@sleep2agi/agent-network 2.3.0-preview.35 → 2.3.0-preview.37
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +35 -334
- package/dist/bin/cli.js +1 -1
- package/dist/src/client.js +1 -1
- package/dist/src/copresence-identity.d.ts +339 -0
- package/dist/src/im/feishu/worker.js +1 -1
- package/dist/src/node-server.js +1 -1
- package/dist/src/tmux-capability.d.ts +58 -0
- package/package.json +1 -1
package/dist/src/client.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
const
|
|
1
|
+
function a0_0x6de1(_0x4e3e59,_0x1b9c4f){_0x4e3e59=_0x4e3e59-0xea;const _0x40fe82=a0_0x40fe();let _0x6de1e1=_0x40fe82[_0x4e3e59];return _0x6de1e1;}const a0_0x230d08=a0_0x6de1;function a0_0x40fe(){const _0x14968a=['url','slice','parse','new_task','sseAbort','text/event-stream','report_status','replace','emit','type','4091458iZWsQm','toTimeString','144765bkuQHm','/events/','catch','heartbeatInterval','getAllStatus','24726GPhIpb','token','connectSSE','520RwIKTP','running','10BPzsZx','signal','reconnectDelay','15568289UrBTPk','SSE\x20failed:\x20','new_message','disconnect','startsWith','text','5490CuQXkh','error','decode','Bearer\x20','get_inbox','s...','695eQhJwC','stringify','content','log','connected',']\x20[commhub:','now','task','sdk','normal','processInbox','sdk-','cwd','Authorization','min','agent','heartbeat\x20failed:\x20','message','get_all_status','status','pop','inbox\x20error:\x20','autoConnect','2.0','application/json,\x20text/event-stream','SSE\x20connected','connect','514lHxAnX','send_message','resumeId','call','disconnected','3430986Elwrzi','5313740UULazF','/mcp','send','getReader','reply','tools/call','alias','body','messages','ack_inbox','name','data:\x20','heartbeatTimer','read','broadcast','server','sleep','send_reply'];a0_0x40fe=function(){return _0x14968a;};return a0_0x40fe();}(function(_0x6bcbe2,_0x394dd0){const _0x28270e=a0_0x6de1,_0x11eb5c=_0x6bcbe2();while(!![]){try{const _0x3862fd=parseInt(_0x28270e(0x131))/0x1*(-parseInt(_0x28270e(0xfa))/0x2)+parseInt(_0x28270e(0xff))/0x3+-parseInt(_0x28270e(0x100))/0x4+parseInt(_0x28270e(0x137))/0x5*(-parseInt(_0x28270e(0x123))/0x6)+parseInt(_0x28270e(0x11c))/0x7+-parseInt(_0x28270e(0x126))/0x8*(-parseInt(_0x28270e(0x11e))/0x9)+parseInt(_0x28270e(0x128))/0xa*(parseInt(_0x28270e(0x12b))/0xb);if(_0x3862fd===_0x394dd0)break;else _0x11eb5c['push'](_0x11eb5c['shift']());}catch(_0x2fac3a){_0x11eb5c['push'](_0x11eb5c['shift']());}}}(a0_0x40fe,0xd60fc));import{EventEmitter as a0_0x5ce8b4}from'events';import{hostname as a0_0x37fdd8}from'os';class T extends a0_0x5ce8b4{[a0_0x230d08(0x112)];[a0_0x230d08(0x106)];[a0_0x230d08(0x124)];[a0_0x230d08(0xee)];['resumeId'];[a0_0x230d08(0x121)];[a0_0x230d08(0x12a)];[a0_0x230d08(0x10c)];['sseAbort'];[a0_0x230d08(0x127)]=!0x1;constructor(_0x5bc09d){const _0x5c0a7b=a0_0x230d08;super();if(this[_0x5c0a7b(0x112)]=_0x5bc09d[_0x5c0a7b(0x112)][_0x5c0a7b(0x119)](/\/$/,''),this[_0x5c0a7b(0x106)]=_0x5bc09d[_0x5c0a7b(0x106)],this[_0x5c0a7b(0x124)]=_0x5bc09d['token'],this[_0x5c0a7b(0xee)]=_0x5bc09d['agent']||_0x5c0a7b(0x13f),this[_0x5c0a7b(0xfc)]=_0x5c0a7b(0xea)+_0x5bc09d[_0x5c0a7b(0x106)]+'-'+Date[_0x5c0a7b(0x13d)]()['toString'](0x24),this[_0x5c0a7b(0x121)]=_0x5bc09d[_0x5c0a7b(0x121)]??0x2bf20,this[_0x5c0a7b(0x12a)]=_0x5bc09d[_0x5c0a7b(0x12a)]??0xbb8,_0x5bc09d[_0x5c0a7b(0xf5)]!