@aron98/load-lock 1.4.0 → 1.5.0

package/dist/adapters/opencode/plugin.js

@@ -24,6 +24,8 @@ import { POLICY_BRIEF } from "../../policy/text.js";
 import { waitForTurn, WaitAbortedError } from "../../shared/wait-turn.js";
 import { waitForLocalJob, waitForTrackedJob } from "../../shared/wait-completion.js";
 import { killProcessGroup } from "../../shared/transport.js";
+import { detectCliDrift } from "../../shared/drift.js";
+import { packageVersion } from "../../shared/version.js";
 const client = new LLClient();
 const knownSessions = new Set();
 const jobs = new Map();
@@ -44,6 +46,18 @@ function toolContent(v) {
 export default Plugin.define({
     id: "load-lock",
     setup(ctx) {
+        // Drift notice (issue #38): when this adapter copy is NEWER than the
+        // `load-lock` CLI that PATH resolves to (opencode refreshed its cache
+        // copy but the global install was never updated), surface one clear
+        // notice naming the exact command — on stderr at init, and once in the
+        // injected context. Notify only: nothing is ever auto-installed. Note
+        // the honest limitation (docs/OPERATIONS.md): a harness session that
+        // was already running keeps the OLD adapter code in memory until the
+        // harness itself restarts — this fires from the NEW copy at its init.
+        const cliDrift = detectCliDrift(packageVersion());
+        if (cliDrift)
+            process.stderr.write(cliDrift.message + "\n");
+        const DRIFT_NOTE = cliDrift ? "\n\n" + cliDrift.message : "";
         // ------------------------------------------------------------- tools
         ctx.tool.transform((editor) => {
             editor.namespace({
@@ -314,7 +328,7 @@ export default Plugin.define({
         });
         // ------------------------------------------- policy on every model call
         void ctx.session.hook("context", async (event) => {
-            event.system.push({ type: "text", text: POLICY_BRIEF + "\n\n" + (await statusBrief()) });
+            event.system.push({ type: "text", text: POLICY_BRIEF + "\n\n" + (await statusBrief()) + DRIFT_NOTE });
         });
         // -------------------------------------------------- idle wakeup via watch
         void (async () => {

package/dist/adapters/opencode/tui.js

@@ -100,6 +100,8 @@ function dashboardLines(v, width, f) {
         push(`note: ${v.daemonRestartNote}`, f.warn);
     if (v.versionSkewNote)
         push(`note: ${v.versionSkewNote}`, f.warn);
+    if (v.installDriftNote)
+        push(`note: ${v.installDriftNote}`, f.warn);
     if (v.machine) {
         const m = v.machine;
         const cg = m.cgroupCpuQuota != null ? ` · cgroup quota ${m.cgroupCpuQuota / 100} CPU` : "";
@@ -209,11 +211,14 @@ export default Plugin.define({
     id: "load-lock.tui",
     setup(ctx) {
         const [view, setView] = createSignal(null);
-        const feed = new DashboardFeed(new LLClient());
+        // driftSurface "opencode": when this session's copy is older than the
+        // PATH CLI, the hint says to restart opencode (plugins never hot-reload).
+        const feed = new DashboardFeed(new LLClient(), { driftSurface: "opencode" });
         feed.onChange = () => setView(feed.view());
         feed.onState = () => setView(feed.view());
         void feed.start().catch(() => {
-            /* daemon down or spawning; the feed keeps retrying and will go live */
+            /* daemon down or spawning; the reconnect loop keeps retrying and
+               will go live — start() only reports the FIRST connect failure */
         });
         // Local countdown tick: produces a fresh snapshot once per second so
         // ages/deadlines advance even between daemon events.

