yamine 0.18.0 → 0.20.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 43b8c059b0635ce4272b806fd2b8f70ae42ed6d591ed87536de9c86ed0419864
-  data.tar.gz: c34fb3a40d5c16442accee4dcbdb32b1b2b5013de5c3a823bade745b6ac65e88
+  metadata.gz: c48a7ce222b3ffe113f542e81d84aca45270e4c3ea4f4f7da74bd22e8d0747d7
+  data.tar.gz: 8a8c1ad0f17b8bd741723cb9d83100248c559f5c7c995d64f30abfcebfe4fa60
 SHA512:
-  metadata.gz: 70495a26f226c3b0dac853c5a4ce1694207f4a9bbb73af92b44b37cc17ff3c13430af7440252102b8acd40f22ee7efdae5dfec26155678a5839e30b10c5c0d1a
-  data.tar.gz: e450abc81d00dad86bf03e540304ad43683e99329a60eb24ddea0122760048c88729e7fe33c9b93056a1840ec871e488ea458d1afdbd655b0dccd477369b8cb5
+  metadata.gz: c9c3ae18ac29e5a30b378d7b70c7dd6c538b9140b058f4308ee2d9e5075567cde9ea21d169d30c54808d6a06a4283d3454d2a652b4b254b40e406d2de4a7edbc
+  data.tar.gz: 594bf48948e649c390aa3aed20246abd1c0eabbd0889f2a159f3b4a35d77b0d8cf8874b1eb1f8ebb51be9b0dc4300879139b943a35bde12fbc421a789b08f809

data/CHANGELOG.md

@@ -2,6 +2,71 @@
 
 ## [Unreleased]
 
+## [0.20.0] — 2026-09-28
+
+### Added
+
+- **Every proxy socket wait is bounded by an idle timeout
+  (`YAMINE_PROXY_IDLE_TIMEOUT`, default 60s).** Silence is capped,
+  total duration is not: the timer resets on each byte transferred, so
+  a slow-but-moving transfer runs as long as it needs while a stalled
+  peer or a stale keep-alive socket is dropped instead of pinning a
+  thread until the proxy stops answering.
+- **`yamine doctor` gains a "serving ca" check.** It verifies the
+  certificate the proxy actually serves against the CA now on disk and
+  names the fix when they disagree — so a regenerated CA shows up in
+  doctor instead of surfacing later as `ERR_CERT_AUTHORITY_INVALID` in
+  the browser.
+
+### Changed
+
+- **`yamine proxy start` no longer spawns a second proxy when one
+  already serves the port.** It reports that idempotently (new
+  `ProxyAlreadyRunningError`) instead of recording a dead PID over
+  real state — the shape that left the recorded PID pointing at
+  nothing while the real proxy kept serving.
+- **`yamine proxy start` on a privileged port elevates the way the
+  boot path does.** One sudo prompt when interactive, or a failure
+  pointing at `yamine setup` when not — never a doomed unprivileged
+  child that dies on `EACCES` and leaves its PID behind.
+- **`yamine proxy stop` tells the truth about a proxy it cannot
+  signal.** On a dead recorded PID it probes the port first: a proxy
+  still serving — the root launchd/systemd service, which the CLI
+  cannot kill — yields a "still serving" answer with the restart
+  command and the recorded state kept, instead of "Removed stale
+  proxy state" while the proxy kept running.
+- **`yamine clean` refuses while a proxy it cannot stop is serving.**
+  It exits 1 instead of untrusting the CA and deleting the state
+  directory out from under a live root service.
+- **A running proxy reloads the signing CA when the pair on disk
+  changes.** It re-reads the CA files and drops cached host
+  certificates, so a regenerated CA takes effect without a restart —
+  previously only a restart fixed it, and until then the proxy kept
+  signing certificates no browser trusts.
+- **The TLS handshake moved out of the acceptor into the connection
+  thread.** A client that connects and sends nothing can no longer pin
+  an acceptor; acceptors now survive per-connection errors and keep
+  accepting.
+
+### Fixed
+
+- **A spawned daemon that dies before serving fails immediately with
+  the proxy log tail instead of a timeout.** A child killed by
+  `EACCES` on a privileged port (or anything else fatal at bind)
+  used to burn the whole wait and then record a PID that was never
+  alive; it now fails fast and records nothing.
+
+## [0.19.0] — 2026-09-27
+
+### Added
+
+- **`yamine worktree info <name> [--json]`** — detailed view of a single
+  worktree: branch, HEAD (short SHA + subject), author, commit date,
+  dirty/merged status, and any database claims. `--json` emits the same
+  data as a machine-readable hash. Follows the same safety rails as
+  `list`: main checkout is always clean, detached HEADs report n/a for
+  merged status, and the path is resolved to its real location.
+
 ## [0.18.0] — 2026-09-23
 
 ### Changed

data/lib/yamine/certs.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "digest"
 require "fileutils"
 require "openssl"
 
