614 lines
27 KiB
Python
614 lines
27 KiB
Python
#!/usr/bin/env python3
|
|
"""Opt-in bounded private XTest keyboard experiment. Not a launcher or gameplay proof."""
|
|
import argparse
|
|
import ctypes as C
|
|
import hashlib
|
|
import json
|
|
import multiprocessing
|
|
import math
|
|
import os
|
|
from pathlib import Path
|
|
import re
|
|
import signal
|
|
import stat
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
|
|
import headless_display_probe as display
|
|
|
|
|
|
NOTIFY = None
|
|
|
|
|
|
def notify(value):
|
|
if NOTIFY is not None:
|
|
NOTIFY.send(value)
|
|
|
|
|
|
class Refused(ValueError):
|
|
pass
|
|
|
|
|
|
class KeyStateBusy(Refused):
|
|
pass
|
|
|
|
|
|
def option(args, name):
|
|
if args.count(name) != 1:
|
|
raise Refused('Missing or repeated native option: ' + name)
|
|
index = args.index(name)
|
|
if index + 1 >= len(args):
|
|
raise Refused('Missing native option value')
|
|
return args[index + 1]
|
|
|
|
|
|
def game_arguments(owner, args):
|
|
native = display.process(owner['pid'])
|
|
if display.identity(native) != owner['process']:
|
|
raise Refused('Game process changed')
|
|
if option(native['args'], '-errOrdinaryInputObserve') != args.nonce:
|
|
raise Refused('Native observer nonce mismatch')
|
|
if option(native['args'], '-errOrdinaryScenario') not in ('core', 'chat'):
|
|
raise Refused('Not an ordinary successor scenario')
|
|
if option(native['args'], '-profile') != 'Z:' + str(args.profile):
|
|
raise Refused('Native profile mismatch')
|
|
|
|
|
|
class Observer:
|
|
"""Only records appended after this exact owned console was opened count."""
|
|
pattern = re.compile(r'ERR INPUT OBSERVE: run=([A-Za-z0-9]{1,32}) sample=(\d+) real=(\d+) world=(\d+(?:\.\d+)?) (.+)$')
|
|
|
|
def __init__(self, path, nonce, clock=time.monotonic):
|
|
self.path, self.nonce, self.clock = path, nonce, clock
|
|
self.fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
|
|
info = os.fstat(self.fd)
|
|
if not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid():
|
|
os.close(self.fd)
|
|
raise Refused('Console is not a regular same-user file')
|
|
self.identity = info.st_dev, info.st_ino
|
|
self.start_offset = os.lseek(self.fd, 0, os.SEEK_END)
|
|
self.offset = self.start_offset
|
|
self.pending = b''
|
|
self.sample = self.real = self.world = -1
|
|
self.last_sample_at = None
|
|
self.events = []
|
|
self.raw = []
|
|
self.bytes = 0
|
|
self.terminal = False
|
|
|
|
def close(self):
|
|
os.close(self.fd)
|
|
|
|
def poll(self):
|
|
info = self.path.lstat()
|
|
if (info.st_dev, info.st_ino) != self.identity or not stat.S_ISREG(info.st_mode) or info.st_size < self.offset:
|
|
raise Refused('Console replaced or truncated')
|
|
data = os.read(self.fd, 65536)
|
|
self.offset += len(data); self.bytes += len(data)
|
|
if self.bytes > 8 * 1024 * 1024:
|
|
raise Refused('Console observation byte budget exceeded')
|
|
self.pending += data
|
|
if len(self.pending) > 131072:
|
|
raise Refused('Console line budget exceeded')
|
|
lines = self.pending.split(b'\n'); self.pending = lines.pop()
|
|
for raw in lines:
|
|
line = raw.decode('utf-8', 'strict').rstrip('\r')
|
|
if 'ERR INPUT OBSERVE: run=' + self.nonce + ' ' not in line:
|
|
continue
|
|
match = self.pattern.search(line)
|
|
if not match or match[1] != self.nonce:
|
|
raise Refused('Malformed matching observer record')
|
|
sample, real, world = int(match[2]), int(match[3]), float(match[4])
|
|
if not math.isfinite(world) or real > 2147483647:
|
|
raise Refused('Invalid native observer clock')
|
|
