@jigging/jig 0.1.0-alpha.29 → 0.1.0-alpha.33

package/libexec/macos-native-supervisor.js

@@ -182,7 +182,7 @@ function readRecord(directory, name) {
   const parent = privateDirectory(directory);
   let fd;
   try {
-    fd = openSync(join(directory, name), constants.O_RDONLY | O_NOFOLLOW_ANY | O_CLOEXEC);
+    fd = openSync(join(directory, name), constants.O_RDONLY | constants.O_NONBLOCK | O_NOFOLLOW_ANY | O_CLOEXEC);
     const before = fstatSync(fd, { bigint: true });
     if (!before.isFile() || before.uid !== BigInt(process.getuid?.() ?? -1) || (before.mode & 0o177n) !== 0n || before.nlink !== 1n || before.size < 1n || before.size > 1024n)
       throw new Error("macOS ownership journal is unsafe");
@@ -434,13 +434,11 @@ function acquirePrivateMacosCoalition() {
         observedMembers++;
       }
       const after = usage(owner.coalition);
-      if (after.cpuNanoseconds < before.cpuNanoseconds)
-        throw new Error("macOS CPU accounting moved backwards");
       return Object.freeze({
         ...after,
         footprintBytes,
         observedMembers,
-        complete: complete && before.active === after.active && after.active === BigInt(observedMembers + 1),
+        complete: complete && after.cpuNanoseconds >= before.cpuNanoseconds && before.active === after.active && after.active === BigInt(observedMembers + 1),
         sampleMilliseconds: performance.now() - start
       });
     },
@@ -694,6 +692,10 @@ function privateMacosUnlinkAt(parent, name, directory = false) {
   const { ptr, symbols } = calls2(), path = nameBytes(name);
   checked(symbols.unlinkat(parent, ptr(path), directory ? 128 : 0));
 }
+function privateMacosRenameAt(source, from, target, to, exclusive = false) {
+  const { ptr, symbols } = calls2(), old = nameBytes(from), next = nameBytes(to);
+  checked(symbols.renameatx_np(source, ptr(old), target, ptr(next), exclusive ? 4 : 0));
+}
 
 // src/internal/macos-descriptor-handoff.ts
 var MAX_DESCRIPTORS = 64;
@@ -1018,6 +1020,41 @@ async function sendPrivateMacosDescriptors(path, peer, descriptors, timeoutMs, s
   }
 }
 
+// src/internal/macos-guardian-diagnostics.ts
+import { AsyncLocalStorage } from "async_hooks";
+var causes = new Map([
+  ["macOS control channel ended", "CONTROL_EOF"],
+  ["macOS control channel socket failed", "CONTROL_SOCKET"],
+  ["macOS control channel capacity exceeded", "CONTROL_CAPACITY"],
+  ["macOS control channel malformed", "CONTROL_MALFORMED"],
+  ["macOS control channel truncated", "CONTROL_TRUNCATED"],
+  ["macOS control deadline expired", "CONTROL_DEADLINE"],
+  ["macOS control delivery unavailable", "CONTROL_DELIVERY"],
+  ["invalid macOS guardian response", "INVALID_RESPONSE"],
+  ["macOS collector has no successful fenced owner", "INVALID_COLLECTOR"],
+  ["macOS collector descriptor count changed", "DESCRIPTOR_COUNT"],
+  ["macOS guardian job removal is unconfirmed", "JOB_REMOVAL_UNCONFIRMED"],
+  ["macOS guardian operation deadline expired", "OPERATION_DEADLINE"],
+  ["macOS volume create failed", "VOLUME_CREATE"],
+  ["macOS volume attach failed", "VOLUME_ATTACH"],
+  ["macOS volume info failed", "VOLUME_INFO"],
+  ["macOS volume detach failed", "VOLUME_DETACH"],
+  ["macOS volume plist conversion failed", "VOLUME_PLIST"],
+  ["macOS image attachment does not match its allocation", "VOLUME_IMAGE"],
+  ["macOS volume device does not match its allocation", "VOLUME_DEVICE"]
+]);
+function closedCause(error) {
+  try {
+    return error instanceof Error ? causes.get(error.message) ?? "OTHER" : "OTHER";
+  } catch {
+    return "OTHER";
+  }
+}
+function privateMacosGuardianFailure(step, error) {
+  return Object.freeze({ step, cause: closedCause(error) });
+}
+var observers = new AsyncLocalStorage;
+
 // src/internal/macos-guardian-storage.ts
 import { constants as constants5 } from "fs";
 import { lstat, open as open4 } from "fs/promises";
@@ -1036,6 +1073,7 @@ var MIB = 1024 * 1024;
 var IMAGE = "volume.dmg";
 var INTENT = "volume.json";
 var IMAGE_RECORD = "volume-image.json";
+var IMAGE_PENDING = "volume-image.pending";
