killswitch.go

package gatekit

import (
	"os"
	"path/filepath"
	"time"
)

// isDisabled reports whether the kill switch is currently active. This is
// checked as the literal first line of Evaluate, before SourcesDir is even
// opened -- deliberately so that no bug anywhere else in the engine (a
// corrupt module, a tiering panic, a broken degrade policy) can ever stand
// between Grayson and getting the gate to stop. A missing file means "not
// disabled." An empty file means "disabled indefinitely." A file containing
// an RFC3339 timestamp means "disabled until then" -- and if that timestamp
// fails to parse, it's treated as indefinite rather than as "not disabled":
// a malformed disable file must never silently re-enable blocking.
//
// This exists because of a real incident: reply-gate's own per-prompt
// bypass got a rate limit added, and within minutes it trapped Grayson --
// with every item's SLA already elapsed and his hourly bypass allowance
// already spent, there was no escape hatch left that wasn't itself rate
// limited, and he had to delete the hook script by hand to unblock himself.
// The kill switch is gatekit's answer: one valve, unconditional, checked
// before anything else, with no rate limit of its own -- see requestValve
// for the (much stricter) one that guards RequestBypass and Snooze instead.
func isDisabled(cfg Config, now time.Time) bool {
	b, err := os.ReadFile(disabledPath(cfg))
	if err != nil {
		return false
	}
	s := string(b)
	if len(s) == 0 || (len(s) == 1 && s[0] == '\n') {
		return true
	}
	until, err := time.Parse(time.RFC3339, trimNewline(s))
	if err != nil {
		return true // malformed content must fail toward "disabled," not "enabled"
	}
	return now.Before(until)
}

// Disable activates the kill switch. d == 0 disables indefinitely; any
// other duration disables until now+d. No rate limit, no cooldown, no
// dependency on Evaluate succeeding -- this must work even if every module
// is broken and SourcesDir does not exist.
func Disable(cfg Config, d time.Duration, now time.Time) error {
	if err := os.MkdirAll(filepath.Dir(disabledPath(cfg)), 0700); err != nil {
		return err
	}
	if d <= 0 {
		return os.WriteFile(disabledPath(cfg), nil, 0600)
	}
	until := now.Add(d).Format(time.RFC3339)
	return os.WriteFile(disabledPath(cfg), []byte(until), 0600)
}

// Enable clears the kill switch early. Removing a file that's already
// absent is not an error.
func Enable(cfg Config) error {
	err := os.Remove(disabledPath(cfg))
	if err != nil && !os.IsNotExist(err) {
		return err
	}
	return nil
}

func trimNewline(s string) string {
	if n := len(s); n > 0 && s[n-1] == '\n' {
		return s[:n-1]
	}
	return s
}