+          reason = 'System stabilized.' if prev_health != AgentHealth::GREEN
+        end
+
+        return unless @health != prev_health
+
+        [@health, reason]
+      end
+
+      def trigger_callback(callback_info)
+        health, reason = callback_info
+        @notification_mutex.synchronize do
+          @on_state_change&.call(health, reason)
+        end
+      rescue StandardError
+        # Never crash application thread or safety monitor on callback error
+      end
+
+      def monotonic_ms
+        Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+      end
+    end
+  end
+end