trajectories 0.0.0 → 0.1.2

package/legacy/src/pressure.ts

@@ -0,0 +1,162 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export type PressureSeverity = "unavailable" | "calm" | "constrained" | "critical";
+
+export interface PsiWindow {
+  some_avg10: number;
+  full_avg10: number;
+}
+
+export interface PressureSnapshot {
+  platform: NodeJS.Platform;
+  severity: PressureSeverity;
+  cpu: PsiWindow | null;
+  memory: PsiWindow | null;
+  io: PsiWindow | null;
+  cgroup_memory_ratio: number | null;
+  cgroup_cpu_cores: number | null;
+  reasons: string[];
+}
+
+export interface AdaptivePressureState {
+  scale_permille: number;
+  calm_runs: number;
+  last_severity: PressureSeverity;
+}
+
+type PressureSignals = Omit<PressureSnapshot, "severity" | "reasons">;
+
+export const DEFAULT_PRESSURE_STATE: AdaptivePressureState = {
+  scale_permille: 1000,
+  calm_runs: 0,
+  last_severity: "unavailable",
+};
+
+const MIN_SCALE_PERMILLE = 250;
+const RECOVERY_STEP_PERMILLE = 125;
+const CALM_RUNS_PER_RECOVERY_STEP = 2;
+
+function finiteNumber(value: string | undefined): number | null {
+  if (value === undefined) return null;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+
+export function parsePsi(text: string): PsiWindow | null {
+  let some: number | null = null;
+  let full: number | null = null;
+  for (const line of text.trim().split("\n")) {
+    const [kind, ...fields] = line.trim().split(/\s+/);
+    const avg10 = finiteNumber(fields.find((field) => field.startsWith("avg10="))?.slice(6));
+    if (kind === "some") some = avg10;
+    if (kind === "full") full = avg10;
+  }
+  return some === null || full === null ? null : { some_avg10: some, full_avg10: full };
+}
+
+function readText(path: string): string | null {
+  try { return readFileSync(path, "utf8"); }
+  catch { return null; }
+}
+
+function cgroupRoot(): string | null {
+  const membership = readText("/proc/self/cgroup");
+  const relative = membership?.split("\n")
+    .map((line) => line.split(":"))
+    .find((parts) => parts[0] === "0" && parts[1] === "")?.[2];
+  return relative ? join("/sys/fs/cgroup", relative) : null;
+}
+
+function cgroupMemoryRatio(root: string | null): number | null {
+  if (!root) return null;
+  const current = finiteNumber(readText(join(root, "memory.current"))?.trim());
+  const rawMax = readText(join(root, "memory.max"))?.trim();
+  const max = rawMax === "max" ? null : finiteNumber(rawMax);
+  return current === null || max === null || max === 0 ? null : current / max;
+}
+
+function cgroupCpuCores(root: string | null): number | null {
+  if (!root) return null;
+  const [quotaText, periodText] = (readText(join(root, "cpu.max")) ?? "").trim().split(/\s+/);
+  if (quotaText === "max") return null;
+  const quota = finiteNumber(quotaText);
+  const period = finiteNumber(periodText);
+  return quota === null || period === null || period === 0 ? null : quota / period;
+}
+
+function pressureWindow(root: string | null, kind: "cpu" | "memory" | "io"): PsiWindow | null {
+  const scoped = root ? readText(join(root, `${kind}.pressure`)) : null;
+  return parsePsi(scoped ?? readText(`/proc/pressure/${kind}`) ?? "");
+}
+
+export function samplePressure(platform: NodeJS.Platform = process.platform): PressureSnapshot {
+  if (platform !== "linux") {
+    return { platform, severity: "unavailable", cpu: null, memory: null, io: null,
+      cgroup_memory_ratio: null, cgroup_cpu_cores: null, reasons: ["psi_unavailable"] };
+  }
+  const root = cgroupRoot();
+  const cpu = pressureWindow(root, "cpu");
+  const memory = pressureWindow(root, "memory");
+  const io = pressureWindow(root, "io");
+  const ratio = cgroupMemoryRatio(root);
+  const cpuCores = cgroupCpuCores(root);
+  return classifyPressure({ platform, cpu, memory, io,
+    cgroup_memory_ratio: ratio, cgroup_cpu_cores: cpuCores });
+}
+
+export function classifyPressure(signals: PressureSignals): PressureSnapshot {
+  const { platform, cpu, memory, io, cgroup_memory_ratio: ratio, cgroup_cpu_cores: cpuCores } = signals;
+  if (!cpu && !memory && !io && ratio === null) {
+    return { ...signals, severity: "unavailable", reasons: ["psi_unavailable"] };
+  }
+
+  const critical: string[] = [];
+  if (memory && memory.full_avg10 >= 1) critical.push("memory_full");
+  if (io && io.full_avg10 >= 10) critical.push("io_full");
+  if (ratio !== null && ratio >= 0.9) critical.push("cgroup_memory_90pct");
+  if (critical.length) return { platform, severity: "critical", cpu, memory, io,
+    cgroup_memory_ratio: ratio, cgroup_cpu_cores: cpuCores, reasons: critical };
+
+  const constrained: string[] = [];
+  if (memory && memory.some_avg10 >= 2) constrained.push("memory_some");
+  if (io && io.some_avg10 >= 10) constrained.push("io_some");
+  if (cpu && cpu.some_avg10 >= 80) constrained.push("cpu_some");
+  if (ratio !== null && ratio >= 0.75) constrained.push("cgroup_memory_75pct");
+  return { platform, severity: constrained.length ? "constrained" : "calm", cpu, memory, io,
+    cgroup_memory_ratio: ratio, cgroup_cpu_cores: cpuCores, reasons: constrained };
+}
+
+export function adaptPressure(
+  previous: AdaptivePressureState,
+  snapshot: PressureSnapshot,
+): { state: AdaptivePressureState; pause: boolean } {
+  const scale = Math.min(1000, Math.max(MIN_SCALE_PERMILLE, previous.scale_permille));
+  if (snapshot.severity === "critical" || snapshot.severity === "constrained") {
+    return {
+      state: {
+        scale_permille: Math.max(MIN_SCALE_PERMILLE, Math.floor(scale / 2)),
+        calm_runs: 0,
+        last_severity: snapshot.severity,
+      },
+      pause: snapshot.severity === "critical",
+    };
+  }
+  if (snapshot.severity === "unavailable") {
+    return { state: { ...previous, scale_permille: scale, last_severity: "unavailable" }, pause: false };
+  }
+  const calmRuns = previous.calm_runs + 1;
+  const recover = calmRuns >= CALM_RUNS_PER_RECOVERY_STEP;
+  return {
+    state: {
+      scale_permille: recover ? Math.min(1000, scale + RECOVERY_STEP_PERMILLE) : scale,
+      calm_runs: recover ? 0 : calmRuns,
+      last_severity: "calm",
+    },
+    pause: false,
+  };
+}
+
+export function scaledLimit(limit: number, scalePermille: number): number {
+  return Math.max(1, Math.floor(limit * scalePermille / 1000));
+}