 var RETIRE_RECORD = "storage.release.json";
 function identity(stat) {
   return { device: String(stat.dev), inode: String(stat.ino) };
@@ -1179,7 +1217,7 @@ async function attached(controlPath, allocation, signal) {
   if (candidates.length !== 1 || item["owner-uid"] !== process.getuid() || item.blocksize !== 512 || item.blockcount !== allocation.bytes / 512 || item["image-encrypted"] !== false || !Array.isArray(entities) || entities.length !== 1)
     throw new Error("macOS image attachment does not match its allocation");
   const entity = entities[0];
-  if (entity === null || typeof entity !== "object" || typeof entity["dev-entry"] !== "string" || !/^\/dev\/disk[1-9][0-9]{0,5}$/.test(entity["dev-entry"]) || entity["mount-point"] !== undefined && entity["mount-point"] !== allocation.mount.path)
+  if (entity === null || typeof entity !== "object" || typeof entity["dev-entry"] !== "string" || !/^\/dev\/disk[1-9][0-9]{0,5}$/.test(entity["dev-entry"]))
     throw new Error("macOS volume device does not match its allocation");
   return entity["dev-entry"];
 }
@@ -1243,7 +1281,9 @@ async function attachPrivateMacosVolume(controlPath, token, signal) {
       if (stat2.size !== BigInt(bytes))
         throw new Error("macOS volume capacity changed");
       recordedImage = { ...identity(stat2), allocationMac };
-      await writeRecord(parent, IMAGE_RECORD, token, recordedImage);
+      await writeRecord(parent, IMAGE_PENDING, token, recordedImage, IMAGE_RECORD);
+      privateMacosRenameAt(parent.fd, IMAGE_PENDING, parent.fd, IMAGE_RECORD, true);
+      await parent.sync();
     } finally {
       await image.close();
     }
@@ -1795,18 +1835,19 @@ async function preparePrivateMacosScope(input) {
           stop("process_limit");
           break;
         }
-        if (!sample.complete) {
+        const cpuRegressed = sample.cpuNanoseconds < previousCpu;
+        if (!sample.complete || cpuRegressed) {
           incompleteSamples++;
           incompleteSince ??= now;
+          if (now - incompleteSince > 500) {
+            stop("accounting_failed");
+            break;
+          }
         } else
           incompleteSince = undefined;
-        if (incompleteSince !== undefined && now - incompleteSince > 500) {
-          stop("accounting_failed");
-          break;
-        }
-        if (sample.cpuNanoseconds < previousCpu) {
-          stop("accounting_failed");
-          break;
+        if (cpuRegressed) {
+          await new Promise((resolve) => setTimeout(resolve, 20));
+          continue;
         }
         credit += BigInt(Math.max(0, Math.floor((now - previousTime) * 1e6))) * BigInt(limits.cpuQuotaMicros) / BigInt(limits.cpuPeriodMicros) - (sample.cpuNanoseconds - previousCpu);
         if (credit > burst)
@@ -1984,6 +2025,7 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
     releaseCollection = resolve;
   });
   let stopped;
+  let preparationDeadlineExpired = false;
   let resolveAdmission = () => {};
   let rejectAdmission = () => {};
   const admission = new Promise((resolve, reject) => {
@@ -1995,8 +2037,11 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
   });
   let phase = "starting";
   const currentPhase = () => phase;
-  const stop = (reason) => {
-    stopped ??= reason;
+  const stop = (reason, deadlineExpired = false) => {
+    if (stopped === undefined) {
+      stopped = reason;
+      preparationDeadlineExpired = deadlineExpired;
+    }
     cancellation.abort();
     releaseCollection();
     rejectAdmission(new Error("macOS guardian admission stopped"));
@@ -2007,6 +2052,7 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
       stop("coordinator_lost");
   });
   let timer;
+  let failureStep = "configuration";
   try {
     configuration = startMessage(await privateMacosBefore(channel.receive(), 1e4));
     if (stopped !== undefined)
@@ -2023,7 +2069,7 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
     phase = "prepared";
     channel.send({ type: "prepared", identity: owner.identity });
     const operationDeadline = configuration.type === "start" ? configuration.limits.deadlineUnixMs : configuration.deadlineUnixMs;