if sample < self.sample or real < self.real or world < self.world:
|
|
raise Refused('Native observer clock/sample reversed')
|
|
if sample > 450 or len(self.raw) >= 512:
|
|
raise Refused('Native observer record budget exceeded')
|
|
detail = match[5]
|
|
if detail.startswith('SAMPLE '):
|
|
if sample <= self.sample:
|
|
raise Refused('Repeated native sample')
|
|
self.last_sample_at = self.clock()
|
|
self.sample, self.real, self.world = sample, real, world
|
|
self.raw.append(line)
|
|
if detail == 'READY':
|
|
if self.events or self.last_sample_at is None:
|
|
raise Refused('Repeated or unbound READY')
|
|
self.events.append('READY')
|
|
elif detail in ('INVENTORY_OPEN', 'INVENTORY_CLOSED'):
|
|
expected = ['READY'] if detail == 'INVENTORY_OPEN' else ['READY', 'INVENTORY_OPEN']
|
|
if self.events != expected:
|
|
raise Refused('Unexpected native inventory transition')
|
|
self.events.append(detail)
|
|
elif detail.startswith(('CANCELLED ', 'FINISHED ')):
|
|
self.terminal = True
|
|
if self.terminal:
|
|
raise Refused('Native observer ended')
|
|
|
|
def fresh(self):
|
|
self.poll()
|
|
if self.last_sample_at is None or self.clock() - self.last_sample_at > 1:
|
|
raise Refused('Native observer samples are stale')
|
|
|
|
|
|
class Keyboard:
|
|
"""Only W/Tab key events on the pre-existing explicit owned connection."""
|
|
def __init__(self, query):
|
|
self.query = query
|
|
self.xt = C.CDLL('libXtst.so.6')
|
|
self.xt.XTestQueryExtension.restype = C.c_int
|
|
self.xt.XTestQueryExtension.argtypes = [C.c_void_p] + [C.POINTER(C.c_int)] * 4
|
|
self.xt.XTestFakeKeyEvent.restype = C.c_int
|
|
self.xt.XTestFakeKeyEvent.argtypes = [C.c_void_p, C.c_uint, C.c_int, C.c_ulong]
|
|
for name, restype, argtypes in (
|
|
('XKeysymToKeycode', C.c_ubyte, [C.c_void_p, C.c_ulong]),
|
|
('XKeycodeToKeysym', C.c_ulong, [C.c_void_p, C.c_ubyte, C.c_int]),
|
|
('XQueryKeymap', C.c_int, [C.c_void_p, C.POINTER(C.c_char)]),
|
|
('XFlush', C.c_int, [C.c_void_p])):
|
|
fn = getattr(query.x, name); fn.restype = restype; fn.argtypes = argtypes
|
|
values = [C.c_int() for _ in range(4)]
|
|
if not self.xt.XTestQueryExtension(query.d, *(C.byref(v) for v in values)):
|
|
raise Refused('Private XTest extension unavailable')
|
|
self.codes = {}
|
|
for key, keysym in (('W', 0x77), ('Tab', 0xff09)):
|
|
code = int(query.x.XKeysymToKeycode(query.d, keysym))
|
|
if not 8 <= code <= 255 or query.x.XKeycodeToKeysym(query.d, code, 0) != keysym:
|
|
raise Refused('Default unmodified key mapping unavailable')
|
|
self.codes[key] = code
|
|
if len(set(self.codes.values())) != 2:
|
|
raise Refused('Ambiguous key mapping')
|
|
|
|
def require_idle(self):
|
|
state = C.create_string_buffer(32)
|
|
if not self.query.x.XQueryKeymap(self.query.d, state):
|
|
raise Refused('Native private keyboard state query failed')
|
|
if any(state.raw):
|
|
raise KeyStateBusy('A private keyboard key is still held')
|
|
|
|
def send(self, key, down):
|
|
if key not in self.codes or type(down) is not bool:
|
|
raise Refused('Unsupported input event')
|
|
if not self.xt.XTestFakeKeyEvent(self.query.d, self.codes[key], int(down), 0):
|
|
raise Refused('Native XTest key request failed')
|
|
self.query.x.XFlush(self.query.d)
|
|
|
|
|
|
class Guard:
|
|
def __init__(self, args, bound, query, owner):
|
|
self.args, self.bound, self.query, self.owner = args, bound, query, owner
|
|
|
|
def check(self):
|
|
if display.binding(self.args.host_display, self.args.prefix) != self.bound:
|
|
raise Refused('Original display binding changed')
