amalgm 0.1.238 → 0.1.240

package/runtime/scripts/amalgm-mcp/workspace/native-file-transaction/manifest.json

@@ -0,0 +1,19 @@
+{
+  "contract": "amalgm-native-file-transaction-build@1",
+  "sourceSha256": "728af934075f99e5d102edb375e0f4d1ea7fcae3e35751125d9e4fb9ec0b95f7",
+  "sources": [
+    "go.mod",
+    "go.sum",
+    "main.go",
+    "move_darwin.go",
+    "move_linux.go",
+    "process_darwin.go",
+    "process_linux.go",
+    "writers_darwin.go",
+    "writers_linux.go"
+  ],
+  "binaries": {
+    "darwin-arm64": "5bcef1a258b8988a56bfbe57acf3d1df4f94351d9e5e693670b47b101bd2367a",
+    "linux-x64": "b559ae0ac5668f075720cc1e26239c5a0bc47599ba09d91f1c14918ac60206e7"
+  }
+}

package/runtime/scripts/amalgm-mcp/workspace/native-file-transaction/move_darwin.go

@@ -0,0 +1,18 @@
+//go:build darwin
+
+package main
+
+import "golang.org/x/sys/unix"
+
+// moveNoReplace consumes the prepared transaction artifact only when the
+// destination is still absent. The artifact's disappearance is therefore
+// the operation-owned receipt that installation crossed.
+func moveNoReplace(fromFD int, from string, toFD int, to string) error {
+	return unix.RenameatxNp(fromFD, from, toFD, to, unix.RENAME_EXCL)
+}
+
+// exchangeEntries atomically replaces a shared namespace with its guard
+// marker while retaining the original namespace at the prepared path.
+func exchangeEntries(leftFD int, left string, rightFD int, right string) error {
+	return unix.RenameatxNp(leftFD, left, rightFD, right, unix.RENAME_SWAP)
+}

package/runtime/scripts/amalgm-mcp/workspace/native-file-transaction/move_linux.go

@@ -0,0 +1,18 @@
+//go:build linux
+
+package main
+
+import "golang.org/x/sys/unix"
+
+// moveNoReplace consumes the prepared transaction artifact only when the
+// destination is still absent. The artifact's disappearance is therefore
+// the operation-owned receipt that installation crossed.
+func moveNoReplace(fromFD int, from string, toFD int, to string) error {
+	return unix.Renameat2(fromFD, from, toFD, to, unix.RENAME_NOREPLACE)
+}
+
+// exchangeEntries atomically replaces a shared namespace with its guard
+// marker while retaining the original namespace at the prepared path.
+func exchangeEntries(leftFD int, left string, rightFD int, right string) error {
+	return unix.Renameat2(leftFD, left, rightFD, right, unix.RENAME_EXCHANGE)
+}

package/runtime/scripts/amalgm-mcp/workspace/native-file-transaction/process_darwin.go

@@ -0,0 +1,33 @@
+//go:build darwin
+
+package main
+
+import (
+	"errors"
+	"fmt"
+
+	"golang.org/x/sys/unix"
+)
+
+const darwinZombieState = int8(5)
+
+func processIdentity(pid int) (string, bool, error) {
+	if err := unix.Kill(pid, 0); err != nil && errors.Is(err, unix.ESRCH) {
+		return "", false, nil
+	}
+	info, err := unix.SysctlKinfoProc("kern.proc.pid", pid)
+	if err != nil {
+		if errors.Is(err, unix.ESRCH) || errors.Is(err, unix.ENOENT) {
+			return "", false, nil
+		}
+		return "", false, err
+	}
+	if int(info.Proc.P_pid) != pid {
+		return "", false, nil
+	}
+	if info.Proc.P_stat == darwinZombieState {
+		return "", false, nil
+	}
+	started := info.Proc.P_starttime
+	return fmt.Sprintf("%d:%d:%d", pid, started.Sec, started.Usec), true, nil
+}

package/runtime/scripts/amalgm-mcp/workspace/native-file-transaction/process_linux.go

@@ -0,0 +1,47 @@
+//go:build linux
+
+package main
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+)
+
+func processIdentity(pid int) (string, bool, error) {
+	bootID, err := os.ReadFile("/proc/sys/kernel/random/boot_id")
+	if err != nil {
+		return "", false, err
+	}
+	boot := strings.TrimSpace(string(bootID))
+	if boot == "" {
+		return "", false, fmt.Errorf("Linux boot identity is empty")
+	}
+	content, err := os.ReadFile(fmt.Sprintf("/proc/%d/stat", pid))
+	if err != nil {
+		if os.IsNotExist(err) {
+			return "", false, nil
+		}
+		return "", false, err
+	}
+	closing := strings.LastIndexByte(string(content), ')')
+	if closing < 0 || closing+2 >= len(content) {
+		return "", false, errorsNewProcessStat(pid)
+	}
+	fields := strings.Fields(string(content[closing+2:]))
+	if len(fields) <= 19 {
+		return "", false, errorsNewProcessStat(pid)
+	}
+	if fields[0] == "Z" || fields[0] == "X" || fields[0] == "x" {
+		return "", false, nil
+	}
+	if _, err := strconv.ParseUint(fields[19], 10, 64); err != nil {
+		return "", false, errorsNewProcessStat(pid)
+	}
+	return fmt.Sprintf("%s:%d:%s", boot, pid, fields[19]), true, nil
+}
+
+func errorsNewProcessStat(pid int) error {
+	return fmt.Errorf("process %d has an invalid stat identity", pid)
+}

package/runtime/scripts/amalgm-mcp/workspace/native-file-transaction/verify.mjs

@@ -0,0 +1,43 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.dirname(fileURLToPath(import.meta.url));
+const manifest = JSON.parse(fs.readFileSync(path.join(root, 'manifest.json'), 'utf8'));
+if (manifest.contract !== 'amalgm-native-file-transaction-build@1') {
+  throw new Error('native file transaction manifest contract is invalid');
+}
+
+function digestFiles(names) {
+  const hash = crypto.createHash('sha256');
+  for (const name of names) {
+    hash.update(name);
+    hash.update('\0');
+    hash.update(fs.readFileSync(path.join(root, name)));
+    hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+
+const sourceDigest = digestFiles(manifest.sources);
+if (sourceDigest !== manifest.sourceSha256) {
+  throw new Error(
+    `native file transaction source is ${sourceDigest}, expected ${manifest.sourceSha256}`,
+  );
+}
+for (const [platform, expected] of Object.entries(manifest.binaries)) {
+  const binary = path.join(root, 'bin', platform, 'amalgm-file-transaction');
+  const actual = crypto.createHash('sha256').update(fs.readFileSync(binary)).digest('hex');
+  if (actual !== expected) {
+    throw new Error(`native file transaction ${platform} is ${actual}, expected ${expected}`);
+  }
+  if ((fs.statSync(binary).mode & 0o111) === 0) {
+    throw new Error(`native file transaction ${platform} is not executable`);
+  }
+}
+
+console.log(
+  `[native-file-transaction] verified source ${manifest.sourceSha256} `
+  + `and ${Object.keys(manifest.binaries).length} binaries`,
+);

package/runtime/scripts/amalgm-mcp/workspace/native-file-transaction/writers_darwin.go

@@ -0,0 +1,114 @@
+//go:build darwin
+
+package main
+
+/*
+#cgo LDFLAGS: -lproc
+
+#include <errno.h>
+#include <libproc.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <sys/fcntl.h>
+#include <sys/proc_info.h>
+
+static int amalgm_has_writable_vnode(uint64_t device, uint64_t inode) {
+	int pid_bytes = proc_listpids(PROC_ALL_PIDS, 0, NULL, 0);
+	if (pid_bytes <= 0) {
+		return -1;
+	}
+	pid_bytes *= 2;
+	pid_t *pids = (pid_t *)calloc(1, (size_t)pid_bytes);
+	if (pids == NULL) {
+		return -1;
+	}
+	int listed_pid_bytes = proc_listpids(PROC_ALL_PIDS, 0, pids, pid_bytes);
+	if (listed_pid_bytes < 0) {
+		free(pids);
+		return -1;
+	}
+	int pid_count = listed_pid_bytes / (int)sizeof(pid_t);
+	for (int pid_index = 0; pid_index < pid_count; pid_index++) {
+		pid_t pid = pids[pid_index];
+		if (pid <= 0) {
+			continue;
+		}
+		int fd_bytes = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, NULL, 0);
+		if (fd_bytes <= 0) {
+			continue;
+		}
+		fd_bytes *= 2;
+		struct proc_fdinfo *fds = (struct proc_fdinfo *)calloc(1, (size_t)fd_bytes);
+		if (fds == NULL) {
+			free(pids);
+			return -1;
+		}
+		int listed_fd_bytes = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, fds, fd_bytes);
+		if (listed_fd_bytes <= 0) {
+			free(fds);
+			continue;
+		}
+		int fd_count = listed_fd_bytes / PROC_PIDLISTFD_SIZE;
+		for (int fd_index = 0; fd_index < fd_count; fd_index++) {
+			if (fds[fd_index].proc_fdtype != PROX_FDTYPE_VNODE) {
+				continue;
+			}
+			struct vnode_fdinfo info;
+			int info_bytes = proc_pidfdinfo(
+				pid,
+				fds[fd_index].proc_fd,
+				PROC_PIDFDVNODEINFO,
+				&info,
+				PROC_PIDFDVNODEINFO_SIZE
+			);
+			if (info_bytes != PROC_PIDFDVNODEINFO_SIZE) {
+				continue;
+			}
+			struct vinfo_stat stat = info.pvi.vi_stat;
+			if (
+				(uint64_t)stat.vst_dev == device
+				&& stat.vst_ino == inode
+				&& (info.pfi.fi_openflags & FWRITE) != 0
+			) {
+				free(fds);
+				free(pids);
+				return 1;
+			}
+		}
+		free(fds);
+	}
+	free(pids);
+	return 0;
+}
+*/
+import "C"
+
+import (
+	"errors"
+
+	"golang.org/x/sys/unix"
+)
+
+// The source pathname has already been removed, so only a descriptor opened
+// before extraction can still mutate its inode. Two complete libproc scans
+// avoid process-spawn cost and require two independently empty observations
+// before the old inode can be retired.
+func hasWritableOpen(dirFD int, name, _ string) (bool, error) {
+	var source unix.Stat_t
+	if err := unix.Fstatat(dirFD, name, &source, unix.AT_SYMLINK_NOFOLLOW); err != nil {
+		return false, err
+	}
+	for pass := 0; pass < 2; pass++ {
+		result := int(C.amalgm_has_writable_vnode(
+			C.uint64_t(uint64(source.Dev)),
+			C.uint64_t(uint64(source.Ino)),
+		))
+		if result < 0 {
+			return false, errors.New("libproc could not enumerate writable vnode owners")
+		}
+		if result > 0 {
+			return true, nil
+		}
+	}
+	return false, nil
+}

