flowproof 0.7.0__tar.gz → 0.8.0__tar.gz

{flowproof-0.7.0 → flowproof-0.8.0}/Cargo.lock

@@ -760,7 +760,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -779,7 +779,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "chrono",
  "flowproof-driver",
@@ -795,7 +795,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "ab_glyph",
  "chrono",
@@ -816,7 +816,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-driver"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "image",
  "postgres",
@@ -830,7 +830,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -842,7 +842,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -856,7 +856,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "jsonschema",
  "regex",

{flowproof-0.7.0 → flowproof-0.8.0}/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproof-replay", "crates/flowproof-agent", "crates/flowproof-adapters", "crates/flowproof-cli", "crates/flowproof-python"]
 
 [workspace.package]
-version = "0.7.0"
+version = "0.8.0"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"

{flowproof-0.7.0 → flowproof-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.7.0
+Version: 0.8.0
 Classifier: Development Status :: 2 - Pre-Alpha
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3

{flowproof-0.7.0 → flowproof-0.8.0}/crates/flowproof-adapters/src/agent_proxy.rs

@@ -17,7 +17,7 @@
 
 use std::io::{BufRead, BufReader, Read, Write};
 use std::net::{SocketAddr, TcpListener, TcpStream};
-use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 
 use flowproof_trace::cassette::{
@@ -64,6 +64,12 @@ pub struct AgentProxy {
     thread: Option<std::thread::JoinHandle<()>>,
     /// Turns captured in record mode, in order. Empty in replay mode.
     captured: Arc<Mutex<Vec<Turn>>>,
+    /// Bumped once when a request starts and again when it finishes, so a
+    /// caller can tell "nothing is happening" from "between two requests".
+    /// See [`AgentProxy::quiesce`].
+    activity: Arc<AtomicUsize>,
+    /// Requests started but not yet finished.
+    in_flight: Arc<AtomicUsize>,
 }
 
 impl AgentProxy {
@@ -126,16 +132,41 @@ impl AgentProxy {
         let log = Arc::new(Mutex::new(ProxyLog::default()));
         let stop = Arc::new(AtomicBool::new(false));
         let captured = Arc::new(Mutex::new(Vec::new()));
+        let activity = Arc::new(AtomicUsize::new(0));
+        let in_flight = Arc::new(AtomicUsize::new(0));
         let thread = {
             let (log, stop, captured) =
                 (Arc::clone(&log), Arc::clone(&stop), Arc::clone(&captured));
+            let (activity, in_flight) = (Arc::clone(&activity), Arc::clone(&in_flight));
             std::thread::spawn(move || {
                 let mut turn = 0usize;
+                // One flag per recorded turn, marking the ones already
+                // served. Matching consumes rather than indexes, so an
+                // agent that issues calls concurrently still replays.
+                let mut consumed: Vec<bool> = Vec::new();
                 while !stop.load(Ordering::Relaxed) {
                     match listener.accept() {
                         Ok((stream, _)) => {
                             stream.set_nonblocking(false).ok();
-                            serve_one(stream, &mode, &mocks, &mut turn, &log, &captured);
+                            // Mark the request in flight BEFORE serving it.
+                            // A record run reads the cassette as soon as the
+                            // agent exits; without this an agent that fired a
+                            // call and did not wait for it would have that
+                            // call forwarded, answered, and then silently
+                            // missed from the trace.
+                            in_flight.fetch_add(1, Ordering::SeqCst);
+                            activity.fetch_add(1, Ordering::SeqCst);
+                            serve_one(
+                                stream,
+                                &mode,
+                                &mocks,
+                                &mut turn,
+                                &mut consumed,
+                                &log,
+                                &captured,
+                            );
+                            in_flight.fetch_sub(1, Ordering::SeqCst);
+                            activity.fetch_add(1, Ordering::SeqCst);
                         }
                         Err(ref e) if e.kind() == std::io::ErrorKind::WouldBlock => {
                             std::thread::sleep(std::time::Duration::from_millis(5));
@@ -151,9 +182,40 @@ impl AgentProxy {
             stop,
             thread: Some(thread),
             captured,
+            activity,
+            in_flight,
         })
     }
 
