@git.zone/tsrust 1.13.0 → 1.14.0

package/ts/mod_cargo/classes.targetcache.ts

@@ -1,5 +1,7 @@
-import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
+import * as plugins from '../plugins.js';
+import { withTargetCacheLock, assertTargetCacheIdle } from './classes.targetguard.js';
+const fs = plugins.fsPromises;
+const path = plugins.path;
 
 export const toolCacheMarkerFile = '.gitzone-tool-cache.json';
 export const tsrustCacheOwner = '@git.zone/tsrust';
@@ -21,6 +23,9 @@ export interface ITsrustPruneCandidate {
   shouldPrune: boolean;
   reason: string;
   truncated?: boolean;
+  /** Captured eligibility and identity, revalidated by apply. */
+  criteria?: { days?: number; maxSizeBytes?: number };
+  identity?: { dev: number; ino: number; markerCreatedAt: string };
 }
 
 export interface ITsrustPruneOptions {
@@ -42,7 +47,9 @@ export function createTargetCacheMarker(): IToolCacheMarker {
 
 export function isValidTargetCacheMarker(markerArg: unknown): markerArg is IToolCacheMarker {
   const marker = markerArg as Partial<IToolCacheMarker>;
-  return marker.owner === tsrustCacheOwner
+  return !!marker && typeof marker === 'object'
+    && typeof marker.createdAt === 'string' && Number.isFinite(Date.parse(marker.createdAt))
+    && marker.owner === tsrustCacheOwner
     && marker.kind === targetCacheKind
     && marker.safeToPrune === true
     && marker.schemaVersion === 1;
@@ -119,7 +126,10 @@ export async function writeTargetCacheMarker(targetDirArg: string): Promise<void
 
 export async function readTargetCacheMarker(targetDirArg: string): Promise<IToolCacheMarker | undefined> {
   try {
-    const markerRaw = await fs.readFile(path.join(targetDirArg, toolCacheMarkerFile), 'utf8');
+    const markerPath = path.join(targetDirArg, toolCacheMarkerFile);
+    const stat = await fs.lstat(markerPath);
+    if (!stat.isFile() || stat.size > 65536) return undefined;
+    const markerRaw = await fs.readFile(markerPath, 'utf8');
     const marker = JSON.parse(markerRaw);
     return isValidTargetCacheMarker(marker) ? marker : undefined;
   } catch {
@@ -161,86 +171,56 @@ export async function getDirectorySize(pathArg: string): Promise<number> {
   return total;
 }
 
-async function getDirectoryUsage(pathArg: string, maxEntriesArg = 100_000): Promise<{ bytes: number; newestMtimeMs: number; truncated: boolean }> {
+async function getDirectoryUsage(pathArg: string): Promise<{ bytes: number; newestMtimeMs: number; truncated: boolean }> {
   let bytes = 0;
   let newestMtimeMs = 0;
   let visitedEntries = 0;
   let truncated = false;
-
-  const visit = async (entryPathArg: string): Promise<void> => {
-    if (visitedEntries >= maxEntriesArg) {
-      truncated = true;
-      return;
-    }
-    visitedEntries++;
-
-    let stat;
-    try {
-      stat = await fs.stat(entryPathArg);
-    } catch {
-      return;
-    }
-    newestMtimeMs = Math.max(newestMtimeMs, stat.mtimeMs);
-    if (stat.isFile()) {
-      bytes += stat.size;
-      return;
-    }
-    if (!stat.isDirectory()) {
-      return;
-    }
-
-    let entries;
+  const deadline = Date.now() + 30_000;
+  const root = await fs.lstat(pathArg);
+  const visit = async (entryPath: string): Promise<void> => {
+    if (++visitedEntries > 100_000 || Date.now() > deadline) { truncated = true; return; }
     try {
-      entries = await fs.readdir(entryPathArg, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (visitedEntries >= maxEntriesArg) {
+      const stat = await fs.lstat(entryPath);
+      if (stat.isSymbolicLink() || stat.dev !== root.dev || stat.uid !== root.uid) {
         truncated = true;
         return;
       }
-      await visit(path.join(entryPathArg, entry.name));
-    }
+      newestMtimeMs = Math.max(newestMtimeMs, stat.mtimeMs);
+      if (stat.isFile()) bytes += stat.size;
+      else if (stat.isDirectory()) {
+        for (const entry of await fs.readdir(entryPath)) {
+          await visit(path.join(entryPath, entry));
+          if (truncated) break;
+        }
+      } else truncated = true;
+    } catch { truncated = true; }
   };
-
   await visit(pathArg);
   return { bytes, newestMtimeMs, truncated };
 }
 
