failproofai 1.0.0-beta.2 → 1.0.0-beta.21

package/.next/standalone/crates/failproofaid/src/worker.rs

@@ -1,400 +0,0 @@
-//! Spawns and supervises the warm Node/Bun worker process, and relays
-//! `Hook` requests to it.
-//!
-//! The worker speaks a SEPARATE, simpler internal protocol on its own
-//! socket (no `protocolVersion` — this process always spawns a
-//! version-matched worker, so there's nothing to negotiate) — this module
-//! is the only thing that talks to it, and it's the one place that
-//! translates between that internal protocol and the client-facing
-//! [`fpai_ipc::ServerMessage`] envelope (which DOES carry `protocolVersion`,
-//! since that one crosses a real compatibility boundary against whatever
-//! `failproofai` CLI version happens to be installed).
-
-use fpai_ipc::framing::{read_message, write_message};
-use serde_json::json;
-use std::io;
-use std::os::unix::net::UnixStream;
-use std::os::unix::process::CommandExt;
-use std::path::{Path, PathBuf};
-use std::process::{Child, Command, Stdio};
-use std::sync::Mutex;
-use std::time::{Duration, Instant};
-
-#[derive(Debug)]
-pub enum WorkerError {
-    Io(io::Error),
-    /// The worker never created its socket within the startup deadline.
-    StartupTimedOut,
-    /// A response arrived but wasn't a well-formed hookResult/error.
-    BadResponse(String),
-}
-
-impl std::fmt::Display for WorkerError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            WorkerError::Io(e) => write!(f, "worker io error: {e}"),
-            WorkerError::StartupTimedOut => write!(f, "worker did not start in time"),
-            WorkerError::BadResponse(s) => write!(f, "unexpected worker response: {s}"),
-        }
-    }
-}
-
-impl std::error::Error for WorkerError {}
-
-#[derive(Debug)]
-pub struct HookOutcome {
-    pub exit_code: i32,
-    pub stdout: String,
-    pub stderr: String,
-}
-
-/// How to launch the worker process. `FAILPROOFAI_WORKER_CMD` (dev/test
-/// override — a full shell command string, run via `sh -c`) always takes
-/// precedence; otherwise falls back to `node <script>` for a production
-/// install where `dist/worker.mjs` sits next to this binary.
-///
-/// Resolved explicitly by the caller (`from_env`, called once from
-/// `main.rs`) rather than read from the environment inside `Worker` itself
-/// — `std::env::var` is process-global, and Rust's test harness runs tests
-/// in parallel by default, so multiple tests setting
-/// `FAILPROOFAI_WORKER_CMD` to different values would race. Tests instead
-/// construct a `WorkerCommand` directly via `shell`/`node`.
-pub enum WorkerCommand {
-    Shell(String),
-    Node { script: PathBuf },
-}
-
-impl WorkerCommand {
-    pub fn from_env() -> Self {
-        if let Ok(cmd) = std::env::var("FAILPROOFAI_WORKER_CMD") {
-            return WorkerCommand::shell(cmd);
-        }
-        // Packaging (Stage 5) lands dist/worker.mjs; until then this is only
-        // reachable via the explicit override above in dev/test.
-        WorkerCommand::Node {
-            script: PathBuf::from("dist/worker.mjs"),
-        }
-    }
-
-    pub fn shell(cmd: impl Into<String>) -> Self {
-        WorkerCommand::Shell(cmd.into())
-    }
-
-    fn spawn(&self, worker_socket: &Path) -> io::Result<Child> {
-        let mut command = match self {
-            WorkerCommand::Shell(shell_cmd) => {
-                let mut c = Command::new("sh");
-                c.arg("-c").arg(shell_cmd);
-                c
-            }
-            WorkerCommand::Node { script } => {
-                let mut c = Command::new("node");
-                c.arg(script);
-                c
-            }
-        };
-        command
-            .env("FAILPROOFAI_WORKER_SOCKET", worker_socket)
-            .stdin(Stdio::null())
-            // Piped, not inherited: an inherited stdout/stderr hands the
-            // worker its own copy of this process's fds, and if this
-            // process's own stdout is itself part of a pipeline (a test
-            // harness, `cargo test | tail`, a shell capturing output), that
-            // pipe never sees EOF as long as the worker — however it exits
-            // — still holds a copy open. Piped fds belong to this process
-            // alone and close cleanly when the worker does. Both pipes are
-            // drained below: the worker outlives the daemon's whole
-            // lifetime running real policy code, so any `console.log` from
-            // a user's custom policy accumulates, and an undrained pipe
-            // would eventually fill its OS buffer and block the worker
-            // mid-write — every later hook call would then fail closed
-            // until the daemon restarted.
-            .stdout(Stdio::piped())
-            .stderr(Stdio::piped())
-            // New session + process group leader: `sh -c "<cmd>"` is not
-            // guaranteed to exec(2) into `<cmd>` in place (some shells fork
-            // instead), so killing only the tracked PID can leave a real
-            // grandchild worker process running, reparented and orphaned.
-            // Killing the whole group (see `kill_process_group`) reaches it
-            // either way.
-            .process_group(0);
-        let mut child = command.spawn()?;
-        if let Some(out) = child.stdout.take() {
-            std::thread::spawn(move || forward_worker_output("stdout", out));
-        }
-        if let Some(err) = child.stderr.take() {
-            std::thread::spawn(move || forward_worker_output("stderr", err));
-        }
-        Ok(child)
-    }
-}
-
-/// Drains one of the worker's output pipes for its whole life, relaying it
-/// to the daemon's own stderr (which systemd/launchd already capture into
-/// the service log). Ends on EOF when the worker exits.
-fn forward_worker_output(label: &'static str, pipe: impl io::Read) {
-    use std::io::BufRead;
-    for line in io::BufReader::new(pipe).lines().map_while(Result::ok) {
-        eprintln!("[failproofaid] worker {label}: {line}");
-    }
-}
-
-/// Kills the entire process group `child` leads (see `.process_group(0)` in
-/// `WorkerCommand::spawn`), not just the single tracked PID — reaches a
-/// `sh -c "<cmd>"` grandchild even when `sh` forked rather than exec'd.
-fn kill_process_group(child: &mut Child) {
-    let pgid = child.id() as libc::pid_t;
-    unsafe {
-        libc::kill(-pgid, libc::SIGKILL);
-    }
-    let _ = child.wait();
-}
-
-pub struct Worker {
-    socket_path: PathBuf,
-    cmd: WorkerCommand,
-    child: Mutex<Option<Child>>,
-}
-
-impl Worker {
-    pub fn new(socket_path: PathBuf, cmd: WorkerCommand) -> Self {
-        Worker {
-            socket_path,
-            cmd,
-            child: Mutex::new(None),
-        }
-    }
-
-    /// Spawns the worker if it isn't already running (or has died since the
-    /// last check), then waits for it to actually accept connections —
-    /// failing fast (rather than waiting out the full startup deadline) if
-    /// the process exits before ever getting there, e.g. a broken
-    /// FAILPROOFAI_WORKER_CMD.
-    ///
-    /// Readiness is a real `connect()`, not `socket_path.exists()`: a Unix
-    /// socket file outlives the process that bound it, so a dead worker
-    /// always leaves one behind. `exists()` would see the *previous*
-    /// worker's leftover file the instant this one is spawned, break out of
-    /// the wait immediately, and hand `call()` a socket nothing is
-    /// listening on — `ECONNREFUSED` on every request until the daemon
-    /// restarted, which is exactly the crash-recovery path this loop is
-    /// here to provide. The stale file is removed first for the same
-    /// reason.
-    fn ensure_started(&self) -> Result<(), WorkerError> {
-        let mut guard = self.child.lock().unwrap();
-        let needs_spawn = match guard.as_mut() {
-            Some(child) => !matches!(child.try_wait(), Ok(None)), // Ok(None) == still running
-            None => true,
-        };
-        if needs_spawn {
-            let _ = std::fs::remove_file(&self.socket_path);
-            let mut child = self.cmd.spawn(&self.socket_path).map_err(WorkerError::Io)?;
-            let deadline = Instant::now() + Duration::from_secs(5);
-            loop {
-                if UnixStream::connect(&self.socket_path).is_ok() {
-                    break;
-                }
-                if let Ok(Some(status)) = child.try_wait() {
-                    return Err(WorkerError::Io(io::Error::other(format!(
-                        "worker process exited before creating its socket (status: {status})"
-                    ))));
-                }
-                if Instant::now() >= deadline {
-                    kill_process_group(&mut child);
-                    let _ = std::fs::remove_file(&self.socket_path);
-                    return Err(WorkerError::StartupTimedOut);
-                }
-                std::thread::sleep(Duration::from_millis(20));
-            }
-            *guard = Some(child);
-        }
-        Ok(())
-    }
-
-    /// Spawns the worker eagerly and blocks until it's ready, without
-    /// running a hook through it. Called once from `main.rs` right after
-    /// startup so the worker's ~hundreds-of-ms cold start (process spawn +
-    /// module load) happens before any real request arrives, not on the
-    /// critical path of the first one. The client's fail-closed budget
-    /// (`DAEMON_ATTEMPT_TIMEOUT_MS` in `daemon-client.ts`) is deliberately
-    /// tight for a *healthy warm* daemon and is not meant to also cover a
-    /// cold worker spawn — without this, the very first hook call after
-    /// every daemon (re)start would fail closed even though the daemon
-    /// itself is up, which defeats the point of keeping evaluation warm.
-    /// Errors are logged, not propagated: a failed warm-up isn't fatal to
-    /// the daemon itself, since `call()` retries `ensure_started` on the
-    /// next real request anyway.
-    pub fn warm(&self) {
-        if let Err(err) = self.ensure_started() {
-            eprintln!("[failproofaid] worker warm-up failed (will retry on first request): {err}");
-        }
-    }
-
-    /// Relays one hook evaluation to the worker and returns its verdict.
-    /// `ensure_started` is called first so a worker that crashed since the
-    /// last request gets one restart attempt before this request fails —
-    /// but a request already in flight is never retried mid-call; a
-    /// failure here surfaces as `WorkerError` and the caller (server.rs)
-    /// turns that into a client-facing `Error` response.
-    pub fn call(
-        &self,
-        hook_event: &str,
-        cli: &str,
-        stdin: &str,
-        cwd: Option<&str>,
-    ) -> Result<HookOutcome, WorkerError> {
-        self.ensure_started()?;
-
-        let mut stream = UnixStream::connect(&self.socket_path).map_err(WorkerError::Io)?;
-        stream
-            .set_read_timeout(Some(Duration::from_secs(30)))
-            .map_err(WorkerError::Io)?;
-
-        let request = json!({
-            "type": "hook",
-            "hookEvent": hook_event,
-            "cli": cli,
-            "stdin": stdin,
-            "cwd": cwd,
-        });
-        write_message(&mut stream, &request).map_err(|e| WorkerError::Io(io::Error::other(e)))?;
-
-        let response: serde_json::Value =
-            read_message(&mut stream).map_err(|e| WorkerError::Io(io::Error::other(e)))?;
-
-        match response.get("type").and_then(|t| t.as_str()) {
-            Some("hookResult") => {
-                let exit_code = response
-                    .get("exitCode")
-                    .and_then(|v| v.as_i64())
-                    .ok_or_else(|| WorkerError::BadResponse("missing exitCode".to_string()))?
-                    as i32;
-                let stdout = response
-                    .get("stdout")
-                    .and_then(|v| v.as_str())
-                    .unwrap_or("")
-                    .to_string();
-                let stderr = response
-                    .get("stderr")
-                    .and_then(|v| v.as_str())
-                    .unwrap_or("")
-                    .to_string();
-                Ok(HookOutcome {
-                    exit_code,
-                    stdout,
-                    stderr,
-                })
-            }
-            Some("error") => {
-                let message = response
-                    .get("message")
-                    .and_then(|v| v.as_str())
-                    .unwrap_or("worker reported an error")
-                    .to_string();
-                Err(WorkerError::BadResponse(message))
-            }
-            _ => Err(WorkerError::BadResponse(response.to_string())),
-        }
-    }
-}
-
-impl Drop for Worker {
-    fn drop(&mut self) {
-        if let Ok(mut guard) = self.child.lock()
-            && let Some(mut child) = guard.take()
-        {
-            kill_process_group(&mut child);
-            // The worker's socket file survives the process that bound it,
-            // so a clean shutdown has to clear it too — otherwise the next
-            // daemon inherits debris that looks, to anything checking the
-            // filesystem, like a live worker.