==!0x1)this[_0x5c0a7b(0xf9)]();}[a0_0x230d08(0x13a)](_0x1f9b0e){const _0x275549=a0_0x230d08;console[_0x275549(0x13a)]('['+new Date()[_0x275549(0x11d)]()[_0x275549(0x113)](0x0,0x8)+_0x275549(0x13c)+this['alias']+']\x20'+_0x1f9b0e);}async['call'](_0x29f9c4,_0x201e70){const _0x411ac6=a0_0x230d08;let _0x220afa={'Content-Type':'application/json','Accept':_0x411ac6(0xf7)};if(this['token'])_0x220afa[_0x411ac6(0xec)]='Bearer\x20'+this['token'];let _0x4b27f6=await(await fetch(this[_0x411ac6(0x112)]+_0x411ac6(0x101),{'method':'POST','headers':_0x220afa,'body':JSON[_0x411ac6(0x138)]({'jsonrpc':_0x411ac6(0xf6),'id':Date[_0x411ac6(0x13d)](),'method':_0x411ac6(0x105),'params':{'name':_0x29f9c4,'arguments':_0x201e70}})}))[_0x411ac6(0x130)](),_0x5acd89=_0x4b27f6['match'](/data: (.+)/),_0x372246=_0x5acd89?JSON[_0x411ac6(0x114)](_0x5acd89[0x1]):JSON[_0x411ac6(0x114)](_0x4b27f6),_0x92053b=_0x372246?.['result']?.[_0x411ac6(0x139)]?.[0x0]?.['text'];return _0x92053b?JSON[_0x411ac6(0x114)](_0x92053b):_0x372246;}async[a0_0x230d08(0xf9)](){const _0x2ebdc6=a0_0x230d08;if(this[_0x2ebdc6(0x127)])return;this[_0x2ebdc6(0x127)]=!0x0,await this['status']('idle'),this[_0x2ebdc6(0x13a)]('registered'),this['heartbeatTimer']=setInterval(()=>{const _0x2f5259=_0x2ebdc6;this[_0x2f5259(0xf2)]('idle')[_0x2f5259(0x120)](_0x57cd61=>this[_0x2f5259(0x13a)](_0x2f5259(0xef)+_0x57cd61[_0x2f5259(0xf0)]));},this['heartbeatInterval']),this[_0x2ebdc6(0x125)]();}async[a0_0x230d08(0x12e)](){const _0x183f5f=a0_0x230d08;if(this[_0x183f5f(0x127)]=!0x1,this[_0x183f5f(0x116)]?.['abort'](),this[_0x183f5f(0x10c)])clearInterval(this['heartbeatTimer']);await this['status']('offline')[_0x183f5f(0x120)](()=>{}),this['log'](_0x183f5f(0xfe));}async[a0_0x230d08(0x102)](_0x3a7d95,_0x47a952,_0x36398e=a0_0x230d08(0x140)){const _0x2a160d=a0_0x230d08;return this[_0x2a160d(0xfd)]('send_task',{'alias':_0x3a7d95,'task':_0x47a952,'priority':_0x36398e,'from_session':this[_0x2a160d(0x106)]});}async[a0_0x230d08(0xf0)](_0x484042,_0xf535cf){const _0x24802d=a0_0x230d08;return this[_0x24802d(0xfd)](_0x24802d(0xfb),{'alias':_0x484042,'message':_0xf535cf,'from_session':this[_0x24802d(0x106)]});}async[a0_0x230d08(0x104)](_0x394ec4,_0x1abafa,_0x1408f2='completed'){const _0x144317=a0_0x230d08;return this[_0x144317(0xfd)](_0x144317(0x111),{'in_reply_to':_0x394ec4,'text':_0x1abafa,'status':_0x1408f2});}async[a0_0x230d08(0xf2)](_0x56e212,_0x2c4ef9){const _0x226ed9=a0_0x230d08;return this['call'](_0x226ed9(0x118),{'resume_id':this['resumeId'],'alias':this[_0x226ed9(0x106)],'status':_0x56e212,'server':a0_0x37fdd8(),'hostname':a0_0x37fdd8(),'agent':this[_0x226ed9(0xee)],'project_dir':process[_0x226ed9(0xeb)](),..._0x2c4ef9});}async[a0_0x230d08(0x122)](){const _0x4103bf=a0_0x230d08;return this[_0x4103bf(0xfd)](_0x4103bf(0xf1),{});}async[a0_0x230d08(0x10e)](_0x94aed9,_0x54955a){const _0x343276=a0_0x230d08;return this[_0x343276(0xfd)](_0x343276(0x10e),{'message':_0x94aed9,'filter_server':_0x54955a?.[_0x343276(0x10f)],'filter_status':_0x54955a?.