package/dist/cli/copies.d.ts

@@ -1,3 +1,4 @@
+export { enclosingPackage, opencodeCacheRoot } from "../shared/pkginfo.js";
 export interface InstalledCopy {
     /** Where this copy was found. */
     source: "cli" | "path" | "opencode-cache";
@@ -6,15 +7,6 @@ export interface InstalledCopy {
     /** Version string, or null when the package.json could not be read. */
     version: string | null;
 }
-/**
- * Find the package.json of the @aron98/load-lock copy that contains the
- * given file, by climbing parent directories. Best-effort: returns null if
- * no enclosing package.json matches (or is readable).
- */
-export declare function enclosingPackage(startDir: string, maxDepth?: number): {
-    path: string;
-    version: string | null;
-} | null;
 /** The copy of load-lock this process runs from (its own package root). */
 export declare function thisCopy(): InstalledCopy | null;
 /**

package/dist/cli/copies.js

@@ -10,41 +10,10 @@
  */
 import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { isWindows } from "../shared/transport.js";
-/** Package name of this package (used to find enclosing package roots). */
-const PKG_NAME = "@aron98/load-lock";
-/**
- * Find the package.json of the @aron98/load-lock copy that contains the
- * given file, by climbing parent directories. Best-effort: returns null if
- * no enclosing package.json matches (or is readable).
- */
-export function enclosingPackage(startDir, maxDepth = 12) {
-    let dir = startDir;
-    for (let i = 0; i < maxDepth; i++) {
-        const pkgPath = join(dir, "package.json");
-        try {
-            if (existsSync(pkgPath)) {
-                const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-                if (pkg?.name === PKG_NAME) {
-                    return { path: dir, version: typeof pkg.version === "string" ? pkg.version : null };
-                }
-                // A foreign package.json terminates the climb (e.g. a PATH bin
-                // inside some other tool's package).
-                return null;
-            }
-        }
-        catch {
-            return null;
-        }
-        const parent = dirname(dir);
-        if (parent === dir)
-            return null;
-        dir = parent;
-    }
-    return null;
-}
+import { enclosingPackage, opencodeCacheRoot, PKG_NAME } from "../shared/pkginfo.js";
+export { enclosingPackage, opencodeCacheRoot } from "../shared/pkginfo.js";
 /** The copy of load-lock this process runs from (its own package root). */
 export function thisCopy() {
     // dist/cli/copies.js -> dist/cli -> ... -> <pkg>/package.json
@@ -195,13 +164,3 @@ export function findInstalledCopies(platform = process.platform, env = process.e
     }
     return copies;
 }
-/** Cache root the way opencode resolves it (its npm cache lives under it). */
-function opencodeCacheRoot(platform, env) {
-    if (env.XDG_CACHE_HOME)
-        return env.XDG_CACHE_HOME;
-    if (platform === "win32")
-        return env.LOCALAPPDATA ?? null;
-    if (platform === "darwin")
-        return join(env.HOME ?? homedir(), "Library", "Caches");
-    return join(env.HOME ?? homedir(), ".cache");
-}

package/dist/cli/install.js

@@ -1154,7 +1154,7 @@ function installOmac(opts, P) {
         "LOAD_LOCK_LABEL_PREFIX=omac (dashboard shows holders as omac:<label>); " +
         "LOAD_LOCK_SOCKET only if the default <state dir>/daemon.sock is not what the sandbox sees");
     actions.push("label prefixes need load-lock >= 1.2.0 on BOTH ends: a daemon started before v1.2.0 " +
-        "silently strips the unknown labelPrefix field — upgrade and restart the daemon (load-lock service stop && load-lock service start)");
+        "silently strips the unknown labelPrefix field — upgrade and restart the daemon (load-lock service restart)");
     actions.push("verified live against omac 0.11.0 (bubblewrap + Landlock): sandboxed client -> host daemon " +
         "round-trip, prefixed labels, LOAD_LOCK_NO_SPAWN error contract");
     return actions;

