@adhdev/daemon-core 0.9.82-rc.45 → 0.9.82-rc.450

package/src/commands/stream-commands.ts

@@ -245,6 +245,14 @@ export function normalizeProviderScriptArgs(args: any, scriptName?: string): Rec
 function buildControlScriptResult(scriptName: string, payload: any): Record<string, unknown> {
     if (!payload || typeof payload !== 'object') return {};
 
+    // The spec-driven control adapter (open_picker LIST/SELECT) already
+    // produced a structured controlResult by parsing the live screen. Honour
+    // it verbatim instead of re-deriving one from legacy payload shapes —
+    // otherwise the screen-parsed options/currentValue get clobbered.
+    if (payload.controlResult && typeof payload.controlResult === 'object') {
+        return { controlResult: payload.controlResult };
+    }
+
     const legacyListPayload = (() => {
         if (Array.isArray(payload.options)) return payload;
         if (/^listmodels$/i.test(scriptName) && Array.isArray(payload.models)) {

package/src/commands/upgrade-helper.ts

@@ -169,6 +169,43 @@ export function buildPinnedGlobalInstallCommand(options: {
   };
 }
 
+/**
+ * Build an env for the `npm install` child whose PATH is prefixed with the
+ * directory of the node binary currently running this helper.
+ *
+ * npm runs lifecycle scripts (e.g. adhdev's `preinstall` Node-version guard) by
+ * spawning a bare `node`, which resolves from PATH — NOT from the node that runs
+ * npm. On Windows a machine can have several node installs (e.g. a standalone
+ * `C:\Program Files\nodejs` ahead of an nvm-managed node on PATH). Without this,
+ * the guard sees the wrong (unsupported) node version and aborts the upgrade,
+ * even though npm/adhdev actually run under a supported node. Pinning the
+ * running node's dir to the front of PATH makes lifecycle scripts use the same
+ * node as the install itself.
+ */
+function buildInstallEnvWithNodeOnPath(baseEnv: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  // The Node-version guard this works around only fires on Windows, so scope the
+  // PATH rewrite to win32 — POSIX keeps its env untouched.
+  if (process.platform !== 'win32') return { ...baseEnv };
+  const nodeBinDir = path.dirname(process.execPath);
+  if (!nodeBinDir) return { ...baseEnv };
+  const env: NodeJS.ProcessEnv = { ...baseEnv };
+  // Windows env keys are case-insensitive and conventionally spelled `Path`;
+  // prepend to the existing key (whatever its case) to avoid creating a dupe.
+  const pathKey = Object.keys(env).find((k) => k.toLowerCase() === 'path') || 'PATH';
+  const current = env[pathKey] || '';
+  env[pathKey] = current ? `${nodeBinDir};${current}` : nodeBinDir;
+  // Belt-and-suspenders for the same Node-version guard: the PATH prepend above
+  // only works if the running helper's node is itself a supported version, but a
+  // helper launched via an nvm shim (e.g. `C:\nvm4w\nodejs\node.exe`) can resolve
+  // to Node 24 even though the real install target node is pinned via `--prefix`.
+  // In the AUTOMATIC upgrade path the install target is already pinned/verified,
+  // so authorize the lifecycle guard to proceed via the same bootstrap escape
+  // hatch the guard already honors. This is scoped to the helper-built env only —
+  // it never weakens the guard for a user-run `npm i -g adhdev`.
+  env.ADHDEV_BOOTSTRAP = '1';
+  return env;
+}
+
 export function getNpmExecOptions(platform: NodeJS.Platform = process.platform): NpmExecOptions {
   if (platform === 'win32') {
     return { shell: false, windowsHide: true };
@@ -264,13 +301,14 @@ async function waitForPidExit(pid: number, timeoutMs: number): Promise<void> {
   }
 }
 
