mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-08 00:54:38 +02:00
108 lines
11 KiB
Python
108 lines
11 KiB
Python
"""Sparse additive instrumentation of one pinned bundle; never edits vendor closure bytes."""
|
|
import hashlib,json
|
|
from source_guard import require
|
|
ORIGINAL_SHA='ce987993ffb92f449ef0432dee6cd7eb90ea19521ce3d7b51a185fed16ed8c47'
|
|
BBA_SHA='c7c331492378017d474ab732648dc96c0ece08466983e11be795d60abb9ed99c'
|
|
PREFIX='__pcStartupDiagnostic'
|
|
|
|
def patch_sidecar(original,sink,expected_sha=ORIGINAL_SHA):
|
|
require(expected_sha in {ORIGINAL_SHA,BBA_SHA} and hashlib.sha256(original).hexdigest()==expected_sha,'Diagnostic sidecar original digest mismatch')
|
|
require(set(sink)=={'path','dev','ino','uid'} and sink['path'].startswith('/private/tmp/pc-intel-diagnostic-') and sink['path'].endswith('/startup-timings.jsonl'),'Unexpected timing sink binding')
|
|
require(all(isinstance(sink[k],str) and sink[k].isdigit() for k in ['dev','ino','uid']),'Sink identity must use decimal strings')
|
|
text=original.decode();insertions=[];labels=[]
|
|
def mark(scope,anchor,label,after=False):
|
|
start=text.rindex(scope) if scope else 0
|
|
end=text.find('\n// src/',start+len(scope)) if scope else len(text)
|
|
if end<0:end=len(text)
|
|
sub=text[start:end];require(sub.count(anchor)==1,'Missing/ambiguous timing anchor: '+label)
|
|
pos=start+sub.index(anchor)+(len(anchor) if after else 0)
|
|
insertions.append((pos,'\n'+PREFIX+'Mark('+json.dumps(label)+');\n'));labels.append(label)
|
|
mark('', '#!/usr/bin/env node\n','sidecar.entry',True)
|
|
mark('// src/cli/acpx-runtime-sidecar.ts','async function dispatch(request) {','sidecar.dispatch',True)
|
|
mark('// src/cli/acpx-runtime-sidecar.ts','if (request.command === "session.open") {','session.open.begin',True)
|
|
mark('// src/cli/acpx-runtime-sidecar.ts',' host = openedHost;','session.open.admitted')
|
|
mark('// src/cli/acpx-runtime-sidecar.ts',' const normalized = error51 instanceof Error ? error51 : new Error(String(error51));','sidecar.command.error')
|
|
mark('// src/cli/acpx-runtime-sidecar.ts','function requestShutdown(reason) {','sidecar.shutdown.request',True)
|
|
mark('// src/drivers/acpx/runtime-host.ts',' static async open(options, dependencies) {','host.open.begin',True)
|
|
mark('// src/drivers/acpx/runtime-host.ts',' const installation = await runAbortableAdmissionStage(','installation.begin')
|
|
mark('// src/drivers/acpx/runtime-host.ts',' if (installation.commandDigest !== profile.commandDigest) {','installation.end')
|
|
mark('// src/drivers/acpx/runtime-host.ts',' const sandbox = await runAbortableAdmissionStage(','sandbox.begin')
|
|
mark('// src/drivers/acpx/runtime-host.ts',' assertAcpxProfileEnvironment(options.agent, sandbox.launchEnvironment);','sandbox.lifetime.end')
|
|
mark('// src/drivers/acpx/runtime-host.ts',' command = await acquireAbortableAdmissionResource({','command.acquire.begin')
|
|
mark('// src/drivers/acpx/runtime-host.ts',' const commandOwner = createAcpxCommandLeaseOwner(','command.acquire.end')
|
|
mark('// src/drivers/acpx/runtime-host.ts',' runtime = await acquireAbortableAdmissionResource({','runtime.acquire.begin')
|
|
mark('// src/drivers/acpx/pi-installation.ts','async function verifyPiInstallation(profile) {','pi.install.begin',True)
|
|
mark('// src/drivers/acpx/pi-installation.ts',' const entries = await readNativeAcpxDistributionEntries(declaration);','pi.native_manifest.begin')
|
|
mark('// src/drivers/acpx/pi-installation.ts',' const layout = await verifyPiRuntimeLayoutForNativeSnapshot(runtimeRoot, manifest, { entries }, expectedClosure);','pi.native_manifest.end')
|
|
mark('// src/drivers/acpx/pi-installation.ts',' return Object.freeze({','pi.install.end')
|
|
mark('// src/drivers/acpx/pi-verified-runtime.ts','async function discoverPiRuntimeFiles(root) {','pi.discovery.begin',True)
|
|