-async function getNewestMtimeMs(pathArg: string): Promise<number> {
-  let newest = 0;
-  try {
-    const stat = await fs.stat(pathArg);
-    newest = stat.mtimeMs;
-  } catch {
-    return 0;
-  }
-
-  let entries;
-  try {
-    entries = await fs.readdir(pathArg, { withFileTypes: true });
-  } catch {
-    return newest;
-  }
-
-  for (const entry of entries) {
-    const entryPath = path.join(pathArg, entry.name);
-    if (entry.isDirectory()) {
-      newest = Math.max(newest, await getNewestMtimeMs(entryPath));
-    } else if (entry.isFile()) {
-      try {
-        newest = Math.max(newest, (await fs.stat(entryPath)).mtimeMs);
-      } catch {
-        // Ignore files that disappear while planning a prune.
-      }
+async function assertSafeTarget(workspace: string, target: string): Promise<void> {
+  if (!isSafeManagedTargetDir(workspace, target)) throw new Error(`Unsafe target: ${target}`);
+  for (const location of [workspace, target]) {
+    const stat = await fs.lstat(location);
+    if (!stat.isDirectory() || await fs.realpath(location) !== location || stat.uid !== process.getuid?.()) {
+      throw new Error(`Target must be an owned directory without symlink ancestors: ${location}`);
     }
   }
+  const workspaceStat = await fs.lstat(workspace);
+  const targetStat = await fs.lstat(target);
+  if (workspaceStat.dev !== targetStat.dev) throw new Error('Target crosses a filesystem boundary');
+}
 
-  return newest;
+function validateThresholds(options: { days?: number; maxSizeBytes?: number }): void {
+  for (const value of [options.days, options.maxSizeBytes]) {
+    if (value !== undefined && (!Number.isFinite(value) || value < 0)) throw new Error('Prune thresholds must be finite non-negative numbers');
+  }
 }
 
 export async function createTsrustPrunePlan(optionsArg: ITsrustPruneOptions): Promise<ITsrustPruneCandidate[]> {
+  validateThresholds(optionsArg);
   const workspace = path.resolve(optionsArg.workspace);
   const managedTargetDir = optionsArg.targetDir
     ? resolveManagedTargetDir(workspace, optionsArg.targetDir)
@@ -264,14 +244,19 @@ export async function createTsrustPrunePlan(optionsArg: ITsrustPruneOptions): Pr
     const ageMatches = typeof maxAgeMs === 'number' ? Date.now() - usage.newestMtimeMs >= maxAgeMs : false;
     const bytes = usage.bytes;
     const sizeMatches = typeof optionsArg.maxSizeBytes === 'number' ? bytes >= optionsArg.maxSizeBytes : false;
-    const shouldPrune = !!marker && isManagedTarget && (ageMatches || sizeMatches);
-    const reason = marker
+    let safetyError: string | undefined;
+    if (isManagedTarget) {
+      try { await assertSafeTarget(workspace, candidate); }
+      catch (error) { safetyError = (error as Error).message; }
+    }
+    const shouldPrune = !!marker && isManagedTarget && !usage.truncated && !safetyError && (ageMatches || sizeMatches);
+    const reason = safetyError || (usage.truncated ? 'incomplete or unsafe cache scan; report-only' : undefined) || (marker
       ? !isManagedTarget
         ? 'marked Rust target outside managed tsrust target allowlist; report-only'
         : shouldPrune
         ? [ageMatches ? `older than ${optionsArg.days} day(s)` : '', sizeMatches ? `at least ${optionsArg.maxSizeBytes} bytes` : ''].filter(Boolean).join(', ')
         : 'marked tsrust target cache; below prune thresholds'
-      : 'unmarked conventional Rust target; report-only';
+      : 'unmarked conventional Rust target; report-only');
 
     pruneCandidates.push({
       path: candidate,
@@ -281,6 +266,8 @@ export async function createTsrustPrunePlan(optionsArg: ITsrustPruneOptions): Pr
       shouldPrune,
       reason,
       truncated: usage.truncated,
+      criteria: { days: optionsArg.days, maxSizeBytes: optionsArg.maxSizeBytes },
+      identity: marker ? { dev: (await fs.lstat(candidate)).dev, ino: (await fs.lstat(candidate)).ino, markerCreatedAt: marker.createdAt } : undefined,
     });
   }
 
@@ -289,16 +276,28 @@ export async function createTsrustPrunePlan(optionsArg: ITsrustPruneOptions): Pr
 