-export function stopSessionHostProcesses(appName: string): void {
+export async function stopSessionHostProcesses(appName: string): Promise<void> {
   const pidFile = path.join(os.homedir(), '.adhdev', `${appName}-session-host.pid`);
+  let killedPid: number | null = null;
   try {
     if (fs.existsSync(pidFile)) {
       const pid = Number.parseInt(fs.readFileSync(pidFile, 'utf8').trim(), 10);
       if (Number.isFinite(pid) && pid !== process.pid && isManagedSessionHostPid(pid)) {
-        killPid(pid);
+        if (killPid(pid)) killedPid = pid;
       }
     }
   } catch {
@@ -282,6 +320,164 @@ export function stopSessionHostProcesses(appName: string): void {
       // noop
     }
   }
+
+  // The session-host process keeps node-pty's `conpty.node` memory-mapped. On
+  // Windows a mapped native addon stays EXCLUSIVELY locked until the process
+  // fully exits and tears down the mapping — and that teardown lags `taskkill`
+  // by an indeterminate interval. `taskkill` only *requests* termination, so
+  // returning immediately lets the caller run `npm install` while conpty.node
+  // is still locked, which makes npm's copy-to-staging fail with EBUSY (the
+  // intermittent Windows upgrade failure). Wait for the killed process to
+  // actually disappear — like we already do for the parent daemon pid — so the
+  // file handle is released before the install runs. (POSIX can replace an open
+  // file freely, so the wait is harmless there.)
+  if (killedPid !== null) {
+    await waitForPidExit(killedPid, 15000);
+  }
+}
+
+// Native addons that stay EXCLUSIVELY locked on Windows while any process keeps
+// them memory-mapped. node-pty's `conpty.node` is the confirmed offender; the
+// ghostty VT dll has the same lifetime, so guard both.
+const LOCKED_NATIVE_ADDON_BASENAMES = ['conpty.node', 'ghostty-vt.dll'];
+
+/**
+ * Enumerate processes that have a locked native addon (conpty.node /
+ * ghostty-vt.dll) of *this* install memory-mapped.
+ *
+ * `stopSessionHostProcesses()` only knows the single managed session-host pid, so
+ * any *foreign* holder — e.g. an orphaned `pty_*probe*.cjs` left in `%TEMP%` — is
+ * invisible to it and keeps the addon locked through every install retry, dooming
+ * the upgrade with EBUSY. This scans by the module's full path so we only ever
+ * target a holder of the exact `packageRoot` being replaced (never an unrelated
+ * install's copy). Windows-only — these locks don't exist on POSIX.
+ */
+export function listForeignNativeAddonHolders(
+  packageRoot: string | null | undefined,
+): Array<{ pid: number; commandLine: string | null }> {
+  if (process.platform !== 'win32' || !packageRoot) return [];
+  const rootLower = packageRoot.replace(/\//g, '\\').replace(/'/g, "''").toLowerCase();
+  const endsWithChecks = LOCKED_NATIVE_ADDON_BASENAMES
+    .map((name) => `$lf.EndsWith('${name}')`)
+    .join(' -or ');
+  // List pids of node processes whose loaded modules include a locked native
+  // addon living UNDER this install's package root. Accessing .Modules for a
+  // process we can't open throws — swallow per-process so one inaccessible
+  // process doesn't abort the whole scan.
+  const script = [
+    `$root = '${rootLower}'`,
+    `Get-Process node -ErrorAction SilentlyContinue | ForEach-Object {`,
+    `  $p = $_`,
+    `  try {`,
+    `    foreach ($m in $p.Modules) {`,
+    `      $fn = $m.FileName`,
+    `      if ($fn) {`,
+    `        $lf = $fn.ToLower()`,
+    `        if ($lf.StartsWith($root) -and (${endsWithChecks})) { $p.Id; break }`,
+    `      }`,
+    `    }`,
+    `  } catch {}`,
+    `}`,
+  ].join('\n');
+
+  let out = '';
+  try {
+    out = String(execFileSync('powershell.exe', [
+      '-NoProfile',
+      '-NonInteractive',
+      '-ExecutionPolicy', 'Bypass',
+      '-Command', script,