@@ -170,23 +171,32 @@ module Yamine
     end
 
     # Build an SSLContext whose SNI callback serves the right cert per host.
+    #
+    # The CA pair on disk can be regenerated under a live proxy (`yamine
+    # clean`/`trust`/`setup` rewrite it). A proxy that keeps signing with
+    # its boot-time CA then mints leaves no browser trusts
+    # (ERR_CERT_AUTHORITY_INVALID against the new CA), so the SNI
+    # callback — which already runs per handshake — reloads the pair
+    # when it changes and drops every leaf minted from the old one.
     def server_context(dir = state_dir)
-      ca_cert, ca_key = load_ca(dir)
+      watcher = CaWatcher.new(dir)
       cache = CertCache.new(CACHE_SIZE)
+      watcher.on_reload = -> { cache.clear }
       ctx = OpenSSL::SSL::SSLContext.new
-      ctx.cert = ca_cert
-      ctx.key = ca_key
+      ctx.cert, ctx.key = watcher.current
       # ruby-openssl versions differ in how the callback receives its
       # arguments: [[socket, name]] (one array arg), (socket, name), or
       # (name). Flatten defensively — a raise inside the callback
       # surfaces as an unrecognized-name handshake alert.
       ctx.servername_cb = lambda do |*args|
         host = Array(args).flatten.last.to_s.downcase
-        entry = cache.fetch(host) do
-          cert, key = mint_host(host, ca_cert, ca_key)
-          [cert, key]
+        watcher.with_current do |ca_cert, ca_key|
+          entry = cache.fetch(host) do
+            cert, key = mint_host(host, ca_cert, ca_key)
+            [cert, key]
+          end
+          entry ? OpenSSL::SSL::SSLContext.new.tap { |c| c.cert, c.key = entry } : nil
         end
-        entry ? OpenSSL::SSL::SSLContext.new.tap { |c| c.cert, c.key = entry } : nil
       end
       ctx
     end
@@ -252,6 +262,96 @@ module Yamine
       def size
         @mutex.synchronize { @store.size }
       end
+
+      # Every entry is signed by one CA generation; a reload must not
+      # leave old-CA leaves behind to be served after the swap.
+      def clear
+        @mutex.synchronize do
+          @store.clear
+          @order.clear
+        end
+      end
+    end
+
+    # The CA pair a live server_context signs with, reloaded when the
+    # files on disk change. The hot path is two stat calls per
+    # handshake; the pair is only re-read (and the leaf cache only
+    # dropped) when a stat snapshot moves AND the digest differs, so a
+    # touch without content change costs nothing. One mutex around
+    # check+reload+mint keeps a swap from racing a handshake into a
+    # mixed pair or a stale cache hit. A failed reload keeps serving
+    # the previous CA — a raise inside the SNI callback would abort
+    # the handshake outright.
+    class CaWatcher
+      def initialize(dir)
+        @dir = dir
+        @mutex = Mutex.new
+        @cert, @key = Certs.load_ca(dir)
+        @stat = stat_snapshot
+        @digest = pair_digest
+        @on_reload = nil
+      end
+
+      # Called (once per swap, under the lock) after a reload. The
+      # server_context sets this to drop its leaf cache.
+      attr_writer :on_reload
+
+      def current
+        [@cert, @key]
+      end
+
+      def with_current
+        @mutex.synchronize do
+          reload_if_changed!
+          yield @cert, @key
+        end
+      end
+
+      private
+
+      def paths
+        Certs.ca_paths(@dir)
+      end
+
+      def stat_snapshot
+        [paths[:cert], paths[:key]].map do |path|
+          stat = File.stat(path)
+          [stat.mtime, stat.size]
+        end
+      rescue SystemCallError
+        nil
+      end
+
+      def pair_digest
+        Digest::SHA256.hexdigest(File.read(paths[:cert]) + File.read(paths[:key]))
+      rescue SystemCallError, OpenSSL::OpenSSLError
+        nil
+      end
+
+      def reload_if_changed!
+        snapshot = stat_snapshot
+        return if !snapshot.nil? && snapshot == @stat
+
+        digest = pair_digest
+        if !digest.nil? && digest == @digest
+          # Touched but unchanged: adopt the snapshot so the hot path
+          # goes back to two stats instead of a digest per handshake.
+          @stat = snapshot
+          return
+        end
+
+        # The serving SSLContext is frozen once the server accepts, so
+        # the default certificate cannot be swapped mid-flight — and it
+        # does not need to be: every real client sends SNI, and the
+        # per-host context this callback returns carries the new CA.
+        cert, key = Certs.load_ca(@dir)
+        @cert, @key = cert, key
+        @stat = stat_snapshot
+        @digest = digest || pair_digest
+        @on_reload&.call
+      rescue CertError, OpenSSL::OpenSSLError, SystemCallError
+        nil
+      end
     end
   end
 end

