@aopslabs/aops 0.3.22 → 0.3.24

package/dist/lib/community-cockpit-lifecycle.js

@@ -205,6 +205,71 @@ function terminalObservation(record, observedAt, disappeared = false) {
         signal: record.signal ?? null,
     };
 }
+export const COCKPIT_PID_START_TOLERANCE_MS = 300_000;
+export function classifyTerminalCockpitPids(params) {
+    if (params.identityPresent) {
+        return { stale: false, reason: 'community_cockpit_terminal_identity_file_present', findings: [] };
+    }
+    if (params.livePids.length === 0) {
+        return { stale: false, reason: 'community_cockpit_terminal_no_live_pid', findings: [] };
+    }
+    const recordedStart = Date.parse(params.record.startedAt);
+    if (!Number.isFinite(recordedStart)) {
+        return { stale: false, reason: 'community_cockpit_pid_record_start_unparsable', findings: [] };
+    }
+    const tolerance = params.startToleranceMs ?? COCKPIT_PID_START_TOLERANCE_MS;
+    const findings = [];
+    let blocked = null;
+    for (const { pid, role } of params.livePids) {
+        let inspection;
+        try {
+            inspection = params.inspect(pid);
+        }
+        catch (error) {
+            inspection = {
+                outcome: 'undetermined',
+                pid,
+                reason: error instanceof Error ? error.message : 'community_cockpit_pid_inspection_threw',
+            };
+        }
+        if (inspection.outcome === 'absent') {
+            findings.push({ pid, role, outcome: 'absent', disagreedOn: ['identity', 'start-time', 'host-entry'], reason: null });
+            continue;
+        }
+        if (inspection.outcome === 'undetermined') {
+            findings.push({ pid, role, outcome: 'undetermined', disagreedOn: [], reason: inspection.reason });
+            blocked ??= `community_cockpit_pid_inspection_undetermined:${pid}:${inspection.reason}`;
+            continue;
+        }
+        const observedStart = Date.parse(inspection.startedAt);
+        if (!Number.isFinite(observedStart)) {
+            findings.push({ pid, role, outcome: 'inspected', disagreedOn: [], reason: 'start_time_unparsable' });
+            blocked ??= `community_cockpit_pid_start_time_unparsable:${pid}`;
+            continue;
+        }
+        if (inspection.command.trim() === '') {
+            findings.push({ pid, role, outcome: 'inspected', disagreedOn: [], reason: 'command_unavailable' });
+            blocked ??= `community_cockpit_pid_command_unavailable:${pid}`;
+            continue;
+        }
+        const disagreedOn = ['identity'];
+        if (Math.abs(observedStart - recordedStart) > tolerance)
+            disagreedOn.push('start-time');
+        if (!commandNamesHostEntry(inspection.command, params.record.hostEntry))
+            disagreedOn.push('host-entry');
+        findings.push({ pid, role, outcome: 'inspected', disagreedOn, reason: null });
+        if (disagreedOn.length !== 3) {
+            blocked ??= `community_cockpit_pid_may_be_owned:${pid}:${disagreedOn.join('+')}`;
+        }
+    }
+    if (blocked)
+        return { stale: false, reason: blocked, findings };
+    return { stale: true, reason: 'community_cockpit_terminal_record_pid_reused', findings };
+}
+function commandNamesHostEntry(command, hostEntry) {
+    const normalise = (value) => value.split('\\').join('/').toLowerCase();
+    return normalise(command).includes(normalise(hostEntry));
+}
 async function observeCockpit(params) {
     const record = params.processRecord;
     const identityPresent = existsSync(params.paths.identityPath);
@@ -254,11 +319,40 @@ async function observeCockpit(params) {
                 terminalObservation: terminalObservation(record, record.updatedAt),
             };
         }
+        const observation = terminalObservation(record, record.updatedAt);
+        const verdict = observation.classification === 'clean-exit'
+            ? classifyTerminalCockpitPids({
+                record,
+                identityPresent,
+                livePids: [
+                    ...(supervisorAlive ? [{ pid: record.pid, role: 'supervisor' }] : []),
+                    ...(hostAlive && hostPid ? [{ pid: hostPid, role: 'host' }] : []),
+                ],
+                inspect: params.runtime.inspectProcess ?? ((pid) => ({
+                    outcome: 'undetermined',
+                    pid,
+                    reason: 'community_cockpit_pid_inspection_unavailable',
+                })),
+            })
+            : {
+                stale: false,
+                reason: `community_cockpit_terminal_record_with_live_or_unowned_process:${observation.classification}`,
+                findings: [],
+            };
+        if (verdict.stale) {
+            return {
+                ...base,
+                runtimeState: 'stopped', recoverable: true, process: record, identity,
+                supervisorAlive, hostAlive, health: 'not-checked',
+                reason: verdict.reason,
+                terminalObservation: observation,
+            };
+        }
         return {
             ...base,
             runtimeState: 'identity-conflict', recoverable: false, process: record, identity,
             supervisorAlive, hostAlive, health: 'not-checked',
-            reason: 'community_cockpit_terminal_record_with_live_or_unowned_process',
+            reason: verdict.reason,
             terminalObservation: null,
         };
     }