 export async function applyTsrustPrunePlan(planArg: ITsrustPruneCandidate[]): Promise<void> {
   for (const candidate of planArg) {
-    if (!candidate.shouldPrune) {
-      continue;
-    }
-    if (!isSafeManagedTargetDir(candidate.workspace, candidate.path)) {
-      throw new Error(`Refusing unsafe Rust target cache path: ${candidate.path}`);
-    }
-    const marker = await readTargetCacheMarker(candidate.path);
-    if (!marker) {
-      throw new Error(`Refusing to remove unmarked Rust target cache: ${candidate.path}`);
-    }
-    await fs.rm(candidate.path, { recursive: true, force: true });
+    if (!candidate.shouldPrune) continue;
+    await withTargetCacheLock(candidate.path, async () => {
+      await assertSafeTarget(candidate.workspace, candidate.path);
+      if (!candidate.criteria || !candidate.identity) throw new Error('Prune plan lacks eligibility and identity; create a new plan');
+      validateThresholds(candidate.criteria);
+      const fresh = (await createTsrustPrunePlan({ workspace: candidate.workspace, targetDir: candidate.path, ...candidate.criteria }))
+        .find((entry) => entry.path === candidate.path);
+      if (!fresh?.shouldPrune || JSON.stringify(fresh.identity) !== JSON.stringify(candidate.identity)) {
+        throw new Error(`Rust target cache changed or is no longer eligible: ${candidate.path}`);
+      }
+      await assertTargetCacheIdle(candidate.path);
+      await assertSafeTarget(candidate.workspace, candidate.path);
+      const stat = await fs.lstat(candidate.path);
+      if (stat.dev !== candidate.identity.dev || stat.ino !== candidate.identity.ino) throw new Error('Target identity changed');
+      // Recheck after process inspection as well; it can take time on busy hosts.
+      const usage = await getDirectoryUsage(candidate.path);
+      const { days, maxSizeBytes } = candidate.criteria;
+      if (usage.truncated || !((days !== undefined && Date.now() - usage.newestMtimeMs >= days * 86400000)
+        || (maxSizeBytes !== undefined && usage.bytes >= maxSizeBytes))) throw new Error('Target eligibility changed');
+      const marker = await readTargetCacheMarker(candidate.path);
+      if (!marker || marker.createdAt !== candidate.identity.markerCreatedAt) throw new Error('Target marker changed');
+      await fs.rm(candidate.path, { recursive: true, force: false });
+    });
   }
 }

package/ts/mod_cargo/classes.targetguard.ts

@@ -0,0 +1,63 @@
+import * as plugins from '../plugins.js';
+
+const heldTargets = new plugins.AsyncLocalStorage<ReadonlySet<string>>();
+
+/** A kernel-owned Linux socket serializes builds and pruning without stale lock files. */
+export async function withTargetCacheLock<T>(targetArg: string, action: () => Promise<T>): Promise<T> {
+  const target = plugins.path.resolve(targetArg);
+  if (process.platform !== 'linux' || heldTargets.getStore()?.has(target)) return action();
+  const address = '\0tsrust-target-' + plugins.crypto.createHash('sha256').update(target).digest('hex');
+  const deadline = Date.now() + 30_000;
+  let server: plugins.net.Server;
+  while (true) {
+    server = plugins.net.createServer((connection) => connection.destroy());
+    const acquired = await new Promise<boolean>((resolve, reject) => {
+      const failed = (error: NodeJS.ErrnoException) => {
+        if (error.code === 'EADDRINUSE') resolve(false);
+        else reject(error);
+      };
+      server.once('error', failed);
+      server.listen(address, () => { server.removeListener('error', failed); resolve(true); });
+    });
+    if (acquired) break;
+    if (Date.now() >= deadline) throw new Error(`Timed out waiting for the Rust target cache guard: ${target}`);
+    await new Promise<void>((resolve) => setTimeout(resolve, 100));
+  }
+  try {
+    return await heldTargets.run(new Set([...(heldTargets.getStore() || []), target]), action);
+  } finally {
+    await new Promise<void>((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+  }
+}
+
+/** Fail closed if this host cannot prove that the cache is idle. */
+export async function assertTargetCacheIdle(target: string): Promise<void> {
+  if (process.platform !== 'linux') throw new Error('Safe target pruning requires Linux /proc process inspection');
+  const fs = plugins.fsPromises;
+  const contains = (value: string) => value === target || value.startsWith(target + plugins.path.sep);
+  const disappeared = (error: unknown) => ['ENOENT', 'ESRCH'].includes((error as NodeJS.ErrnoException).code || '');
+  const deadline = Date.now() + 30_000;
+  for (const pid of await fs.readdir('/proc')) {
+    if (!/^\d+$/.test(pid) || Number(pid) === process.pid) continue;
+    if (Date.now() > deadline) throw new Error('Process inspection timed out; refusing to prune');
+    const base = `/proc/${pid}`;
+    try {
+      const status = await fs.readFile(`${base}/status`, 'utf8');
+      const uid = Number(status.match(/^Uid:\s+(\d+)/m)?.[1]);
+      if (!Number.isFinite(uid)) throw new Error(`Cannot identify process ${pid}`);
+      if (uid !== process.getuid?.()) continue;
+      const command = await fs.readFile(`${base}/comm`, 'utf8');
+      if (/^(cargo|rustc|rust-analyzer)\n?$/.test(command)) throw new Error(`Rust tool process ${pid} is active; refusing to prune`);
+      for (const name of ['cwd', 'exe', ...(await fs.readdir(`${base}/fd`)).map((fd) => `fd/${fd}`)]) {
+        try {
+          if (contains(await fs.readlink(`${base}/${name}`))) throw new Error(`Process ${pid} is using target cache ${target}`);
+        } catch (error) { if (!disappeared(error)) throw error; }
+      }
+      const maps = await fs.readFile(`${base}/maps`, 'utf8');
+      if (maps.split('\n').some((line) => {
+        const mappedPath = line.match(/^\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+(.*)$/)?.[1];
+        return mappedPath !== undefined && contains(mappedPath);
+      })) throw new Error(`Process ${pid} maps target cache ${target}`);
+    } catch (error) { if (!disappeared(error)) throw error; }
+  }
+}