data/lib/yamine/cli/system.rb

@@ -30,7 +30,16 @@ module Yamine
       end
 
       def clean(ctx, _args)
-        ProxyControl.stop(ctx.store)
+        # A root service the CLI cannot signal keeps serving past stop:
+        # deleting the state dir (and untrusting the CA) then would
+        # orphan the live proxy and break its TLS. Refuse with the fix
+        # instead; the state on disk still describes the live proxy.
+        if ProxyControl.stop(ctx.store) == :needs_root
+          $stderr.puts "Cannot clean: the proxy runs as root (the launchd/systemd service) and is still serving."
+          $stderr.puts "  Restart it: sudo launchctl kickstart -k system/#{LAUNCHD_LABEL}"
+          $stderr.puts "  Or uninstall it: sudo yamine service uninstall — then re-run `yamine clean`."
+          exit 1
+        end
         result = Trust.untrust
         puts "CA removed from trust store." if result[:removed]
         warn "CA untrust failed: #{result[:error]}" if result[:error]
@@ -91,7 +100,33 @@ module Yamine
             Proxy.new(store: ctx.store, port: port, tls: tls,
               state_dir: ctx.store.dir, supervisor: sup, tlds: tlds).start_foreground
           else
-            ProxyControl.spawn_daemon(store: ctx.store, port: port, tls: tls, tlds: tlds)
+            # Privileged ports need root exactly like the boot path:
+            # spawn elevated when interactive (one sudo prompt),
+            # otherwise fail with the setup hint — never a doomed
+            # unprivileged child that dies of EACCES.
+            privileged = port < 1024 && !ProxyControl.root?
+            if privileged && !ctx.interactive?
+              $stderr.puts "Error: proxy is not running and port #{port} needs root."
+              $stderr.puts "  Human: run this once — yamine setup"
+              $stderr.puts "  Agent/CI: pre-provision passwordless sudo once —"
+              $stderr.puts "    yamine sudoers > /tmp/yamine.sudoers"
+              $stderr.puts "    sudo install -o root -g wheel -m 440 /tmp/yamine.sudoers /etc/sudoers.d/yamine"
+              $stderr.puts "  Or start the proxy by hand: sudo yamine proxy start"
+              exit 1
+            end
+            begin
+              ProxyControl.spawn_daemon(store: ctx.store, port: port, tls: tls,
+                sudo: privileged, tlds: tlds)
+            rescue ProxyAlreadyRunningError => e
+              # Idempotent: the proxy we wanted is already serving, so
+              # report that instead of a false "started".
+              puts e.message
+              return
+            rescue ProxyNotRunningError => e
+              $stderr.puts "Error: #{e.message.lines.first&.strip}"
+              $stderr.puts "  Fix once: yamine setup"
+              exit 1
+            end
             puts "Proxy started on port #{port}#{tls ? " (HTTPS)" : " (HTTP)"}."
           end
         when "stop"
@@ -102,10 +137,12 @@ module Yamine
           when :unknown_process then puts "Port in use by an unknown process."
           when :needs_root
             # A root service keeps serving; say so rather than implying
-            # success. Uninstalling is the real answer — signalling it
-            # would just leave launchd's KeepAlive restarting it.
-            $stderr.puts "The proxy runs as root (the launchd/systemd service)."
-            $stderr.puts "  Uninstall it: sudo yamine service uninstall"
+            # success. Restarting picks up new state, uninstalling
+            # removes it — signalling the pid would just leave
+            # launchd's KeepAlive restarting it.
+            $stderr.puts "The proxy runs as root (the launchd/systemd service) and is still serving."
+            $stderr.puts "  Restart it: sudo launchctl kickstart -k system/#{LAUNCHD_LABEL}"
+            $stderr.puts "  Or uninstall it: sudo yamine service uninstall"
             exit 1
           end
         else
@@ -669,6 +706,10 @@ module Yamine
         end
         ProxyControl.spawn_daemon(store: ctx.store, port: port, tls: tls, sudo: true)
         wait_for_ours(ctx, port, tls: tls)
+      rescue ProxyAlreadyRunningError
+        # The root service (or another daemon) already serves 443: that
+        # IS the privileged proxy setup wanted — verify and report.
+        wait_for_ours(ctx, port, tls: tls)
       rescue Yamine::ProxyNotRunningError, SystemCallError => e
         warn "    daemon start failed: #{e.message.lines.first&.strip}"
         false

data/lib/yamine/cli/worktree.rb

@@ -52,12 +52,13 @@ module Yamine
         sub = args.first
         case sub
         when "list", nil then list(ctx, args[1..] || [])
+        when "info" then info(ctx, args[1..] || [])
         when "add" then add(ctx, args[1..] || [])
         when "remove" then remove(ctx, args[1..] || [])
         when "clean" then clean(ctx, args[1..] || [])
         else
           raise Error,
-            "Usage: yamine worktree list | add <name> [--dir <path>] [--no-install] | " \
+            "Usage: yamine worktree list | info <name> [--json] | add <name> [--dir <path>] [--no-install] | " \
             "remove <name> [--force] | clean [--all] [--dry-run]"
         end
       end
@@ -110,6 +111,59 @@ module Yamine
         line
       end
 