+    /// Wait until the proxy has been idle for `grace`, or `cap` elapses.
+    ///
+    /// An agent process exiting does NOT mean the proxy is done: an agent
+    /// can fire a model call and exit without waiting for it (goose does
+    /// exactly this, generating a session title). That call is still being
+    /// forwarded when the agent's exit status arrives, so reading the
+    /// cassette right then races it - and loses, non-deterministically,
+    /// whenever the upstream is slow enough. A dropped turn is invisible:
+    /// `record` still exits 0 and still writes a trace, which then cannot
+    /// replay, because replay serves instantly and always sees the call.
+    ///
+    /// Idle means both: nothing in flight, AND no request started or
+    /// finished during the last `grace` window. The second half matters
+    /// because the accept loop is sequential - between finishing one
+    /// request and accepting the next that is already queued, `in_flight`
+    /// is briefly zero.
+    pub fn quiesce(&self, grace: std::time::Duration, cap: std::time::Duration) {
+        let deadline = std::time::Instant::now() + cap;
+        loop {
+            let before = self.activity.load(Ordering::SeqCst);
+            std::thread::sleep(grace);
+            let settled = self.activity.load(Ordering::SeqCst) == before
+                && self.in_flight.load(Ordering::SeqCst) == 0;
+            if settled || std::time::Instant::now() >= deadline {
+                return;
+            }
+        }
+    }
+
     /// The cassette captured in record mode, in order. Empty in replay.
     pub fn captured(&self) -> Cassette {
         Cassette {
@@ -206,6 +268,7 @@ fn serve_one(
     mode: &Mode,
     mocks: &Mocks,
     turn: &mut usize,
+    consumed: &mut Vec<bool>,
     log: &Mutex<ProxyLog>,
     captured: &Mutex<Vec<Turn>>,
 ) {
@@ -303,12 +366,11 @@ fn serve_one(
         }
     };
 
-    let index = *turn;
     *turn += 1;
 
     match mode {
-        Mode::Replay(cassette) => match cassette.turn(index, &incoming, protocol) {
-            Ok(recorded) => {
+        Mode::Replay(cassette) => match cassette.match_turn(consumed, &incoming, protocol) {
+            Ok((_index, recorded)) => {
                 log.lock().unwrap_or_else(|e| e.into_inner()).served += 1;
                 // Render the recorded assistant message in the dialect the
                 // agent asked in. OpenAI honors `stream: true` with a

{flowproof-0.7.0 → flowproof-0.8.0}/crates/flowproof-adapters/src/egress_linux.rs

@@ -599,6 +599,14 @@ fn decide(
     }
 }
 
+/// Temporary diagnostic for D5: why a connect was refused. Off unless
+/// FLOWPROOF_EGRESS_DEBUG is set, so it costs nothing in a normal run.
+fn dbg_egress(what: &str) {
+    if std::env::var_os("FLOWPROOF_EGRESS_DEBUG").is_some() {
+        eprintln!("[egress] {what}");
+    }
+}
+
 /// `connect(fd, addr, addrlen)`: the core TOCTOU-safe path.
 fn handle_connect(
     fd: RawFd,
@@ -619,6 +627,7 @@ fn handle_connect(
         return errno_resp(libc::EPERM);
     }
     let Ok(n) = read else {
+        dbg_egress("connect: read_child FAILED -> EPERM");
         return errno_resp(libc::EPERM);
     };
 
@@ -628,14 +637,26 @@ fn handle_connect(
         Some(Dest::Inet(ip, port)) => {
             let ip = normalize(ip);
             if allow.allows(ip, port) {
+                dbg_egress(&format!("connect: ALLOWED {ip}:{port}, performing"));
                 perform_connect(req.pid, sockfd, &buf[..n])
             } else {
+                dbg_egress(&format!("connect: DENIED by policy {ip}:{port}"));
                 record(log, spawn, &format!("{ip}:{port}"), "tcp");
                 errno_resp(libc::ECONNREFUSED)
             }
         }
         // An address family we do not model: deny rather than guess.
-        None => errno_resp(libc::EPERM),
+        None => {
+            dbg_egress(&format!(
+                "connect: UNPARSEABLE sockaddr, {n} bytes, family={:?} -> EPERM",
+                if n >= 2 {
+                    u16::from_ne_bytes([buf[0], buf[1]]) as i32
+                } else {
+                    -1
+                }
+            ));
+            errno_resp(libc::EPERM)
+        }
     }
 }
 