package/dist/lib/community-native-lifecycle.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
@@ -68,6 +68,56 @@ const PACKAGE_BUILD_PATHS = Object.freeze({
     handlerEntry: 'build/handler.js',
     cockpitIndex: 'cockpit/index.html',
 });
+export function inspectHostProcess(pid, execute = (command, args) => {
+    const result = spawnSync(command, args, { encoding: 'utf8', windowsHide: true, timeout: 5_000 });
+    if (result.error)
+        throw result.error;
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}, platform = process.platform) {
+    if (!Number.isSafeInteger(pid) || pid < 1) {
+        return { outcome: 'undetermined', pid, reason: 'pid_not_inspectable' };
+    }
+    try {
+        if (platform === 'win32') {
+            const result = execute('powershell.exe', [
+                '-NoProfile', '-NonInteractive', '-Command',
+                `$p = Get-CimInstance Win32_Process -Filter "ProcessId=${pid}" -ErrorAction Stop; ` +
+                    'if ($null -eq $p) { exit 3 }; ' +
+                    '"{0}`t{1}" -f $p.CreationDate.ToString("o"), $p.CommandLine',
+            ]);
+            if (result.status === 3)
+                return { outcome: 'absent', pid };
+            if (result.status !== 0) {
+                return { outcome: 'undetermined', pid, reason: `process_query_failed:${result.status ?? 'no_status'}` };
+            }
+            const [startedAt, ...rest] = result.stdout.trim().split('\t');
+            if (!startedAt)
+                return { outcome: 'undetermined', pid, reason: 'process_query_empty' };
+            return { outcome: 'inspected', pid, startedAt, command: rest.join('\t').trim() };
+        }
+        const result = execute('ps', ['-o', 'lstart=,args=', '-p', String(pid)]);
+        if (result.status === 1 && result.stdout.trim() === '')
+            return { outcome: 'absent', pid };
+        if (result.status !== 0) {
+            return { outcome: 'undetermined', pid, reason: `process_query_failed:${result.status ?? 'no_status'}` };
+        }
+        const line = result.stdout.split('\n')[0]?.trim() ?? '';
+        if (line === '')
+            return { outcome: 'absent', pid };
+        const fields = line.split(/\s+/u);
+        if (fields.length < 6)
+            return { outcome: 'undetermined', pid, reason: 'process_query_unparsable' };
+        const startedAt = fields.slice(0, 5).join(' ');
+        return { outcome: 'inspected', pid, startedAt, command: fields.slice(5).join(' ') };
+    }
+    catch (error) {
+        return {
+            outcome: 'undetermined',
+            pid,
+            reason: error instanceof Error ? `process_query_threw:${error.message.slice(0, 80)}` : 'process_query_threw',
+        };
+    }
+}
 function sha256(content) {
     return `sha256:${createHash('sha256').update(content).digest('hex')}`;
 }
@@ -1437,6 +1487,9 @@ export const communityNativeRuntime = {
             return Boolean(error && typeof error === 'object' && 'code' in error && error.code === 'EPERM');
         }
     },
+    inspectProcess(pid) {
+        return inspectHostProcess(pid);
+    },
     sleep: (milliseconds, signal) => new Promise((resolve, reject) => {
         if (signal?.aborted) {
             reject(new Error('community_operation_aborted'));