+      # yamine worktree info <name> [--json]
+      #
+      # Detailed view of a single worktree: branch, HEAD, author, date,
+      # dirty/merged status, and any database claims.
+      def info(ctx, args)
+        opts, rest = take_flags(args, value_flags: [], flags: %w[--json])
+        name = rest.first
+        raise Error, "Usage: yamine worktree info <name> [--json]" unless name
+
+        repo = repo_top || abort_not_in_repo
+        entry = Worktrees.find(repo, name)
+        unless entry
+          raise Error, "no worktree named #{name.inspect} here — `yamine worktree list` shows what exists"
+        end
+
+        map = Database.load_map(ctx.store.dir)
+        claim = claim_for(map, entry.path)
+        default_branch = Worktrees.default_branch(repo)
+
+        result = Worktrees.info(repo, entry, default_branch: default_branch)
+        result[:databases] = database_names(claim)
+
+        if opts[:json]
+          require "json"
+          puts JSON.pretty_generate(result)
+        else
+          print_info(result)
+        end
+      end
+
+      def database_names(claim)
+        return [] unless claim
+
+        info = claim[1]
+        names = info.is_a?(Hash) ? info["names"] : nil
+        return [claim[0]] unless names.is_a?(Hash) && !names.empty?
+
+        names.values
+      end
+
+      def print_info(result)
+        puts "  branch     #{result[:branch]}"
+        puts "  path       #{result[:path]}"
+        puts "  HEAD       #{result[:head]}"
+        puts "  author     #{result[:author]}" if result[:author]
+        puts "  date       #{result[:date]}" if result[:date]
+        puts "  dirty      #{result[:dirty] ? "yes" : "no"}"
+        puts "  merged     #{result[:merged].nil? ? "n/a" : (result[:merged] ? "yes" : "no")}"
+        if result[:databases] && !result[:databases].empty?
+          result[:databases].each { |db| puts "  database   #{db}" }
+        end
+      end
+
       # Every database a claim stands for, one per line under the row —
       # five names inline would unreadable, and hiding them would
       # re-create the "which database is this worktree even using"

data/lib/yamine/doctor.rb

@@ -34,6 +34,7 @@ module Yamine
       checks << check_dns(store)
       checks << check_ca
       checks << check_ca_bundle
+      checks << check_serving_ca(port, tls: tls)
       checks
     end
 
@@ -224,6 +225,38 @@ module Yamine
       Check.new(name: "bundle", ok: false, message: "could not build #{Certs.bundle_path(dir)}: #{e.message}")
     end
 
+    # The certificate the proxy ACTUALLY serves, verified against the CA
+    # now on disk. The CA can be regenerated under a live proxy
+    # (`yamine clean`/`trust`/`setup` rewrite the pair); without this
+    # check doctor reported "[ok] proxy: listening" and "[ok] ca: CA
+    # trusted" while every browser got ERR_CERT_AUTHORITY_INVALID,
+    # because nothing compared the served leaf to the current CA.
+    def check_serving_ca(port, tls:)
+      return Check.new(name: "serving ca", ok: true, message: "TLS off — no serving certificate to check") unless tls
+      return Check.new(name: "serving ca", ok: true, message: "no proxy serving — skipped") if port.nil?
+
+      dir = Certs.state_dir
+      ca_path = Certs.ca_paths(dir)[:cert]
+      return Check.new(name: "serving ca", ok: true, message: "no CA on disk — skipped") unless File.file?(ca_path)
+
+      leaf = Trust.proxy_peer_cert(port)
+      return Check.new(name: "serving ca", ok: true, warn: true,
+        message: "could not read the proxy's serving certificate — skipped") if leaf.nil?
+
+      ca = OpenSSL::X509::Certificate.new(File.read(ca_path))
+      if Trust.signed_by?(leaf, ca)
+        Check.new(name: "serving ca", ok: true, message: "serving certificate matches the CA on disk")
+      else
+        Check.new(name: "serving ca", ok: false,
+          message: "proxy serves a certificate signed by a superseded CA — " \
+            "restart it: sudo launchctl kickstart -k system/dev.yamine " \
+            "(or sudo yamine service install to re-register the service after a gem upgrade)")
+      end
+    rescue StandardError => e
+      Check.new(name: "serving ca", ok: true, warn: true,
+        message: "could not check the serving certificate (#{e.message}) — skipped")
+    end
+
     # How many trusted certificates carry one of our CA names without
     # being the CA currently on disk. Best-effort: 0 when the keychain
     # cannot be read (doctor must never fail on a read-only probe).

