mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-08 17:58:13 +01:00
garrytanandcapy-ai[bot]
03acc162d1
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
258 lines
11 KiB
Bash
Executable File
258 lines
11 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gstack-lease — the workflow lease on a shared gstack installation. Several
|
|
# agents (eight Capy subagents, say) share one checkout; a session-start
|
|
# fast-forward must not move it under a session mid-workflow. The state-root
|
|
# session markers (bin/gstack-skill-start) differ per agent, so an updater
|
|
# cannot see them; leases live in the installation's own git dir, beside
|
|
# gstack-upgrade.pending, where every session and updater of this checkout
|
|
# shares them.
|
|
#
|
|
# Usage:
|
|
# gstack-lease touch [--root <checkout>] [--pid <p> | --from <pid>]
|
|
# write <git dir>/gstack-leases/<pid> holding the pid's start identity;
|
|
# pid defaults to the harness pid behind this call
|
|
# (bin/gstack-harness-pid.sh, the same derivation the session marker
|
|
# uses), or behind --from (a caller whose own parent is short-lived
|
|
# passes its parent pid); leases older than 120 min are pruned. Exits 3
|
|
# and writes nothing when a live process holds the directory lock
|
|
# gstack-lease live [--root <checkout>] [--exclude-ancestry-of <pid>]
|
|
# print `<pid> <age>m <command>` per lease held by a live process that
|
|
# is neither the given pid nor one of its ancestors (the caller's own
|
|
# session); exit 0 when any live lease exists, 1 when none. A stale lease
|
|
# is reclaimed (deleted, one `gstack-lease: reclaimed …` line on stderr)
|
|
# gstack-lease list [--root <checkout>]
|
|
# print `<pid> <age>m alive|dead|stale` for every lease
|
|
# A pid alone is not a holder: pids are reused after a reboot or a machine
|
|
# wake. A lease records its process's start identity (Linux: boot id and
|
|
# /proc start time; elsewhere `ps -o lstart`), and a lease whose pid now
|
|
# belongs to another process is stale. A lease without an identity (written by
|
|
# an older gstack) is stale once it is older than the 120-minute prune window.
|
|
# <checkout> defaults to the source checkout behind this bin (an installed
|
|
# runtime root's .source-path, else ../). A root that is not a git checkout
|
|
# exits 2 and writes nothing. GSTACK_LEASE_DIR overrides the lease directory
|
|
# (hermetic tests; a dev checkout's own tests must not lease it). Bash 3.2
|
|
# plus git, ps, find, mkdir, mv, readlink.
|
|
set -u
|
|
BIN="$(cd "$(dirname "$0")" && pwd -P)"
|
|
# shellcheck source=bin/gstack-install-verdict.sh
|
|
. "$BIN/gstack-install-verdict.sh" 2>/dev/null || gstack_source_root() { (cd "$1/.." && pwd -P); }
|
|
# shellcheck source=bin/gstack-harness-pid.sh
|
|
. "$BIN/gstack-harness-pid.sh" 2>/dev/null || gstack_harness_pid() { printf '%s\n' "$1"; }
|
|
|
|
VERB="${1:-}"; [ $# -gt 0 ] && shift
|
|
ROOT="" PID="" EXCLUDE="" FROM=""
|
|
while [ $# -gt 0 ]; do
|
|
case "$1" in
|
|
--root) ROOT="${2:-}"; shift ;;
|
|
--pid) PID="${2:-}"; shift ;;
|
|
--from) FROM="${2:-}"; shift ;;
|
|
--exclude-ancestry-of) EXCLUDE="${2:-}"; shift ;;
|
|
*) echo "gstack-lease: unknown argument '$1'" >&2; exit 2 ;;
|
|
esac
|
|