-            let _ = std::fs::remove_file(&self.socket_path);
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::os::unix::net::UnixListener;
-
-    fn temp_socket_path(name: &str) -> PathBuf {
-        let nanos = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap()
-            .as_nanos();
-        std::env::temp_dir().join(format!(
-            "failproofaid-worker-test-{}-{}-{}",
-            std::process::id(),
-            name,
-            nanos
-        ))
-    }
-
-    /// The restart-on-crash path: a worker that died left its socket file
-    /// behind, and the supervisor must not read that file's mere existence
-    /// as "a worker is listening". Before the readiness probe became a real
-    /// `connect()`, this returned `Ok(())` immediately and every later
-    /// request hit `ECONNREFUSED` on a dead socket.
-    #[test]
-    fn a_stale_socket_file_is_not_mistaken_for_a_live_worker() {
-        let socket_path = temp_socket_path("stale");
-        // Exactly the debris a dead worker leaves: std does not unlink the
-        // path when the listener is dropped.
-        let listener = UnixListener::bind(&socket_path).unwrap();
-        drop(listener);
-        assert!(
-            socket_path.exists(),
-            "premise: a bound-then-dropped socket file outlives its listener"
-        );
-
-        // A "worker" that exits without ever binding. The stale file is the
-        // only thing on disk that could be mistaken for readiness.
-        let worker = Worker::new(socket_path.clone(), WorkerCommand::shell("exit 0"));
-        let err = worker
-            .call("PreToolUse", "claude", "{}", None)
-            .expect_err("a worker that never bound must not report ready");
-        assert!(
-            err.to_string()
-                .contains("exited before creating its socket"),
-            "got: {err}"
-        );
-
-        std::fs::remove_file(&socket_path).ok();
-    }
-
-    /// Readiness against the real worker, over a socket path that already
-    /// holds a stale file — the exact shape of a restart after an unclean
-    /// exit. `ensure_started` must clear the debris, wait for the new
-    /// worker to genuinely accept connections, and `Drop` must leave the
-    /// path clean again so the next daemon starts from a blank slate.
-    #[test]
-    fn restarts_over_a_stale_socket_file_and_cleans_up_on_drop() {
-        let repo_root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
-            .parent()
-            .and_then(|p| p.parent())
-            .expect("crates/failproofaid should be two levels under the repo root")
-            .to_path_buf();
-        let worker_script = repo_root.join("bin").join("failproofai-worker.mjs");
-
-        let socket_path = temp_socket_path("restart-over-stale");
-        let listener = UnixListener::bind(&socket_path).unwrap();
-        drop(listener);
-
-        let worker = Worker::new(
-            socket_path.clone(),
-            WorkerCommand::shell(format!("bun {}", worker_script.display())),
-        );
-        worker
-            .ensure_started()
-            .expect("the worker should start over the stale file");
-        // Ready means *connectable*, not merely "a file is there".
-        UnixStream::connect(&socket_path).expect("a ready worker accepts connections");
-
-        drop(worker);
-        assert!(
-            !socket_path.exists(),
-            "Drop should remove the worker socket file"
-        );
-    }
-}

package/.next/standalone/crates/failproofaid/tests/daemon_e2e.rs

@@ -1,241 +0,0 @@
-//! Black-box tests that spawn the real compiled `failproofaid` binary as a
-//! subprocess and talk to it over a real Unix socket — closer to how a
-//! systemd unit / launchd agent will actually invoke it (Stage 4) than the
-//! in-process unit tests in `src/server.rs` are.