['status']});}async[a0_0x230d08(0x125)](){const _0x3a741a=a0_0x230d08;let _0x38bfda=encodeURIComponent(this[_0x3a741a(0x106)]),_0x62700f=this[_0x3a741a(0x112)]+_0x3a741a(0x11f)+_0x38bfda,_0x18d07f=this[_0x3a741a(0x12a)];while(this[_0x3a741a(0x127)]){try{this['sseAbort']=new AbortController();let _0x386080={'Accept':_0x3a741a(0x117)};if(this['token'])_0x386080[_0x3a741a(0xec)]=_0x3a741a(0x134)+this['token'];let _0x25c195=await fetch(_0x62700f,{'headers':_0x386080,'signal':this[_0x3a741a(0x116)][_0x3a741a(0x129)]});if(!_0x25c195['ok']||!_0x25c195[_0x3a741a(0x107)]){this[_0x3a741a(0x13a)](_0x3a741a(0x12c)+_0x25c195[_0x3a741a(0xf2)]),await this['sleep'](_0x18d07f),_0x18d07f=Math[_0x3a741a(0xed)](_0x18d07f*1.5,0xea60);continue;}_0x18d07f=this['reconnectDelay'];let _0x223947=_0x25c195[_0x3a741a(0x107)][_0x3a741a(0x103)](),_0x47e6d3=new TextDecoder(),_0x291c17='';while(this[_0x3a741a(0x127)]){let {done:_0x7a321d,value:_0x5719eb}=await _0x223947[_0x3a741a(0x10d)]();if(_0x7a321d)break;_0x291c17+=_0x47e6d3[_0x3a741a(0x133)](_0x5719eb,{'stream':!0x0});let _0x544ff5=_0x291c17['split']('\x0a');_0x291c17=_0x544ff5[_0x3a741a(0xf3)]()||'';for(let _0xa90ef6 of _0x544ff5){if(!_0xa90ef6[_0x3a741a(0x12f)](_0x3a741a(0x10b)))continue;try{let _0x4003a3=JSON[_0x3a741a(0x114)](_0xa90ef6[_0x3a741a(0x113)](0x6));if(_0x4003a3[_0x3a741a(0x11b)]===_0x3a741a(0x13b)){this[_0x3a741a(0x13a)](_0x3a741a(0xf8)),this[_0x3a741a(0x11a)](_0x3a741a(0x13b));continue;}if(_0x4003a3['type']===_0x3a741a(0x115)||_0x4003a3['type']===_0x3a741a(0x12d)||_0x4003a3[_0x3a741a(0x11b)]===_0x3a741a(0x10e))await this[_0x3a741a(0x141)]();}catch{}}}}catch(_0x56ecd7){if(_0x56ecd7[_0x3a741a(0x10a)]==='AbortError')break;this[_0x3a741a(0x11a)](_0x3a741a(0x132),_0x56ecd7),this[_0x3a741a(0x13a)]('SSE\x20error:\x20'+_0x56ecd7['message']);}if(this[_0x3a741a(0x127)])this[_0x3a741a(0x11a)](_0x3a741a(0xfe)),this[_0x3a741a(0x13a)]('SSE\x20reconnecting\x20in\x20'+_0x18d07f/0x3e8+_0x3a741a(0x136)),await this['sleep'](_0x18d07f),_0x18d07f=Math[_0x3a741a(0xed)](_0x18d07f*1.5,0xea60);}}async[a0_0x230d08(0x141)](){const _0x549c3d=a0_0x230d08;try{let _0x4348a1=(await this[_0x549c3d(0xfd)](_0x549c3d(0x135),{'alias':this[_0x549c3d(0x106)],'limit':0xa}))?.[_0x549c3d(0x108)]||[];for(let _0x212c2b of _0x4348a1)await this[_0x549c3d(0xfd)](_0x549c3d(0x109),{'alias':this[_0x549c3d(0x106)],'message_id':_0x212c2b['id']}),this[_0x549c3d(0x13a)]('←\x20'+_0x212c2b['from_session']+':\x20'+_0x212c2b[_0x549c3d(0x139)][_0x549c3d(0x113)](0x0,0x3c)),this['emit'](_0x549c3d(0x13e),_0x212c2b),this[_0x549c3d(0x11a)](_0x549c3d(0xf0),_0x212c2b);}catch(_0x39cfba){this[_0x549c3d(0x13a)](_0x549c3d(0xf4)+_0x39cfba['message']);}}[a0_0x230d08(0x110)](_0x3aad9b){return new Promise(_0x44066d=>setTimeout(_0x44066d,_0x3aad9b));}}var $=T;export{$ as default,T as CommHub};
|
|
@@ -0,0 +1,339 @@
|
|
|
1
|
+
export interface SessionInfo {
|
|
2
|
+
tmux: string;
|
|
3
|
+
pid: number;
|
|
4
|
+
pgid: number;
|
|
5
|
+
starttime_jiffies: number;
|
|
6
|
+
}
|
|
7
|
+
export interface CopresenceMarker {
|
|
8
|
+
marker: string;
|
|
9
|
+
boot_id: string;
|
|
10
|
+
started_at_epoch_ms: number;
|
|
11
|
+
owner_uid: number;
|
|
12
|
+
sessions: {
|
|
13
|
+
appsrv?: SessionInfo;
|
|
14
|
+
bridge?: SessionInfo;
|
|
15
|
+
tui?: SessionInfo;
|
|
16
|
+
};
|
|
17
|
+
}
|
|
18
|
+
export type RefuseCause = "MISSING" | "SYMLINK" | "NOT_REGULAR" | "WRONG_MODE" | "OWNER_MISMATCH" | "PARSE_ERROR" | "SCHEMA_INVALID" | "STALE_BOOT_ID" | "PLATFORM_UNSUPPORTED";
|
|
19
|
+
export type ReadMarkerResult = {
|
|
20
|
+
kind: "ok";
|
|
21
|
+
marker: CopresenceMarker;
|
|
22
|
+
} | {
|
|
23
|
+
kind: "refuse";
|
|
24
|
+
cause: RefuseCause;
|
|
25
|
+
detail: string;
|
|
26
|
+
};
|
|
27
|
+
export interface ProcStat {
|
|
28
|
+
pgid: number;
|
|
29
|
+
starttime_jiffies: number;
|
|
30
|
+
ppid: number;
|
|
31
|
+
}
|
|
32
|
+
/**
|
|
33
|
+
* Injectable primitive for /proc access. Real impl reads the filesystem;
|
|
34
|
+
* unit tests inject a mock so /proc-based logic is deterministically testable.
|
|
35
|
+
*
|
|
36
|
+
* Contract:
|
|
37
|
+
* - listAllPids: read /proc directory and return numeric-name entries.
|
|
38
|
+
* Throws on unrecoverable errors (permission denied on /proc itself).
|
|
39
|
+
* - readEnviron: read /proc/<pid>/environ as a raw string. Returns null
|
|
40
|
+
* if the pid has vanished (ENOENT) — that's a normal race, not a failure.
|
|
41
|
+
* Throws for permission errors etc.
|
|
42
|
+
* - readStat: read /proc/<pid>/stat and extract (pgid, starttime, ppid).
|
|
43
|
+
* Returns null on ENOENT (pid gone). Throws on other errors.
|
|
44
|
+
*/
|
|
45
|
+
export interface ProcessEnumerator {
|
|
46
|
+
listAllPids(): number[];
|
|
47
|
+
readEnviron(pid: number): string | null;
|
|
48
|
+
readStat(pid: number): ProcStat | null;
|
|
49
|
+
/**
|
|
50
|
+
* REAL uid of the process itself (`Uid:` line of /proc/<pid>/status,
|
|
51
|
+
* field 0). Used by the environ-EACCES discriminator to tell
|
|
52
|
+
* "other-user process (expected EACCES)" from "our own process we could
|
|
53
|
+
* not inspect (must be accounted for)".
|
|
54
|
+
*
|
|
55
|
+
* MUST NOT be implemented as `statSync('/proc/<pid>/environ').uid`.
|
|
56
|
+
* A process that called prctl(PR_SET_DUMPABLE, 0) keeps its real uid but
|
|
57
|
+
* its /proc/<pid>/{environ,mem,...} nodes flip to root:root 0400 (see
|
|
58
|
+
* proc(5) / kernel `task_dump_owner`). Deriving ownership from the
|
|
59
|
+
* environ inode therefore reports uid 0 for our OWN non-dumpable
|
|
60
|
+
* children, which made them invisible to the scan: not in `hits`, not in
|
|
61
|
+
* the unreadable list, so teardown reported success and deleted the
|
|
62
|
+
* marker while the orphan lived on (Defect A).
|
|
63
|
+
*
|
|
64
|
+
* Returns null if the pid is gone (ENOENT) or if even /proc/<pid>/status
|
|
65
|
+
* is blocked (hidepid / LSM) — in that case the process cannot be ours
|
|
66
|
+
* to reason about and is skipped.
|
|
67
|
+
*/
|
|
68
|
+
readOwnerUid(pid: number): number | null;
|
|
69
|
+
/**
|
|
70
|
+
* Single-character process state from /proc/<pid>/status (R/S/D/Z/T/...).
|
|
71
|
+
* `Z` means zombie — mm freed, environ returns EACCES even to owner, but
|
|
72
|
+
* the pid is going away shortly. Skip zombies during environ scan.
|
|
73
|
+
* Returns null if the pid is gone (ENOENT).
|
|
74
|
+
*/
|
|
75
|
+
readState(pid: number): string | null;
|
|
76
|
+
}
|
|
77
|
+
/**
|
|
78
|
+
* Injectable primitive for sending signals. Real impl uses process.kill;
|
|
79
|
+
* tests inject a mock.
|
|
80
|
+
*/
|
|
81
|
+
export interface KillPrimitive {
|
|
82
|
+
killPgroup(pgid: number, signal: "TERM" | "KILL"): void;
|
|
83
|
+
/** Returns true if ANY process in the pgroup is still alive. */
|
|
84
|
+
pgroupAlive(pgid: number): boolean;
|
|
85
|
+
}
|
|
86
|
+
export declare function markerFilePath(nodesDir: string, nodeId: string): string;
|
|
87
|
+
export declare function readBootId(): string;
|
|
88
|
+
/**
|
|
89
|
+
* Write the marker file atomically.
|
|
90
|
+
*
|
|
91
|
+
* IMPORTANT (Blocker 1 fix): the uuid parameter is the SINGLE SOURCE OF
|
|
92
|
+
* TRUTH. Caller is expected to inject this same uuid into every tmux
|
|
93
|
+
* session's ANET_NODE_MARKER env var. writeMarker does NOT generate its
|
|
94
|
+
* own uuid — that was the exact bug in 9f2ec282.
|
|
95
|
+
*/
|
|
96
|
+
export declare function writeMarker(nodesDir: string, nodeId: string, uuid: string, sessions: CopresenceMarker["sessions"]): CopresenceMarker;
|
|
97
|
+
/**
|
|
98
|
+
* Read the marker file with structured fail-closed refuses.
|
|
99
|
+
*
|
|
100
|
+
* Never throws for expected refuse causes. Only throws if the OS itself
|
|
101
|
+
* is broken (e.g. EIO). Malformed JSON, wrong types, null bodies etc.
|
|
102
|
+
* all return { kind: "refuse", cause, detail }.
|
|
103
|
+
*/
|
|
104
|
+
export declare function readMarker(nodesDir: string, nodeId: string): ReadMarkerResult;
|
|
105
|
+
export declare function removeMarker(nodesDir: string, nodeId: string): void;
|
|
106
|
+
export declare function realEnumerator(): ProcessEnumerator;
|
|
107
|
+
export declare function realKiller(): KillPrimitive;
|
|
108
|
+
/**
|
|
109
|
+
* Scan /proc for all pids whose environ contains ANET_NODE_MARKER=<uuid>.
|
|
110
|
+
* This is the authoritative identity source — NOT the marker file's stored
|
|
111
|
+
* pids, which may be stale (main died, workers survived under new pgids).
|
|
112
|
+
*
|
|
113
|
+
* Bytes format of /proc/PID/environ: NUL-separated key=value pairs.
|
|
114
|
+
*
|
|
115
|
+
* Blocker 1 fix (independent audit 92d53c8f, 2026-07-29): /proc/<pid>/environ
|
|
116
|
+
* is 0400 owner-only. Blindly reading it will hit EACCES on every other-user
|
|
117
|
+
* process (pid 1 is systemd/root → guaranteed EACCES). The naive fix — wrap
|
|
118
|
+
* in try/catch and continue — would silently miss marker-carrying processes
|
|
119
|
+
* whose environ we can't read for some other reason, recreating Defect A
|
|
120
|
+
* ("nothing killed but report success"). Right fix:
|
|
121
|
+
*
|
|
122
|
+
* 1. Try readEnviron.
|
|
123
|
+
* 2. On EACCES, discriminate via readOwnerUid + readState:
|
|
124
|
+
* - Owner uid != ours → EXPECTED skip (can't be one of our procs).
|
|
125
|
+
* - Own uid, state = Z → EXPECTED skip (zombie, mm freed).
|
|
126
|
+
* - Own uid, not zombie → FAIL-CLOSED (unexplained EACCES on our own
|
|
127
|
+
* live process is a real problem, must throw).
|
|
128
|
+
*/
|
|
129
|
+
export interface ScanResult {
|
|
130
|
+
/** Pids whose environ we successfully read and matched the marker uuid. */
|
|
131
|
+
hits: number[];
|
|
132
|
+
/**
|
|
133
|
+
* Own-uid, live, environ-unreadable pids that are PLAUSIBLY PART OF THE
|
|
134
|
+
* COPRESENCE TREE (invariant 11 scope test). These might be marker-
|
|
135
|
+
* carrying without us being able to prove it, so the reap flow REFUSES
|
|
136
|
+
* marker removal while this list is non-empty — defense against Defect A
|
|
137
|
+
* (silently missing a marker-carrying process, then deleting the marker
|
|
138
|
+
* as if teardown had succeeded).
|
|
139
|
+
*/
|
|
140
|
+
unreadableOwnUid: number[];
|
|
141
|
+
/**
|
|
142
|
+
* Own-uid, live, environ-unreadable pids that failed the scope test:
|
|
143
|
+
* their pgid belongs to no marker-carrying group and their ppid chain
|
|
144
|
+
* reaches no marker carrier / validated marker-file session pid.
|
|
145
|
+
*
|
|
146
|
+
* INFORMATIONAL ONLY — never fail-closed. A machine routinely has such
|
|
147
|
+
* processes (a same-uid process whose primary GID differs from ours fails
|
|
148
|
+
* the kernel's __ptrace_may_access gid check and EACCESes on environ even
|
|
149
|
+
* though its real uid matches). v2 lumped these into unreadableOwnUid,
|
|
150
|
+
* which made reapMarkerGroups structurally unable to return success on
|
|
151
|
+
* any such host.
|
|
152
|
+
*
|
|
153
|
+
* KNOWN RESIDUAL GAP (stated rather than papered over): a marker-carrying
|
|
154
|
+
* process that is BOTH non-dumpable (environ unreadable) AND fully
|
|
155
|
+
* detached (setsid'd into its own pgroup with ppid=1, no live recorded
|
|
156
|
+
* session pid above it) lands here and is therefore not reaped and does
|
|
157
|
+
* not block marker removal. Nothing in /proc exposes the environment of a
|
|
158
|
+
* non-dumpable task to a non-root reader, so no scope widening can
|
|
159
|
+
* recover it — only running teardown as root could. Widening scope to
|
|
160
|
+
* "every same-uid unreadable process" is NOT an acceptable trade: that is
|
|
161
|
+
* exactly the v2 behaviour that made teardown never succeed. The
|
|
162
|
+
* realistic copresence shape (child of a recorded pane pid, or sharing a
|
|
163
|
+
* marker carrier's pgroup) IS covered — see the real-/proc test.
|
|
164
|
+
*/
|
|
165
|
+
unreadableOutOfScope: number[];
|
|
166
|
+
}
|
|
167
|
+
/**
|
|
168
|
+
* Marker-file session records used to anchor the invariant-11 scope test.
|
|
169
|
+
* Each entry must be re-validated (pid alive AND same starttime) before it
|
|
170
|
+
* is trusted — see validateAnchors.
|
|
171
|
+
*/
|
|
172
|
+
export interface ScanAnchors {
|
|
173
|
+
sessions?: Array<{
|
|
174
|
+
pid: number;
|
|
175
|
+
starttime_jiffies: number;
|
|
176
|
+
}>;
|
|
177
|
+
}
|
|
178
|
+
export declare function anchorsFromMarker(marker: CopresenceMarker): ScanAnchors;
|
|
179
|
+
/**
|
|
180
|
+
* Invariant 11 scope test: is `pid` plausibly part of the copresence tree?
|
|
181
|
+
*
|
|
182
|
+
* True when the pid IS an anchor, when its pgid belongs to a marker-carrying
|
|
183
|
+
* group (or a validated anchor's group), or when walking its ppid chain
|
|
184
|
+
* reaches an anchor / marker carrier / a pid inside a relevant pgroup.
|
|
185
|
+
*
|
|
186
|
+
* Everything else is out of scope and must not participate in a fail-closed
|
|
187
|
+
* decision, no matter how unreadable it is.
|
|
188
|
+
*/
|
|
189
|
+
export declare function isInCopresenceScope(enumer: ProcessEnumerator, pid: number, relevantPids: Set<number>, relevantPgids: Set<number>): boolean;
|
|
190
|
+
export declare function scanEnvironForMarker(enumer: ProcessEnumerator, markerUuid: string): number[];
|
|
191
|
+
export declare function scanEnvironForMarkerFull(enumer: ProcessEnumerator, markerUuid: string, anchors?: ScanAnchors): ScanResult;
|
|
192
|
+
export declare function groupPidsByPgid(enumer: ProcessEnumerator, pids: number[]): Map<number, number[]>;
|
|
193
|
+
export type HomogeneityResult = {
|
|
194
|
+
ok: true;
|
|
195
|
+
members: number[];
|
|
196
|
+
} | {
|
|
197
|
+
ok: false;
|
|
198
|
+
cause: "FOREIGN_MEMBER" | "ENUM_ERROR" | "EMPTY_GROUP";
|
|
199
|
+
foreignPids: number[];
|
|
200
|
+
unreadablePids: number[];
|
|
201
|
+
detail: string;
|
|
202
|
+
};
|
|
203
|
+
/**
|
|
204
|
+
* Verify that EVERY live member of `pgid` carries the marker.
|
|
205
|
+
*
|
|
206
|
+
* Blocker 2 fix: enumeration errors surface as ENUM_ERROR (fail-closed),
|
|
207
|
+
* never as an empty-list judged "safe". Any unreadable member also
|
|
208
|
+
* fails-closed. Empty group (no live members at all) also refuses — killing
|
|
209
|
+
* an empty pgroup can't be right and empty-list judged "ok" recreates the
|
|
210
|
+
* exact defect shape (independent audit 92d53c8f finding #6).
|
|
211
|
+
*
|
|
212
|
+
* Blocker 2 second half (zombie): a zombie same-uid process's environ
|
|
213
|
+
* returns EACCES even to owner (mm freed), but stat still exists with
|
|
214
|
+
* original pgid. Without discrimination, the zombie would be treated as
|
|
215
|
+
* "unreadable member" → ENUM_ERROR → entire group SKIPPED. Since re-verify
|
|
216
|
+
* happens post-SIGTERM (when zombies are most numerous), teardown would
|
|
217
|
+
* never escalate. Fix: apply the same owner-uid + state=Z discriminator as
|
|
218
|
+
* scanEnvironForMarker.
|
|
219
|
+
*
|
|
220
|
+
* Algorithm:
|
|
221
|
+
* 1. Enumerate all pids on the system.
|
|
222
|
+
* 2. Filter to pids whose /proc/PID/stat pgid == target pgid.
|
|
223
|
+
* 3. For each such pid, check its environ with EACCES discrimination:
|
|
224
|
+
* - Other-user EACCES → skip (can't be ours anyway).
|
|
225
|
+
* - Own-uid zombie → skip (expected, dying).
|
|
226
|
+
* - Own-uid live EACCES → truly unreadable → fail-closed.
|
|
227
|
+
* - Missing marker → foreign member → fail-closed.
|
|
228
|
+
*/
|
|
229
|
+
export declare function verifyGroupHomogeneity(enumer: ProcessEnumerator, pgid: number, markerUuid: string): HomogeneityResult;
|
|
230
|
+
/**
|
|
231
|
+
* Walk the caller's ancestry (self → PPID → grandparent → ...) and check
|
|
232
|
+
* whether any ancestor carries the target marker. If yes → caller is
|
|
233
|
+
* running inside the copresence tree we're about to kill, and would take
|
|
234
|
+
* itself down.
|
|
235
|
+
*/
|
|
236
|
+
export declare function callerCarriesMarker(enumer: ProcessEnumerator, markerUuid: string): {
|
|
237
|
+
self: boolean;
|
|
238
|
+
ancestorPid?: number;
|
|
239
|
+
};
|
|
240
|
+
export type ReapResult = {
|
|
241
|
+
kind: "success";
|
|
242
|
+
killedPgids: number[];
|
|
243
|
+
residualPids: number[];
|
|
244
|
+
unreadableOwnUid?: number[];
|
|
245
|
+
} | {
|
|
246
|
+
kind: "failed";
|
|
247
|
+
killedPgids: number[];
|
|
248
|
+
residualPids: number[];
|
|
249
|
+
skippedGroups: Array<{
|
|
250
|
+
pgid: number;
|
|
251
|
+
reason: string;
|
|
252
|
+
}>;
|
|
253
|
+
detail: string;
|
|
254
|
+
unreadableOwnUid?: number[];
|
|
255
|
+
};
|
|
256
|
+
export interface ReapOptions {
|
|
257
|
+
graceMs: number;
|
|
258
|
+
logger: (msg: string) => void;
|
|
259
|
+
/**
|
|
260
|
+
* Sleep primitive (grace period). Real code uses setTimeout; tests inject
|
|
261
|
+
* a fast/deterministic sleep so grace paths are actually covered. Prior
|
|
262
|
+
* impl was a busy-wait `while (Date.now() < end) {}` — audit 92d53c8f
|
|
263
|
+
* finding #3 flagged that as pinning one CPU core for graceMs and blocking
|
|
264
|
+
* the event loop; test coverage missed it because tests passed graceMs=0.
|
|
265
|
+
*/
|
|
266
|
+
sleep?: (ms: number) => Promise<void>;
|
|
267
|
+
/**
|
|
268
|
+
* Invariant-11 scope anchors, normally `anchorsFromMarker(marker)`.
|
|
269
|
+
*
|
|
270
|
+
* Without them the only anchors are the marker carriers the scan itself
|
|
271
|
+
* found, so a marker-carrying process we cannot READ (non-dumpable) but
|
|
272
|
+
* whose parent IS a recorded session pid would be judged out of scope and
|
|
273
|
+
* silently dropped. Passing the marker's recorded session pids closes that
|
|
274
|
+
* hole; each one is re-validated (alive + same starttime) before it can
|
|
275
|
+
* widen scope, so a stale/recycled pid cannot.
