SourceIndex 0.1.0__py3-none-any.whl

sourceindex/daemon/keyring_store.py

@@ -0,0 +1,129 @@
+"""Per-repo master key: OS keychain when available, mode-0600 file fallback."""
+
+from __future__ import annotations
+
+import base64
+import logging
+import os
+from pathlib import Path
+
+from . import crypto
+
+
+_log = logging.getLogger(__name__)
+
+
+KEYRING_SERVICE = "sourceindex"
+ENV_KEY_FILE_DIR = "SOURCEINDEX_KEY_DIR"
+
+
+def _key_file_dir() -> Path:
+    override = os.environ.get(ENV_KEY_FILE_DIR)
+    if override:
+        return Path(override).expanduser().resolve()
+    xdg = os.environ.get("XDG_CONFIG_HOME")
+    base = Path(xdg).expanduser() if xdg else Path.home() / ".config"
+    return base / "sourceindex" / "keys"
+
+
+def _try_keyring_get(repo_hash: str) -> bytes | None:
+    try:
+        import keyring  # type: ignore[import-not-found]
+        import keyring.errors  # noqa: F401  type: ignore[import-not-found]
+    except Exception:
+        return None
+    try:
+        encoded = keyring.get_password(KEYRING_SERVICE, repo_hash)
+    except Exception as e:
+        _log.debug("keyring.get_password failed: %s", e)
+        return None
+    if not encoded:
+        return None
+    try:
+        key = base64.b64decode(encoded)
+    except Exception:
+        return None
+    if len(key) != crypto.KEY_LEN:
+        return None
+    return key
+
+
+def _try_keyring_set(repo_hash: str, key: bytes) -> bool:
+    try:
+        import keyring  # type: ignore[import-not-found]
+    except Exception:
+        return False
+    encoded = base64.b64encode(key).decode("ascii")
+    try:
+        keyring.set_password(KEYRING_SERVICE, repo_hash, encoded)
+    except Exception as e:
+        _log.debug("keyring.set_password failed: %s", e)
+        return False
+    return True
+
+
+def _read_key_file(path: Path) -> bytes | None:
+    try:
+        raw = path.read_bytes()
+    except FileNotFoundError:
+        return None
+    if len(raw) != crypto.KEY_LEN:
+        # Refuse rather than silently regenerate — operator may have hand-edited.
+        raise ValueError(
+            f"Key file at {path} is {len(raw)} bytes; expected {crypto.KEY_LEN}."
+        )
+    return raw
+
+
+def _write_key_file(path: Path, key: bytes) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    try:
+        path.parent.chmod(0o700)
+    except OSError:
+        pass
+    # O_EXCL+0o600 avoids a window where the key sits at the default umask.
+    fd = os.open(str(path), os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    try:
+        os.write(fd, key)
+    finally:
+        os.close(fd)
+
+
+def load_or_create_key(repo_hash: str) -> bytes:
+    key = _try_keyring_get(repo_hash)
+    if key is not None:
+        return key
+
+    key_path = _key_file_dir() / f"{repo_hash}.key"
+    key = _read_key_file(key_path)
+    if key is not None:
+        return key
+
+    key = crypto.generate_key()
+    if _try_keyring_set(repo_hash, key):
+        return key
+
+    _write_key_file(key_path, key)
+    _log.warning(
+        "No OS keychain backend available; persisted the encryption key to "
+        "%s (mode 0600). Set up gnome-keyring / kwallet / Keychain.app for "
+        "stronger at-rest protection. Override the directory with "
+        "$SOURCEINDEX_KEY_DIR.",
+        key_path,
+    )
+    return key
+
+
+def delete_key(repo_hash: str) -> None:
+    try:
+        import keyring  # type: ignore[import-not-found]
+        keyring.delete_password(KEYRING_SERVICE, repo_hash)
+    except Exception as e:
+        _log.debug("keyring.delete_password failed: %s", e)
+    key_path = _key_file_dir() / f"{repo_hash}.key"
+    try:
+        key_path.unlink()
+    except FileNotFoundError:
+        pass
+    except OSError as e:
+        _log.debug("unlink %s failed: %s", key_path, e)

sourceindex/daemon/lifecycle.py

@@ -0,0 +1,237 @@
+"""Daemon lifecycle: socket paths, spawn-on-first-RPC, pidfile, graceful stop."""
+
+from __future__ import annotations
+
+import errno
+import fcntl
+import hashlib
+import logging
+import os
+import shutil
+import signal
+import socket
+import sys
+import time
+from contextlib import contextmanager
+from pathlib import Path
+
+
+_log = logging.getLogger(__name__)
+
+
+def repo_hash_for(main_worktree: Path) -> str:
+    # Resolve symlinks so a symlinked-in path and its target hash the same.
+    canonical = str(Path(main_worktree).resolve())
+    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()[:16]
+
+
+def runtime_dir() -> Path:
+    xdg = os.environ.get("XDG_RUNTIME_DIR")
+    if xdg and Path(xdg).is_dir():
+        base = Path(xdg) / "sourceindex"
+    else:
+        # Per-user fallback so two accounts on a shared box don't collide.
+        base = Path("/tmp") / f"sourceindex-{os.getuid()}"
+    base.mkdir(parents=True, exist_ok=True)
+    try:
+        base.chmod(0o700)
+    except OSError:
+        pass
+    return base
+
+
+def user_socket(repo_hash: str) -> Path:
+    return runtime_dir() / f"{repo_hash}.sock"
+
+
+def admin_socket(repo_hash: str) -> Path:
+    return runtime_dir() / f"{repo_hash}.admin.sock"
+
+
+def pidfile(repo_hash: str) -> Path:
+    return runtime_dir() / f"{repo_hash}.pid"
+
+
+def spawn_lock(repo_hash: str) -> Path:
+    return runtime_dir() / f"{repo_hash}.spawn.lock"
+
+
+def progress_file(repo_hash: str) -> Path:
+    return runtime_dir() / f"{repo_hash}.progress"
+
+
+def write_pidfile(repo_hash: str) -> None:
+    p = pidfile(repo_hash)
+    payload = f"{os.getpid()} {int(time.time())}\n"
+    tmp = p.with_suffix(".pid.tmp")
+    tmp.write_text(payload)
+    os.replace(tmp, p)
+
+
+def read_pidfile(repo_hash: str) -> tuple[int, int] | None:
+    p = pidfile(repo_hash)
+    try:
+        raw = p.read_text().strip()
+    except OSError:
+        return None
+    parts = raw.split()
+    if len(parts) != 2:
+        return None
+    try:
+        return int(parts[0]), int(parts[1])
+    except ValueError:
+        return None
+
+
+def pid_alive(pid: int) -> bool:
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        return True
+    return True
+
+
+def cleanup_stale_files(repo_hash: str) -> None:
+    info = read_pidfile(repo_hash)
+    if info is not None and pid_alive(info[0]):
+        return
+    for p in (pidfile(repo_hash), user_socket(repo_hash), admin_socket(repo_hash)):
+        try:
+            p.unlink()
+        except FileNotFoundError:
+            pass
+
+
+@contextmanager
+def spawn_lock_held(repo_hash: str):
+    lock_path = spawn_lock(repo_hash)
+    lock_path.touch(exist_ok=True)
+    fd = os.open(str(lock_path), os.O_RDWR)
+    try:
+        fcntl.flock(fd, fcntl.LOCK_EX)
+        yield
+    finally:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_UN)
+        finally:
+            os.close(fd)
+
+
+def _double_fork_exec(argv: list[str]) -> None:
+    pid = os.fork()
+    if pid > 0:
+        os.waitpid(pid, 0)
+        return
+    os.setsid()
+    pid2 = os.fork()
+    if pid2 > 0:
+        os._exit(0)
+    # Reopen stdio onto /dev/null so a stray print() can't leak to the client.
