mirror of
https://github.com/kuhyx/steam-backlog-enforcer.git
synced 2026-11-11 16:33:49 +01:00
Krzysztof kuhy Rudnicki
b3e629e3f0
A running game process was treated as proof of play. On 2026-08-28 the budget
billed ~2h23m while a gatelock screen locker covered the display and the
machine could not be touched at all -- the game was simply still resident.
A tick now bills only when all three hold, evaluated together rather than
short-circuited so the audit log can answer "was the screen ALSO locked?":
* no gatelock guard owns the screen (_screen_hold, via /proc/locks)
* the focused window belongs to a qualifying process or its ancestry
* some input source has been used within idle_grace_seconds (default 300)
Any probe that cannot answer BILLS the tick and is recorded in `degraded`.
A broken detector must never become an unlimited-gaming exploit.
Three findings from measuring this machine rather than assuming:
* /dev/input/js0 here is an *ASRock LED Controller* -- the kernel exposes
the motherboard RGB device as a joystick. A presence check would have
disabled the idle criterion permanently, so _controller_input watches for
real events instead (skipping joydev's synthetic open burst).
* Aseprite's window carries no _NET_WM_PID at all, so focus attribution
falls back to XRes, which asks the server who owns the window rather than
trusting the client to have announced itself.
* /proc/locks reports gatelock's hold without taking it; gatelock's own
read_claim_if_held detects held-ness by acquiring, which would race a
guard every 3 seconds.
Idle pauses also refund the grace period once per walk-away, on the
engaged->paused edge only, never across a day rollover, and never on the first
tick after a restart -- the only place the counter moves backwards.
Everything is recorded to /var/log/steam-backlog-enforcer/budget.jsonl, on
change plus a heartbeat rather than one line per 3s tick. Records name the
qualifying PIDs: reconstructing this incident from journald alone was only
possible by inferring accrual from the spacing of two warning notifications.
Also: refuse to bounce Steam while a game is running. ensure_steam_debug_port
relaunches Steam when the CDP port is closed, which kills the running game --
that is how restarting the daemon to deploy this change ended a live session.
It now defers exactly as it already did for in-flight game updates.
Talks to X through ctypes over one cached connection: at a 3s tick, forking
xprintidle and xprop would cost ~40 forks a minute.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019CEsG6BzHtYR9cHcdxPZqG
100 lines
3.1 KiB
Python
100 lines
3.1 KiB
Python
"""Fake libX11 / libXss / libXRes handles so no test needs an X server.
|
|
|
|
The real modules talk to X through ``ctypes``, which means the seam worth
|
|
faking is the shared-library handle itself. These stand-ins return the same
|
|
kinds of values Xlib does — an integer display pointer, a struct pointer, a
|
|
status code — and, where the C API writes through a pointer argument, actually
|
|
write through it, so the calling code is exercised rather than bypassed.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import ctypes
|
|
from typing import TYPE_CHECKING
|
|
from unittest.mock import MagicMock
|
|
|
|
if TYPE_CHECKING:
|
|
from collections.abc import Callable
|
|
|
|
|
|
def fake_x11(*, display: int = 0x1234, root: int = 0x50, atom: int = 7) -> MagicMock:
|
|
"""Build a libX11 stand-in.
|
|
|
|
Args:
|
|
display: Value ``XOpenDisplay`` returns; ``0`` means "cannot connect".
|
|
root: Value ``XDefaultRootWindow`` returns.
|
|
atom: Value ``XInternAtom`` returns; ``0`` means "no such atom".
|
|
|
|
Returns:
|
|
The fake handle.
|
|
"""
|
|
lib = MagicMock(name="libX11")
|
|
lib.XOpenDisplay.return_value = display
|
|
lib.XDefaultRootWindow.return_value = root
|
|
lib.XInternAtom.return_value = atom
|
|
return lib
|
|
|
|
|
|
def fake_xss(*, idle_ms: int = 0, allocated: bool = True, ok: bool = True) -> MagicMock:
|
|
"""Build a libXss stand-in.
|
|
|
|
Args:
|
|
idle_ms: Idle milliseconds reported by ``XScreenSaverQueryInfo``.
|
|
allocated: Whether ``XScreenSaverAllocInfo`` returns a struct.
|
|
ok: Whether ``XScreenSaverQueryInfo`` succeeds.
|
|
|
|
Returns:
|
|
The fake handle.
|
|
"""
|
|
lib = MagicMock(name="libXss")
|
|
if allocated:
|
|
info = MagicMock(name="XScreenSaverInfo")
|
|
info.contents.idle = idle_ms
|
|
lib.XScreenSaverAllocInfo.return_value = info
|
|
else:
|
|
lib.XScreenSaverAllocInfo.return_value = 0
|
|
lib.XScreenSaverQueryInfo.return_value = 1 if ok else 0
|
|
return lib
|
|
|
|
|
|
def property_writer(
|
|
*, status: int = 0, nitems: int = 1, value: int = 4321, null: bool = False
|
|
) -> Callable[..., int]:
|
|
"""Build an ``XGetWindowProperty`` stand-in that writes its out-params.
|
|
|
|
Args:
|
|
status: Return code; non-zero means failure.
|
|
nitems: Number of items to report.
|
|
value: The first 32-bit value to hand back.
|
|
null: Whether to leave the property pointer NULL.
|
|
|
|
Returns:
|
|
A callable with ``XGetWindowProperty``'s signature.
|
|
"""
|
|
# Kept alive for the lifetime of the fake: the pointer written into the
|
|
# caller's out-param must not dangle.
|
|
keepalive: list[ctypes.c_ulong] = []
|
|
|
|
def impl( # signature mirrors the C function
|
|
_display: object,
|
|
_window: object,
|
|
_atom: object,
|
|
_offset: object,
|
|
_length: object,
|
|
_delete: object,
|
|
_req_type: object,
|
|
_actual_type: object,
|
|
_actual_format: object,
|
|
nitems_ref: object,
|
|
_bytes_after: object,
|
|
prop_ref: object,
|
|
) -> int:
|
|
nitems_ref._obj.value = nitems # type-erased ctypes byref holder
|
|
if not null:
|
|
holder = ctypes.c_ulong(value)
|
|
keepalive.append(holder)
|
|
prop_ref._obj.contents = holder
|
|
return status
|
|
|
|
return impl
|