|
|
276
|
+
*/
|
|
277
|
+
anchors?: ScanAnchors;
|
|
278
|
+
}
|
|
279
|
+
/**
|
|
280
|
+
* Full reap flow with TOCTOU re-verification.
|
|
281
|
+
*
|
|
282
|
+
* Sequence:
|
|
283
|
+
* 1. Environ scan for marker → get all live pids carrying it.
|
|
284
|
+
* 2. Group by current PGID.
|
|
285
|
+
* 3. For each group: verify homogeneity. Skip on foreign/unreadable.
|
|
286
|
+
* 4. For each verified group: send SIGTERM to pgroup.
|
|
287
|
+
* 5. Wait grace.
|
|
288
|
+
* 6. Re-verify each group (marker still there, no new foreign) before SIGKILL.
|
|
289
|
+
* 7. Send SIGKILL to any group still alive.
|
|
290
|
+
* 8. Post-rescan: if any marker-carrying pid alive → preserve marker.
|
|
291
|
+
*/
|
|
292
|
+
export declare function reapMarkerGroups(enumer: ProcessEnumerator, killer: KillPrimitive, markerUuid: string, opts: ReapOptions): Promise<ReapResult>;
|
|
293
|
+
export interface PrepareStartDeps {
|
|
294
|
+
/** Usually () => readMarker(nodesDir, nodeId). */
|
|
295
|
+
readMarker(): ReadMarkerResult;
|
|
296
|
+
/** Usually (uuid, anchors) => reapMarkerGroups(realEnumerator(), realKiller(), uuid, {...anchors}). */
|
|
297
|
+
reap(uuid: string, anchors: ScanAnchors): Promise<ReapResult>;
|
|
298
|
+
/** Usually () => removeMarker(nodesDir, nodeId). */
|
|
299
|
+
removeMarker(): void;
|
|
300
|
+
/** Usually (uuid, sessions) => writeMarker(nodesDir, nodeId, uuid, sessions). */
|
|
301
|
+
writeMarker(uuid: string, sessions: CopresenceMarker["sessions"]): void;
|
|
302
|
+
logger(msg: string): void;
|
|
303
|
+
}
|
|
304
|
+
export type PrepareStartResult = {
|
|
305
|
+
kind: "ok";
|
|
306
|
+
reclaimedUuid?: string;
|
|
307
|
+
} | {
|
|
308
|
+
kind: "blocked";
|
|
309
|
+
cause: "STALE_TREE_ALIVE" | "UNUSABLE_MARKER";
|
|
310
|
+
detail: string;
|
|
311
|
+
remedy: string;
|
|
312
|
+
};
|
|
313
|
+
/**
|
|
314
|
+
* Everything that must happen BEFORE the first `tmux new-session` of a
|
|
315
|
+
* copresence start. Extracted out of cli.ts so both blockers below are
|
|
316
|
+
* actually reachable by tests — the audit's point that the two fatal
|
|
317
|
+
* defects of the previous rounds both lived in an untested cli.ts seam.
|
|
318
|
+
*
|
|
319
|
+
* Blocker 5 — marker-before-tmux ordering.
|
|
320
|
+
* v2 wrote the marker only after the app-server had bound its port, i.e.
|
|
321
|
+
* after a 25s wait and after several `process.exit(1)` paths. A start that
|
|
322
|
+
* died in that window left a live, marker-carrying tmux session behind
|
|
323
|
+
* with NO marker file on disk: the exact unreclaimable-ghost this feature
|
|
324
|
+
* exists to prevent. The marker is now written here, before any session is
|
|
325
|
+
* created, with an empty `sessions` object — reap identity has always been
|
|
326
|
+
* the environ uuid, never the recorded pids, so an empty sessions object
|
|
327
|
+
* loses nothing but observability hints (which the start path fills in
|
|
328
|
+
* later, best-effort).
|
|
329
|
+
*
|
|
330
|
+
* Blocker 6 — never overwrite a preserved marker.
|
|
331
|
+
* A failed stop deliberately PRESERVES the marker so the next stop can
|
|
332
|
+
* retry idempotently. v2's start then overwrote it with a fresh uuid while
|
|
333
|
+
* only killing tmux sessions BY NAME, so the still-running subprocesses of
|
|
334
|
+
* the previous instance became permanently unreclaimable: their uuid was
|
|
335
|
+
* gone from disk forever. Now the old identity is reaped FIRST; if that
|
|
336
|
+
* reap does not fully succeed we refuse to start rather than destroy the
|
|
337
|
+
* only handle on those processes.
|
|
338
|
+
*/
|
|
339
|
+
export declare function prepareIdentityForStart(newUuid: string, deps: PrepareStartDeps): Promise<PrepareStartResult>;
|