-
-use fpai_ipc::{ClientMessage, PROTOCOL_VERSION, ServerMessage, read_message, write_message};
-use std::io::BufRead;
-use std::os::unix::net::UnixStream;
-use std::path::PathBuf;
-use std::process::{Child, Command, ExitStatus, Stdio};
-use std::sync::{Arc, Mutex};
-use std::time::{Duration, Instant};
-
-fn binary_path() -> &'static str {
-    env!("CARGO_BIN_EXE_failproofaid")
-}
-
-/// A dedicated, never-before-existing run directory per test — mirroring a
-/// real deployment, where `~/.failproofai/run` is always failproofaid's own
-/// directory that it creates itself. `ensure_run_dir` (see `src/paths.rs`)
-/// deliberately refuses to chmod a pre-existing directory it didn't create,
-/// so reusing a shared directory like the bare system temp dir here would
-/// make every test in this file fail with a permissions error instead of
-/// exercising the daemon at all.
-fn unique_socket_path(name: &str) -> PathBuf {
-    let nanos = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .unwrap()
-        .as_nanos();
-    std::env::temp_dir()
-        .join(format!(
-            "failproofaid-e2e-{}-{}-{}",
-            std::process::id(),
-            name,
-            nanos
-        ))
-        .join("failproofaid.sock")
-}
-
-/// Owns a spawned daemon subprocess and guarantees it is killed and reaped
-/// on scope exit — including during an unwind from a failed assertion.
-/// Without this, any panic between `spawn_daemon` and a test's explicit
-/// SIGTERM orphaned a live daemon (and the worker process group under it)
-/// for the rest of the machine's uptime.
-struct DaemonGuard {
-    child: Option<Child>,
-    /// Everything the daemon has written to stderr so far, drained
-    /// continuously on a background thread. Drained rather than merely
-    /// piped: an unread pipe fills at ~64 KiB and blocks the daemon
-    /// mid-write, hanging these tests. Kept so a failure can report what
-    /// the daemon itself said, which is the part actually worth reading.
-    stderr: Arc<Mutex<String>>,
-}
-
-impl DaemonGuard {
-    fn stderr(&self) -> String {
-        self.stderr.lock().unwrap().clone()
-    }
-
-    /// SIGTERM, then wait — the clean-shutdown path a systemd `stop` /
-    /// launchd unload takes. Consumes the child, so `Drop` becomes a no-op.
-    fn terminate(&mut self) -> ExitStatus {
-        let mut child = self.child.take().expect("daemon already reaped");
-        unsafe {
-            libc::kill(child.id() as libc::pid_t, libc::SIGTERM);
-        }
-        child.wait().expect("daemon should exit after SIGTERM")
-    }
-}
-
-impl Drop for DaemonGuard {
-    fn drop(&mut self) {
-        if let Some(mut child) = self.child.take() {
-            child.kill().ok();
-            child.wait().ok();
-        }
-    }
-}
-
-fn spawn_daemon(socket_path: &PathBuf) -> DaemonGuard {
-    let mut child = Command::new(binary_path())
-        .env("FAILPROOFAI_DAEMON_SOCKET", socket_path)
-        .stdout(Stdio::null())
-        .stderr(Stdio::piped())
-        .spawn()
-        .expect("failed to spawn failproofaid binary");
-
-    let stderr_log = Arc::new(Mutex::new(String::new()));
-    if let Some(pipe) = child.stderr.take() {
-        let sink = stderr_log.clone();
-        std::thread::spawn(move || {
-            for line in std::io::BufReader::new(pipe).lines().map_while(Result::ok) {
-                sink.lock().unwrap().push_str(&line);
-                sink.lock().unwrap().push('\n');
-            }
-        });
-    }
-    let mut guard = DaemonGuard {
-        child: Some(child),
-        stderr: stderr_log,
-    };
-
-    let deadline = Instant::now() + Duration::from_secs(5);
-    while !socket_path.exists() {
-        // A daemon that died during startup should report *why* rather than
-        // burn the full deadline and then panic with no diagnosis.
