zano-native 0.0.1

package/lib/scripts/utils/closeWalletPatch.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.patchCloseWallet = void 0;
+const patchMarker = 'Edge patch: close-during-refresh deadlock';
+const hint = 'The SDK sources changed at this pin. If upstream has fixed the ' +
+    'close-during-refresh lock inversion, delete this patch; otherwise port ' +
+    'it to the new body.';
+/**
+ * `close_wallet` as pinned at zano_native_lib 91085c0, modulo invisible
+ * trailing whitespace. The transform refuses to run unless the function it
+ * found matches this byte-for-byte after trailing whitespace is stripped,
+ * so ANY upstream drift - not just drift through the lines the deadlock
+ * analysis rests on - fails the build for a human to re-evaluate.
+ */
+const original = `std::string wallets_manager::close_wallet(size_t wallet_id)
+{
+  EXCLUSIVE_CRITICAL_REGION_LOCAL(m_wallets_lock);
+
+  auto it = m_wallets.find(wallet_id);
+  if (it == m_wallets.end())
+    return API_RETURN_CODE_WALLET_WRONG_ID;
+
+
+  try
+  {
+    it->second.major_stop = true;
+    it->second.stop_for_refresh = true;
+    it->second.w.unlocked_get()->stop();
+
+    it->second.w->get()->store();
+    m_wallets.erase(it);
+    {
+      CRITICAL_REGION_LOCAL(m_wallet_log_prefixes_lock);
+      m_wallet_log_prefixes[wallet_id] = std::string("[") + epee::string_tools::num_to_string_fast(wallet_id) + ":CLOSED] ";
+    }
+  }
+
+  catch (const std::exception& e)
+  {
+    return std::string(API_RETURN_CODE_FAIL) + ":" + e.what();
+  }
+  catch (...)
+  {
+    return API_RETURN_CODE_INTERNAL_ERROR;
+  }
+  //m_pview->hide_wallet();
+  return API_RETURN_CODE_OK;
+}`;
+/**
+ * The replacement `close_wallet`. The pinned original holds
+ * `m_wallets_lock` exclusively across two waits on the wallet being
+ * closed: the `store()` call, which needs the per-wallet lock the refresh
+ * worker holds for the whole of a scan chunk, and the map erase, whose
+ * destructor joins the worker thread. The refresh path re-enters the
+ * manager through wallet callbacks (`on_transfer2`, `on_transfer_canceled`)
+ * that take `m_wallets_lock` shared, and every other API call takes it
+ * shared up front - so a close issued while the wallet is catching up
+ * wedges the worker, the close, and then every Zano call in the process,
+ * permanently. Thread dumps of the frozen app show the close parked inside
+ * the native call, and no checkpoint ever lands again.
+ *
+ * The rewrite detaches the map node while holding the lock, then does the
+ * slow parts - the store and the implicit thread join when the node dies
+ * - with no manager lock held at all. Node extraction keeps the element
+ * at its address, so the worker thread's references stay valid; wallet ids
+ * are never reused, so late callbacks cannot hit a recycled id. The
+ * log-prefix write gains a bounds check, because the manager lock no
+ * longer serializes it against `reset()`'s vector clear.
+ *
+ * Deliberate semantics changes, all confined to the window after the node
+ * leaves the map:
+ *
+ * - "Absent from `m_wallets`" no longer implies "closed and stored".
+ *   During the store/join window the wallet is invisible to
+ *   `open_wallet`'s ALREADY_EXISTS check and to status calls while its
+ *   `wallet2` still writes the file. Safe for this bridge, which strictly
+ *   sequences close-before-reopen per wallet on one executor thread; a
+ *   caller without that discipline could double-open the file. Say so in
+ *   any upstream submission.
+ * - The refresh worker's own callbacks miss where they used to hit. Both
+ *   `on_transfer2` and `on_transfer_canceled` look the wallet up by id
+ *   under a shared `m_wallets_lock` while the store runs, and the entry is
+ *   no longer there. Both lookups are checked - `on_transfer2` through
+ *   `GET_WALLET_OPTIONS_BY_ID_VOID_RET`, which returns on a miss, and
+ *   `on_transfer_canceled` with an explicit `end()` test that logs and
+ *   returns - so the cost is a dropped view notification for a wallet
+ *   that is closing anyway, not an unchecked dereference. Every
+ *   `m_wallets.find` in the file is checked this way; the three bare
+ *   `m_wallets[...]` sites all insert a freshly counted id in the open,
+ *   restore and generate paths, and ids are never reused.
+ * - When `store()` throws, the original left the entry in the map as a
+ *   zombie (its stop flags already set, so it could never sync again);
+ *   the rewrite reports the same error but the wallet is gone. A
+ *   `closeWallet` retry therefore reports WALLET_WRONG_ID instead of
+ *   retrying the store, so `CppBridge`'s re-key migration takes its
+ *   "leave the file alone" branch with the wallet already released; the
+ *   next launch retries the migration.
+ *
+ * iOS links the prebuilt `libzano-plain-wallet` framework and keeps the
+ * original blocking semantics throughout.
+ */
+const replacement = `std::string wallets_manager::close_wallet(size_t wallet_id)
+{
+  // ${patchMarker}.
+  //
+  // The original held m_wallets_lock exclusively across store() and across
+  // the map erase, whose destructor joins the refresh worker. Both wait on
+  // a wallet that may be mid-refresh, and the refresh path re-enters the
+  // manager through wallet callbacks that take m_wallets_lock shared - so
+  // a close issued during a long refresh held the very lock the worker
+  // needed to reach its stop flags, and neither side could ever proceed.
+  // Detach the map node under the lock instead, then store and join with
+  // no manager lock held. The node is declared outside the try so its
+  // destructor - which joins the worker thread the stop flags told to
+  // finish - runs at function exit rather than during unwinding, while
+  // everything that can throw stays inside the try, so failures keep
+  // reporting as return codes exactly as they did before this patch.
+  decltype(m_wallets)::node_type wallet_node;
+  try
+  {
+    {
+      EXCLUSIVE_CRITICAL_REGION_LOCAL(m_wallets_lock);
+
+      auto it = m_wallets.find(wallet_id);
+      if (it == m_wallets.end())
+        return API_RETURN_CODE_WALLET_WRONG_ID;
+
+      it->second.major_stop = true;
+      it->second.stop_for_refresh = true;
+      it->second.w.unlocked_get()->stop();
+      wallet_node = m_wallets.extract(it);
+    }
+
+    wallet_node.mapped().w->get()->store();
+    {
+      CRITICAL_REGION_LOCAL(m_wallet_log_prefixes_lock);
+      // The manager lock no longer serializes this write against reset()'s
+      // clear of the vector, so respect its current size:
+      if (wallet_id < m_wallet_log_prefixes.size())
+        m_wallet_log_prefixes[wallet_id] = std::string("[") + epee::string_tools::num_to_string_fast(wallet_id) + ":CLOSED] ";
+    }
+  }
+  catch (const std::exception& e)
+  {
+    return std::string(API_RETURN_CODE_FAIL) + ":" + e.what();
+  }
+  catch (...)
+  {
+    return API_RETURN_CODE_INTERNAL_ERROR;
+  }
+  //m_pview->hide_wallet();
+  return API_RETURN_CODE_OK;
+}`;
+/** Strips trailing whitespace per line, the one formatting freedom the
+ * comparison allows - the pinned file carries an invisible trailing
+ * space that transcriptions of it should not have to reproduce. `\r` is
+ * in the class so a CRLF checkout reports the drift it has, rather than
+ * one carriage return per line. */
+function normalize(code) {
+    return code
+        .split('\n')
+        .map(line => line.replace(/[ \t\r]+$/, ''))
+        .join('\n');
+}
+/**
+ * Rewrites the SDK's `wallets_manager::close_wallet` so it does not hold
+ * the wallet-manager lock while waiting on the wallet being closed. See
+ * the comment on `replacement` above for the deadlock this removes and
+ * the semantics it deliberately changes.
+ *
+ * Only the Android libraries pick this up: iOS links the prebuilt
+ * `libzano-plain-wallet` xcframework rather than building these sources,
+ * and iOS runs the same close-during-catch-up cycle without wedging.
+ *
+ * The function is located by its unique signature, delimited by brace
+ * counting, and then required to match the pinned original exactly
+ * (modulo trailing whitespace), so a pin bump that changes `close_wallet`
+ * in any way fails the build here instead of silently keeping (or
+ * dropping) a stale patch. The brace counter would be fooled by a brace
+ * inside a string literal, but the full-body comparison catches that case
+ * too: a mis-delimited body cannot match the original.
+ *
+ * @param text - The contents of the SDK's `wallets_manager.cpp`.
+ * @returns The patched contents. Already-patched input comes back
+ * unchanged, so the caller does not need to track whether it ran.
+ */
+function patchCloseWallet(text) {
+    if (text.includes(patchMarker))
+        return text;
+    const anchor = 'std::string wallets_manager::close_wallet(size_t wallet_id)';
+    const start = text.indexOf(anchor);
+    if (start < 0 || text.includes(anchor, start + 1)) {
+        throw new Error(`Cannot find a unique wallets_manager::close_wallet to patch. ${hint}`);
+    }
+    // Take the whole function by brace balance:
+    let depth = 0;
+    let end = -1;
+    for (let i = text.indexOf('{', start); i >= 0 && i < text.length; ++i) {
+        if (text[i] === '{')
+            ++depth;
+        if (text[i] === '}' && --depth === 0) {
+            end = i + 1;
+            break;
+        }
+    }
+    if (end < 0) {
+        throw new Error(`Cannot delimit the body of wallets_manager::close_wallet. ${hint}`);
+    }
+    if (normalize(text.slice(start, end)) !== normalize(original)) {
+        throw new Error('wallets_manager::close_wallet does not match the pinned original ' +
+            `this patch was written against. ${hint}`);
+    }
+    return text.slice(0, start) + replacement + text.slice(end);
+}
+exports.patchCloseWallet = patchCloseWallet;

package/lib/scripts/utils/common.d.ts

@@ -0,0 +1,37 @@
+/// <reference types="node" />
+export declare const tmpPath: string;
+/**
+ * Fetches a git repo and checks out a hash.
+ *
+ * We fetch just the pinned commit rather than cloning the whole history.
+ * Some of these repos keep large prebuilt binaries in Git LFS, so a plain
+ * clone drags down every historical revision of those - slow, and prone to
+ * dying partway through on a flaky connection.
+ *
+ * Pass `lfsIncludes` for LFS repos to grab only the paths we build against,
+ * skipping the platforms we never touch.
+ */
+export declare function getRepo(name: string, uri: string, hash: string, opts?: {
+    lfsIncludes?: string[];
+}): Promise<void>;
+/**
+ * Downloads & unpacks a zip file.
+ */
+export declare function getZip(name: string, uri: string): Promise<void>;
+export declare function fileExists(path: string): Promise<boolean>;
+export declare function loudExec(command: string, args: string[], opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<void>;
+/**
+ * Runs a command and returns its stdout, without going through a shell.
+ */
+export declare function captureExec(command: string, args: string[], opts?: {
+    cwd?: string;
+}): Promise<string>;
+/**
+ * Runs a command and returns its results.
+ */
+export declare function quietExec(command: string, args: string[], opts?: {
+    cwd?: string;
+}): Promise<string>;

package/lib/scripts/utils/common.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.quietExec = exports.captureExec = exports.loudExec = exports.fileExists = exports.getZip = exports.getRepo = exports.tmpPath = void 0;
+const child_process_1 = require("child_process");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+exports.tmpPath = (0, path_1.join)(__dirname, '../../tmp');
+/**
+ * Fetches a git repo and checks out a hash.
+ *
+ * We fetch just the pinned commit rather than cloning the whole history.
+ * Some of these repos keep large prebuilt binaries in Git LFS, so a plain
+ * clone drags down every historical revision of those - slow, and prone to
+ * dying partway through on a flaky connection.
+ *
+ * Pass `lfsIncludes` for LFS repos to grab only the paths we build against,
+ * skipping the platforms we never touch.
+ */
+async function getRepo(name, uri, hash, opts = {}) {
+    const { lfsIncludes } = opts;
+    const path = (0, path_1.join)(exports.tmpPath, name);
+    // Set up the repo. Both steps are idempotent and run every time rather
+    // than behind a `fileExists(path)` check: a run killed between the mkdir
+    // and the init used to leave a directory that looked set up but had no
+    // `.git` and no remote, which every later run then skipped and no fetch
+    // could recover from.
+    if (!(await fileExists((0, path_1.join)(path, '.git'))))
+        console.log(`Creating ${name}...`);
+    await (0, promises_1.mkdir)(path, { recursive: true });
+    await loudExec('git', ['init', '-q'], { cwd: path });
+    if (!(await tryExec('git', ['remote', 'set-url', 'origin', uri], path))) {
+        await loudExec('git', ['remote', 'add', 'origin', uri], { cwd: path });
+    }
+    // Fetch the pinned commit, unless we already have it.
+    // The check also picks up hash bumps on an existing checkout:
+    if (!(await hasCommit(path, hash))) {
+        console.log(`Fetching ${name}...`);
+        try {
+            await loudExec('git', ['fetch', '--depth', '1', 'origin', hash], {
+                cwd: path
+            });
+        }
+        catch (error) {
+            // Not every server allows fetching a bare hash. Revoked access, a
+            // dropped connection and a force-pushed-away commit land here too, and
+            // if the full fetch succeeds without bringing the hash along, the
+            // checkout below fails on an unrelated-looking "unknown revision" --
+            // so say what actually went wrong first:
+            console.log(`Could not fetch ${hash} directly, retrying with a full fetch: ${String(error)}`);
+            // A plain `fetch` on a repo an earlier run left shallow keeps it
+            // shallow, which brings down the branch tips and not the pinned commit
+            // behind them. `--unshallow` is only valid on a shallow repo, so pick
+            // by whether git left its marker:
+            const shallow = await fileExists((0, path_1.join)(path, '.git', 'shallow'));
+            await loudExec('git', shallow ? ['fetch', '--unshallow', 'origin'] : ['fetch', 'origin'], { cwd: path });
+        }
+        // Fail here rather than at the checkout, which reports a missing pin as
+        // an opaque "unknown revision" with the fetch error already gone:
+        if (!(await hasCommit(path, hash))) {
+            throw new Error(`Could not fetch ${hash} for ${name} from ${uri}`);
+        }
+    }
+    // Checkout. Skipping the LFS smudge filter keeps this from blocking on an
+    // all-platforms LFS download; we pull the parts we need below:
+    console.log(`Checking out ${name}...`);
+    await loudExec('git', ['checkout', '-f', hash], {
+        cwd: path,
+        env: { ...process.env, GIT_LFS_SKIP_SMUDGE: '1' }
+    });
+    // Grab the LFS objects we actually build against. The empty `--exclude` is
+    // load-bearing: `--include` overrides `lfs.fetchinclude` but leaves any
+    // configured `lfs.fetchexclude` in force, so on a machine with a global
+    // exclude the pull reports success while leaving pointer files in place,
+    // and the build then links against 4KB of ASCII.
+    if (lfsIncludes != null) {
+        console.log(`Fetching ${name} LFS objects...`);
+        await loudExec('git', ['lfs', 'pull', `--include=${lfsIncludes.join(',')}`, '--exclude='], { cwd: path });
+    }
+    // Checkout submodules. `--force` because `update-sources` patches
+    // `RIPEMD160.h`, which lives inside the Zano submodule: without it the
+    // second run of this script aborts on "local changes would be overwritten"
+    // and the build is not repeatable, which `prepack` needs it to be.
+    await loudExec('git', ['submodule', 'update', '--init', '--recursive', '--force'], { cwd: path });
+}
+exports.getRepo = getRepo;
+/**
+ * Checks whether a repo already contains a particular commit, and everything
+ * that commit points at.
+ *
+ * `rev-parse --verify` would accept any well-formed hash without checking
+ * that we have it, and `cat-file -e <hash>` proves only that the commit
+ * object arrived. Below `fetch.unpackLimit` git writes loose objects in no
+ * particular order, so a run killed mid-unpack can leave the commit present
+ * with its tree missing -- which this check would wave through, skipping the
+ * fetch that would repair it. `rev-list --objects` walks the whole thing.
+ */
+async function hasCommit(path, hash) {
+    return await tryExec('git', ['rev-list', '--objects', '--quiet', hash, '--'], path);
+}
+/**
+ * Runs a command, reporting whether it succeeded rather than throwing, and
+ * without inheriting stdio -- for the cases where a failure is an expected
+ * answer instead of an error.
+ */
+async function tryExec(command, args, cwd) {
+    return await new Promise(resolve => {
+        const child = (0, child_process_1.spawn)(command, args, { cwd, stdio: 'ignore' });
+        child.on('error', () => resolve(false));
+        child.on('exit', code => resolve(code === 0));
+    });
+}
+/**
+ * Downloads & unpacks a zip file.
+ */
+async function getZip(name, uri) {
+    const path = (0, path_1.join)(exports.tmpPath, name);
+    if (!(await fileExists(path))) {
+        console.log(`Getting ${name}...`);
+        await loudExec('curl', ['-L', '-o', path, uri]);
+    }
+    // Unzip:
+    await loudExec('unzip', ['-u', path]);
+}
+exports.getZip = getZip;
+async function fileExists(path) {
+    return await (0, promises_1.access)(path).then(() => true, () => false);
+}
+exports.fileExists = fileExists;
+async function loudExec(command, args, opts = {}) {
+    const { cwd = exports.tmpPath, env = process.env } = opts;
+    return await new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(command, args, {
+            cwd,
+            stdio: 'inherit',
+            env
+        });
+        child.on('error', reject);
+        child.on('exit', code => {
+            if (code === 0) {
+                resolve();
+            }
+            else {
+                reject(new Error(`${command} exited with code ${String(code)}`));
+            }
+        });
+    });
+}
+exports.loudExec = loudExec;
+/**
+ * Runs a command and returns its stdout, without going through a shell.
+ */
+async function captureExec(command, args, opts = {}) {
+    const { cwd = exports.tmpPath } = opts;
+    return await new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(command, args, {
+            cwd,
+            stdio: ['ignore', 'pipe', 'inherit']
+        });
+        let out = '';
+        child.stdout.on('data', chunk => {
+            out += String(chunk);
+        });
+        child.on('error', reject);
+        // `close` rather than `exit`: the process can exit while stdout still has
+        // buffered data, which would truncate the output we are here to collect.
+        // `close` waits for the stdio streams too.
+        child.on('close', code => {
+            if (code === 0)
+                resolve(out.replace(/\n$/, ''));
+            else
+                reject(new Error(`${command} exited with code ${String(code)}`));
+        });
+    });
+}
+exports.captureExec = captureExec;
+/**
+ * Runs a command and returns its results.
+ */
+async function quietExec(command, args, opts = {}) {
+    const { cwd = exports.tmpPath } = opts;
+    return (0, child_process_1.execSync)(command + ' ' + args.join(' '), {
+        cwd,
+        encoding: 'utf8'
+    }).replace(/\n$/, '');
+}
+exports.quietExec = quietExec;

package/lib/scripts/utils/ios-tools.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Finds llvm-objcopy in Homebrew.
+ *
+ * Homebrew doesn't symlink LLVM into the normal location,
+ * to avoid conflicting with Xcode's built-in tools.
+ * We can get around this by looking in the right places.
+ */
+export declare function getObjcopyPath(): Promise<string>;

package/lib/scripts/utils/ios-tools.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getObjcopyPath = void 0;
+const common_1 = require("./common");
+/**
+ * Finds llvm-objcopy in Homebrew.
+ *
+ * Homebrew doesn't symlink LLVM into the normal location,
+ * to avoid conflicting with Xcode's built-in tools.
+ * We can get around this by looking in the right places.
+ */
+async function getObjcopyPath() {
+    const whichPath = await (0, common_1.quietExec)('which', ['llvm-objcopy']).catch(() => { });
+    if (whichPath != null)
+        return whichPath;
+    const paths = [
+        '/opt/homebrew/opt/llvm/bin/llvm-objcopy',
+        '/usr/local/opt/llvm/bin/llvm-objcopy' // for Intel Macs
+    ];
+    for (const path of paths) {
+        if (await (0, common_1.fileExists)(path))
+            return path;
+    }
+    throw new Error('Please install `llvm-objcopy` using `brew install llvm`.');
+}
+exports.getObjcopyPath = getObjcopyPath;

package/lib/scripts/utils/sdkFolders.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Directories the Zano SDK creates under the working directory the app hands
+ * it, and that `ios/ZanoModule.mm` therefore has to pre-create so it can
+ * exclude them from device backups -- the wallet files hold the seed and
+ * spend keys.
+ *
+ * Keep this in sync with the `prepareZanoDirectory` calls in
+ * `ios/ZanoModule.mm`. `update-sources.ts` fails the build if the SDK
+ * declares a directory that is missing here.
+ */
+export declare const sdkFolders: string[];
+/**
+ * Extracts the directory names the SDK declares, sorted.
+ *
+ * Matches `#define`s whose name mentions a folder, so `APP_CONFIG_FOLDER`
+ * and `WALLETS_FOLDER_NAME` count but `APP_CONFIG_FILENAME` does not.
+ *
+ * This catches directories declared as `#define`d names, which is how the
+ * SDK has always declared them. It cannot catch a path composed inline, so
+ * it is a tripwire rather than a proof.
+ *
+ * @param apiText - The contents of the SDK's `plain_wallet_api.cpp`.
+ * @throws If nothing matches at all, which means the SDK changed how it
+ * declares directories and this check needs rewriting rather than silently
+ * reporting "no new folders".
+ */
+export declare function findSdkFolders(apiText: string): string[];

package/lib/scripts/utils/sdkFolders.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findSdkFolders = exports.sdkFolders = void 0;
+/**
+ * Directories the Zano SDK creates under the working directory the app hands
+ * it, and that `ios/ZanoModule.mm` therefore has to pre-create so it can
+ * exclude them from device backups -- the wallet files hold the seed and
+ * spend keys.
+ *
+ * Keep this in sync with the `prepareZanoDirectory` calls in
+ * `ios/ZanoModule.mm`. `update-sources.ts` fails the build if the SDK
+ * declares a directory that is missing here.
+ */
+exports.sdkFolders = ['app_config', 'logs', 'wallets'];
+/**
+ * Extracts the directory names the SDK declares, sorted.
+ *
+ * Matches `#define`s whose name mentions a folder, so `APP_CONFIG_FOLDER`
+ * and `WALLETS_FOLDER_NAME` count but `APP_CONFIG_FILENAME` does not.
+ *
+ * This catches directories declared as `#define`d names, which is how the
+ * SDK has always declared them. It cannot catch a path composed inline, so
+ * it is a tripwire rather than a proof.
+ *
+ * @param apiText - The contents of the SDK's `plain_wallet_api.cpp`.
+ * @throws If nothing matches at all, which means the SDK changed how it
+ * declares directories and this check needs rewriting rather than silently
+ * reporting "no new folders".
+ */
+function findSdkFolders(apiText) {
+    const found = new Set();
+    const regexp = /^#define\s+\w*(?:FOLDER|_DIR)\w*\s+"([^"]*)"/gm;
+    let match;
+    while ((match = regexp.exec(apiText)) != null) {
+        found.add(match[1]);
+    }
+    if (found.size === 0) {
+        throw new Error('Found no folder definitions in plain_wallet_api.cpp. The SDK has ' +
+            'probably changed how it declares them, so this check needs updating.');
+    }
+    return [...found].sort((a, b) => a.localeCompare(b));
+}
+exports.findSdkFolders = findSdkFolders;