mirror of
https://github.com/stablyai/orca.git
synced 2026-10-23 16:03:49 +00:00
* perf(windows): read the process table natively instead of forking PowerShell Seven independent readers each forked powershell.exe to run Get-CimInstance Win32_Process, with a wmic fallback that Windows 11 24H2 has removed. On a domain-joined host with PowerShell Transcription enabled by policy, one of them running every ~2s recorded ~289GB across 1.4 million files (#15209). The same scan cost ~700ms and ran per pane (#15036), and a Group Policy or AV block turned it into 'unavailable', which callers read as 'no evidence' -- which is how a PTY tree survives its own teardown (#9045, #10475). A Toolhelp32 snapshot answers the same question with no child process. Measured on Windows 11 with 1050 processes, p50/p95: pid+ppid+name 15.9 / 17.5 ms +memory +command line 30.6 / 33.7 ms Get-CimInstance 706 / 723 ms Two upstream defects needed patching, both found by running it on real hardware. The binding requires Spectre-mitigated libraries our agents do not carry (node-pty is patched the same way). And enumeration stopped after 1024 processes: on a host with 1051 the module returned exactly 1024, and the querying process was itself among the 27 missing -- a truncated snapshot silently hides the descendants teardown is looking for, which is the failure this whole change exists to remove. Migrated: the foreground/descendant reader (the #15209 scraper and the teardown identity gate) and the port scanner's PID attribution. NOT migrated: the memory collector and three identity probes, which need Win32_Process.CreationDate and have no native equivalent. Start time is a proxy for identity anyway; an inherited job handle is the real answer, so those belong with the job-object work rather than here. Packaging follows the windows-native-registry contract exactly: optional, absent from onlyBuiltDependencies so macOS/Linux never run node-gyp, win32-only in the packaged runtime. Asserted by the existing contract test, which also stops pinning a whole source literal that only tested its own formatting. * chore(process): ratchet the child_process allowlist down windows-foreground-process-rows.ts no longer spawns anything, so its allowlist line is stale. The guard fails on a stale entry as well as a new one, precisely so a migrated file cannot keep a slot open and hide the next regression in the same path. * fix(ports): import the process-table reader the scanner uses Missing import: the migration replaced the PowerShell call but the new symbol was never imported, so tsc failed. Vitest transpiles without typechecking, which is why the port-scanner suite stayed green. * fix(deps): sync this branch's lockfile with its patch set Same class as the fix on the tip branch: pnpm records a hash per patched dependency, and this branch introduces the windows-process-tree patch without its lockfile entry matching. Every job here failed at install with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Verified with --frozen-lockfile, which is what CI runs and what my local runs were not. * test(relay): drive the relay's Windows fixtures from the native snapshot Two relay cases fed a PowerShell CIM payload through a mocked execFile. That reader is gone, so both failed -- deterministically, on every PR run for this branch and the one above it. I did not catch it because my own verification sweep was 'src/main src/shared config/scripts' and never included src/relay. The relay is a first-class consumer of the process table; leaving it out of the sweep is how a deterministic failure survived six review rounds.
417 lines
12 KiB
JavaScript
417 lines
12 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
import { spawnSync } from 'node:child_process'
|
|
import { createRequire } from 'node:module'
|
|
import { existsSync, readFileSync } from 'node:fs'
|
|
import { release } from 'node:os'
|
|
import { basename, resolve } from 'node:path'
|
|
|
|
const require = createRequire(import.meta.url)
|
|
const scriptPath = import.meta.filename
|
|
const projectDir = resolve(import.meta.dirname, '../..')