data/lib/yamine/errors.rb

@@ -33,5 +33,9 @@ module Yamine
     end
   end
   class ProxyNotRunningError < Error; end
+  # spawn_daemon raises this instead of spawning when our proxy already
+  # answers on the port: the readiness probe would otherwise pass on the
+  # live proxy's behalf and a dead pid would be recorded over real state.
+  class ProxyAlreadyRunningError < Error; end
   class CertError < Error; end
 end

data/lib/yamine/proxy.rb

@@ -23,6 +23,20 @@ module Yamine
     # Bounded concurrency: beyond this many simultaneous connections the
     # proxy answers 503 instead of spawning threads without limit.
     MAX_CONNECTIONS = Integer(ENV.fetch("YAMINE_MAX_CONNECTIONS", "200"))
+    # Idle bound: waiting for the NEXT byte on any client or backend
+    # socket gives up after this many seconds. The clock resets on every
+    # byte transferred, so it caps silence — never total duration. A
+    # slow trickle (SSE/NDJSON chat stream, big download) runs as long as
+    # bytes keep moving; a peer that goes quiet is dropped instead of
+    # pinning a thread. Without this, stale keep-alive sockets and
+    # stalled peers accumulate until the proxy stops answering.
+    # Named YAMINE_PROXY_IDLE_TIMEOUT (not YAMINE_IDLE_TIMEOUT — that one
+    # is the Supervisor's app-idle kill, a different clock entirely).
+    IDLE_TIMEOUT = Float(ENV.fetch("YAMINE_PROXY_IDLE_TIMEOUT", "60"))
+    # Raised when a peer is silent past the idle bound. An IOError so the
+    # existing rescue-and-close paths treat it like any dead peer.
+    IdleTimeout = Class.new(IOError)
+    CHUNK_BYTES = 16_384
     # Route cache: routes.json is the source of truth, but re-reading
     # and re-parsing it on every request is wasteful under HMR polling.
     # Keyed on file mtime, so a freshly registered route is visible on
@@ -33,7 +47,7 @@ module Yamine
     LoopDetected = Struct.new(:host, :hops)
 
     def initialize(store:, port: 443, tls: true, state_dir: nil, on_error: nil,
-      supervisor: nil, max_connections: MAX_CONNECTIONS, tlds: nil)
+      supervisor: nil, max_connections: MAX_CONNECTIONS, idle_timeout: IDLE_TIMEOUT, tlds: nil)
       @store = store
       @port = port
       @tls = tls
@@ -41,6 +55,7 @@ module Yamine
       @on_error = on_error || ->(msg) { warn msg }
       @supervisor = supervisor
       @max_connections = max_connections
+      @idle_timeout = idle_timeout
       @tlds = Array(tlds).flatten.compact.map(&:downcase)
       @tlds = [Hostname::DEFAULT_TLD] if @tlds.empty?
       @inflight = 0
@@ -92,7 +107,17 @@ module Yamine
                 end
               end
             rescue OpenSSL::SSL::SSLError, IOError, SystemCallError
-              break unless @running
+              # A per-connection accept failure (bad TLS handshake,
+              # reset peer) is one dropped connection, not a reason to
+              # stop listening. Only shutdown breaks the loop.
+              next if @running
+              break
+            rescue StandardError => e
+              # An unexpected accept error must not silently kill the
+              # acceptor either: log it and keep serving while running.
+              @on_error.call("accept error: #{e.class}: #{e.message}")
+              next if @running
+              break
             end
           end
         end
@@ -180,17 +205,29 @@ module Yamine
       [TCPServer.new("127.0.0.1", @port), TCPServer.new("::1", @port)].map do |server|
         next server unless @tls
 
-        OpenSSL::SSL::SSLServer.new(server, Certs.server_context(@state_dir))
+        with_deferred_handshake(OpenSSL::SSL::SSLServer.new(server, Certs.server_context(@state_dir)))
       end
     rescue SystemCallError
       server = TCPServer.new("127.0.0.1", @port)
-      @tls ? [OpenSSL::SSL::SSLServer.new(server, Certs.server_context(@state_dir))] : [server]
+      @tls ? [with_deferred_handshake(OpenSSL::SSL::SSLServer.new(server, Certs.server_context(@state_dir)))] : [server]
+    end
+
+    # The TLS handshake reads from the peer, so doing it inside
+    # SSLServer#accept would let a connect-and-send-nothing client pin an
+    # acceptor thread forever (and with both acceptors pinned the proxy
+    # stops answering). Defer it: accept returns after the TCP handshake
+    # and the per-connection thread finishes TLS under the idle bound in
+    # #handle. SNI/cert behavior is unchanged — only the timing moves.
+    def with_deferred_handshake(ssl_server)
+      ssl_server.start_immediately = false
+      ssl_server
     end
 