mark('// src/drivers/acpx/pi-verified-runtime.ts',' await visit(physicalRoot);','pi.discovery.end',True)
|
|
mark('// src/drivers/acpx/pi-verified-runtime.ts','async function verifyPiRuntimeLayoutForNativeSnapshot(root, manifest, nativeManifest, expectedClosureSha256) {','pi.layout.begin',True)
|
|
mark('// src/drivers/acpx/pi-verified-runtime.ts',' return { manifestDigest };','pi.layout.end')
|
|
mark('// src/drivers/acpx/native-distribution-integrity.ts','async function createNativeAcpxDistributionSnapshot(input, entries) {','snapshot.begin',True)
|
|
mark('// src/drivers/acpx/native-distribution-integrity.ts',' for (const depth of [...parentLevels.keys()].sort((a, b) => a - b)) {','snapshot.directories.begin')
|
|
mark('// src/drivers/acpx/native-distribution-integrity.ts',' const copyEntry = async (entry) => {','snapshot.directories.end')
|
|
mark('// src/drivers/acpx/native-distribution-integrity.ts',' const active = /* @__PURE__ */ new Set();','snapshot.copy.begin')
|
|
mark('// src/drivers/acpx/native-distribution-integrity.ts',' const executable = (0, import_node_path5.join)(packageRoot, ...input.executable.split("/"));','snapshot.copy.end')
|
|
mark('// src/drivers/acpx/native-distribution-integrity.ts',' await directoryBatch([...directories], (path3) => (0, import_promises6.chmod)(path3, 320));','snapshot.seal.begin')
|
|
mark('// src/drivers/acpx/native-distribution-integrity.ts',' return { commandDirectory, bootstrap, snapshot:','snapshot.seal.end')
|
|
mark('// src/drivers/acpx/installation-integrity.ts',' const lease = commandLease(','command.lease.begin')
|
|
mark('// src/drivers/acpx/installation-integrity.ts',' return {\n spawn(args = [], options = {}, lifetime) {','command.lease.end')
|
|
mark('// src/drivers/acpx/installation-integrity.ts',' if (consumed) throw new Error("Verified ACPX command lease is closed");','command.spawn.begin')
|
|
mark('// src/drivers/acpx/installation-integrity.ts',' const runtimeHandoff = verifiedRuntimeExecutableHandoff(runtimeTargetFd);','runtime.handoff.begin')
|
|
mark('// src/drivers/acpx/installation-integrity.ts',' const environment = sanitizedNodeEnvironment(options.env);','runtime.handoff.end')
|
|
mark('// src/drivers/acpx/installation-integrity.ts',' child = (0, import_node_child_process2.spawn)(','command.os_spawn.begin')
|
|
mark('// src/drivers/acpx/installation-integrity.ts',' if (guarded) {\n const guardianOwnerPipe','command.os_spawn.end')
|
|
mark('// src/drivers/acpx/codex-runtime-adapter.ts',' onAgentInitialize: (result) => {','wrapper.initialize.ack',True)
|
|
mark('// src/drivers/acpx/codex-runtime-adapter.ts',' commandLaunches.count += 1;','runtime.spawn.callback')
|
|
mark('// src/drivers/acpx/codex-runtime-adapter.ts',' const ensuredSession = Promise.resolve().then(','runtime.ensure.begin')
|
|
mark('// src/drivers/acpx/codex-runtime-adapter.ts',' cursorInstructions?.assertReady();','runtime.ensure.settled')
|
|
# Native RPC internals remain in the unchanged closure; these are ACP boundaries only.
|
|
mark('', ' async initializeProtocolConnection(connection, launch) {', 'acp.initialize.begin', True)
|
|
mark('', ' await this.authenticateIfRequired(connection, initialized.authMethods ?? []);', 'acp.initialize.response')
|
|
mark('// src/drivers/acpx/pi-thinking.ts', ' if (method === "session/new" || method === "session/load") {', 'pi.acp.session.request', True)
|
|
mark('// src/drivers/acpx/pi-thinking.ts', ' const result = object(message.result);', 'pi.acp.correlated.response')
|
|
mark('// src/drivers/acpx/pi-thinking.ts', ' state.mode = mode;', 'pi.acp.mode.verified', True)
|
|
mark('// src/drivers/acpx/codex-runtime-adapter.ts', ' await runtime.setConfigOption({ handle: ensuredHandle, key: "thought_level", value: selectedPiThinkingLevel });', 'pi.acp.thought_level.begin')
|
|
mark('// src/drivers/acpx/codex-runtime-adapter.ts', ' piThinking.assertReady();', 'pi.acp.thought_level.verified', True)