+    ], { encoding: 'utf8', timeout: 8000, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true })).trim();
+  } catch {
+    return [];
+  }
+
+  const selfPid = process.pid;
+  const seen = new Set<number>();
+  const holders: Array<{ pid: number; commandLine: string | null }> = [];
+  for (const line of out.split(/\r?\n/)) {
+    const pid = Number.parseInt(line.trim(), 10);
+    if (!Number.isFinite(pid) || pid <= 0 || pid === selfPid || seen.has(pid)) continue;
+    seen.add(pid);
+    holders.push({ pid, commandLine: getProcessCommandLine(pid) });
+  }
+  return holders;
+}
+
+/**
+ * Terminate every foreign process holding this install's native addon mapped,
+ * then wait for each to actually exit so the mapping is released before npm
+ * copies the file into its staging dir. Returns what it found/killed so the
+ * caller can surface an actionable recovery message on failure.
+ */
+export async function stopForeignNativeAddonHolders(
+  packageRoot: string | null | undefined,
+  options: { parentPid?: number } = {},
+): Promise<Array<{ pid: number; commandLine: string | null; killed: boolean }>> {
+  if (process.platform !== 'win32' || !packageRoot) return [];
+  const parentPid = Number.isFinite(options.parentPid) ? Number(options.parentPid) : -1;
+  const holders = listForeignNativeAddonHolders(packageRoot);
+  const results: Array<{ pid: number; commandLine: string | null; killed: boolean }> = [];
+  for (const holder of holders) {
+    // The parent daemon pid is already awaited for exit separately; never
+    // double-handle it here.
+    if (holder.pid === parentPid) continue;
+    appendUpgradeLog(
+      `Foreign native-addon holder found: pid ${holder.pid}${holder.commandLine ? ` — ${holder.commandLine}` : ''}`,
+    );
+    const killed = killPid(holder.pid);
+    if (killed) {
+      await waitForPidExit(holder.pid, 15000);
+      appendUpgradeLog(`Terminated foreign native-addon holder pid ${holder.pid}`);
+    } else {
+      appendUpgradeLog(`Failed to terminate foreign native-addon holder pid ${holder.pid}`);
+    }
+    results.push({ ...holder, killed });
+  }
+  return results;
+}
+
+function getUpgradeFailureNoticePath(): string {
+  const home = os.homedir();
+  const dir = path.join(home, '.adhdev');
+  try {
+    fs.mkdirSync(dir, { recursive: true });
+  } catch {
+    // noop — appendUpgradeLog already creates the dir; this is best-effort.
+  }
+  return path.join(dir, 'daemon-upgrade-last-error.txt');
+}
+
+function buildManualRecoveryCommand(installCommand: PinnedGlobalInstallCommand): string {
+  return [installCommand.command, ...installCommand.args]
+    .map((part) => (/\s/.test(part) ? `"${part}"` : part))
+    .join(' ');
+}
+
+/**
+ * On final failure, leave the user something actionable instead of only a buried
+ * log line: the pids/commandlines still holding the lock and a paste-ready
+ * recovery command. Written to a stable path the CLI can surface on next boot.
+ */
+function emitUpgradeFailureNotice(lines: string[]): void {
+  const body = lines.join('\n');
+  appendUpgradeLog(`Upgrade blocked — user action required:\n${body}`);
+  try {
+    fs.writeFileSync(getUpgradeFailureNoticePath(), `[${new Date().toISOString()}]\n${body}\n`, 'utf8');
+  } catch {
+    // noop
+  }
+}
+
+// npm copies the current install's files into a staging dir before swapping in
+// the new version. On Windows that copy of `conpty.node` can still race a
+// just-killed session-host whose mapping hasn't been released yet, surfacing as
+// EBUSY/EPERM. Treat those as transient and retry with backoff.
+function isRetriableInstallLockError(error: any): boolean {
+  const code = error?.code;
+  if (code === 'EBUSY' || code === 'EPERM') return true;
+  const text = `${error?.message || ''} ${error?.stderr || ''}`;
+  return /\bEBUSY\b|\bEPERM\b|resource busy or locked/i.test(text);
 }
 