     # One connection = many requests (keep-alive). Each request head is
     # re-parsed and rewritten; bodies are framed by Content-Length;
     # responses with Content-Length allow the loop to continue.
     def handle(sock)
+      tls_handshake(sock)
       buf = +""
       loop do
         head, buf = read_head(sock, buf)
@@ -256,13 +293,13 @@ module Yamine
     # the response. Returns :keep_alive when both sides want to reuse
     # the connection and the response length was known.
     def pipe_request(sock, backend, method, target, headers, buf)
-      backend.write(rebuild_head(method, target, headers))
+      write_all(backend, rebuild_head(method, target, headers))
 
       body_len = request_body_length(headers)
       if body_len == :chunked
         # Unclassifiable request body: stream to EOF, close after.
-        backend.write(buf) unless buf.empty?
-        IO.copy_stream(sock, backend)
+        write_all(backend, buf) unless buf.empty?
+        copy_stream(sock, backend)
         relay_response_close(backend, sock)
         return :close
       end
@@ -270,13 +307,11 @@ module Yamine
       remaining = body_len
       unless buf.empty?
         from_buf = buf.byteslice(0, remaining)
-        backend.write(from_buf)
+        write_all(backend, from_buf)
         remaining -= from_buf.bytesize
         buf = buf.byteslice(from_buf.bytesize..) || +""
       end
-      if remaining > 0
-        IO.copy_stream(sock, backend, remaining)
-      end
+      copy_stream(sock, backend, remaining) if remaining > 0
 
       rhead, rbuf = read_head(backend, +"")
       if rhead.nil?
@@ -284,19 +319,17 @@ module Yamine
         return :close
       end
       _rm, _rt, rheaders = parse_head(rhead)
-      sock.write(rhead)
-      sock.write(rbuf) unless rbuf.empty?
+      write_all(sock, rhead)
+      write_all(sock, rbuf) unless rbuf.empty?
 
       rlen = content_length(rheaders)
       if rlen.nil?
         # No Content-Length: close-delimited response.
-        IO.copy_stream(backend, sock)
+        copy_stream(backend, sock)
         return :close
       end
       remaining = rlen - rbuf.bytesize
-      if remaining > 0
-        IO.copy_stream(backend, sock, remaining)
-      end
+      copy_stream(backend, sock, remaining) if remaining > 0
 
       if keep_alive?(headers) && keep_alive?(rheaders)
         # Any bytes beyond Content-Length on the backend are a second
@@ -311,9 +344,9 @@ module Yamine
       rhead, rbuf = read_head(backend, +"")
       return if rhead.nil?
 
-      sock.write(rhead)
-      sock.write(rbuf) unless rbuf.empty?
-      IO.copy_stream(backend, sock)
+      write_all(sock, rhead)
+      write_all(sock, rbuf) unless rbuf.empty?
+      copy_stream(backend, sock)
     rescue IOError, SystemCallError
       nil
     end
@@ -331,8 +364,8 @@ module Yamine
       set_forwarded(headers, sock, tls: @tls)
 
       backend = dial(entry)
-      backend.write(rebuild_head(method, target, headers))
-      backend.write(buf) unless buf.empty?
+      write_all(backend, rebuild_head(method, target, headers))
+      write_all(backend, buf) unless buf.empty?
       pipe_both(sock, backend)
     rescue SystemCallError, OpenSSL::SSL::SSLError, IOError => e
       @on_error.call("upgrade proxy error: #{e.message}")
@@ -369,9 +402,11 @@ module Yamine
       true
     end
 
-    # Read just the header block with readpartial (no stdio buffering,
-    # so nothing is stolen from the body stream). `buf` carries bytes
-    # read ahead (pipelined requests) across calls. Returns [head, buf].
+    # Read just the header block without stdio buffering (so nothing is
+    # stolen from the body stream). `buf` carries bytes read ahead
+    # (pipelined requests) across calls. Returns [head, buf]. The wait
+    # for more bytes is idle-bounded: a peer that sends nothing is
+    # dropped (nil) instead of pinning the thread.
     def read_head(sock, buf)
       loop do
         if (idx = buf.index("\r\n\r\n"))
@@ -379,13 +414,109 @@ module Yamine
         end
         return [nil, buf] if buf.bytesize > MAX_HEAD_BYTES
 
-        chunk = sock.readpartial(16_384)
-        buf << chunk
+        buf << read_chunk(sock, CHUNK_BYTES)
       end
     rescue EOFError, IOError
       [nil, +""]
     end
 