-    timer = setTimeout(() => stop("cancelled"), Math.max(0, Math.min(1e4, operationDeadline - Date.now())));
+    timer = setTimeout(() => stop("cancelled", Date.now() >= operationDeadline), Math.max(0, Math.min(1e4, operationDeadline - Date.now())));
     const commands = (async () => {
       for (;; ) {
         const next = object(await channel.receive(), "type");
@@ -2033,7 +2079,7 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
           releaseCollection();
         else if (next.type === "admit" && phase === "prepared" && stopped === undefined) {
           clearTimeout(timer);
-          timer = setTimeout(() => stop("cancelled"), Math.max(0, operationDeadline - Date.now()));
+          timer = setTimeout(() => stop("cancelled", true), Math.max(0, operationDeadline - Date.now()));
           phase = "preparing";
           resolveAdmission();
         } else if (next.type === "continue" && currentPhase() === "ready" && stopped === undefined) {
@@ -2044,10 +2090,12 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
       }
     })();
     commands.catch(() => stop("coordinator_lost"));
+    failureStep = "admission";
     await admission;
     if (stopped !== undefined)
       throw new Error("macOS guardian stopped before preparation");
     if (configuration.type === "recover-storage") {
+      failureStep = "storage-recovery";
       await recoverPrivateMacosGuardianStorage(configuration.targetDirectory, configuration.targetToken, cancellation.signal);
       const fencedBy = performance.now() + 5000;
       while (!owner.empty()) {
@@ -2061,20 +2109,23 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
       stdin.destroy();
       stdout.end();
       stderr.end();
-      channel.send({ type: "terminal", result: null, outputLost: false });
+      channel.send({ type: "terminal", result: null, outputLost: false, failure: null });
       await privateMacosBefore(new Promise((resolve) => control.end(resolve)), 1000);
       return;
     }
     if (inputReceiver !== undefined) {
+      failureStep = "input-transfer";
       inputBundle = await inputReceiver.receive({ pid: coordinatorPid, version: coordinatorVersion }, 5000, cancellation.signal);
       await inputReceiver.close();
     }
     if (configuration.storage !== undefined) {
+      failureStep = "storage";
       const storage = await preparePrivateMacosGuardianStorage(configuration.ownerDirectory, configuration.ownerToken, configuration.storage, cancellation.signal);
       collector = storage.collector;
       storageRoot = storage.directory;
     }
     if ((configuration.inputDirectories?.length ?? 0) > 0) {
+      failureStep = "input-projection";
       await projectPrivateMacosInputs(storageRoot, configuration.inputs, configuration.inputDirectories, inputBundle, cancellation.signal);
       inputBundle?.close();
       inputBundle = undefined;
@@ -2082,6 +2133,7 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
     await storageRoot?.close();
     storageRoot = undefined;
     cancellation.signal.throwIfAborted();
+    failureStep = "scope-preparation";
     execution = await preparePrivateMacosScope({
       ...configuration,
       owner,
@@ -2132,6 +2184,7 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
     stdin.pipe(execution.stdin);
     phase = "ready";
     channel.send({ type: "ready", pid: execution.pid, version: execution.version });
+    failureStep = "execution";
     const result = await execution.completion;
     stdin.destroy();
     for (const destination of [stdout, stderr]) {
@@ -2151,6 +2204,7 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
     execution.stdout.destroy();
     execution.stderr.destroy();
     if (configuration.storage !== undefined) {
+      failureStep = "collection";
       phase = "collecting";
       const collect = collector !== undefined && stopped === undefined && !outputLost && result.reason === "payload_exit" && result.exitCode === 0;
       channel.send({ type: "fenced", result, outputLost, collect });