|
|
const runtime = readRuntimeArg()
|
|
|
|
const NATIVE_MODULES = [
|
|
'node-pty',
|
|
...(process.platform === 'win32'
|
|
? ['windows-native-registry', '@vscode/windows-process-tree']
|
|
: [])
|
|
]
|
|
const NODE_PTY_CONPTY_RUNTIME_FILES = ['conpty.dll', 'OpenConsole.exe']
|
|
const CHILD_CHECK_FLAG = '--check-only'
|
|
|
|
if (process.argv.includes(CHILD_CHECK_FLAG)) {
|
|
const failures = collectNativeModuleFailures()
|
|
if (failures.length > 0) {
|
|
for (const failure of failures) {
|
|
console.error(`${failure.moduleName}: ${failure.message}`)
|
|
}
|
|
process.exit(1)
|
|
}
|
|
process.exit(0)
|
|
}
|
|
|
|
if (runtime === 'node') {
|
|
ensureNodeRuntime()
|
|
} else if (runtime === 'electron') {
|
|
ensureElectronRuntime()
|
|
} else {
|
|
console.error('Usage: node config/scripts/ensure-native-runtime.mjs --runtime=node|electron')
|
|
process.exit(2)
|
|
}
|
|
|
|
function readRuntimeArg() {
|
|
const inline = process.argv.find((arg) => arg.startsWith('--runtime='))
|
|
if (inline) {
|
|
return inline.slice('--runtime='.length)
|
|
}
|
|
|
|
const runtimeIndex = process.argv.indexOf('--runtime')
|
|
if (runtimeIndex !== -1) {
|
|
return process.argv[runtimeIndex + 1]
|
|
}
|
|
|
|
return null
|
|
}
|
|
|
|
function ensureNodeRuntime() {
|
|
const initial = runNodeCheck()
|
|
const patchedNodePtyRebuildReason = getPatchedNodePtyRebuildReason()
|
|
if (initial.ok && !patchedNodePtyRebuildReason) {
|
|
return
|
|
}
|
|
|
|
if (patchedNodePtyRebuildReason) {
|
|
console.warn(`[native-runtime] ${patchedNodePtyRebuildReason}`)
|
|
if (!initial.ok) {
|
|
printCheckError(initial)
|
|
}
|
|
runPnpm(['rebuild', 'node-pty'])
|
|
verifyNodeRuntimeAfterRebuild()
|
|
return
|
|
}
|
|
|
|
const failedModules = initial.failures.map((failure) => failure.moduleName)
|
|
console.warn(
|
|
`[native-runtime] ${formatRuntimeLabel('node')} cannot load native modules; rebuilding ${failedModules.join(', ')} for Node.`
|
|
)
|
|
printCheckError(initial)
|
|
runPnpm(['rebuild', ...failedModules])
|
|
verifyNodeRuntimeAfterRebuild()
|
|
}
|
|
|
|
function verifyNodeRuntimeAfterRebuild() {
|
|
const final = runNodeCheck()
|
|
if (!final.ok) {
|
|
console.error(
|
|
`[native-runtime] Native modules still do not load for ${formatRuntimeLabel('node')}.`
|
|
)
|
|
printCheckError(final)
|
|
process.exit(1)
|
|
}
|
|
}
|
|
|
|
function ensureElectronRuntime() {
|
|
const initial = runElectronCheck()
|
|
const patchedNodePtyRebuildReason = getPatchedNodePtyRebuildReason()
|
|
if (initial.ok && !patchedNodePtyRebuildReason) {
|
|
return
|
|
}
|
|
|
|
if (patchedNodePtyRebuildReason) {
|
|
console.warn(`[native-runtime] ${patchedNodePtyRebuildReason}`)
|
|
if (!initial.ok) {
|
|
printCheckError(initial)
|
|
}
|
|
} else {
|
|
console.warn(
|
|
`[native-runtime] ${formatRuntimeLabel('electron')} cannot load native modules; rebuilding native deps for Electron.`
|
|
)
|
|
printCheckError(initial)
|
|
}
|
|
runNodeScript(['config/scripts/rebuild-native-deps.mjs'])
|
|
|
|
const final = runElectronCheck()
|
|
if (!final.ok) {
|
|
console.error(
|
|
`[native-runtime] Native modules still do not load for ${formatRuntimeLabel('electron')}.`
|
|
)
|
|
printCheckError(final)
|
|
process.exit(1)
|
|
}
|
|
}
|
|
|
|
function runNodeCheck() {
|
|
// Why: a failed native addon load can poison the current process, so the
|
|
// post-rebuild verification must happen in a fresh Node process.