|
|
# A new per-check read budget, still bounded by the experiment deadline.
|
|
self.query.query_budget = 128
|
|
current = {'window': self.owner['window'], 'pid': self.query.prop(self.owner['window'], '_NET_WM_PID'),
|
|
'server_pid': self.query.server_pid(self.owner['window'])}
|
|
verified = display.owned_window(current, self.bound, self.args.prefix, self.args.game_executable)
|
|
if verified is None or verified['process'] != self.owner['process'] or verified['pid'] != self.owner['pid']:
|
|
raise Refused('Original game window or process changed')
|
|
game_arguments(verified, self.args)
|
|
target = display.input_target(self.query, verified)
|
|
if target.get('verified') is not True:
|
|
raise Refused('Owned existing focus/mapping unavailable: ' + target.get('reason', 'unknown'))
|
|
if display.binding(self.args.host_display, self.args.prefix) != self.bound:
|
|
raise Refused('Display binding changed during target check')
|
|
return target
|
|
|
|
|
|
def confirm_release(guard, keyboard, report, key, clock=time.monotonic, sleep=time.sleep):
|
|
"""Bounded read-only state polling; never sends/retries an input event."""
|
|
start = clock(); deadline = start + .35
|
|
observation = {'key': key, 'start': start, 'attempts': 0, 'confirmed': False}
|
|
report.setdefault('release_observations', []).append(observation)
|
|
try:
|
|
while True:
|
|
guard.check()
|
|
if clock() >= deadline:
|
|
raise Refused('Private key release state did not settle within 350ms')
|
|
observation['attempts'] += 1
|
|
try:
|
|
keyboard.require_idle()
|
|
if clock() >= deadline:
|
|
raise Refused('Private key release state query exceeded 350ms bound')
|
|
observation['confirmed'] = True
|
|
return
|
|
except KeyStateBusy as error:
|
|
observation['last_busy_error'] = str(error)
|
|
remaining = deadline - clock()
|
|
if remaining <= 0:
|
|
raise Refused('Private key release state did not settle within 350ms') from error
|
|
sleep(min(.025, remaining))
|
|
finally:
|
|
observation['end'] = clock()
|
|
|
|
|
|
def sequence(guard, keyboard, observer, report, clock=time.monotonic, sleep=time.sleep):
|
|
deadline = clock() + 70
|
|
held = None
|
|
report.update(events=[], paired_release_errors=[], sequence_completed=False)
|
|
|
|
def check(native=True):
|
|
if clock() >= deadline:
|
|
raise Refused('Input sequence deadline exceeded')
|
|
if native:
|
|
observer.fresh()
|
|
return guard.check()
|
|
|
|
def wait_for(event, seconds):
|
|
end = min(deadline, clock() + seconds)
|
|
while clock() < end:
|
|
observer.poll()
|
|
guard.check()
|
|
if event in observer.events:
|
|
observer.fresh()
|
|
return
|
|
sleep(0.05)
|
|
raise Refused('Native transition timeout: ' + event)
|
|
|
|
def key(key, down):
|
|
nonlocal held
|
|
check()
|
|
if down:
|
|
keyboard.require_idle()
|
|
# Mark uncertain commit before the FFI call, so an exception also releases.
|
|
held = key
|
|
notify({'kind': 'press-pending', 'key': key})
|
|
report['input_attempted'] = True
|
|
keyboard.send(key, down)
|
|
report['events'].append({'key': key, 'down': down, 'monotonic': clock()})
|
|
report['input_sent'] = True
|
|
if not down:
|
|
confirm_release(guard, keyboard, report, key, clock, sleep)
|
|
held = None
|
|
notify({'kind': 'release-confirmed', 'key': key})
|
|
|
|
def pulse(key_name, duration):
|
|
key(key_name, True)
|
|
end = clock() + duration
|
|
while clock() < end:
|
|
sleep(min(0.05, end - clock()))