 function removeDaemonPidFile(): void {
@@ -293,42 +489,64 @@ function removeDaemonPidFile(): void {
   }
 }
 
-function cleanupStaleGlobalInstallDirs(pkgName: string, surface: CurrentGlobalInstallSurface): void {
-  const prefixArgs = surface.installPrefix ? ['--prefix', surface.installPrefix] : [];
-  const npmRoot = String(execNpmCommandSync(['root', '-g', ...prefixArgs], { encoding: 'utf8' }, surface)).trim();
-  if (!npmRoot) return;
-  const npmPrefix = surface.installPrefix
-    || String(execNpmCommandSync(['prefix', '-g', ...prefixArgs], { encoding: 'utf8' }, surface)).trim();
-  const binDir = process.platform === 'win32' ? npmPrefix : path.join(npmPrefix, 'bin');
-  const packageBaseName = pkgName.startsWith('@') ? pkgName.split('/')[1] : pkgName;
-  const binNames = new Set<string>([packageBaseName]);
-  if (pkgName === '@adhdev/daemon-standalone') {
-    binNames.add('adhdev-standalone');
-  }
-
-  if (pkgName.startsWith('@')) {
-    const [scope, name] = pkgName.split('/');
-    const scopeDir = path.join(npmRoot, scope);
-    if (!fs.existsSync(scopeDir)) return;
-    for (const entry of fs.readdirSync(scopeDir)) {
-      if (!entry.startsWith(`.${name}-`)) continue;
-      fs.rmSync(path.join(scopeDir, entry), { recursive: true, force: true });
-      appendUpgradeLog(`Removed stale scoped staging dir: ${path.join(scopeDir, entry)}`);
+/**
+ * Best-effort removal of a leftover npm staging entry.
+ *
+ * A stale staging dir can hold a locked native binary — e.g. `ghostty-vt.dll`
+ * from `@adhdev/ghostty-vt-node` still mapped by a lingering session-host
+ * process — which makes `rmSync` throw `EPERM` on Windows. Staging cleanup is
+ * only housekeeping: the leftover is inert and npm creates its own fresh
+ * staging dir for the real install, so a lock on an old leftover must NOT abort
+ * the upgrade. Log and continue instead of letting the error propagate.
+ */
+export function safeRemoveStaleEntry(target: string, label: string): void {
+  try {
+    fs.rmSync(target, { recursive: true, force: true });
+    appendUpgradeLog(`${label}: ${target}`);
+  } catch (error: any) {
+    appendUpgradeLog(`Skipped locked stale entry (${error?.code || 'error'}): ${target} — ${error?.message || String(error)}`);
+  }
+}
+
+export function cleanupStaleGlobalInstallDirs(pkgName: string, surface: CurrentGlobalInstallSurface): void {
+  // The whole routine is housekeeping — never let it throw out and abort the
+  // upgrade (npm root/prefix probing or readdir can fail for unrelated reasons).
+  try {
+    const prefixArgs = surface.installPrefix ? ['--prefix', surface.installPrefix] : [];
+    const npmRoot = String(execNpmCommandSync(['root', '-g', ...prefixArgs], { encoding: 'utf8' }, surface)).trim();
+    if (!npmRoot) return;
+    const npmPrefix = surface.installPrefix
+      || String(execNpmCommandSync(['prefix', '-g', ...prefixArgs], { encoding: 'utf8' }, surface)).trim();
+    const binDir = process.platform === 'win32' ? npmPrefix : path.join(npmPrefix, 'bin');
+    const packageBaseName = pkgName.startsWith('@') ? pkgName.split('/')[1] : pkgName;
+    const binNames = new Set<string>([packageBaseName]);
+    if (pkgName === '@adhdev/daemon-standalone') {
+      binNames.add('adhdev-standalone');
     }
-  } else {
-    for (const entry of fs.readdirSync(npmRoot)) {
-      if (!entry.startsWith(`.${pkgName}-`)) continue;
-      fs.rmSync(path.join(npmRoot, entry), { recursive: true, force: true });
-      appendUpgradeLog(`Removed stale staging dir: ${path.join(npmRoot, entry)}`);
+
+    if (pkgName.startsWith('@')) {
+      const [scope, name] = pkgName.split('/');
+      const scopeDir = path.join(npmRoot, scope);
+      if (!fs.existsSync(scopeDir)) return;
+      for (const entry of fs.readdirSync(scopeDir)) {
+        if (!entry.startsWith(`.${name}-`)) continue;
+        safeRemoveStaleEntry(path.join(scopeDir, entry), 'Removed stale scoped staging dir');
+      }
+    } else {
+      for (const entry of fs.readdirSync(npmRoot)) {
+        if (!entry.startsWith(`.${pkgName}-`)) continue;
+        safeRemoveStaleEntry(path.join(npmRoot, entry), 'Removed stale staging dir');
+      }
     }
-  }
 
-  if (fs.existsSync(binDir)) {
-    for (const entry of fs.readdirSync(binDir)) {
-      if (!Array.from(binNames).some((name) => entry.startsWith(`.${name}-`))) continue;
-      fs.rmSync(path.join(binDir, entry), { recursive: true, force: true });
-      appendUpgradeLog(`Removed stale bin staging entry: ${path.join(binDir, entry)}`);
+    if (fs.existsSync(binDir)) {
+      for (const entry of fs.readdirSync(binDir)) {
+        if (!Array.from(binNames).some((name) => entry.startsWith(`.${name}-`))) continue;
+        safeRemoveStaleEntry(path.join(binDir, entry), 'Removed stale bin staging entry');
+      }
     }
+  } catch (error: any) {
+    appendUpgradeLog(`Stale staging cleanup skipped (${error?.code || 'error'}): ${error?.message || String(error)}`);
   }
 }
 