shift
|
|
done
|
|
case "$VERB" in
|
|
touch|live|list) ;;
|
|
-h|--help|'') sed -n '2,24p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
|
|
*) echo "gstack-lease: unknown verb '$VERB'" >&2; exit 2 ;;
|
|
esac
|
|
[ -n "$ROOT" ] || ROOT=$(gstack_source_root "$BIN")
|
|
GIT_DIR_ABS=$(git -C "$ROOT" rev-parse --absolute-git-dir 2>/dev/null) \
|
|
|| { echo "gstack-lease: $ROOT is not a git checkout" >&2; exit 2; }
|
|
DIR="${GSTACK_LEASE_DIR:-$GIT_DIR_ABS/gstack-leases}"
|
|
|
|
alive() { kill -0 "$1" 2>/dev/null || ps -p "$1" >/dev/null 2>&1; }
|
|
identity() { # PID — the process's start identity, empty when unknown
|
|
if [ -r "/proc/$1/stat" ] && [ -r /proc/sys/kernel/random/boot_id ]; then
|
|
_st=$(cat "/proc/$1/stat" 2>/dev/null) || return 0
|
|
_st=${_st##*) }
|
|
_id="linux $(cat /proc/sys/kernel/random/boot_id 2>/dev/null) $(printf '%s\n' "$_st" | awk '{print $20}')"
|
|
else
|
|
_id="ps $(LC_ALL=C TZ=UTC0 ps -o lstart= -p "$1" 2>/dev/null | sed 's/^ *//; s/ *$//')"
|
|
fi
|
|
valid_identity "$_id" && printf '%s\n' "$_id"
|
|
return 0
|
|
}
|
|
# valid_identity ID — a well-formed identity from either backend
|
|
valid_identity() {
|
|
case "$1" in
|
|
"linux "*) printf '%s\n' "$1" | grep -Eq '^linux [0-9a-f-]{36} [0-9]+$' ;;
|
|
"ps "?*) case "$1" in "ps "*[!\ ]*) return 0 ;; esac; return 1 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
# state PID RECORD AGE — alive | dead | stale for a lease whose record (first
|
|
# line) and age were read once by the caller. Stale needs proof: two
|
|
# well-formed identities from the same backend that differ. An identity that
|
|
# cannot be read now, a malformed record or a backend change keeps the lease
|
|
# (never reclaim a live session on missing evidence).
|
|
state() {
|
|
alive "$1" || { echo dead; return; }
|
|
if [ -z "$2" ]; then
|
|
[ "$3" -ge 120 ] && echo stale || echo alive
|
|
return
|
|
fi
|
|
_now=$(identity "$1")
|
|
if valid_identity "$2" && [ -n "$_now" ] && [ "${2%% *}" = "${_now%% *}" ] && [ "$2" != "$_now" ]; then echo stale
|
|
else echo alive
|
|
fi
|
|
}
|
|
# The lease directory's lock: touch's publish and prune, and reclaim's
|
|
# reread-and-delete, run under it, so a reclaim never deletes a renewal and a
|
|
# lease never disappears while it is live. The lock is a directory, .lock,
|
|
# whose owner file names its holder (`<pid> <start identity>`); mkdir is
|
|
# atomic everywhere gstack runs, Git Bash on Windows included, where ln -s to a
|
|
# target that does not exist always fails (#3330). A taker publishes its token
|
|
# as a claim (.lock.claim.<pid>) before its mkdir and renames the claim into
|
|
# the lock as its owner after, so a lock without an owner is either being
|
|
# taken by a live claimant or orphaned by a dead one. A lock is broken only
|
|
# when its holder (or, ownerless, every claimant) is dead or its pid now
|
|
# belongs to another process, never by age, and unlock removes only the
|
|
# caller's own lock. A symlink .lock left by an older gstack names its holder
|
|
# the same way and excludes a directory lock at the same path. A live holder
|
|
# makes lock() give up after GSTACK_LEASE_LOCK_TRIES tries 0.1 s apart
|
|
# (default 300).
|
|
LOCK="$DIR/.lock" TOKEN=""
|
|
# take PATH — create the lock PATH owned by TOKEN; 1 when it exists.
|
|
take() {
|
|
printf '%s\n' "$TOKEN" > "$1.claim.$$" || return 1
|
|
if mkdir "$1" 2>/dev/null; then
|
|
mv -f "$1.claim.$$" "$1/owner" && return 0
|
|
rm -rf "$1"
|
|
fi
|
|
rm -f "$1.claim.$$"
|
|
return 1
|
|
}
|
|
# owner_of PATH — the token the lock PATH names, empty when it names none.
|
|
owner_of() { if [ -L "$1" ]; then readlink "$1" 2>/dev/null; else head -1 "$1/owner" 2>/dev/null; fi; }
|
|
# orphaned PATH — PATH is a lock directory without an owner and no live
|
|
# claimant. Claims are read before the owner, so a taker that renames its
|
|
# claim in between is seen as the owner. An empty claim is a taker that has
|
|
# not reached its mkdir, so it never made this lock.
|
|
orphaned() {
|
|
[ -d "$1" ] && [ ! -L "$1" ] || return 1
|
|
for _c in "$1".claim.*; do
|
|
_t=$(head -1 "$_c" 2>/dev/null)
|
|
[ -n "$_t" ] && ! holder_gone "$_t" && return 1
|
|
done
|
|
[ ! -e "$1/owner" ]
|
|
}
|
|
# drop PATH — remove a lock in one step: a directory is renamed aside first,
|
|
# so nobody sees it ownerless on the way out.
|
|
drop() {
|
|
if [ -L "$1" ]; then rm -f "$1"; return; fi
|
|
mv "$1" "$1.gone.$$" 2>/dev/null && rm -rf "$1.gone.$$"
|
|
}
|
|
lock() {
|
|
[ -n "$TOKEN" ] || TOKEN="$$ $(identity $$)"
|
|
_tries=0 _gone=0
|
|
until take "$LOCK"; do
|
|
LOCK_OWNER=$(owner_of "$LOCK")
|
|
if [ ! -e "$LOCK" ] && [ ! -L "$LOCK" ]; then
|
|
# Released since take, or take itself cannot work here: never wait out
|
|
# the tries for a lock nobody holds.
|
|
_gone=$((_gone + 1))
|
|
[ "$_gone" -ge 3 ] && return 1
|
|
continue
|
|
fi
|
|
_gone=0 _tries=$((_tries + 1))
|
|
if [ -n "$LOCK_OWNER" ]; then holder_gone "$LOCK_OWNER" && break_lock "$LOCK_OWNER" && continue
|
|
elif orphaned "$LOCK"; then break_lock "" && continue
|
|
fi
|
|
[ "$_tries" -ge "${GSTACK_LEASE_LOCK_TRIES:-300}" ] && return 1
|
|
sleep 0.1
|
|
done
|
|
}
|
|
holder_gone() { case "$(state "${1%% *}" "${1#* }" 0)" in dead|stale) return 0 ;; esac; return 1; }
|
|
# break_lock OWNER — remove the lock only if it still names OWNER (empty: is
|
|
# still orphaned). Breakers take a second lock, .lock.break, and reread the
|
|
# lock under it, so a lock taken since the verdict is never removed; a
|
|
# .lock.break whose holder is gone is cleared. Returns 1 when another breaker
|
|
# holds .lock.break. Known limit: that clear is not atomic, so two
|
|
# gstack-lease processes killed in a row (one holding .lock, the next inside
|
|
# this function) can let a reclaim delete a renewal; one crash is always safe.
|
|
break_lock() {
|
|
if ! take "$LOCK.break"; then
|
|
_b=$(owner_of "$LOCK.break")
|
|
if [ -n "$_b" ]; then
|
|
holder_gone "$_b" && [ "$(owner_of "$LOCK.break")" = "$_b" ] && drop "$LOCK.break"
|
|
else
|
|
orphaned "$LOCK.break" && drop "$LOCK.break"
|
|
fi
|
|
return 1
|
|
fi
|
|
if [ -n "$1" ]; then
|
|
[ "$(owner_of "$LOCK")" = "$1" ] && drop "$LOCK"
|
|
else
|
|
orphaned "$LOCK" && drop "$LOCK"
|
|
fi
|
|
drop "$LOCK.break"
|
|
return 0
|
|
}
|
|
unlock() { [ "$(owner_of "$LOCK")" = "$TOKEN" ] && { drop "$LOCK" || rm -rf "$LOCK"; }; return 0; }
|
|
# reclaim FILE RECORD — delete a stale lease only if, under the lock, it still
|
|
# holds the record judged stale; a renewal since then keeps it.
|
|
reclaim() {
|
|
lock || return 1
|
|
if [ "$(head -1 "$1" 2>/dev/null)" = "$2" ]; then rm -f "$1"; unlock; return 0; fi
|
|
unlock
|
|
return 1
|
|
}
|
|
age_min() { # FILE — minutes since its mtime
|
|
_m=$(stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null || echo 0)
|
|
echo $(( ( $(date +%s) - _m ) / 60 ))
|
|
}
|
|
|
|
case "$VERB" in
|
|
touch)
|
|
[ -n "$PID" ] || PID=$(gstack_harness_pid "${FROM:-$PPID}")
|
|
mkdir -p "$DIR" || exit 2
|
|
lock || {
|
|
if [ -n "${LOCK_OWNER:-}" ]; then echo "gstack-lease: the lease directory is locked by live process ${LOCK_OWNER%% *}; lease $PID not renewed" >&2
|
|
else echo "gstack-lease: cannot take the lease directory lock $LOCK; lease $PID not renewed" >&2
|
|
fi
|
|
exit 3
|
|
}
|
|
_tmp="$DIR/.$PID.$$"
|
|
identity "$PID" > "$_tmp" && mv -f "$_tmp" "$DIR/$PID" || { rm -f "$_tmp"; unlock; exit 2; }
|
|
find "$DIR" -mmin +120 -type f -exec rm -f {} + 2>/dev/null
|
|
unlock
|
|
exit 0 ;;
|
|
list)
|
|
for f in "$DIR"/*; do
|
|
[ -f "$f" ] || continue
|
|
p=${f##*/}
|
|
_age=$(age_min "$f")
|
|
echo "$p ${_age}m $(state "$p" "$(head -1 "$f" 2>/dev/null)" "$_age")"
|
|
done
|
|
exit 0 ;;
|
|
esac
|
|
|
|
# live: the caller's own chain (the pid and its ancestors, up to 64 hops) never counts.
|
|
ANCESTRY=" "
|
|
p="$EXCLUDE"; hops=0
|
|
while [ -n "$p" ] && [ "$hops" -lt 64 ]; do
|
|
case "$p" in ''|*[!0-9]*|0|1) break ;; esac
|
|
ANCESTRY="$ANCESTRY$p "
|
|
p=$(ps -o ppid= -p "$p" 2>/dev/null | tr -d ' ')
|
|
hops=$((hops + 1))
|
|
done
|
|
FOUND=1
|
|
for f in "$DIR"/*; do
|
|
[ -f "$f" ] || continue
|
|
p=${f##*/}
|
|
case "$ANCESTRY" in *" $p "*) continue ;; esac
|
|
_rec=$(head -1 "$f" 2>/dev/null) _age=$(age_min "$f")
|
|
case "$(state "$p" "$_rec" "$_age")" in
|
|
dead) continue ;;
|
|
stale)
|
|
if reclaim "$f" "$_rec"; then
|
|
echo "gstack-lease: reclaimed stale lease $p (${_age}m; recorded '$_rec', pid $p is now $(ps -o comm= -p "$p" 2>/dev/null | head -1) '$(identity "$p")')" >&2
|
|
continue
|
|
fi ;;
|
|
esac
|
|
echo "$p $(age_min "$f")m $(ps -o comm= -p "$p" 2>/dev/null | head -1 | sed 's|.*/||')"
|
|
FOUND=0
|
|
done
|
|
exit $FOUND
|