|
|
# The key-up path performs a full fresh guard immediately before
|
|
# sending. Avoid duplicating that guard once the hold has elapsed.
|
|
if clock() < end:
|
|
check()
|
|
key(key_name, False)
|
|
|
|
try:
|
|
wait_for('READY', 45)
|
|
deadline = clock() + 12
|
|
if observer.events != ['READY']:
|
|
raise Refused('Inventory was already changed before input')
|
|
pulse('W', 0.30)
|
|
check()
|
|
pulse('Tab', 0.05)
|
|
wait_for('INVENTORY_OPEN', 4)
|
|
open_until = clock() + 3.0
|
|
while clock() < open_until:
|
|
sleep(min(.05, open_until - clock()))
|
|
check()
|
|
if observer.events != ['READY', 'INVENTORY_OPEN']:
|
|
raise Refused('Inventory closed before the observed open interval')
|
|
pulse('Tab', 0.05)
|
|
wait_for('INVENTORY_CLOSED', 4)
|
|
check()
|
|
keyboard.require_idle()
|
|
report['sequence_completed'] = True
|
|
finally:
|
|
if held is not None:
|
|
try:
|
|
# Release needs live display/window/focus authority, but not a live
|
|
# observer; cancellation must not suppress an otherwise safe key-up.
|
|
guard.check()
|
|
keyboard.send(held, False)
|
|
confirm_release(guard, keyboard, report, held, clock, sleep)
|
|
notify({'kind': 'release-confirmed', 'key': held})
|
|
report['events'].append({'key': held, 'down': False, 'finally': True, 'monotonic': clock()})
|
|
except (OSError, ValueError) as error:
|
|
report['paired_release_errors'].append(str(error))
|
|
report['unconfirmed_held_key'] = held if report['paired_release_errors'] else None
|
|
report['all_attempted_presses_released'] = not report.get('unconfirmed_held_key')
|
|
|
|
|
|
def arguments(argv=None):
|
|
p = argparse.ArgumentParser(description=__doc__)
|
|
p.add_argument('--enable-private-keyboard-proof', action='store_true', required=True)
|
|
for name in ('prefix', 'game-executable', 'profile', 'report'):
|
|
p.add_argument('--' + name, type=Path, required=True)
|
|
p.add_argument('--console', type=Path, help='Existing exact session; omit only in wrapper mode')
|
|
p.add_argument('--host-display', required=True)
|
|
p.add_argument('--nonce', required=True)
|
|
p.add_argument('command', nargs=argparse.REMAINDER)
|
|
return p.parse_args(argv)
|
|
|
|
|
|
def wrapper_command(args):
|
|
command = args.command[1:] if args.command[:1] == ['--'] else args.command
|
|
if not command:
|
|
if args.console is None:
|
|
raise Refused('Sidecar requires an exact existing console')
|
|
return []
|
|
if args.console is not None:
|
|
raise Refused('Wrapper discovers a new session; do not supply console')
|
|
if (len(command) < 3 or Path(command[0]).resolve() != Path(sys.executable).resolve() or
|
|
Path(command[1]) != Path(display.__file__).resolve()):
|
|
raise Refused('Only the unchanged sibling read-only display wrapper is allowed')
|
|
wrapped = display.parse_args(command[2:])
|
|
if (wrapped.query_worker or wrapped.prefix != args.prefix or wrapped.profile != args.profile or
|
|
wrapped.game_executable != args.game_executable or wrapped.host_display != args.host_display or
|
|
wrapped.report == args.report):
|
|
raise Refused('Read-only wrapper context differs')
|
|
display.validate_paths(wrapped)
|
|
native = wrapped.command[1:] if wrapped.command[:1] == ['--'] else wrapped.command
|
|
proton = Path.home() / '.local/share/Steam/steamapps/common/Proton - Experimental/proton'
|
|
if len(native) < 3 or native[:3] != [str(proton), 'run', str(args.game_executable)]:
|
|
raise Refused('Expected exact installed Proton/game command')
|
|
if (option(native, '-errOrdinaryInputObserve') != args.nonce or
|