|
|
const result = spawnSync(process.execPath, [scriptPath, CHILD_CHECK_FLAG], {
|
|
cwd: projectDir,
|
|
encoding: 'utf8',
|
|
stdio: ['ignore', 'pipe', 'pipe']
|
|
})
|
|
|
|
return parseChildCheckResult(result)
|
|
}
|
|
|
|
function runElectronCheck() {
|
|
const electronExecutable = resolveInstalledElectronExecutable()
|
|
if (!electronExecutable.ok) {
|
|
return { ok: false, error: electronExecutable.error }
|
|
}
|
|
|
|
const result = spawnSync(electronExecutable.path, [scriptPath, CHILD_CHECK_FLAG], {
|
|
cwd: projectDir,
|
|
env: {
|
|
...process.env,
|
|
ELECTRON_RUN_AS_NODE: '1'
|
|
},
|
|
encoding: 'utf8',
|
|
stdio: ['ignore', 'pipe', 'pipe']
|
|
})
|
|
|
|
return parseChildCheckResult(result)
|
|
}
|
|
|
|
function resolveInstalledElectronExecutable() {
|
|
const electronPackageDir = resolve(projectDir, 'node_modules/electron')
|
|
try {
|
|
const electronVersion = JSON.parse(
|
|
readFileSync(resolve(electronPackageDir, 'package.json'), 'utf8')
|
|
).version
|
|
const platformPath = getElectronPlatformPath()
|
|
const installedVersion = readFileSync(resolve(electronPackageDir, 'dist', 'version'), 'utf8')
|
|
.trim()
|
|
.replace(/^v/, '')
|
|
if (installedVersion !== electronVersion) {
|
|
return {
|
|
ok: false,
|
|
error: new Error(
|
|
`Electron package binary version ${installedVersion} does not match ${electronVersion}.`
|
|
)
|
|
}
|
|
}
|
|
const installedPlatformPath = readFileSync(resolve(electronPackageDir, 'path.txt'), 'utf8')
|
|
if (installedPlatformPath !== platformPath) {
|
|
return {
|
|
ok: false,
|
|
error: new Error(
|
|
`Electron package path.txt points at ${installedPlatformPath}, expected ${platformPath}.`
|
|
)
|
|
}
|
|
}
|
|
const electronPath = process.env.ELECTRON_OVERRIDE_DIST_PATH
|
|
? resolve(process.env.ELECTRON_OVERRIDE_DIST_PATH, platformPath)
|
|
: resolve(electronPackageDir, 'dist', platformPath)
|
|
if (!existsSync(electronPath)) {
|
|
return { ok: false, error: new Error(`Electron executable is missing at ${electronPath}.`) }
|
|
}
|
|
return { ok: true, path: electronPath }
|
|
} catch (error) {
|
|
return { ok: false, error }
|
|
}
|
|
}
|
|
|
|
function getElectronPlatformPath() {
|
|
const targetPlatform =
|
|
process.env.ELECTRON_INSTALL_PLATFORM || process.env.npm_config_platform || process.platform
|
|
switch (targetPlatform) {
|
|
case 'mas':
|
|
case 'darwin':
|
|
return 'Electron.app/Contents/MacOS/Electron'
|
|
case 'freebsd':
|
|
case 'openbsd':
|
|
case 'linux':
|
|
return 'electron'
|
|
case 'win32':
|
|
return 'electron.exe'
|
|
default:
|
|
throw new Error(`Electron builds are not available on platform: ${targetPlatform}`)
|
|
}
|
|
}
|
|
|
|
function parseChildCheckResult(result) {
|
|
const failures = parseCheckFailures(result.stderr)
|
|
|
|
return {
|
|
ok: result.status === 0,
|
|
status: result.status,
|
|
stdout: result.stdout,
|
|
stderr: result.stderr,
|
|
error: result.error,
|
|
failures
|
|
}
|
|
}
|
|
|
|
function parseCheckFailures(stderr) {
|
|
const failures = []
|
|
for (const line of (stderr ?? '').split(/\r?\n/)) {
|
|
const match = /^([^:]+):\s*(.*)$/.exec(line)
|
|
if (match && NATIVE_MODULES.includes(match[1])) {
|
|
failures.push({ moduleName: match[1], message: match[2] })
|
|
}
|
|
}
|
|
return failures
|
|
}
|
|
|
|
function collectNativeModuleFailures() {
|
|
const failures = []
|
|
for (const moduleName of NATIVE_MODULES) {
|
|
try {
|
|
loadNativeModule(moduleName)
|
|
} catch (cause) {
|
|
failures.push({ moduleName, message: formatError(cause), cause })
|
|
}
|
|
}
|
|
return failures
|
|
}
|
|
|
|
function loadNativeModule(moduleName) {
|
|
if (moduleName === '@vscode/windows-process-tree') {
|
|
// Why call through: the package defers its .node addon until first use, so
|
|
// a bare require would not catch an ABI mismatch or a missing build.