+    # Finish a deferred TLS handshake under the idle bound. A no-op for
+    # plain sockets and for SSLSockets that already handshook (a second
+    # accept on an established connection returns immediately).
+    def tls_handshake(sock)
+      return unless sock.is_a?(OpenSSL::SSL::SSLSocket)
+
+      loop do
+        result = sock.accept_nonblock(exception: false)
+        return if result.is_a?(OpenSSL::SSL::SSLSocket)
+
+        wait_for(sock, result)
+      end
+    end
+
+    # One idle-bounded read: returns bytes, raises EOFError at end of
+    # stream, IdleTimeout when the peer is silent past the bound. Never
+    # blocks in the kernel without a select deadline, so no stalled peer
+    # pins the thread — including mid-TLS-handshake stalls, which plain
+    # readpartial would ride out forever.
+    def read_chunk(sock, size)
+      loop do
+        result = sock.read_nonblock(size, exception: false)
+        return result if result.is_a?(String)
+        raise EOFError, "end of file reached" if result.nil?
+
+        wait_for(sock, result)
+      end
+    end
+
+    # Idle-bounded write of the whole string. A peer that stops reading
+    # (full window) stalls here only until the bound, then IdleTimeout.
+    def write_all(sock, data)
+      offset = 0
+      while offset < data.bytesize
+        result = sock.write_nonblock(data.byteslice(offset..), exception: false)
+        if result.is_a?(Integer)
+          # A zero write made no progress: wait like a blocked writer
+          # instead of spinning.
+          result.zero? ? wait_for(sock, :wait_writable) : offset += result
+        else
+          wait_for(sock, result)
+        end
+      end
+      offset
+    end
+
+    # Idle-bounded relay. length nil copies to EOF (close-delimited or
+    # chunked-upload bodies); otherwise exactly length bytes. Every byte
+    # that moves resets the idle clock, so a slow trickle survives while
+    # a stalled source is abandoned with IdleTimeout. A truncated fixed
+    # body re-raises EOFError like IO.copy_stream did.
+    def copy_stream(src, dst, length = nil)
+      remaining = length
+      loop do
+        break if !remaining.nil? && remaining <= 0
+
+        size = remaining.nil? ? CHUNK_BYTES : [CHUNK_BYTES, remaining].min
+        begin
+          data = read_chunk(src, size)
+        rescue EOFError
+          raise if !remaining.nil? && remaining.positive?
+
+          break
+        end
+        write_all(dst, data)
+        remaining -= data.bytesize unless remaining.nil?
+      end
+    end
+
+    # Block until the socket is ready for the direction a nonblocking op
+    # asked for; IdleTimeout when the bound passes with no progress.
+    def wait_for(sock, wait_kind)
+      if wait_kind == :wait_readable
+        raise IdleTimeout, "idle timeout after #{@idle_timeout}s with no bytes" unless readable?(sock)
+      elsif !writable?(sock)
+        raise IdleTimeout, "idle timeout after #{@idle_timeout}s with no bytes"
+      end
+      nil
+    end
+
+    # select(2) with the idle bound. SSL-buffered bytes count as
+    # readable without a syscall. A closed socket raises in select —
+    # report not-ready and let the nonblocking op raise the real error.
+    def readable?(sock)
+      return true if sock.respond_to?(:pending) && sock.pending.positive?
+
+      !IO.select([sock], nil, nil, @idle_timeout).nil?
+    rescue IOError, SystemCallError
+      false
+    end
+
+    def writable?(sock)
+      !IO.select(nil, [sock], nil, @idle_timeout).nil?
+    rescue IOError, SystemCallError
+      false
+    end
+
     def parse_head(head)
       lines = head.split("\r\n")
       method, target, _version = lines.first.to_s.split(" ", 3)
@@ -432,7 +563,9 @@ module Yamine
     end
 
     # Raw bidirectional pump for upgrades; either side closing unblocks
-    # the other.
+    # the other. Deliberately outside the idle bound: an idle websocket
+    # is legitimate traffic (silence is the normal state), and framing
+    # no longer applies once the connection is hijacked.
     def pipe_both(client, backend)
       t1 = Thread.new do
         IO.copy_stream(client, backend)
@@ -508,11 +641,11 @@ module Yamine
 
     def respond(sock, status, body)
       message = { 404 => "Not Found", 502 => "Bad Gateway", 508 => "Loop Detected" }[status]
-      sock.write("HTTP/1.1 #{status} #{message}\r\n" \
-                 "Content-Type: text/html\r\n" \
-                 "#{HEALTH_HEADER}: 1\r\n" \
-                 "Content-Length: #{body.bytesize}\r\n" \
-                 "Connection: close\r\n\r\n#{body}")
+      write_all(sock, "HTTP/1.1 #{status} #{message}\r\n" \
+                      "Content-Type: text/html\r\n" \
+                      "#{HEALTH_HEADER}: 1\r\n" \
+                      "Content-Length: #{body.bytesize}\r\n" \
+                      "Connection: close\r\n\r\n#{body}")
     rescue IOError, SystemCallError
       nil
     end