@@ -778,11 +799,20 @@ fn handle_listen(req: &SeccompNotif) -> SeccompNotifResp {
     if rc == 0 {
         ok_resp(0)
     } else {
-        errno_resp(
-            io::Error::last_os_error()
-                .raw_os_error()
-                .unwrap_or(libc::EPERM),
-        )
+        let e = io::Error::last_os_error()
+            .raw_os_error()
+            .unwrap_or(libc::EPERM);
+        // EINPROGRESS is the NORMAL result for a nonblocking socket, not a
+        // failure: it is handed back to the child, which epolls its own fd.
+        let how = if e == libc::EINPROGRESS {
+            "in progress"
+        } else {
+            "FAILED"
+        };
+        dbg_egress(&format!(
+            "perform_connect: supervisor connect {how} errno={e}"
+        ));
+        errno_resp(e)
     }
 }
 
@@ -792,6 +822,7 @@ fn handle_listen(req: &SeccompNotif) -> SeccompNotifResp {
 /// correct, and the kernel never re-reads child memory.
 fn perform_connect(pid: u32, sockfd: RawFd, addr: &[u8]) -> SeccompNotifResp {
     let Ok(dup) = dup_child_fd(pid, sockfd) else {
+        dbg_egress("perform_connect: dup_child_fd FAILED -> EPERM");
         return errno_resp(libc::EPERM);
     };
     let rc = unsafe {
@@ -804,11 +835,20 @@ fn perform_connect(pid: u32, sockfd: RawFd, addr: &[u8]) -> SeccompNotifResp {
     if rc == 0 {
         ok_resp(0)
     } else {
-        errno_resp(
-            io::Error::last_os_error()
-                .raw_os_error()
-                .unwrap_or(libc::EPERM),
-        )
+        let e = io::Error::last_os_error()
+            .raw_os_error()
+            .unwrap_or(libc::EPERM);
+        // EINPROGRESS is the NORMAL result for a nonblocking socket, not a
+        // failure: it is handed back to the child, which epolls its own fd.
+        let how = if e == libc::EINPROGRESS {
+            "in progress"
+        } else {
+            "FAILED"
+        };
+        dbg_egress(&format!(
+            "perform_connect: supervisor connect {how} errno={e}"
+        ));
+        errno_resp(e)
     }
 }
 
@@ -997,12 +1037,50 @@ fn read_child(pid: u32, remote: u64, buf: &mut [u8], want: usize) -> io::Result<
     }
 }
 
+/// The thread-group leader of `tid`, read from `/proc/<tid>/status`.
+///
+/// `pidfd_open` only accepts a thread-group LEADER, but a seccomp
+/// notification carries the TID of whichever thread made the syscall. For a
+/// single-threaded agent those are the same number and nobody notices; for a
+/// multi-threaded one they are not, and every syscall off a worker thread
+/// would otherwise fail to open a pidfd.
+fn tgid_of(tid: u32) -> Option<u32> {
+    let status = std::fs::read_to_string(format!("/proc/{tid}/status")).ok()?;
+    status
+        .lines()
+        .find_map(|line| line.strip_prefix("Tgid:"))
+        .and_then(|v| v.trim().parse().ok())
+}
+
 /// Dup a fd out of the child into the supervisor (same file description), via
 /// `pidfd_open` + `pidfd_getfd`.
+///
+/// `pid` is the seccomp notification's pid field, which is a TID. When the
+/// calling thread is not the thread-group leader `pidfd_open` refuses it, so
+/// fall back to the leader: threads share one file-descriptor table, so the
+/// fd number means the same thing there and the dup is identical.
+///
+/// This is why a multi-threaded agent used to be denied its own loopback
+/// connections: goose (Rust/tokio) connects from a worker thread, so every
+/// `pidfd_open` failed and the supervisor answered EPERM even though the
+/// destination was allowed. A single-threaded Python or Node agent never hit
+/// it, which is why flowproof's own examples all passed.
 fn dup_child_fd(pid: u32, fd: RawFd) -> io::Result<OwnedFd> {
-    let pidfd = unsafe { libc::syscall(libc::SYS_pidfd_open, pid as libc::pid_t, 0) };
+    let open = |p: u32| unsafe { libc::syscall(libc::SYS_pidfd_open, p as libc::pid_t, 0) };
+    let mut pidfd = open(pid);
     if pidfd < 0 {
-        return Err(io::Error::last_os_error());
+        let first = io::Error::last_os_error();
+        match tgid_of(pid) {
+            // Already the leader: the failure is real, report the original.
+            Some(tgid) if tgid == pid => return Err(first),
+            Some(tgid) => {
+                pidfd = open(tgid);
+                if pidfd < 0 {
+                    return Err(io::Error::last_os_error());
+                }
+            }
+            None => return Err(first),
+        }
     }
     let pidfd = unsafe { OwnedFd::from_raw_fd(pidfd as RawFd) };
     let newfd = unsafe { libc::syscall(libc::SYS_pidfd_getfd, pidfd.as_raw_fd(), fd, 0) };