|
|
const processTree = require(moduleName)
|
|
processTree.getAllProcesses(() => {}, processTree.ProcessDataFlag.None)
|
|
return
|
|
}
|
|
if (moduleName === 'windows-native-registry') {
|
|
const registry = require(moduleName)
|
|
// Why: the package defers loading its .node addon until the first registry call.
|
|
registry.getRegistryKey(registry.HK.CU, 'Environment')
|
|
return
|
|
}
|
|
if (moduleName === 'node-pty') {
|
|
loadNodePtyNativeModule()
|
|
return
|
|
}
|
|
|
|
require(moduleName)
|
|
}
|
|
|
|
function loadNodePtyNativeModule() {
|
|
require('node-pty')
|
|
|
|
const { loadNativeModule } = require('node-pty/lib/utils')
|
|
const nativeName = getNodePtyNativeModuleName()
|
|
// Why: node-pty's Windows JS wrapper defers conpty.node/pty.node until a
|
|
// terminal is created, so require('node-pty') alone can miss ABI mismatches.
|
|
const native = loadNativeModule(nativeName)
|
|
assertNodePtyWindowsConptyRuntime(native?.dir)
|
|
if (requiresPatchedNodePtySourceBuild() && !isNodePtyReleaseBuildDir(native?.dir)) {
|
|
throw new Error(
|
|
`node-pty resolved to ${native.dir}; expected build/Release so Orca's node-pty patch is active`
|
|
)
|
|
}
|
|
}
|
|
|
|
function assertNodePtyWindowsConptyRuntime(nativeDir) {
|
|
if (process.platform !== 'win32' || !isNodePtyReleaseBuildDir(nativeDir)) {
|
|
return
|
|
}
|
|
const runtimeDir = resolve(projectDir, 'node_modules', 'node-pty', 'build', 'Release', 'conpty')
|
|
const missingFile = NODE_PTY_CONPTY_RUNTIME_FILES.find(
|
|
(filename) => !existsSync(resolve(runtimeDir, filename))
|
|
)
|
|
if (missingFile) {
|
|
throw new Error(`node-pty ConPTY runtime file is missing: ${resolve(runtimeDir, missingFile)}`)
|
|
}
|
|
}
|
|
|
|
function getNodePtyNativeModuleName() {
|
|
if (process.platform !== 'win32') {
|
|
return 'pty'
|
|
}
|
|
|
|
return getWindowsBuildNumber() >= 18309 ? 'conpty' : 'pty'
|
|
}
|
|
|
|
function getPatchedNodePtyRebuildReason() {
|
|
if (!requiresPatchedNodePtySourceBuild()) {
|
|
return null
|
|
}
|
|
|
|
// Why: a loadable upstream node-pty prebuild is not enough; Orca's Unix
|
|
// patch only lands in the source-built build/Release artifacts.
