daemon: replace exit(1) callbacks with recoverable state machine

[silentone12725]

Summary

This PR changes the wrapper from a process that terminates on Apple playback lease errors into a long-running, self-recovering daemon.

Previously, both SVPlaybackLeaseManager callbacks (endLeaseCb and pbErrCb) called exit(1) unconditionally. A lease termination therefore killed the entire wrapper, requiring an external supervisor to restart the process.

The new implementation keeps the wrapper and its HTTP services alive, moves FairPlay context reacquisition into a dedicated recovery worker, makes access to the shared decryption context thread-safe, exposes lifecycle state to external consumers, and brings the rootless wrapper in line with the same recovery model.

It also adds build/drift tooling to help keep the C and rootless wrapper implementations synchronized.

---

What changed

Recovery state machine

main.cpp now maintains an explicit recovery lifecycle:

• Running
• Scheduled
• Refreshing
• Failed

get_recovery_state() is exported as an extern "C" API so external consumers can observe the daemon state:

Value	State
0	Running
1	Scheduled
2	Refreshing
3	Failed

is_recovery_active() provides a simple recovery gate for request handlers.

Non-blocking lease callbacks

endLeaseCb and pbErrCb no longer perform recovery work or terminate the process directly.

Instead, callbacks enqueue a recovery event and return immediately.

This keeps FairPlay/library calls out of the lease-manager callback context and reduces the risk of callback reentrancy or deadlocks.

Dedicated recovery worker

Recovery is handled by a persistent worker thread that owns context reacquisition.

The worker:

• drains and coalesces queued lease events before each recovery attempt;
• performs one refresh for a burst of related errors instead of repeatedly refreshing for every callback;
• calls refresh_decrypt_ctx() as the single owner of reacquisition;
• verifies recovery using is_preshare_ctx_ready();
• resets the consecutive-failure counter only after a usable preshareCtx exists; and
• schedules its own retry after a failed refresh, so recovery continues even when Apple sends no additional lease event.

Retry delay uses bounded exponential backoff:

1s -> 2s -> 5s -> 10s -> 30s

The 30-second delay is clamped rather than terminating recovery, allowing the daemon to survive prolonged transient failures.

Thread-safe FairPlay context access

main.c now protects preshareCtx with a PTHREAD_MUTEX_INITIALIZER-backed mutex.

All relevant reads and writes are synchronized between the decrypt path and the recovery worker.

The mutex is deliberately released before FairPlay/network reacquisition work so long-running recovery operations do not hold the context lock.

is_preshare_ctx_ready() also checks the context while holding the mutex.

Request gating during recovery

Decrypt and M3U8 request handling now checks the recovery state before using the FairPlay context.

During recovery:

• the decrypt endpoint returns immediately/EOF;
• the M3U8 endpoint returns an empty response and continues serving subsequent requests; and
• key-delivery work is prevented from racing context reacquisition.

The decrypt, M3U8, and account servers themselves remain running throughout lease recovery.

External supervision is therefore reserved for actual process failures such as crashes, OOM termination, or other unrecoverable failures rather than normal lease lifecycle events.

---

DRM lifecycle state

The wrapper now publishes its lifecycle through:

<base-dir>/drm-state

The state file allows the surrounding Go/Electron layer to observe wrapper lifecycle changes without inferring state solely from process existence.

Lifecycle states include:

• STARTING
• LOGIN
• WAITING_2FA
• INITIALIZING_FAIRPLAY
• RUNNING
• RECOVERY
• FAILED
• STOPPED

This provides a lightweight interface for status reporting and supervisor integration while keeping recovery ownership inside the wrapper.

---

Rootless wrapper

wrapper-rootless.c has been updated to follow the persistent-daemon recovery model rather than treating lease termination as an unconditional process-exit condition.

This keeps rootless operation aligned with the recovery behavior introduced in the main wrapper implementation.

---

Build and drift protection

This PR also adds tooling around the wrapper build:

• adds Dockerfile.build for a reproducible wrapper build environment;
• adds scripts/check-drift.py;
• runs the wrapper drift check from the x86_64 GitHub Actions workflow.

The drift check is intended to catch unintended divergence between related wrapper implementations as recovery/lifecycle behavior evolves.

