Watch
0
0
Fork
You've already forked hyperhive
0
hyperhive/hive-c0re/src/agent_config/mod.rs
atlas 6fac00dcc5 hive-c0re: fail on an unparseable resource-limits or topology file, write both atomically
resource-limits.json and topology.json were read with parse errors
folded into an empty map, and written in place with std::fs::write. One
truncated resource-limits.json followed by a single set_limits call
rewrote the file with only that agent's entry, erasing every other
agent's CPU and memory overrides without a log line. topology.json had
the same shape: reconcile rebuilt it from the live set, losing pending
(provisioned, never spawned) names.

- agent_config::read_map / write_map are generic over the stored type.
  tool-groups and capabilities behave as before.
- resource_limits::read / effective return an error for an existing but
  unreadable file; a missing file is still the empty map. set_limits
  fails without writing on such a file, and writes atomically.
- topology: reconcile fails without writing on an unreadable file and
  writes atomically. all_agents logs the error and returns no agents,
  so a ManageRootAgent holder starts without cross-agent mounts.

Read-path behaviour on an unreadable resource-limits.json, per caller:
- write_dropins (every spawn / swap / WriteDropin): logs the error and
  keeps the limits drop-in already under /run; the agent still starts.
  With no drop-in yet (first start since boot) it writes the hive
  defaults, because no drop-in means an uncapped container.
- render_flake: propagates, so sync_agents (and spawn/rebuild/destroy
  jobs) fail. An empty map would give tighter-capped agents the hive
  memoryMaxBytes.
- container_view::build_all: logs the error each scan and renders the
  rows at the hive defaults (no ContainerView wire change).
- set_resource_limits reply: propagates.

Closes #4731
2026-09-27 02:41:38 +02:00

110 lines
4.2 KiB
Rust

//! Per-agent configuration registries: tool groups, capabilities,
//! resource limits, topology (all JSON files under
//! `/var/lib/hyperhive/meta/`) and the shared wire-protocol size
//! limits. Each submodule is re-exported at the crate root, so
//! `crate::topology::…` etc. keep working unchanged.
//!
//! Note the two similarly-named modules: [`limits`] caps inline
//! *message body* sizes on the sockets, while [`resource_limits`] holds
//! per-agent CPU/memory caps for the container drop-in.
pub mod capabilities;
pub mod limits;
pub mod resource_limits;
pub mod tool_groups;
pub mod topology;
use std::io::{self, Write as _};
use std::path::Path;
use serde::Serialize;
use serde::de::DeserializeOwned;
/// Read one of these JSON registries. A missing file is `T::default()`
/// (the empty map or set); any other read failure, or content that
/// doesn't parse, is an error, so a read-modify-write can't write back a
/// registry that has lost every other agent's entry.
fn read_map<T: DeserializeOwned + Default>(path: &Path) -> io::Result<T> {
let raw = match std::fs::read_to_string(path) {
Ok(raw) => raw,
Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(T::default()),
Err(e) => {
return Err(io::Error::new(
e.kind(),
format!("read {}: {e}", path.display()),
));
}
};
serde_json::from_str(&raw).map_err(|e| {
io::Error::new(
io::ErrorKind::InvalidData,
format!("parse {}: {e}", path.display()),
)
})
}
/// Serialise `value` as pretty JSON and replace `path` with it atomically:
/// a temp file in the same directory (`rename(2)` is only atomic within a
/// filesystem), fsynced, renamed over `path`, then the directory fsynced
/// so the rename itself survives a crash. A reader sees the old file or
/// the new one, never a truncated one.
fn write_map<T: Serialize + ?Sized>(path: &Path, value: &T) -> io::Result<()> {
let text = serde_json::to_string_pretty(value)
.map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
let (Some(dir), Some(name)) = (path.parent(), path.file_name()) else {
return Err(io::Error::new(
io::ErrorKind::InvalidInput,
format!("{} has no parent directory or file name", path.display()),
));
};
std::fs::create_dir_all(dir)?;
let tmp = dir.join(format!(".{}.tmp", name.to_string_lossy()));
let mut file = std::fs::File::create(&tmp)?;
file.write_all(format!("{text}\n").as_bytes())?;
file.sync_all()?;
drop(file);
std::fs::rename(&tmp, path)?;
std::fs::File::open(dir)?.sync_all()
}
#[cfg(test)]
mod tests {
use std::collections::BTreeMap;
use super::*;
type Map = BTreeMap<String, Vec<String>>;
#[test]
fn write_map_round_trips_and_leaves_no_temp_file() {
let dir = tempfile::tempdir().expect("tempdir");
let path = dir.path().join("map.json");
let map = BTreeMap::from([("alice".to_owned(), vec!["messaging".to_owned()])]);
write_map(&path, &map).expect("first write");
let replaced = BTreeMap::from([("bob".to_owned(), vec!["inbox".to_owned()])]);
write_map(&path, &replaced).expect("replacing write");
assert_eq!(read_map::<Map>(&path).expect("read"), replaced);
let entries: Vec<_> = std::fs::read_dir(dir.path())
.expect("read_dir")
.map(|e| e.expect("entry").file_name())
.collect();
assert_eq!(entries, vec![std::ffi::OsString::from("map.json")]);
}
#[test]
fn read_map_of_a_missing_file_is_empty() {
let dir = tempfile::tempdir().expect("tempdir");
let map =
read_map::<Map>(&dir.path().join("absent.json")).expect("missing file is not an error");
assert!(map.is_empty());
}
#[test]
fn read_map_of_a_truncated_file_is_an_error() {
let dir = tempfile::tempdir().expect("tempdir");
let path = dir.path().join("map.json");
std::fs::write(&path, "{\n \"alice\": [\"messag").expect("seed");
let err = read_map::<Map>(&path).expect_err("truncated JSON must not read as a map");
assert_eq!(err.kind(), io::ErrorKind::InvalidData);
}
}