@@ -2160,14 +2214,16 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
       }
       await collector?.close();
       collector = undefined;
+      failureStep = "storage-recovery";
       await recoverPrivateMacosGuardianStorage(configuration.ownerDirectory, configuration.ownerToken, AbortSignal.timeout(30000));
       if (stopped !== undefined)
         outputLost = true;
     }
     phase = "terminal";
-    channel.send({ type: "terminal", result, outputLost });
+    channel.send({ type: "terminal", result, outputLost, failure: null });
     await privateMacosBefore(new Promise((resolve) => control.end(resolve)), 1000);
   } catch (error) {
+    const failure = privateMacosGuardianFailure(failureStep, configuration?.type === "start" && execution === undefined && preparationDeadlineExpired ? new Error("macOS guardian operation deadline expired", { cause: error }) : error);
     cancellation.abort();
     execution?.stop("coordinator_lost");
     let result;
@@ -2190,7 +2246,7 @@ async function supervise(path2, coordinatorPid, coordinatorVersion) {
       await recoverPrivateMacosGuardianStorage(configuration.ownerDirectory, configuration.ownerToken, AbortSignal.timeout(30000));
     phase = "terminal";
     try {
-      channel.send({ type: "terminal", result: result ?? null, outputLost: true });
+      channel.send({ type: "terminal", result: result ?? null, outputLost: true, failure });
       await privateMacosBefore(new Promise((resolve) => control.end(resolve)), 1000);
     } catch {}
     if (stopped === undefined)

package/libexec/preparation/bun-native-preparation-worker.js

@@ -88,12 +88,20 @@ function requirePrivateBunPatches(value) {
   }
   return Object.freeze({ ...patches });
 }
+
+class PrivateBunLockVersionError extends TypeError {
+  constructor() {
+    super("bun.lock uses a format unsupported by the pinned Bun runtime");
+  }
+}
 function requirePrivateBunLockPolicy(value, members, version = 1) {
   const lock = ordinaryRecord(value);
   const workspaces = ordinaryRecord(lock?.workspaces);
   const rootWorkspace = ordinaryRecord(workspaces?.[""]);
   const packages = ordinaryRecord(lock?.packages);
-  if (version !== 1 && version !== 2 || lock?.lockfileVersion !== version || workspaces === undefined || rootWorkspace === undefined || packages === undefined || (members === undefined ? Object.keys(workspaces).length !== 1 : Object.keys(workspaces).some((path) => path !== "" && !members.has(path))) || members === undefined && lock.patchedDependencies !== undefined) {
+  if (lock !== undefined && lock.lockfileVersion !== 1 && lock.lockfileVersion !== version)
+    throw new PrivateBunLockVersionError;
+  if (version !== 1 && version !== 2 || lock === undefined || workspaces === undefined || rootWorkspace === undefined || packages === undefined || (members === undefined ? Object.keys(workspaces).length !== 1 : Object.keys(workspaces).some((path) => path !== "" && !members.has(path))) || members === undefined && lock.patchedDependencies !== undefined) {
     throw new TypeError("unsupported Bun lock source");
   }
   requirePrivateBunPatches(lock.patchedDependencies);
@@ -5128,10 +5136,12 @@ async function requireSupportedLock(resolved, patches) {
   }
   try {
     requirePrivateBunLockPolicy(value, workspace === undefined ? undefined : new Set(workspace.members), process.platform === "darwin" && process.versions.bun === "1.4.2" ? 2 : 1);
-  } catch {
+  } catch (error) {
     if (resolved) {
       throw new WorkerFailure("PACKAGE_BUN_RESOLVED_SOURCE_UNSUPPORTED", "resolved dependencies are unsupported; resolution requests may already have occurred");
     }
+    if (error instanceof PrivateBunLockVersionError)
+      throw new WorkerFailure("PACKAGE_BUN_LOCK_VERSION_UNSUPPORTED", error.message);
     unsupportedSource();
   }
   if (workspace !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jigging/jig",
-  "version": "0.1.0-alpha.29",
+  "version": "0.1.0-alpha.33",
   "description": "A local, secure host for admitted FLOW packages",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {