"""Syscall-boundary crash points (ALICE/CrashMonkey method, process-crash only).

A tiny interposer library counts durability boundaries (fsync, F_FULLFSYNC /

F_BARRIERFSYNC, rename) in the subject process and SIGKILLs it immediately

before the N-th one. Enumerating N = 1..count gives a crash state at every

durability boundary the operation crosses, instead of guessing time offsets.

Scope and honesty:

- This is process death, not power loss: the page cache survives, so

  un-fsynced writes are NOT dropped. Power-loss states need LazyFS (Linux,

  external tool); rows say ``crash_model: process_kill``.

- macOS: DYLD_INSERT_LIBRARIES is ignored for hardened-runtime binaries, so

  the harness runs an ad-hoc re-signed copy of the SAME Mach-O (identical code;

  both sha256 recorded). Git needs the copy named ``git`` (builtin dispatch)

  and GIT_EXEC_PATH pointing at the original libexec. Children exec'd from the

  original signed libexec do not load the library (they are not crash targets).

- Linux: LD_PRELOAD with the same source (symbol wrapping via dlsym) is the

  intended port; unsupported rows are emitted until it is exercised.

"""

from __future__ import annotations

import hashlib

import os

import platform

import shutil

import subprocess

from dataclasses import dataclass

from pathlib import Path

from typing import Optional

INTERPOSER_SOURCE = r"""

#include <stdio.h>

#include <stdlib.h>

#include <unistd.h>

#include <signal.h>

#include <fcntl.h>

#include <stdarg.h>

static long counter = 0, target = -1; static int inited = 0; static const char *logp = 0;

static void init(void) { if (inited) return; inited = 1;

  const char *t = getenv("P4_CRASH_AT"); if (t) target = atol(t); logp = getenv("P4_CRASH_LOG"); }

static void tick(const char *what) { init(); counter++;

  if (logp) { int fd = open(logp, O_WRONLY | O_APPEND | O_CREAT, 0644);

    if (fd >= 0) { char b[96]; int n = snprintf(b, sizeof b, "%d %ld %s\n", (int)getpid(), counter, what); write(fd, b, n); close(fd); } }

  if (target > 0 && counter == target) kill(getpid(), SIGKILL); }

static int p4_fsync(int fd) { tick("fsync"); return fsync(fd); }

static int p4_rename(const char *a, const char *b) { tick("rename"); return rename(a, b); }

static int p4_fcntl(int fd, int cmd, ...) { va_list ap; va_start(ap, cmd); void *arg = va_arg(ap, void *); va_end(ap);

  if (cmd == F_FULLFSYNC || cmd == F_BARRIERFSYNC) tick("fullfsync"); return fcntl(fd, cmd, arg); }

#define INTERPOSE(r, o) __attribute__((used)) static struct { const void *replacement; const void *replacee; } \

  _interpose_##o __attribute__((section("__DATA,__interpose"))) = { (const void *)(unsigned long)&r, (const void *)(unsigned long)&o };

INTERPOSE(p4_fsync, fsync)

INTERPOSE(p4_rename, rename)

INTERPOSE(p4_fcntl, fcntl)

"""

NO_BOUNDARY_REASON = {

    "oak": "no durability boundary (fsync / F_FULLFSYNC / rename) observed in the oak client process during the "

           "clean instrumented run",

    "git": "no durability boundary observed in the top-level git process (git pull delegates to libexec children "

           "that the interposer cannot load into)",

}

@dataclass

class CrashInstrument:

    dylib: Path

    oak_bin: Optional[Path]

    git_bin: Optional[Path]

    git_exec_path: Optional[str]

    provenance: dict

    skipped: dict = None  # kind -> reason the instrumented copy is unavailable (e.g. codesign failed)

    def env(self, target: int, log: Optional[Path] = None, kind: str = "oak") -> dict:

        env = {"DYLD_INSERT_LIBRARIES": str(self.dylib), "P4_CRASH_AT": str(target)}

        if log is not None:

            env["P4_CRASH_LOG"] = str(log)

        if kind == "git" and self.git_exec_path:

            env["GIT_EXEC_PATH"] = self.git_exec_path

        return env

def _sha(path: Path) -> str:

    return hashlib.sha256(path.read_bytes()).hexdigest()

def build(workdir: Path, oak_bin: Optional[str], git_bin: Optional[str]) -> tuple[Optional[CrashInstrument], str]:

    """Build the interposer + re-signed subject copies. Returns (instrument, reason)."""

    if platform.system() != "Darwin":

        return None, "syscall crash points implemented for macOS DYLD interposition only (Linux LD_PRELOAD port pending)"

    clang = shutil.which("clang")

    codesign = shutil.which("codesign")

    if not clang or not codesign:

        return None, "clang and codesign required to build the crash interposer"

    workdir.mkdir(parents=True, exist_ok=True)

    source = workdir / "p4crash.c"

    source.write_text(INTERPOSER_SOURCE)

    dylib = workdir / "p4crash.dylib"

    proc = subprocess.run([clang, "-dynamiclib", "-O1", "-o", str(dylib), str(source)], capture_output=True, text=True)

    if proc.returncode != 0:

        return None, "interposer build failed: " + proc.stderr[-300:]

    provenance = {"interposer_sha256": _sha(dylib), "crash_model": "process_kill"}

    oak_copy = git_copy = None

    git_exec = None

    skipped: dict = {}

    if oak_bin:

        oak_copy = workdir / "oak-bin" / "oak"

        oak_copy.parent.mkdir(exist_ok=True)

        shutil.copy2(oak_bin, oak_copy)

        why = _resign(codesign, oak_copy)

        if why:

            skipped["oak"], oak_copy = why, None

        else:

            provenance.update(oak_original_sha256=_sha(Path(oak_bin)), oak_adhoc_sha256=_sha(oak_copy))

    if git_bin:

        git_copy = workdir / "git-bin" / "git"

        git_copy.parent.mkdir(exist_ok=True)

        shutil.copy2(git_bin, git_copy)

        why = _resign(codesign, git_copy)

        if why:

            skipped["git"], git_copy = why, None

        else:

            exec_path = subprocess.run([git_bin, "--exec-path"], capture_output=True, text=True).stdout.strip()

            git_exec = exec_path or None

            provenance.update(git_original_sha256=_sha(Path(git_bin)), git_adhoc_sha256=_sha(git_copy),

                              git_exec_path=git_exec)

    return CrashInstrument(dylib, oak_copy, git_copy, git_exec, provenance, skipped), ""

def _resign(codesign: str, binary: Path) -> str:

    """Ad-hoc re-sign a copy so DYLD_INSERT_LIBRARIES loads; '' on success, else the reason."""

    proc = subprocess.run([codesign, "-f", "-s", "-", str(binary)], capture_output=True, text=True)

    if proc.returncode != 0:

        return f"codesign -f -s - failed (rc={proc.returncode}): {(proc.stderr or proc.stdout).strip()[-200:]}"

    check = subprocess.run([codesign, "--verify", str(binary)], capture_output=True, text=True)

    if check.returncode != 0:

        return f"re-signed copy does not verify: {(check.stderr or check.stdout).strip()[-200:]}"

    return ""

def unavailable_reason(instrument: Optional[CrashInstrument], build_reason: str, kind: str) -> str:

    """Why syscall crash points cannot run for this subject ('' when they can)."""

    if instrument is None:

        return build_reason or "crash interposer unavailable"

    if (instrument.skipped or {}).get(kind):

        return instrument.skipped[kind]

    if (instrument.oak_bin if kind == "oak" else instrument.git_bin) is None:

        return f"no instrumented {kind} copy was built"

    return ""

def count_boundaries(log: Path, pid: Optional[int] = None) -> int:

    """Durability boundaries crossed by the first (top-level) process in the log."""

    if not log.exists():

        return 0

    counts: dict[str, int] = {}

    first: Optional[str] = None

    for line in log.read_text().splitlines():

        parts = line.split()

        if len(parts) < 3:

            continue

        first = first or parts[0]

        counts[parts[0]] = max(counts.get(parts[0], 0), int(parts[1]))

    if pid is not None:

        return counts.get(str(pid), 0)

    return counts.get(first, 0) if first else 0

def boundary_kinds(log: Path) -> list[str]:

    if not log.exists():

        return []

    lines = [line.split() for line in log.read_text().splitlines() if line.strip()]

    if not lines:

        return []

    first = lines[0][0]

    return [parts[2] for parts in lines if parts[0] == first]