hyperprobe-agent 1.2.27.pre.3-java

data/lib/hyperprobe/core/quota.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+module HyperProbe
+  module Core
+    class TokenBucket
+      attr_reader :capacity, :tokens
+
+      def initialize(capacity, refill_rate_per_sec)
+        @capacity = capacity.to_f
+        @refill_rate = refill_rate_per_sec.to_f / 1000.0 # tokens per millisecond
+        @tokens = @capacity
+        @last_refill = monotonic_ms
+        @mutex = Mutex.new
+      end
+
+      def try_consume(count = 1)
+        @mutex.synchronize do
+          refill
+          if @tokens >= count
+            @tokens -= count
+            true
+          else
+            false
+          end
+        end
+      end
+
+      def reserve(count)
+        @mutex.synchronize do
+          refill
+          if @tokens >= count
+            @tokens -= count
+            BandwidthReservation.new(self, count)
+          else
+            nil
+          end
+        end
+      end
+
+      def release_tokens(count)
+        @mutex.synchronize do
+          @tokens = [@capacity, @tokens + count].min
+        end
+      end
+
+      private
+
+      def refill
+        now = monotonic_ms
+        delta = now - @last_refill
+        amount = delta * @refill_rate
+        @tokens = [@capacity, @tokens + amount].min
+        @last_refill = now
+      end
+
+      def monotonic_ms
+        Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+      end
+    end
+
+    class BandwidthReservation
+      attr_reader :tokens
+
+      def initialize(bucket, tokens)
+        @bucket = bucket
+        @tokens = tokens
+        @committed = false
+        @released = false
+        @mutex = Mutex.new
+      end
+
+      def commit
+        @mutex.synchronize do
+          @committed = true
+        end
+      end
+
+      def release
+        @mutex.synchronize do
+          return if @committed || @released
+
+          @released = true
+          @bucket.release_tokens(@tokens)
+        end
+      end
+    end
+
+    class QuotaManager
+      def initialize(hits_per_sec = 10, bytes_per_sec = 200 * 1024)
+        @eval_bucket = TokenBucket.new(hits_per_sec, hits_per_sec)
+        @bandwidth_bucket = TokenBucket.new(bytes_per_sec, bytes_per_sec)
+      end
+
+      def can_evaluate?
+        @eval_bucket.try_consume(1)
+      end
+
+      alias can_evaluate can_evaluate?
+
+      def can_send?(bytes)
+        @bandwidth_bucket.try_consume(bytes)
+      end
+
+      alias can_send can_send?
+
+      def reserve_bandwidth(bytes)
+        @bandwidth_bucket.reserve(bytes)
+      end
+    end
+  end
+end

data/lib/hyperprobe/core/safe_ast_validator.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require 'ripper'
+
+module HyperProbe
+  module Core
+    # This is deliberately a small expression language, not read-only Ruby.
+    # Compile the entire tree before executing even a short-circuited branch.
+    class SafeASTValidator
+      MAX_EXPRESSION_LENGTH = 256
+      MAX_NODES = 128
+      MAX_DEPTH = 32
+      BINARY_OPERATORS = %i[+ - * / % == != < <= > >= && || and or].freeze
+      UNARY_OPERATORS = %i[+@ -@ ! not].freeze
+      CLASS = Object.instance_method(:class)
+      IDENTITY = BasicObject.instance_method(:equal?)
+      STRING_SIZE = String.instance_method(:bytesize)
+      STRING_SLICE = String.instance_method(:byteslice)
+
+      class << self
+        def validate!(expression)
+          parse!(expression)
+          nil
+        end
+
+        # Copy through a builtin, never dup/clone/to_str hooks on application data.
+        def source(expression, limit = MAX_EXPRESSION_LENGTH)
+          unless IDENTITY.bind(CLASS.bind(expression).call).call(String)
+            raise SecurityError, 'Expression must be an exact builtin String'
+          end
+          if STRING_SIZE.bind(expression).call > limit
+            raise SecurityError, "Expression is too long (max #{limit} bytes)"
+          end
+
+          copy = STRING_SLICE.bind(expression).call(0, limit + 1)
+          raise SecurityError, "Expression is too long (max #{limit} bytes)" if copy.bytesize > limit
+          copy
+        end
+
+        def parse!(expression)
+          return [:literal, nil] if IDENTITY.bind(expression).call(nil)
+
+          text = source(expression)
+          return [:literal, nil] if text.strip.empty?
+
+          tree = Ripper.sexp(text)
+          raise ArgumentError, 'Invalid expression syntax' unless tree
+
+          # Only ordinary quoted strings are supported. Decode their contents
+          # ourselves; Ripper returns escaped source, not evaluated strings.
+          strings = {}
+          quote = nil
+          Ripper.lex(text).each do |position, type, token, _state|
+            case type
+            when :on_tstring_beg
+              reject!('string syntax') unless ["'", '"'].include?(token)
+              quote = token
+            when :on_tstring_content
+              strings[position] = decode_string(token, quote)
+            when :on_tstring_end
+              quote = nil
+            when :on_embexpr_beg, :on_embvar, :on_heredoc_beg
+              reject!('string interpolation or heredoc')
+            end
+          end
+
+          compile(tree, strings, [0], 0)
+        end
+
+        # Kept for callers that used to clear the lexical validator's cache.
+        # Parsing is bounded and no user-controlled expressions are retained.
+        def reset_cache!; end
+
+        private
+
+        def reject!(feature)
+          raise SecurityError, "Unsupported #{feature}: forbidden in probe expressions"
+        end
+
+        def decode_string(text, quote)
+          reject!('string syntax') unless quote
+          text.gsub(/\\(.)/m) do
+            char = Regexp.last_match(1)
+            if quote == "'"
+              ["'", '\\'].include?(char) ? char : "\\#{char}"
+            else
+              escapes = { 'n' => "\n", 'r' => "\r", 't' => "\t", '\\' => '\\', '"' => '"', "'" => "'", '#' => '#' }
+              reject!('string escape') unless escapes.key?(char)
+              escapes[char]
+            end
+          end
+        end
+
+        def compile(node, strings, budget, depth)
+          budget[0] += 1
+          reject!('expression complexity') if budget[0] > MAX_NODES || depth > MAX_DEPTH
+          child = ->(value) { compile(value, strings, budget, depth + 1) }
+
+          case node[0]
+          when :program, :paren
+            reject!('multiple statements') unless node[1]&.length == 1
+            child.call(node[1][0])
+          when :vcall, :var_ref
+            token = node[1]
+            if token[0] == :@ident
+              [:local, token[1]]
+            elsif token[0] == :@kw && %w[true false nil].include?(token[1])
+              [:literal, { 'true' => true, 'false' => false, 'nil' => nil }[token[1]]]
+            else
+              reject!('variable or constant access')
+            end
+          when :@int
+            [:literal, Integer(node[1])]
+          when :@float
+            [:literal, Float(node[1])]
+          when :string_literal
+            content = node[1]
+            reject!('string syntax') unless content[0] == :string_content
+            value = content.drop(1).map do |part|
+              reject!('string interpolation') unless part[0] == :@tstring_content
+              strings.fetch(part[2])
+            end.join
+            [:literal, value]
+          when :symbol_literal
+            symbol = node[1]
+            reject!('symbol syntax') unless symbol[0] == :symbol && %i[@ident @op @kw].include?(symbol[1][0])
+            [:literal, symbol[1][1].to_sym]
+          when :@label
+            [:literal, node[1][0...-1].to_sym]
+          when :array
+            [:array, (node[1] || []).map { |item| child.call(item) }]
+          when :hash
+            pairs = node[1]
+            reject!('hash syntax') if pairs && pairs[0] != :assoclist_from_args
+            [:hash, (pairs ? pairs[1] : []).map do |pair|
+              reject!('hash expansion') unless pair[0] == :assoc_new
+              [child.call(pair[1]), child.call(pair[2])]
+            end]
+          when :aref
+            args = node[2]
+            unless args && args[0] == :args_add_block && args[2] == false && args[1].length == 1
+              reject!('subscript arguments')
+            end
+            [:lookup, child.call(node[1]), child.call(args[1][0])]
+          when :call
+            unless (node[2][0] == :@period || node[2] == :'.') && node[3][0] == :@ident && %w[length size].include?(node[3][1])
+              reject!('method call')
+            end
+            [:length, child.call(node[1])]
+          when :method_add_arg
+            unless node[1][0] == :call && node[2] == [:arg_paren, nil]
+              reject!('method arguments or function call')
+            end
+            child.call(node[1])
+          when :binary
+            reject!('operator') unless BINARY_OPERATORS.include?(node[2])
+            [:binary, node[2], child.call(node[1]), child.call(node[3])]
+          when :unary
+            reject!('unary operator') unless UNARY_OPERATORS.include?(node[1])
+            [:unary, node[1], child.call(node[2])]
+          when :ifop
+            [:conditional, child.call(node[1]), child.call(node[2]), child.call(node[3])]
+          else
+            reject!("syntax #{node[0]}")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/hyperprobe/core/safety.rb

@@ -0,0 +1,256 @@
+# frozen_string_literal: true
+
+require 'monitor'
+require 'java' if RUBY_ENGINE == 'jruby'
+
+module HyperProbe
+  module Core
+    module AgentHealth
+      GREEN = :GREEN
+      YELLOW = :YELLOW
+      RED = :RED
+    end
+
+    class SafetyMonitor
+      SAMPLE_INTERVAL_SECONDS = 0.1
+      LAG_WINDOW_SIZE = 10
+      LAG_YELLOW_BREACHES = 4
+      LAG_RED_BREACHES = 7
+      SEVERE_LAG_WINDOW_SIZE = 5
+      SEVERE_LAG_RED_BREACHES = 3
+      SEVERE_LAG_MULTIPLIER = 4.0
+      HEAP_SAMPLE_INTERVAL_MS = 5000.0
+      HEAP_YELLOW_FRACTION = 0.15
+      HEAP_RED_FRACTION = 0.05
+
+      attr_reader :health, :last_thread_lag_ms, :cumulative_pause_time, :max_lag_ms, :pause_budget_ms
+
+      def initialize(on_state_change, max_lag_ms: 50.0, pause_budget_ms: 15.0, is_ephemeral_lambda: false,
+                     heap_runtime: (RUBY_ENGINE == 'jruby' ? Java::JavaLang::Runtime.get_runtime : nil))
+        @on_state_change = on_state_change
+        @max_lag_ms = max_lag_ms.to_f
+        @pause_budget_ms = pause_budget_ms.to_f
+        @is_ephemeral_lambda = is_ephemeral_lambda
+        @heap_runtime = heap_runtime
+        @heap_available_fraction = 1.0
+
+        @health = AgentHealth::GREEN
+        @last_heartbeat = monotonic_ms
+        @last_thread_lag_ms = 0.0
+        @thread_lag_samples = []
+        @cumulative_pause_time = 0.0
+        @last_window_reset = monotonic_ms
+
+        @mutex = Mutex.new
+        @notification_mutex = Monitor.new
+        @transition_generation = 0
+        @running = false
+        @thread = nil
+      end
+
+      def start
+        @mutex.synchronize do
+          return if @running && @thread&.alive?
+
+          @running = true
+          @last_heartbeat = monotonic_ms
+          @last_window_reset = monotonic_ms
+          @last_heap_sample = @last_window_reset
+
+          @thread = Thread.new { monitor_loop }
+          @thread.name = 'hyperprobe-safety' if @thread.respond_to?(:name=)
+        end
+      end
+
+      def after_fork
+        @mutex.synchronize do
+          @running = false
+          @thread = nil
+        end
+        start
+      end
+
+      def stop
+        thread = @mutex.synchronize do
+          @running = false
+          current = @thread
+          @thread = nil
+          current
+        end
+        return if !thread || thread == Thread.current
+
+        thread.kill
+        thread.join(0.1)
+      rescue Exception
+        # Stop is agent-owned cleanup, including when called from a trap.
+      end
+
+      def report_pause_duration(ms)
+        callback_info = nil
+        return unless @mutex.try_lock
+        begin
+          @cumulative_pause_time += ms.to_f
+          callback_info = evaluate_health_locked
+          # A live monitor delivers transitions off the application thread.
+          @pending_notification = callback_info if @running && callback_info
+        ensure
+          @mutex.unlock
+        end
+        trigger_callback(callback_info) if callback_info && !@running
+      end
+
+      def record_thread_lag(thread_lag_ms)
+        callback_info = nil
+        @mutex.synchronize do
+          record_thread_lag_locked(thread_lag_ms)
+          callback_info = evaluate_health_locked
+        end
+        trigger_callback(callback_info) if callback_info
+      end
+
+      def get_health
+        @mutex.synchronize { @health }
+      end
+
+      def with_health(expected)
+        @notification_mutex.synchronize do
+          return unless @mutex.synchronize { @health == expected }
+
+          yield
+        end
+      rescue Exception
+        # Serialize cooldown actions with transition delivery, not state updates.
+      end
+
+      private
+
+      def monitor_loop
+        while @running
+          wait_started = monotonic_ms
+          sleep SAMPLE_INTERVAL_SECONDS
+          break unless @running
+
+          callback_info = nil
+          @mutex.synchronize do
+            now = monotonic_ms
+            # Expected interval is 100ms; excess time is lag/jitter
+            thread_lag_ms = [0.0, now - wait_started - (SAMPLE_INTERVAL_SECONDS * 1000.0)].max
+            record_thread_lag_locked(thread_lag_ms)
+
+            if @heap_runtime && !@is_ephemeral_lambda && now - @last_heap_sample >= HEAP_SAMPLE_INTERVAL_MS
+              sample_heap_locked
+              @last_heap_sample = now
+            end
+
+            # Reset pause budget window every second
+            if now - @last_window_reset > 1000.0
+              @cumulative_pause_time = 0.0
+              @last_window_reset = now
+            end
+
+            callback_info = evaluate_health_locked || @pending_notification
+            @pending_notification = nil
+          end
+
+          trigger_callback(callback_info) if callback_info
+        end
+      rescue Exception
+        @running = false
+      end
+
+      def record_thread_lag_locked(lag_ms)
+        clean_lag = [0.0, lag_ms.to_f].max
+        @last_thread_lag_ms = clean_lag
+        @thread_lag_samples << clean_lag
+        @thread_lag_samples.shift while @thread_lag_samples.length > LAG_WINDOW_SIZE
+      end
+
+      def sample_heap_locked
+        maximum = @heap_runtime.max_memory.to_f
+        return unless maximum.positive?
+
+        committed = @heap_runtime.total_memory
+        free = @heap_runtime.free_memory
+        @heap_available_fraction = (free + maximum - committed) / maximum
+      rescue Exception
+        # Preserve the last heap health and retry at the next sample.
+      end
+
+      def evaluate_health_locked
+        prev_health = @health
+        reason = nil
+
+        if @is_ephemeral_lambda
+          @health = AgentHealth::GREEN
+          return nil if prev_health == AgentHealth::GREEN
+
+          @transition_generation += 1
+          return [@health, 'System stabilized in Lambda mode.', @transition_generation]
+        end
+
+        recent_lags = @thread_lag_samples.dup
+        lag_breaches = recent_lags.count { |lag| lag > @max_lag_ms }
+        severe_lag_ms = @max_lag_ms * SEVERE_LAG_MULTIPLIER
+        severe_window = recent_lags.last(SEVERE_LAG_WINDOW_SIZE)
+        severe_lag_breaches = severe_window.count { |lag| lag > severe_lag_ms }
+
+        if @heap_runtime
+          if @heap_available_fraction < HEAP_RED_FRACTION
+            @health = AgentHealth::RED
+            reason = "JVM heap headroom (#{(@heap_available_fraction * 100).round(1)}%) below 5% of maximum heap"
+          elsif @heap_available_fraction < HEAP_YELLOW_FRACTION
+            @health = AgentHealth::YELLOW
+            reason = "JVM heap headroom (#{(@heap_available_fraction * 100).round(1)}%) below 15% of maximum heap"
+          else
+            @health = AgentHealth::GREEN
+            reason = 'JVM heap headroom stabilized.' if prev_health != AgentHealth::GREEN
+          end
+        elsif severe_lag_breaches >= SEVERE_LAG_RED_BREACHES
+          @health = AgentHealth::RED
+          reason = "Severe Execution Thread Lag exceeded #{severe_lag_ms.round(1)}ms in #{severe_lag_breaches}/#{SEVERE_LAG_WINDOW_SIZE} recent readings"
+        elsif lag_breaches >= LAG_RED_BREACHES
+          @health = AgentHealth::RED
+          reason = "Execution Thread Lag exceeded #{@max_lag_ms.round(1)}ms in #{lag_breaches}/#{LAG_WINDOW_SIZE} recent readings"
+        elsif @cumulative_pause_time > @pause_budget_ms
+          @health = AgentHealth::RED
+          reason = "Cumulative Pause Budget (#{@cumulative_pause_time.round(1)}ms) exceeded limit (#{@pause_budget_ms.round(1)}ms)"
+        elsif severe_lag_breaches.positive?
+          @health = AgentHealth::YELLOW
+          reason = "Moderate impact: Severe Execution Thread Lag exceeded #{severe_lag_ms.round(1)}ms in #{severe_lag_breaches}/#{SEVERE_LAG_WINDOW_SIZE} recent readings"
+        elsif lag_breaches >= LAG_YELLOW_BREACHES
+          @health = AgentHealth::YELLOW
+          reason = "Moderate impact: Execution Thread Lag exceeded #{@max_lag_ms.round(1)}ms in #{lag_breaches}/#{LAG_WINDOW_SIZE} recent readings"
+        elsif @cumulative_pause_time > (@pause_budget_ms / 2.0)
+          @health = AgentHealth::YELLOW
+          reason = "Moderate impact: Cumulative Pause Budget (#{@cumulative_pause_time.round(1)}ms) reached 50% of limit (#{@pause_budget_ms.round(1)}ms)"
+        else
+          @health = AgentHealth::GREEN
+          reason = 'System stabilized.' if prev_health != AgentHealth::GREEN
+        end
+
+        return unless @health != prev_health
+
+        @transition_generation += 1
+        [@health, reason, @transition_generation]
+      end
+
+      def trigger_callback(callback_info)
+        health, reason, generation = callback_info
+        @notification_mutex.synchronize do
+          # State transitions release @mutex before acquiring the delivery lock.
+          # Recheck here so a delayed notification cannot undo a newer one.
+          current = @mutex.synchronize { generation == @transition_generation && health == @health }
+          return unless current
+
+          @on_state_change&.call(health, reason)
+        end
+      rescue Exception
+        # Never crash application thread or safety monitor on callback error
+      end
+
+      def monotonic_ms
+        Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+      end
+    end
+  end
+end