|
option(native, '-profile') != 'Z:' + str(args.profile) or
|
|
option(native, '-errOrdinaryScenario') not in ('core', 'chat')):
|
|
raise Refused('Wrapped native observer context differs')
|
|
return command
|
|
|
|
|
|
def sessions(profile):
|
|
folder = profile / 'logs'
|
|
if not folder.exists():
|
|
return set()
|
|
if folder.is_symlink() or not folder.is_dir():
|
|
raise Refused('Invalid private native logs directory')
|
|
return {path for path in folder.iterdir() if re.fullmatch(r'logs_\d{4}-\d{2}-\d{2}_\d{2}-\d{2}-\d{2}', path.name)}
|
|
|
|
|
|
def console_path(args):
|
|
path = args.console
|
|
if (path != path.resolve() or path.name != 'console.log' or
|
|
path.parent.parent != args.profile / 'logs' or
|
|
not re.fullmatch(r'logs_\d{4}-\d{2}-\d{2}_\d{2}-\d{2}-\d{2}', path.parent.name)):
|
|
raise Refused('Expected exact canonical native session console')
|
|
|
|
|
|
def main(argv=None):
|
|
args = arguments(argv)
|
|
args.observe_seconds = 25; args.query_worker = False
|
|
display.validate_paths(args)
|
|
if not re.fullmatch(r'[A-Za-z0-9]{1,32}', args.nonce):
|
|
raise Refused('Invalid observer nonce')
|
|
command = wrapper_command(args)
|
|
if args.console is not None:
|
|
console_path(args)
|
|
bound = display.binding(args.host_display, args.prefix)
|
|
report = {'schema': 1, 'kind': 'headless-private-keyboard-experiment', 'input_sent': False,
|
|
'sequence_completed': False, 'release_qualified': False, 'gameplay_qualified': False,
|
|
'hard_supervision': NOTIFY is not None, 'nonce': args.nonce, 'binding': bound, 'command': command, 'report': str(args.report), 'input_attempted': False,
|
|
'helper_sha256': hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),
|
|
'ownership_helper_sha256': hashlib.sha256(Path(display.__file__).read_bytes()).hexdigest(),
|
|
'prefix': str(args.prefix), 'profile': str(args.profile), 'game_executable': str(args.game_executable)}
|
|
fd = os.open(args.report, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
|
|
info = os.fstat(fd)
|
|
notify({'kind': 'report', 'path': str(args.report), 'device': info.st_dev, 'inode': info.st_ino,
|
|
'metadata': report})
|
|
query = observer = child = None
|
|
before_sessions = sessions(args.profile) if command else set()
|
|
deadline = time.monotonic() + 180
|
|
previous = {}
|
|
def interrupted(signum, frame):
|
|
if report.get('sequence_completed') and fd is None and child is not None:
|
|
if child.poll() is None:
|
|
child.send_signal(signum)
|
|
return
|
|
raise Refused('Input experiment interrupted by signal ' + str(signum))
|
|
try:
|
|
for signum in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
|
|
previous[signum] = signal.signal(signum, interrupted)
|
|
if command:
|
|
child = subprocess.Popen(command) # inherit the existing private process group
|
|
notify({'kind': 'child', 'identity': display.identity(display.process(child.pid)), 'command': command})
|
|
while time.monotonic() < deadline:
|
|
if child.poll() is not None:
|
|
raise Refused('Read-only wrapper exited before native session')
|
|
if display.binding(args.host_display, args.prefix) != bound:
|
|
raise Refused('Display binding changed during startup')
|
|
new = sessions(args.profile) - before_sessions
|
|
if len(new) > 1:
|
|
raise Refused('Ambiguous new native sessions')
|
|
if new:
|
|
candidate = next(iter(new)) / 'console.log'
|
|
if candidate.exists():
|
|
args.console = candidate; console_path(args); break
|
|
time.sleep(.1)
|
|
if args.console is None:
|
|
raise Refused('New native console deadline exceeded')