|
|
# Catch-all standalone function boundaries relevant to verified-runtime preparation.
|
|
for name in ['verifyAcpxProfileInstallation','verifyQualifiedRuntimeExecutable','openVerifiedRuntimeExecutable','openVerifiedCommandDirectory','createAcpxPrivateSnapshot','acquireAcpxProviderLifetimeLease']:
|
|
anchor='async function '+name+'('
|
|
start=text.index(anchor);body=text.index(' {\n',start)+3
|
|
label='entry.'+name
|
|
insertions.append((body,'\n'+PREFIX+'Mark('+json.dumps(label)+');\n'));labels.append(label)
|
|
require(len(labels)==len(set(labels)),'Duplicate diagnostic phase')
|
|
prelude='''
|
|
// Explicit diagnostic derivative: bounded phase-only sink, no runtime policy changes.
|
|
const __pcStartupDiagnosticFs = require("node:fs");
|
|
const __pcStartupDiagnosticBinding = SINK_BINDING;
|
|
const __pcStartupDiagnosticAllowed = new Set(ALLOWED_PHASES);
|
|
let __pcStartupDiagnosticFd = null, __pcStartupDiagnosticRows = 0, __pcStartupDiagnosticBytes = 0, __pcStartupDiagnosticFailed = false;
|
|
function __pcStartupDiagnosticMark(phase) {
|
|
if (__pcStartupDiagnosticFailed) return;
|
|
try {
|
|
if (!__pcStartupDiagnosticAllowed.has(phase) || ++__pcStartupDiagnosticRows > 128) throw new Error("diagnostic bound");
|
|
if (__pcStartupDiagnosticFd === null) __pcStartupDiagnosticFd = __pcStartupDiagnosticFs.openSync(__pcStartupDiagnosticBinding.path, __pcStartupDiagnosticFs.constants.O_WRONLY | __pcStartupDiagnosticFs.constants.O_APPEND | __pcStartupDiagnosticFs.constants.O_NOFOLLOW);
|
|
const st = __pcStartupDiagnosticFs.fstatSync(__pcStartupDiagnosticFd, {bigint:true});
|
|
if (!st.isFile() || st.nlink !== 1n || (st.mode & 511n) !== 384n || st.dev !== BigInt(__pcStartupDiagnosticBinding.dev) || st.ino !== BigInt(__pcStartupDiagnosticBinding.ino) || st.uid !== BigInt(__pcStartupDiagnosticBinding.uid)) throw new Error("diagnostic identity");
|
|
const line = JSON.stringify({phase, ns:process.hrtime.bigint().toString()}) + "\\n";
|
|
if ((__pcStartupDiagnosticBytes += Buffer.byteLength(line)) > 32768 || st.size + BigInt(Buffer.byteLength(line)) > 32768n) throw new Error("diagnostic bound");
|
|
__pcStartupDiagnosticFs.writeSync(__pcStartupDiagnosticFd,line);
|
|
__pcStartupDiagnosticFs.writeSync(2,"PC_STARTUP_TIMING " + line);
|
|
} catch {
|
|
__pcStartupDiagnosticFailed = true;
|
|
try { __pcStartupDiagnosticFs.writeSync(2,"PC_STARTUP_DIAGNOSTIC_SINK_FAILED\\n"); } catch {}
|
|
}
|
|
}
|
|
process.once("exit", () => __pcStartupDiagnosticMark("sidecar.exit"));
|
|
'''.replace('SINK_BINDING',json.dumps(sink)).replace('ALLOWED_PHASES',json.dumps(labels+['sidecar.exit']))
|
|
# Prelude must precede the first mark while preserving the original shebang.
|
|
insertions.append((text.index('\n')+1,prelude))
|
|
# Stable ordering at the shared header offset puts prelude before entry mark.
|
|
ordered=sorted(enumerate(insertions),key=lambda x:(x[1][0],0 if x[1][1]==prelude else 1,x[0]))
|
|
result=[];at=0;patch=[]
|
|
for _,(pos,value) in ordered:
|
|
result.append(text[at:pos]);result.append(value);patch.append({'offset':pos,'inserted':value});at=pos
|
|
result.append(text[at:]);modified=''.join(result).encode()
|
|
return modified,{'schema':'paperclip.startup-timing-additive-patch/v1','originalSha256':expected_sha,'diagnosticSha256':hashlib.sha256(modified).hexdigest(),'sinkBinding':sink,'phases':labels+['sidecar.exit'],'insertions':patch,'onlyAdditions':True,'vendorClosureChanged':False}
|