+    try:
+        fd_null = os.open(os.devnull, os.O_RDWR)
+        for target_fd in (0, 1, 2):
+            os.dup2(fd_null, target_fd)
+        if fd_null > 2:
+            os.close(fd_null)
+    except OSError:
+        pass
+    try:
+        os.execvp(argv[0], argv)
+    except FileNotFoundError as e:
+        _log.error("daemon execvp failed: %s", e)
+        os._exit(2)
+
+
+def daemon_argv(repo_root: Path, *, allow_dump: bool) -> list[str]:
+    binary = shutil.which("sourceindex") or sys.executable
+    if binary == sys.executable:
+        argv = [binary, "-m", "sourceindex.cli", "daemon"]
+    else:
+        argv = [binary, "daemon"]
+    argv += ["--repo-root", str(repo_root)]
+    if allow_dump:
+        argv.append("--allow-dump")
+    return argv
+
+
+def spawn_daemon(repo_root: Path, *, allow_dump: bool, timeout_s: float = 5.0) -> None:
+    rh = repo_hash_for(repo_root)
+    with spawn_lock_held(rh):
+        # File-existence alone is not a liveness signal — a crashed daemon
+        # leaves its socket behind. Check pidfile + pid_alive + socket so
+        # stale orphans fall through to cleanup_stale_files instead of
+        # tricking the client into connecting to a dead listener.
+        if is_daemon_running(repo_root):
+            return
+        cleanup_stale_files(rh)
+        _double_fork_exec(daemon_argv(repo_root, allow_dump=allow_dump))
+
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        if user_socket(rh).exists():
+            return
+        time.sleep(0.05)
+    raise TimeoutError(
+        f"daemon for {repo_root} did not bind {user_socket(rh)} within "
+        f"{timeout_s}s — check `sourceindex daemon --repo-root {repo_root}`"
+    )
+
+
+def stop_daemon(repo_root: Path, *, timeout_s: float = 5.0) -> bool:
+    rh = repo_hash_for(repo_root)
+    info = read_pidfile(rh)
+    if info is None or not pid_alive(info[0]):
+        cleanup_stale_files(rh)
+        return False
+    pid, _ = info
+    try:
+        os.kill(pid, signal.SIGTERM)
+    except ProcessLookupError:
+        cleanup_stale_files(rh)
+        return False
+    deadline = time.monotonic() + timeout_s
+    while time.monotonic() < deadline:
+        if not pid_alive(pid):
+            cleanup_stale_files(rh)
+            return True
+        time.sleep(0.05)
+    try:
+        os.kill(pid, signal.SIGKILL)
+    except ProcessLookupError:
+        pass
+    cleanup_stale_files(rh)
+    return True
+
+
+def is_daemon_running(repo_root: Path) -> bool:
+    rh = repo_hash_for(repo_root)
+    info = read_pidfile(rh)
+    if info is None:
+        return False
+    return pid_alive(info[0]) and user_socket(rh).exists()
+
+
+def connect_blocking(path: Path, *, timeout_s: float = 5.0) -> socket.socket:
+    deadline = time.monotonic() + timeout_s
+    while True:
+        s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        try:
+            s.connect(str(path))
+            return s
+        except (FileNotFoundError, ConnectionRefusedError) as e:
+            s.close()
+            if time.monotonic() >= deadline:
+                raise FileNotFoundError(
+                    f"could not connect to {path} within {timeout_s}s: {e}"
+                ) from e
+            time.sleep(0.05)
+        except OSError as e:
+            s.close()
+            if e.errno in (errno.ENOENT, errno.ECONNREFUSED):
+                if time.monotonic() >= deadline:
+                    raise
+                time.sleep(0.05)
+                continue
+            raise

sourceindex/daemon/protocol.py

@@ -0,0 +1,134 @@
+"""JSON-RPC 2.0 wire protocol over UDS, length-prefixed frames."""