{flowproof-0.7.0 → flowproof-0.8.0}/crates/flowproof-adapters/src/mcp_stdio.rs

@@ -23,8 +23,13 @@
 //! - `<DIR>/<server>.plan.json` - written by the orchestrator BEFORE the
 //!   agent is spawned: `{mode, command, mocks, calls}` (`calls` is the lane
 //!   to serve, present for replay).
-//! - `<DIR>/<server>.out.json` - written by the stand-in ATOMICALLY at stdin
-//!   EOF: record -> `{calls: [...]}`; replay -> `{served, divergence}`.
+//! - `<DIR>/<server>.out.json` - written by the stand-in ATOMICALLY (temp
+//!   file + rename): record -> `{calls: [...]}`; replay ->
+//!   `{served, divergence}`. In RECORD it is rewritten after every captured
+//!   call, not only at stdin EOF, because reaching EOF needs the agent to
+//!   close the stand-in's stdin and an agent that kills its MCP subprocess
+//!   never gets there - which used to lose the whole recording. The EOF write
+//!   remains the authoritative last one.
 //!
 //! No async runtime, matching the model proxy's posture: std threads, plain
 //! pipes, one blocking read loop per direction.
@@ -220,6 +225,40 @@ fn run_replay(plan: &McpPlan, out_path: &Path) -> Result<(), String> {
     )
 }
 
+/// Persist the captured lane NOW, so an abrupt shutdown cannot lose it.
+///
+/// The authoritative write is still the one at stdin EOF, but reaching it
+/// requires the agent to close the stand-in's stdin and let it reap the real
+/// server. An agent that terminates its MCP subprocess abruptly never gets
+/// there - goose does exactly this - and the whole recording was lost, which
+/// then read as "the agent never spawned flowproof's MCP stand-in": a false
+/// negative pointing the adopter at wiring that was already correct.
+///
+/// `write_out_atomic` is a temp-file rename, so a partial flush is never
+/// observable and the last one wins. Errors are swallowed: a failed
+/// incremental flush must not break a run that the EOF write may still save.
+fn flush_lane(
+    out_path: &std::path::Path,
+    calls: &Mutex<BTreeMap<usize, McpCall>>,
+    events: &Mutex<Vec<McpServerEvent>>,
+) {
+    let captured: Vec<McpCall> = calls
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .values()
+        .cloned()
+        .collect();
+    let events: Vec<McpServerEvent> = events.lock().unwrap_or_else(|e| e.into_inner()).clone();
+    let _ = write_out_atomic(
+        out_path,
+        &McpOut {
+            calls: captured,
+            events,
+            ..Default::default()
+        },
+    );
+}
+
 /// RECORD: two threads bridge the agent and the REAL server.
 ///
 /// Thread A (this thread) reads the agent's stdin: a mocked `tools/call` is
@@ -307,6 +346,7 @@ fn run_record(plan: &McpPlan, out_path: &Path) -> Result<(), String> {
         let seq = Arc::clone(&seq);
         let events = Arc::clone(&events);
         let record_error = Arc::clone(&record_error);
+        let out_path_b = out_path.to_path_buf();
         std::thread::spawn(move || {
             let mut reader = BufReader::new(server_stdout);
             let mut line = String::new();
@@ -373,6 +413,7 @@ fn run_record(plan: &McpPlan, out_path: &Path) -> Result<(), String> {
                                         result,
                                     },
                                 );
+                                flush_lane(&out_path_b, &calls, &events);
                             }
                         }
                         (None, None) => {}
@@ -434,6 +475,7 @@ fn run_record(plan: &McpPlan, out_path: &Path) -> Result<(), String> {
                     result: result.clone(),
                 },
             );
+            flush_lane(out_path, &calls, &events);
             let mut out = write_lock.lock().unwrap_or_else(|e| e.into_inner());
             write_result(&mut *out, &id, &result)?;
         } else {