package/native/manifest.json

@@ -6,7 +6,7 @@
       "platform": "darwin",
       "architecture": "arm64",
       "relativePath": "bin/darwin-arm64/aops-agent-assets-fs",
-      "sha256": "c10dfde3b28f8c6c4d5fbc885fc6fa626763b961580e1676af6692342b2c11db",
+      "sha256": "aeff0f83ff7c53f1651ccee44d857f03c5a41846f30302433ade0f3705ae0940",
       "capabilityClass": "macos-exclusive-durable-v1",
       "qualification": null
     },
@@ -14,7 +14,7 @@
       "platform": "darwin",
       "architecture": "x64",
       "relativePath": "bin/darwin-x64/aops-agent-assets-fs",
-      "sha256": "92cb610782d9d53a2ca43ccf8ffbcef2dd03ec684ce19f2252e3a55eda45e22a",
+      "sha256": "d04f3e6ae34c2711cf1cf6bb8a6d5edb669cf4aed4c21e315b23e9d78a0799ef",
       "capabilityClass": "macos-exclusive-durable-v1",
       "qualification": null
     },
@@ -22,7 +22,7 @@
       "platform": "linux",
       "architecture": "arm64",
       "relativePath": "bin/linux-arm64/aops-agent-assets-fs",
-      "sha256": "8e8457f64e9552a3094a910f3e2214ff2e309b8d2b4754af6fe30fd7fd674ff4",
+      "sha256": "4af380c99012b8e847570cb140c70c44c4dcdcee11c17cc5cb2bb8493b82dc8c",
       "capabilityClass": "linux-posix-durable-v1",
       "qualification": null
     },
@@ -30,7 +30,7 @@
       "platform": "linux",
       "architecture": "x64",
       "relativePath": "bin/linux-x64/aops-agent-assets-fs",
-      "sha256": "a313faedbbb5e4ebd570750ce567ab7e42b23077a8ddf60a4c61ba24965dc01c",
+      "sha256": "1c36cd295f0fcfdfd4192748413483b099ac4299e0f770a982846b8915fba31d",
       "capabilityClass": "linux-posix-durable-v1",
       "qualification": null
     },
@@ -38,11 +38,11 @@
       "platform": "win32",
       "architecture": "x64",
       "relativePath": "bin/win32-x64/aops-agent-assets-fs.exe",
-      "sha256": "f7b0fa243092c5c7fbcddf13ab7e6601566dd8f40078667d262c2a70588dd443",
+      "sha256": "c1fcf2fe3689550f1552bdb60a064a9ac0c9e30cba4d9eb7c52140ee14794778",
       "capabilityClass": "windows-ntfs-crash-recoverable-v1",
       "qualification": {
         "relativePath": "qualifications/win32-x64.json",
-        "sha256": "e6c9581ab34629b19a376c5cf3fb675e36ee34403ef64ec4f43c715533c45249"
+        "sha256": "ef348d39e5c9e229b21274d00f779dbe9e8fd7bdbc27cb5c797191bb1294a5ae"
       }
     }
   ]

package/native/qualifications/win32-x64.json

@@ -3,11 +3,11 @@
   "status": "qualified",
   "platform": "win32",
   "architecture": "x64",
-  "osBuild": "10.0.26100",
+  "osBuild": "10.0.26200",
   "filesystem": "NTFS",
   "primitiveProfile": "windows-createfile-flush-movefileex-v1",
   "capabilityClass": "windows-ntfs-crash-recoverable-v1",
-  "evidenceSha256": "4d353324b943a237459b60429128c1bd19ae5e15e86c833a1cd9a20180eca9e3",
+  "evidenceSha256": "d58ca525d9e4a57c111747e1912e4d74266c712b127cfb9857b7d9d2beb5d3c1",
   "crashInjectionPoints": [
     "authority-history",
     "authority-current",

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@aopslabs/aops",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "type": "module",
   "description": "AOPS CLI and terminal setup application.",
-  "aopsDockerServerVersion": "0.2.16",
+  "aopsDockerServerVersion": "0.2.17",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
@@ -44,7 +44,7 @@
     "test:commercial-performance": "node --test test/commercial-performance.test.mjs",
     "test:package-identity": "node --test test/package-identity.test.mjs test/npm-tar-entry-mode.test.mjs",
     "test:tui-launcher": "node --test test/tui-launcher.test.mjs",
-    "test:global-update": "node --test test/global-update.test.mjs test/cli-error-format.test.mjs",
+    "test:global-update": "pnpm run build && node --test test/global-update.test.mjs test/cli-error-format.test.mjs",
     "test:global-update-public-bridge": "node scripts/verify-global-update-public-bridge.mjs",
     "test:skill-discovery": "node --test test/skill-discovery.test.mjs",
     "test:target-auth": "node --test test/target-auth.test.mjs test/device-login.test.mjs",
@@ -62,17 +62,17 @@
   },
   "dependencies": {
     "@aopslabs/aops-agent-runtime": "0.1.0",
-    "@aopslabs/aops-server": "0.2.16",
+    "@aopslabs/aops-server": "0.2.18",
     "@aopslabs/artifact-trust-contracts": "0.3.1",
     "@aopslabs/cli-kit": "0.1.0",
-    "@aopslabs/aops-host-registration": "0.2.1",
+    "@aopslabs/aops-host-registration": "0.2.2",
     "@aopslabs/aops-pg-bootstrap": "0.2.3",
-    "@aopslabs/aops-runtime-config": "0.2.1",
+    "@aopslabs/aops-runtime-config": "0.2.2",
     "@sigstore/bundle": "4.0.0",
     "@sigstore/protobuf-specs": "0.5.1",
     "@sigstore/tuf": "4.0.2",
     "@sigstore/verify": "3.1.1",
-    "@aopslabs/api-client": "0.2.1",
+    "@aopslabs/api-client": "0.2.2",
     "@aopslabs/domain-product-client-chatv3": "0.4.1",
     "@aopslabs/xf-cli-ui": "0.2.0",
     "commander": "14.0.3",