|
|
report['console'] = str(args.console)
|
|
observer = Observer(args.console, args.nonce)
|
|
query = display.X11(bound['display'])
|
|
while time.monotonic() < deadline:
|
|
if child is not None and child.poll() is not None:
|
|
raise Refused('Read-only wrapper exited during startup')
|
|
observer.poll()
|
|
if display.binding(args.host_display, args.prefix) != bound:
|
|
raise Refused('Display binding changed during window startup')
|
|
query.query_budget = display.MAX_WINDOWS
|
|
owners = [owner for window in query.windows()
|
|
if (owner := display.owned_window(window, bound, args.prefix, args.game_executable))]
|
|
eligible = [owner for owner in owners[:16] if display.input_target(query, owner).get('verified') is True]
|
|
exact = [owner for owner in eligible if query.focus()[0] == owner['window']]
|
|
selected = exact or eligible
|
|
if len(selected) == 1:
|
|
break
|
|
if len(selected) > 1:
|
|
raise Refused('Ambiguous mapped focused owned game windows')
|
|
time.sleep(.1)
|
|
else:
|
|
raise Refused('Mapped owned game window deadline exceeded')
|
|
owner = selected[0]
|
|
report['owner'] = {key: owner[key] for key in ('window', 'pid', 'server_pid', 'process')}
|
|
guard = Guard(args, bound, query, owner)
|
|
guard.check()
|
|
keyboard = Keyboard(query)
|
|
keyboard.require_idle()
|
|
sequence(guard, keyboard, observer, report)
|
|
except (OSError, ValueError, UnicodeError, subprocess.SubprocessError) as error:
|
|
report['error'] = str(error)
|
|
finally:
|
|
report['whole_process_group_cleanup_verified'] = False # outer runner owns it
|
|
if observer:
|
|
report['observer'] = {'inode': observer.identity, 'start_offset': observer.start_offset,
|
|
'end_offset': observer.offset, 'records': observer.raw, 'events': observer.events}
|
|
observer.close()
|
|
if query:
|
|
query.close()
|
|
with os.fdopen(fd, 'w') as stream:
|
|
fd = None
|
|
json.dump(report, stream, indent=2); stream.write('\n'); stream.flush(); os.fsync(stream.fileno())
|
|
notify({'kind': 'proof-finished', 'successful': report['sequence_completed'] and not report.get('error')})
|
|
child_code = 0
|
|
try:
|
|
if child is not None:
|
|
if report.get('error'):
|
|
child.terminate()
|
|
child_code = child.wait(timeout=max(.1, deadline - time.monotonic()) if not report.get('error') else 5)
|
|
except subprocess.TimeoutExpired:
|
|
child.terminate()
|
|
try:
|
|
child.wait(timeout=5)
|
|
except subprocess.TimeoutExpired:
|
|
child.kill(); child.wait(timeout=2)
|
|
child_code = 1
|
|
finally:
|
|
for signum, handler in previous.items():
|
|
signal.signal(signum, handler)
|
|
return 0 if report['sequence_completed'] and not report.get('error') and child_code == 0 else 1
|
|
|
|
|
|
def worker_entry(argv, pipe):
|
|
global NOTIFY
|
|
NOTIFY = pipe
|
|
try:
|
|
code = main(argv)
|
|
finally:
|
|
pipe.close()
|
|
raise SystemExit(code)
|
|
|
|
|
|
def stop_exact_child(record, read=display.process, kill=os.kill):
|
|
if record is None:
|
|
return False
|
|
try:
|
|
current = read(record['identity']['pid'])
|
|
if (display.identity(current) != record['identity'] or current['args'] != record['command'] or
|
|
current['uid'] != os.getuid()):
|
|
return False
|
|
# Only the exact display wrapper created by our worker; no group signalling.
|
|
kill(current['pid'], signal.SIGTERM)
|
|
return True
|
|
except (OSError, ValueError, KeyError):
|
|
return False
|
|
|
|
|
|
def supervision_failure(record, key, reason):
|
|
"""Amend only the exact exclusive report created by our now-stopped worker."""