data/lib/yamine/proxy_control.rb

@@ -247,6 +247,13 @@ module Yamine
     # explicitly because sudo does not preserve the environment.
     # Returns pid.
     def spawn_daemon(store:, port:, tls:, sudo: false, tlds: nil)
+      # Never spawn over a live proxy: the readiness probe below would
+      # pass on ITS behalf while our child dies of EACCES, and the dead
+      # pid would then be recorded over the real proxy's state.
+      if ours?(port, tls: tls)
+        raise ProxyAlreadyRunningError,
+          "A yamine proxy is already serving on port #{port} — not starting another."
+      end
       store.ensure_dir
       log_path = File.join(store.dir, LOG_NAME)
       Log.rotate(log_path)
@@ -261,6 +268,14 @@ module Yamine
       Process.detach(pid)
       deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 15
       until ours?(port, tls: tls)
+        # The child died before serving (EACCES on a privileged port,
+        # EADDRINUSE on a taken one): fail now with its log instead of
+        # waiting out the deadline and blaming a timeout.
+        unless pid_alive?(pid)
+          raise ProxyNotRunningError,
+            "Proxy exited before serving on port #{port}. " \
+            "Log (#{log_path}):\n#{log_tail(log_path)}"
+        end
         if Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
           raise ProxyNotRunningError,
             "Proxy did not start on port #{port}. " \
@@ -269,6 +284,15 @@ module Yamine
 
         sleep 0.25
       end
+      # The probe can pass on someone else's behalf (a root service that
+      # started answering between our pre-spawn check and now, while our
+      # child died): never record a pid that is not alive.
+      unless pid_alive?(pid)
+        raise ProxyNotRunningError,
+          "Proxy process #{pid} is not running, but port #{port} answers. " \
+          "Another proxy (likely the root service) is serving it — not recording #{pid}. " \
+          "Log (#{log_path}):\n#{log_tail(log_path)}"
+      end
       write_proxy_state(store, pid: pid, port: port, tls: tls)
       pid
     end
@@ -296,6 +320,13 @@ module Yamine
         return :unknown_process
       end
       unless pid_alive?(pid)
+        # The recorded process is gone, but someone may still be serving
+        # the recorded port (a root service the CLI cannot signal):
+        # clearing the state then would orphan the live proxy, leaving
+        # nothing on disk to find or stop it by. Probe first.
+        if port && ours?(port, tls: proxy_tls(store))
+          return :needs_root
+        end
         clear_pid(store)
         return :stale
       end

data/lib/yamine/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yamine
-  VERSION = "0.18.0"
+  VERSION = "0.20.0"
 end

data/lib/yamine/worktrees.rb

@@ -52,6 +52,36 @@ module Yamine
       entries
     end
 
+    # Detailed information about a single worktree. Returns a Hash with
+    # keys: :branch, :path, :head, :author, :date, :dirty, :merged.
+    def info(dir, entry, default_branch: nil)
+      repo = dir
+      branch_name = entry.main? ? "main" : (entry.branch || "(detached)")
+
+      head, subject, author_name, author_email, date = commit_info(entry.path)
+
+      dirty = entry.exists? &&
+        !entry.main? &&
+        dirty?(entry.path, ignore: [])
+
+      merged = if entry.detached || entry.main?
+                 nil
+               else
+                 db = default_branch || default_branch_for(repo)
+                 merged?(repo, entry.branch, into: db)
+               end
+
+      {
+        branch: branch_name,
+        path: File.expand_path(entry.path),
+        head: head,
+        author: author_name && author_email ? "#{author_name} <#{author_email}>" : nil,
+        date: date,
+        dirty: dirty,
+        merged: merged
+      }
+    end
+
     # The worktree whose branch or directory basename is `name`.
     def find(dir, name)
       list(dir).find do |entry|
@@ -143,5 +173,30 @@ module Yamine
     rescue SystemCallError, ArgumentError
       ["", nil]
     end
+
+    # Return [short_sha, subject, author_name, author_email, iso_date]
+    # for the HEAD commit of `path`. Any field may be nil when git fails.
+    def commit_info(path)
+      out, status = git(path,
+        "log", "-1", "--format=%h\t%s\t%an\t%ae\t%aI")
+      return [nil, nil, nil, nil, nil] unless status&.success?
+
+      parts = out.strip.split("\t", 5)
+      [parts[0], parts[1], parts[2], parts[3], parts[4]]
+    rescue SystemCallError, ArgumentError
+      [nil, nil, nil, nil, nil]
+    end
+
+    # Resolve the default branch for merging comparisons.
+    def default_branch_for(repo)
+      Variant::DEFAULT_BRANCHES.each do |candidate|
+        return candidate if branch_exists?(repo, candidate)
+      end
+
+      out, status = git(repo, "symbolic-ref", "--quiet", "refs/remotes/origin/HEAD")
+      return out.strip.sub(%r{\Arefs/remotes/origin/}, "") if status&.success? && !out.strip.empty?
+
+      "master"
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yamine
 version: !ruby/object:Gem::Version
-  version: 0.18.0
+  version: 0.20.0
 platform: ruby
 authors:
 - Kaka Ruto