-        if let Some(status) = guard
-            .child
-            .as_mut()
-            .expect("daemon still owned here")
-            .try_wait()
-            .expect("try_wait should not fail")
-        {
-            panic!(
-                "daemon exited before creating its socket ({status}). stderr:\n{}",
-                guard.stderr()
-            );
-        }
-        if Instant::now() > deadline {
-            panic!(
-                "daemon never created its socket file within 5s. stderr:\n{}",
-                guard.stderr()
-            );
-        }
-        std::thread::sleep(Duration::from_millis(20));
-    }
-    guard
-}
-
-#[test]
-fn version_flag_prints_a_version_and_exits_without_binding_a_socket() {
-    let output = Command::new(binary_path())
-        .arg("--version")
-        .output()
-        .expect("failed to run --version");
-    assert!(output.status.success());
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    assert!(stdout.starts_with("failproofaid "), "got: {stdout:?}");
-}
-
-#[test]
-fn real_binary_answers_ping_over_a_real_socket() {
-    let socket_path = unique_socket_path("ping");
-    let mut daemon = spawn_daemon(&socket_path);
-
-    let mut stream = UnixStream::connect(&socket_path).expect("connect should succeed");
-    write_message(
-        &mut stream,
-        &ClientMessage::Ping {
-            protocol_version: PROTOCOL_VERSION,
-        },
-    )
-    .unwrap();
-    let response: ServerMessage = read_message(&mut stream).unwrap();
-    assert_eq!(
-        response,
-        ServerMessage::Pong {
-            protocol_version: PROTOCOL_VERSION
-        }
-    );
-
-    let status = daemon.terminate();
-    assert!(
-        status.success(),
-        "daemon should exit 0 on SIGTERM, got {status:?}"
-    );
-    assert!(
-        !socket_path.exists(),
-        "daemon should remove its socket file on clean shutdown"
-    );
-}
-
-#[test]
-fn a_second_daemon_on_the_same_socket_refuses_to_start() {
-    let socket_path = unique_socket_path("singleton");
-    let mut first = spawn_daemon(&socket_path);
-
-    let second_output = Command::new(binary_path())
-        .env("FAILPROOFAI_DAEMON_SOCKET", &socket_path)
-        .output()
-        .expect("failed to run second instance");
-    assert!(
-        !second_output.status.success(),
-        "a second daemon on the same socket must not exit 0"
-    );
-    let stderr = String::from_utf8_lossy(&second_output.stderr);
-    assert!(
-        stderr.contains("already running"),
-        "expected an 'already running' message, got: {stderr:?}"
-    );
-
-    // First instance is still healthy and answers requests after the
-    // second one's failed startup attempt.
-    let mut stream = UnixStream::connect(&socket_path).unwrap();
-    write_message(
-        &mut stream,
-        &ClientMessage::Ping {
-            protocol_version: PROTOCOL_VERSION,
-        },
-    )
-    .unwrap();
-    let response: ServerMessage = read_message(&mut stream).unwrap();
-    assert_eq!(
-        response,
-        ServerMessage::Pong {
-            protocol_version: PROTOCOL_VERSION
-        }
-    );
-
-    first.terminate();
-}
-
-#[test]
-fn a_fresh_daemon_can_bind_again_after_the_previous_one_shut_down_cleanly() {
-    let socket_path = unique_socket_path("restart");
-
-    let mut first = spawn_daemon(&socket_path);
-    let status = first.terminate();
-    assert!(status.success());
-
-    // The lock is released by the kernel when the process exits, so a
-    // fresh daemon must be able to acquire it and bind immediately.
-    let mut second = spawn_daemon(&socket_path);
-    let mut stream = UnixStream::connect(&socket_path).unwrap();
-    write_message(
-        &mut stream,
-        &ClientMessage::Ping {
-            protocol_version: PROTOCOL_VERSION,
-        },
-    )
-    .unwrap();
-    let response: ServerMessage = read_message(&mut stream).unwrap();
-    assert_eq!(
-        response,
-        ServerMessage::Pong {
-            protocol_version: PROTOCOL_VERSION
-        }
-    );
-
-    second.terminate();
-}

package/.next/standalone/crates/fpai-ipc/Cargo.toml

@@ -1,16 +0,0 @@
-[package]
-name = "fpai-ipc"
-version.workspace = true
-edition.workspace = true
-license-file.workspace = true
-repository.workspace = true
-description = "Wire protocol (framing + envelope + peer verification) shared by failproofaid and its tests"
-publish = false
-
-[dependencies]
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-libc = "0.2"
-
-[dev-dependencies]
-proptest = "1"