+
+from __future__ import annotations
+
+import json
+import struct
+from typing import Any
+
+
+MAX_FRAME_BYTES = 16 * 1024 * 1024
+
+
+USER_METHODS = frozenset(
+    {
+        "ping",
+        "search",
+        "init",
+        "update",
+        "install_hooks",
+        "usage",
+    }
+)
+
+ADMIN_METHODS = frozenset(
+    {
+        "dump_all",
+        "read_index_md",
+        "read_detail",
+        "read_env",
+        "shutdown",
+    }
+)
+
+
+# JSON-RPC reserved
+E_PARSE_ERROR = -32700
+E_INVALID_REQUEST = -32600
+E_METHOD_NOT_FOUND = -32601
+E_INVALID_PARAMS = -32602
+E_INTERNAL = -32603
+E_SERVER = -32000
+
+# SourceIndex-specific
+E_NO_INDEX = 1001
+E_AUTH_REQUIRED = 1002
+E_BUDGET_EXCEEDED = 1003
+E_KEY_UNAVAILABLE = 1004
+E_FRAME_TOO_LARGE = 1005
+
+
+class RpcError(Exception):
+    def __init__(self, code: int, message: str, data: Any | None = None) -> None:
+        super().__init__(message)
+        self.code = code
+        self.message = message
+        self.data = data
+
+    def to_dict(self) -> dict:
+        out: dict[str, Any] = {"code": self.code, "message": self.message}
+        if self.data is not None:
+            out["data"] = self.data
+        return out
+
+
+def encode_frame(obj: dict) -> bytes:
+    body = json.dumps(obj, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+    if len(body) > MAX_FRAME_BYTES:
+        raise RpcError(
+            E_FRAME_TOO_LARGE,
+            f"frame is {len(body)} bytes; max is {MAX_FRAME_BYTES}",
+        )
+    return struct.pack(">I", len(body)) + body
+
+
+async def read_frame_async(reader) -> dict:
+    hdr = await reader.readexactly(4)
+    (n,) = struct.unpack(">I", hdr)
+    if n > MAX_FRAME_BYTES:
+        raise RpcError(
+            E_FRAME_TOO_LARGE,
+            f"incoming frame is {n} bytes; max is {MAX_FRAME_BYTES}",
+        )
+    body = await reader.readexactly(n)
+    try:
+        return json.loads(body.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError) as e:
+        raise RpcError(E_PARSE_ERROR, f"frame parse error: {e}") from e
+
+
+def read_frame_sync(sock) -> dict:
+    hdr = _recv_exact(sock, 4)
+    (n,) = struct.unpack(">I", hdr)
+    if n > MAX_FRAME_BYTES:
+        raise RpcError(
+            E_FRAME_TOO_LARGE,
+            f"incoming frame is {n} bytes; max is {MAX_FRAME_BYTES}",
+        )
+    body = _recv_exact(sock, n)
+    return json.loads(body.decode("utf-8"))
+
+
+def _recv_exact(sock, n: int) -> bytes:
+    buf = bytearray()
+    while len(buf) < n:
+        chunk = sock.recv(n - len(buf))
+        if not chunk:
+            raise ConnectionError("connection closed mid-frame")
+        buf.extend(chunk)
+    return bytes(buf)
+
+
+def make_request(method: str, params: dict | None = None, *, id_: int = 1) -> dict:
+    req: dict[str, Any] = {"jsonrpc": "2.0", "method": method, "id": id_}
+    if params is not None:
+        req["params"] = params
+    return req
+
+
+def make_response(id_: Any, result: Any) -> dict:
+    return {"jsonrpc": "2.0", "id": id_, "result": result}
+
+
+def make_error(id_: Any, err: RpcError | Exception) -> dict:
+    if isinstance(err, RpcError):
+        return {"jsonrpc": "2.0", "id": id_, "error": err.to_dict()}
+    return {
+        "jsonrpc": "2.0",
+        "id": id_,
+        "error": {
+            "code": E_SERVER,
+            "message": str(err) or type(err).__name__,
+            "data": {"error_type": type(err).__name__},
+        },
+    }