@@ -362,22 +580,69 @@ async function runDaemonUpgradeHelper(payload: DaemonUpgradeHelperPayload): Prom
     await waitForPidExit(payload.parentPid, 15000);
   }
 
-  stopSessionHostProcesses(sessionHostAppName);
+  await stopSessionHostProcesses(sessionHostAppName);
   removeDaemonPidFile();
+  // Kill any *foreign* process still holding this install's conpty.node mapped
+  // (the session-host stop above only covers the single managed pid). Do this
+  // BEFORE the staging GC so the just-released file can also be cleaned up now
+  // that no process maps it.
+  await stopForeignNativeAddonHolders(installCommand.surface.packageRoot, { parentPid: payload.parentPid });
   cleanupStaleGlobalInstallDirs(payload.packageName, installCommand.surface);
 
   const spec = `${payload.packageName}@${payload.targetVersion || 'latest'}`;
   appendUpgradeLog(`Installing ${spec}`);
-  const installOutput = execFileSync(
-    installCommand.command,
-    installCommand.args,
-    {
-      encoding: 'utf8',
-      stdio: 'pipe',
-      maxBuffer: 20 * 1024 * 1024,
-      ...installCommand.execOptions,
-    },
-  );
+  // Windows can still race a lingering conpty.node mapping even after the
+  // session-host exits, so retry the install on transient lock errors there.
+  const maxInstallAttempts = process.platform === 'win32' ? 3 : 1;
+  let installOutput = '';
+  for (let attempt = 1; attempt <= maxInstallAttempts; attempt++) {
+    try {
+      installOutput = String(execFileSync(
+        installCommand.command,
+        installCommand.args,
+        {
+          encoding: 'utf8',
+          stdio: 'pipe',
+          maxBuffer: 20 * 1024 * 1024,
+          env: buildInstallEnvWithNodeOnPath(),
+          ...installCommand.execOptions,
+        },
+      ));
+      break;
+    } catch (error: any) {
+      if (attempt < maxInstallAttempts && isRetriableInstallLockError(error)) {
+        appendUpgradeLog(`Install attempt ${attempt} hit a file lock (${error?.code || 'lock'}); clearing holders + staging and retrying after backoff`);
+        // Re-run the active cleanup ("정리 → 확인 → 설치") rather than relying on
+        // backoff alone: a never-exiting foreign holder won't disappear on its
+        // own, so kill it again before the next attempt.
+        await stopForeignNativeAddonHolders(installCommand.surface.packageRoot, { parentPid: payload.parentPid });
+        cleanupStaleGlobalInstallDirs(payload.packageName, installCommand.surface);
+        await new Promise((resolve) => setTimeout(resolve, attempt * 1500));
+        continue;
+      }
+      // Out of retries on a lock error: leave the user an actionable recovery
+      // notice naming whoever is still holding the native addon locked.
+      if (isRetriableInstallLockError(error)) {
+        const blockers = listForeignNativeAddonHolders(installCommand.surface.packageRoot);
+        const notice: string[] = [
+          `adhdev ${spec} could not be installed: a file lock (${error?.code || 'EBUSY/EPERM'}) is blocking the native addon.`,
+        ];
+        if (blockers.length > 0) {
+          notice.push('Processes still holding the lock:');
+          for (const b of blockers) {
+            notice.push(`  pid ${b.pid}${b.commandLine ? ` — ${b.commandLine}` : ''}`);
+          }
+          notice.push('To recover, stop them and reinstall:');
+          notice.push(`  Stop-Process -Id ${blockers.map((b) => b.pid).join(',')} -Force`);
+        } else {
+          notice.push('To recover, reinstall manually:');
+        }
+        notice.push(`  ${buildManualRecoveryCommand(installCommand)}`);
+        emitUpgradeFailureNotice(notice);
+      }
+      throw error;
+    }
+  }
   if (installOutput.trim()) {
     appendUpgradeLog(installOutput.trim());
   }