Admin

name	type	size	perms	modified	actions
[parent directory]
__pycache__/	dir	-	0755	2026-08-19 08:39:37
__init__.py	file	0 B	0644	2026-08-05 00:00:00	edit
detached_dir.py	file	2,723 B	0644	2026-08-05 00:00:00	edit
outdated_scans.py	file	6,191 B	0644	2026-08-05 00:00:00	edit
uncompleted_scans.py	file	4,721 B	0644	2026-08-05 00:00:00	edit

editing: uncompleted_scans.py

"""
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 
See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License
 along with this program.  If not, see <https://www.gnu.org/licenses/>.

This software is also available under ImunifyAV commercial license,
see <https://www.imunify360.com/legal/eula>
"""
import logging
import time
from asyncio import gather

from defence360agent.internals.global_scope import g
from imav.malwarelib.config import QueuedScanState
from imav.malwarelib.scan.detached import DetachedState, PROCESS_START_TIME
from imav.malwarelib.scan.queue_supervisor_sync import (
    QueueSupervisorSync,
)
from imav.malwarelib.scan.ai_bolit.detached import (
    AiBolitDetachedScan,
)
from defence360agent.mr_proper import BaseCleaner
from defence360agent.utils import antivirus_mode

logger = logging.getLogger(__name__)

class UncompletedScansCleaner(BaseCleaner):
    """
    Cleaner for uncompleted (including aborted) detached scans.
    """

if antivirus_mode.enabled:
        _DETACHED_OPERATIONS = [
            AiBolitDetachedScan,
        ]
    else:
        from imav.malwarelib.scan.mds.detached import (
            MDSDetachedCleanup,
            MDSDetachedRestore,
            MDSDetachedScan,
        )

_DETACHED_OPERATIONS = [
            AiBolitDetachedScan,
            MDSDetachedCleanup,
            MDSDetachedRestore,
            MDSDetachedScan,
        ]

@classmethod
    async def cleanup(cls) -> None:
        # We need to bring the queue to a consistent state on agent start.
        # Running 'check_detached_operation' and '_recheck_scan_queue' in async
        # manner leads to already started scan re-running (Wrong 'QueuedScan'
        # state on 'recheck')

coros = [
            op.check_detached_operation_dir(g.sink)
            for op in cls._DETACHED_OPERATIONS
        ]
        await gather(*coros)

# A scan that was running when the agent stopped, but whose run dir is
        # now gone, is invisible to check_detached_operation_dir (it
        # enumerates on-disk dirs only). Nothing will ever re-emit
        # MalwareScanComplete for a missing dir, so the scan would stay
        # "running" forever and block the queue. Finalize such an orphan here
        # using the pickle-backed queue.
        await cls._finalize_orphaned_running_scan()

# We could do a recheck in case some of the scans are 'ABORTED' since
        #  handle_aborted_process is called for them all, so they are removed
        #  from queue and would not be re-run
        QueueSupervisorSync(sink=g.sink).recheck()

@staticmethod
    async def _finalize_orphaned_running_scan() -> None:
        """Finalize a running scan whose run directory has disappeared.

Only the current scan can be running (single-slot queue). Several
        states share ``running`` + ``NO_DIR`` and must NOT be aborted:
          - a queued scan not started yet (no run dir),
          - a scan just marked ``running`` whose worker has not created its run
            dir yet -- the queue sets ``running`` *before* the dir exists.
        So we additionally require the scan to have been running longer than the
        worker-startup grace (``PROCESS_START_TIME``, the same window
        ``get_detached_process_state`` uses for ABORTED). Only then is a missing
        dir a genuine orphan rather than a still-starting scan.
        """
        current = QueueSupervisorSync.queue.current_scan
        if current is None or current.state != QueuedScanState.running:
            return
        started = current.started
        if not started or (time.time() - started) <= PROCESS_START_TIME:
            # Still within the startup window: the run dir may simply not have
            # been created yet. Do not abort a healthy starting scan.
            return
        detached_scan = current.detached_scan
        if detached_scan.get_detached_process_state() != DetachedState.NO_DIR:
            return
        logger.warning(
            "Finalizing orphaned running scan %s: its run directory is gone",
            current.scanid,
        )
        await detached_scan.handle_aborted_process(
            sink=g.sink, kill=False, scan_started=started
        )

cancel