package/dist/cli/main.js

@@ -2,14 +2,13 @@
 /**
  * load-lock CLI: inspection, recovery, scriptable flows, execution helper.
  *
- * Exit codes: 0 ok; 64 usage; 65 protocol/data error; 68 not granted yet
- * (queued/registered); 69 offer/claim failed; 70 internal.
+ * Exit codes: 0 ok; 1 update available (`update --check`); 64 usage; 65
+ * protocol/data error; 68 not granted yet (queued/registered); 69
+ * offer/claim failed; 70 internal.
  */
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync, rmSync, unlinkSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { connect } from "node:net";
-import { setTimeout as delay } from "node:timers/promises";
 import { LLClient, withClient } from "../shared/client.js";
 import { ProtocolError } from "../shared/protocol.js";
 import { waitForTurn } from "../shared/wait-turn.js";
@@ -21,6 +20,8 @@ import { findInstalledCopies } from "./copies.js";
 import { installCommand, uninstallCommand } from "./install.js";
 import { hookCommand } from "./hook.js";
 import { topCommand } from "./top.js";
+import { awaitDaemonUpgraded, serviceRestart, serviceStart, serviceStop, ServiceError } from "./service.js";
+import { updateCommand } from "./update.js";
 // ---------------------------------------------------------------- arg parsing
 const argv = process.argv.slice(2);
 let flags = {};
@@ -35,7 +36,7 @@ for (let i = 0; i < argv.length; i++) {
         const eq = a.indexOf("=");
         if (eq !== -1)
             flags[a.slice(2, eq)] = a.slice(eq + 1);
-        else if (["json", "follow", "force", "admin", "quiet"].includes(a.slice(2)))
+        else if (["json", "follow", "force", "admin", "quiet", "check", "version"].includes(a.slice(2)))
             flags[a.slice(2)] = true;
         else if (i + 1 < argv.length && !argv[i + 1].startsWith("--"))
             flags[a.slice(2)] = argv[++i];
@@ -66,87 +67,6 @@ function defaultAgent() {
     return (process.env.LOAD_LOCK_AGENT ||
         "cli:" + (process.env.USER || "user") + "@" + (process.env.HOSTNAME || "localhost"));
 }
-// ------------------------------------------------- daemon service helpers
-/** daemon.json contents, or null when missing/unreadable. */
-function readDaemonInfo(dir) {
-    try {
-        return JSON.parse(readFileSync(join(dir, "daemon.json"), "utf8"));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Version-less hello over a raw socket connection: deliberately does NOT
- * send clientVersion, so asking a daemon for its identity never orders it
- * to self-restart (used by `service stop` and post-restart confirmation).
- * Best-effort: resolves null on any failure.
- */
-function rawHello(sockPath, timeoutMs = 2000) {
-    return new Promise((resolve) => {
-        let settled = false;
-        let buf = "";
-        const done = (v) => {
-            if (settled)
-                return;
-            settled = true;
-            try {
-                sock.destroy();
-            }
-            catch {
-                /* ignore */
-            }
-            resolve(v);
-        };
-        const sock = connect(sockPath, () => {
-            sock.write(JSON.stringify({ id: 1, method: "hello", params: {} }) + "\n");
-        });
-        sock.on("data", (chunk) => {
-            buf += chunk.toString("utf8");
-            const idx = buf.indexOf("\n");
-            if (idx === -1)
-                return;
-            try {
-                const msg = JSON.parse(buf.slice(0, idx));
-                done(msg.ok ? msg.result : null);
-            }
-            catch {
-                done(null);
-            }
-        });
-        sock.on("error", () => done(null));
-        const timer = setTimeout(() => done(null), timeoutMs);
-        timer.unref?.();
-    });
-}
-/** Poll the socket until nothing answers there (bounded). */
-async function waitSocketFree(sockPath, timeoutMs) {
-    const deadline = Date.now() + Math.max(0, timeoutMs);
-    for (;;) {
-        if (!(await probeTransport(sockPath)))
-            return true;
-        if (Date.now() >= deadline)
-            return false;
-        await delay(100);
-    }
-}
-/**
- * After ordering a self-restart, wait for the daemon to come back running
- * at least `installed` (the version of this CLI copy). Resolves its hello
- * result, or null if it did not come back (or an older/pre-handshake
- * daemon answered again — e.g. the daemon's copy is not actually updated).
- */
-async function awaitDaemonUpgraded(sockPath, timeoutMs, installed) {
-    const deadline = Date.now() + Math.max(0, timeoutMs);
-    for (;;) {
-        const h = await rawHello(sockPath, 1500);
-        if (h && typeof h.daemonVersion === "string" && compareVersions(h.daemonVersion, installed) >= 0)
-            return h;
-        if (Date.now() >= deadline)
-            return null;
-        await delay(250);
-    }
-}
 const HELP_GROUPS = [
     {
         title: "permit operations",
@@ -177,12 +97,14 @@ const HELP_GROUPS = [
             { names: ["config", "get-config"], desc: "current configuration" },