---

Result

Before

Apple lease error
       |
       v
 endLeaseCb / pbErrCb
       |
       v
     exit(1)
       |
       v
 wrapper process dies
       |
       v
 external supervisor must restart it

After

Apple lease error
       |
       v
 endLeaseCb / pbErrCb
       |
       v
 enqueue recovery event
       |
       v
 callback returns immediately
       |
       v
 recovery worker
       |
       +--> coalesce events
       |
       +--> refresh FairPlay context
       |
       +--> success --> RUNNING
       |
       `--> failure --> backoff --> retry

The wrapper therefore behaves as a persistent service: lease expiration and transient FairPlay recovery failures are handled internally, while the process and HTTP servers remain alive.

Update: rebased onto current origin/main

This PR now also contains the host-native build, the in-process library, and follow-ups. It was rebased onto the latest origin/main. Upstream moved from the old key-server code, and conflicts were resolved in cmdline.*, main.c, wrapper.ggo and README.md.

Rebase notes

• --key-port/-K (from origin/main) and --mv-port/-G (from this PR) are both kept.
• cmdline.c / cmdline.h are hand-merged in gengetopt 2.23 style. Regenerating with 2.23.1 differs only in version-related output (help/version ordering, whitespace), so the 2.23-style files were kept.
• FHinstance, preshareCtx and getKdContext are non-static again, because drm_lib.c links against them.

Host-native build via libhybris

• build-native.sh builds drm-native and libdrm-native.so with host gcc/g++ and libhybris; build-and-deploy.sh builds and deploys into apple-music-linux/drm/.
• Fixes the Bionic std::function ABI layout mismatch (__f_-first).
• hybris_stubs.c, hybris_ctor.c, hybris_types.h and import.h provide the host-side glue.

In-process C / CGO library (drm_lib)

• drm_lib.h / drm_lib.c expose drm_lib_init, drm_lib_decrypt and drm_lib_shutdown, with auth (2FA) and state callbacks, so Go can link the DRM engine without socket IPC.
• Library mode builds with -DDRM_LIB_BUILD, which compiles out main().
• GUID is now copied into a null-terminated buffer (Data::bytes() is not null-terminated).
• get_music_user_token and get_dev_token use heap buffers, and the request body is no longer freed before run().
• Android lib load failures return an error instead of calling exit().
• drm_lib_decrypt uses the key context, not its slot.

Behavior changes to review

• --mv-port default is now 50020 (itun decrypt listens on mv-port + 10000 = 60020). It previously shared 40020 with --key-port. Because every listener sets SO_REUSEPORT, both binds could succeed and traffic on that port could reach either service. Passing --mv-port explicitly is unaffected. Scripts relying on the old 40020 default for the MV server will need updating. Docker users need -p 50020:50020 -p 60020:60020 (the README example is updated).
• build-native.sh now links Dobby. The R1 key-server hook from origin/main is no longer gated by MyRelease, so native builds need dobby.h and a built libdobby.a (DOBBY_SRC / DOBBY_BUILD).

Docs

README covers the three execution modes, the CGO API, the recovery state machine, both port options, and the extra Docker ports. The Protocol column for the 50020 and 60020 rows is a placeholder.

Testing

• Both drm-native and libdrm-native.so build from this branch against Dobby and the deployed libhybris.
• drm-native --help lists -K (default 40020) and -G (default 50020), and --version prints wrapper 1.2.0.
• scripts/check-drift.py passes locally.
• Not yet run: [fill in: runtime decrypt test / key and MV servers against a real rootfs].
• CI runs for this fork PR are waiting for maintainer approval ("Approve and run").

Commits

1. daemon: replace exit(1) callbacks with recoverable state machine
2. Add DRM state tracking and wrapper drift check
3. Add host-native DRM wrapper build via libhybris
4. Fix Bionic std::function ABI mismatch: use old __f_-first layout
5. Add build-and-deploy.sh: compile drm-native and deploy to drm/
6. Fix GUID null-termination, add in-process CGO DRM bridge (drm_lib)
7. Return an error instead of exiting when Android libs fail to load
8. Decrypt with the key context, not its slot, in drm_lib_decrypt
9. docs: update README with libhybris host-native mode, CGO API, and recovery state machine
10. Give --mv-port its own default (50020) so it no longer shares 40020 with --key-port
11. docs: document mv/itun ports and expose them in the Docker example
12. docs: expose mv/itun ports in the Docker run example
13. build-native: link Dobby (R1 key-server hook is no longer MyRelease-gated)