package/legacy/src/private-storage.ts

@@ -0,0 +1,74 @@
+import {
+  chmodSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, type Stats,
+} from "node:fs";
+
+/** Owner-private local storage, not encryption or a same-user sandbox. */
+export class PrivateStorageError extends Error {
+  readonly code = "UNSAFE_STORE_PATH";
+  constructor(path: string, detail: string) {
+    super(`Refusing unsafe Ledger storage at ${path}: ${detail}`);
+    this.name = "PrivateStorageError";
+  }
+}
+
+function validate(stat: Stats, path: string, directory = false): void {
+  if (directory ? !stat.isDirectory() : !stat.isFile()) {
+    throw new PrivateStorageError(path, directory ? "not a real directory" : "not a regular, non-symlink file");
+  }
+  // A journal may be unlinked by a concurrent SQLite commit during stat.
+  if (stat.nlink === 0) throw Object.assign(new Error("Storage entry was removed"), { code: "ENOENT" });
+  if (!directory && stat.nlink > 1) throw new PrivateStorageError(path, "hard-linked file");
+  if (process.getuid && stat.uid !== process.getuid()) throw new PrivateStorageError(path, "owned by another user");
+}
+
+/**
+ * Never open/close an extra descriptor for an existing SQLite inode: POSIX
+ * closing ANY descriptor to it can release this process's fcntl locks, even
+ * locks owned by a different SQLite handle. lstat/chmod do not release locks.
+ * The local namespace is trusted against same-UID races; changed identities
+ * are refused, but this is not a sandbox for a hostile process with our UID.
+ */
+function restrictExisting(path: string, directory = false): void {
+  const before = lstatSync(path);
+  validate(before, path, directory);
+  const mode = directory ? 0o700 : 0o600;
+  if ((before.mode & mode) !== mode) throw new PrivateStorageError(path, "owner permissions are restricted; repair explicitly before retrying");
+  if ((before.mode & 0o777) === mode) return;
+  chmodSync(path, mode);
+  const after = lstatSync(path);
+  validate(after, path, directory);
+  if (after.dev !== before.dev || after.ino !== before.ino || (after.mode & 0o777) !== mode) {
+    throw new PrivateStorageError(path, "identity or permissions changed during permission repair");
+  }
+}
+
+/** Only use for Ledger's own default directory, never arbitrary parent directories. */
+export function ensurePrivateDirectory(path: string): void {
+  mkdirSync(path, { recursive: true, mode: 0o700 });
+  restrictExisting(path, true);
+}
+
+export function ensurePrivateFile(path: string, create = true): void {
+  try {
+    restrictExisting(path);
+    return;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    if (!create) return;
+  }
+  let fd: number;
+  try {
+    // O_EXCL guarantees this descriptor is never an existing SQLite inode.
+    fd = openSync(path, constants.O_RDWR | constants.O_NOFOLLOW | constants.O_CREAT | constants.O_EXCL, 0o600);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "EEXIST") return restrictExisting(path);
+    throw new PrivateStorageError(path, (error as NodeJS.ErrnoException).code ?? "cannot create safely");
+  }
+  try { validate(fstatSync(fd), path); } finally { closeSync(fd); }
+}
+
+/** SQLite creates missing sidecars using the primary file's restrictive mode. */
+export function ensurePrivateDatabase(path: string): void {
+  ensurePrivateFile(path);
+  for (const suffix of ["-wal", "-shm", "-journal"]) ensurePrivateFile(path + suffix, false);
+}