|
|
const nodePtyDir = resolve(projectDir, 'node_modules', 'node-pty')
|
|
const artifactPaths = [resolve(nodePtyDir, 'build', 'Release', 'pty.node')]
|
|
// Why: node-pty only builds spawn-helper on macOS; Linux builds only pty.node.
|
|
if (process.platform === 'darwin') {
|
|
artifactPaths.push(resolve(nodePtyDir, 'build', 'Release', 'spawn-helper'))
|
|
}
|
|
const missingArtifact = artifactPaths.find((artifactPath) => !existsSync(artifactPath))
|
|
|
|
if (!missingArtifact) {
|
|
return null
|
|
}
|
|
|
|
return 'Patched node-pty build artifacts are missing; rebuilding native deps.'
|
|
}
|
|
|
|
function requiresPatchedNodePtySourceBuild() {
|
|
if (process.platform === 'win32') {
|
|
return false
|
|
}
|
|
|
|
const nodePtyPatchPath = resolve(projectDir, 'config', 'patches', 'node-pty@1.1.0.patch')
|
|
if (!existsSync(nodePtyPatchPath)) {
|
|
return false
|
|
}
|
|
|
|
return existsSync(resolve(projectDir, 'node_modules', 'node-pty'))
|
|
}
|
|
|
|
function isNodePtyReleaseBuildDir(nativeDir) {
|
|
return typeof nativeDir === 'string' && nativeDir.replace(/\\/g, '/').includes('build/Release/')
|
|
}
|
|
|
|
function getWindowsBuildNumber() {
|
|
const match = /(\d+)\.(\d+)\.(\d+)/g.exec(release())
|
|
return match && match.length === 4 ? Number.parseInt(match[3], 10) : 0
|
|
}
|
|
|
|
function runPnpm(args) {
|
|
const command = process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm'
|
|
const result = spawnSync(command, args, {
|
|
cwd: projectDir,
|
|
stdio: 'inherit',
|
|
shell: process.platform === 'win32'
|
|
})
|
|
|
|
if (result.error || result.status !== 0) {
|
|
console.error(`[native-runtime] ${command} ${args.join(' ')} failed.`)
|
|
if (result.error) {
|
|
console.error(formatError(result.error))
|
|
}
|
|
process.exit(result.status ?? 1)
|
|
}
|
|
}
|
|
|
|
function runNodeScript(args) {
|
|
const result = spawnSync(process.execPath, args, {
|
|
cwd: projectDir,
|
|
stdio: 'inherit'
|
|
})
|
|
|
|
if (result.error || result.status !== 0) {
|
|
console.error(`[native-runtime] ${basename(process.execPath)} ${args.join(' ')} failed.`)
|
|
if (result.error) {
|
|
console.error(formatError(result.error))
|
|
}
|
|
process.exit(result.status ?? 1)
|
|
}
|
|
}
|
|
|
|
function printCheckError(result) {
|
|
for (const failure of result.failures ?? []) {
|
|
console.warn(`[native-runtime] ${failure.moduleName}: ${failure.message}`)
|
|
}
|
|
if (result.error) {
|
|
console.warn(`[native-runtime] ${formatError(result.error)}`)
|
|
}
|
|
if (result.stderr?.trim()) {
|
|
console.warn(result.stderr.trim())
|
|
}
|
|
if (result.stdout?.trim()) {
|
|
console.warn(result.stdout.trim())
|
|
}
|
|
if (
|
|
result.status != null &&
|
|
!result.error &&
|
|
!result.stderr?.trim() &&
|
|
!result.stdout?.trim() &&
|
|
result.status !== 0
|
|
) {
|
|
console.warn(`[native-runtime] Native check exited with status ${result.status}.`)
|
|
}
|
|
}
|
|
|
|
function formatError(error) {
|
|
return error instanceof Error ? error.message : String(error)
|
|
}
|
|
|
|
function formatRuntimeLabel(value) {
|
|
if (value === 'electron') {
|
|
return `Electron ${process.env.npm_package_devDependencies_electron ?? ''}`.trim()
|
|
}
|
|
return `Node ${process.versions.node}`
|
|
}
|