|
|
if record is None:
|
|
return
|
|
fd = os.open(record['path'], os.O_RDWR | os.O_NOFOLLOW)
|
|
try:
|
|
info = os.fstat(fd)
|
|
if (info.st_dev, info.st_ino) != (record['device'], record['inode']) or info.st_uid != os.getuid() or not stat.S_ISREG(info.st_mode):
|
|
raise Refused('Worker report changed before timeout recording')
|
|
raw = os.read(fd, 2 * 1024 * 1024)
|
|
try:
|
|
report = json.loads(raw) if raw else dict(record['metadata'])
|
|
except (ValueError, UnicodeError):
|
|
report = dict(record['metadata'])
|
|
# Keep the worker's actual refusal; supervisor lifecycle is separate evidence.
|
|
key = key or report.get('unconfirmed_held_key')
|
|
report.setdefault('error', reason)
|
|
report.update(supervision_failed=True, supervision_error=reason, sequence_completed=False,
|
|
all_attempted_presses_released=key is None and report.get('all_attempted_presses_released', True),
|
|
unconfirmed_held_key=key)
|
|
if key is not None:
|
|
report['input_attempted'] = True
|
|
report.setdefault('paired_release_errors', []).append('Supervisor could not confirm paired key release')
|
|
payload = (json.dumps(report, indent=2) + '\n').encode()
|
|
os.lseek(fd, 0, os.SEEK_SET); os.write(fd, payload); os.ftruncate(fd, len(payload)); os.fsync(fd)
|
|
finally:
|
|
os.close(fd)
|
|
|
|
|
|
def supervise(argv=None):
|
|
# Fork before loading Xlib or opening any display. The worker owns the one
|
|
# connection. Parent never opens a second connection or retries an event.
|
|
context = multiprocessing.get_context('fork')
|
|
parent, child_pipe = context.Pipe(duplex=False)
|
|
child = context.Process(target=worker_entry, args=(argv, child_pipe))
|
|
previous = {}; received = []
|
|
def forward(signum, frame):
|
|
received.append(signum)
|
|
if child.pid and child.is_alive():
|
|
os.kill(child.pid, signum)
|
|
for signum in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
|
|
previous[signum] = signal.signal(signum, forward)
|
|
held_at = None; held_key = None; owned_child = None; report_record = None; proof_finished = False; expired = False
|
|
deadline = time.monotonic() + 190
|
|
try:
|
|
child.start(); child_pipe.close()
|
|
while child.is_alive():
|
|
if parent.poll(.05):
|
|
try:
|
|
event = parent.recv()
|
|
except EOFError:
|
|
event = None
|
|
if event and event['kind'] == 'press-pending':
|
|
held_at = time.monotonic(); held_key = event['key']
|
|
elif event and event['kind'] == 'release-confirmed':
|
|
held_at = None; held_key = None
|
|
elif event and event['kind'] == 'child':
|
|
owned_child = event
|
|
elif event and event['kind'] == 'report':
|
|
report_record = event
|
|
elif event and event['kind'] == 'proof-finished':
|
|
proof_finished = event['successful']
|
|
now = time.monotonic()
|
|
if received or now >= deadline or (held_at is not None and now - held_at > 1.5):
|
|
expired = True
|
|
child.terminate() # asks worker finally to release if still provable
|
|
child.join(1)
|
|
stop_exact_child(owned_child)
|
|
if child.is_alive():
|
|
child.kill(); child.join(2)
|
|
# Drain release acknowledgements emitted during cooperative finally.
|
|
while parent.poll():
|
|
try:
|
|
last = parent.recv()
|
|
except EOFError:
|
|
break
|
|
if last['kind'] == 'release-confirmed':
|
|
held_key = None
|
|
elif last['kind'] == 'report':
|
|
report_record = last
|
|
elif last['kind'] == 'proof-finished':
|
|
proof_finished = last['successful']
|
|
if not (received and proof_finished and held_key is None):
|
|
supervision_failure(report_record, held_key, 'Private input worker timed out or was interrupted')
|
|
break
|
|
child.join(2)
|
|
if child.exitcode != 0 and not expired:
|
|
stop_exact_child(owned_child)
|
|
if not (received and proof_finished and held_key is None):
|
|
supervision_failure(report_record, held_key, 'Private input worker exited unsuccessfully')
|
|
return 1 if expired or child.exitcode != 0 else 0
|
|
finally:
|
|
if child.pid and child.is_alive():
|
|
child.terminate(); child.join(1)
|
|
stop_exact_child(owned_child)
|
|
if child.is_alive():
|
|
child.kill(); child.join(2)
|
|
parent.close()
|
|
for signum, handler in previous.items():
|
|
signal.signal(signum, handler)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
raise SystemExit(supervise())
|