package/runtime/scripts/amalgm-mcp/workspace/native-file-transaction/writers_linux.go

@@ -0,0 +1,84 @@
+//go:build linux
+
+package main
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"golang.org/x/sys/unix"
+)
+
+// A successful kernel write lease proves that no other process has the inode
+// open. If the filesystem cannot grant leases, /proc supplies a conservative
+// fallback that treats every writable descriptor as ownership.
+func hasWritableOpen(dirFD int, name, _ string) (bool, error) {
+	fd, err := unix.Openat(dirFD, name, unix.O_RDWR|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+	if err == nil {
+		if _, leaseErr := unix.FcntlInt(uintptr(fd), unix.F_SETLEASE, unix.F_WRLCK); leaseErr == nil {
+			_, _ = unix.FcntlInt(uintptr(fd), unix.F_SETLEASE, unix.F_UNLCK)
+			_ = unix.Close(fd)
+			return false, nil
+		}
+		_ = unix.Close(fd)
+	}
+
+	var source unix.Stat_t
+	if err := unix.Fstatat(dirFD, name, &source, unix.AT_SYMLINK_NOFOLLOW); err != nil {
+		return false, err
+	}
+	processes, err := os.ReadDir("/proc")
+	if err != nil {
+		return false, fmt.Errorf("read /proc: %w", err)
+	}
+	for _, process := range processes {
+		if !process.IsDir() {
+			continue
+		}
+		if _, ok := parseFD(process.Name()); !ok {
+			continue
+		}
+		fdDirectory := filepath.Join("/proc", process.Name(), "fd")
+		descriptors, readErr := os.ReadDir(fdDirectory)
+		if readErr != nil {
+			if errors.Is(readErr, os.ErrPermission) || errors.Is(readErr, os.ErrNotExist) {
+				continue
+			}
+			return false, readErr
+		}
+		for _, descriptor := range descriptors {
+			fdNumber, ok := parseFD(descriptor.Name())
+			if !ok {
+				continue
+			}
+			var held unix.Stat_t
+			fdPath := filepath.Join(fdDirectory, descriptor.Name())
+			if err := unix.Stat(fdPath, &held); err != nil {
+				continue
+			}
+			if uint64(held.Dev) != uint64(source.Dev) || uint64(held.Ino) != uint64(source.Ino) {
+				continue
+			}
+			info, readErr := os.ReadFile(
+				filepath.Join("/proc", process.Name(), "fdinfo", strconv.Itoa(fdNumber)),
+			)
+			if readErr != nil {
+				continue
+			}
+			for _, line := range strings.Split(string(info), "\n") {
+				if !strings.HasPrefix(line, "flags:") {
+					continue
+				}
+				flags, parseErr := strconv.ParseUint(strings.TrimSpace(strings.TrimPrefix(line, "flags:")), 8, 64)
+				if parseErr == nil && int(flags)&unix.O_ACCMODE != unix.O_RDONLY {
+					return true, nil
+				}
+			}
+		}
+	}
+	return false, nil
+}