             { names: ["configure"], desc: "change configuration (compare-and-swap): --reason required" },
             { names: ["dashboard", "top"], desc: "full-screen live dashboard, read-only (never acquires): [--once]" },
+            { names: ["version"], desc: "print this CLI copy's version" },
         ],
     },
     {
         title: "service & diagnostics",
         items: [
-            { names: ["service"], desc: "daemon lifecycle: start | stop | status (stop/start take --timeout <ms>)" },
+            { names: ["service"], desc: "daemon lifecycle: start | stop | restart | status (stop/start/restart take --timeout <ms> for the stop phase)" },
+            { names: ["update"], desc: "check npm for a newer version, install it via the detected package manager, then `service restart` (--check dry-run; refuses repo checkouts / opencode-managed copies)" },
             { names: ["doctor"], desc: "health report: state dir, socket, daemon, versions + copies, machine" },
             { names: ["recover"], desc: "list held permits with diagnostics; recover force-release --id <request-id>" },
         ],
@@ -216,10 +138,15 @@ function usage() {
         for (const item of g.items)
             lines.push(helpLine(item));
     }
-    lines.push("", "exit codes: 0 ok, 64 usage, 65 protocol, 68 not granted yet, 69 offer/claim failed, 70 internal");
+    lines.push("", "exit codes: 0 ok, 1 update available (update --check), 64 usage, 65 protocol, 68 not granted yet, 69 offer/claim failed, 70 internal");
     process.stdout.write(lines.join("\n") + "\n");
 }
 async function main() {
+    // `--version` prints this copy's version (same as the `version` command).
+    if (f["version"] === true) {
+        process.stdout.write(packageVersion() + "\n");
+        return;
+    }
     // `--help`, `-h` and a bare `load-lock` all print the same usage as `help`.
     if (f["help"] !== undefined || cmd === "-h" || (positional.length === 0 && argv.length === 0)) {
         usage();
@@ -452,130 +379,29 @@ async function main() {
         // --------------------------------------------------------------- service
         case "service": {
             const sub = rest[0] ?? "status";
+            const phase = (e) => {
+                if (e instanceof ServiceError)
+                    fail(e.message, e.exitCode);
+                throw e;
+            };
             if (sub === "stop") {
-                // Honest stop: signal the daemon, wait bounded for its socket to go
-                // silent, escalate to SIGKILL, and only report success once the
-                // endpoint is verifiably free. A leftover silent socket file or
-                // daemon.json (crash leftovers) is cleaned up either way.
-                const dir = stateDir();
-                const sock = socketPath();
-                const timeoutMs = N("timeout", 5000);
-                const info = readDaemonInfo(dir);
-                const answering = await probeTransport(sock);
-                if (!answering) {
-                    // Nothing is listening: no daemon to stop. Clean crash leftovers.
-                    try {
-                        if (!isWindows() && existsSync(sock))
-                            unlinkSync(sock);
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                    try {
-                        rmSync(join(dir, "daemon.json"), { force: true });
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                    process.stdout.write("load-lock: no running daemon found (stale files cleaned)\n");
-                    return;
-                }
-                // Identify the daemon: prefer daemon.json, else ask it directly
-                // (version-less hello — stopping must not order a self-restart).
-                let pid = typeof info?.pid === "number" ? info.pid : undefined;
-                if (!pid) {
-                    const hello = await rawHello(sock, 1500);
-                    if (hello && typeof hello.pid === "number")
-                        pid = hello.pid;
-                }
-                if (!pid) {
-                    fail(`the socket ${sock} answers but no pid could be identified (daemon did not respond and daemon.json names none) ` +
-                        `— cannot stop safely; run \`load-lock doctor\``, 70);
-                }
-                let how = "SIGTERM";
-                let stopped = false;
-                try {
-                    process.kill(pid, "SIGTERM");
-                }
-                catch (e) {
-                    if (e?.code === "ESRCH")
-                        stopped = true; // already gone
-                    else
-                        fail(`cannot signal daemon pid ${pid}: ${e?.message ?? e}`, 70);
-                }
-                if (!stopped)
-                    stopped = await waitSocketFree(sock, timeoutMs);
-                if (!stopped) {
-                    how = "SIGKILL";
-                    try {
-                        process.kill(pid, "SIGKILL");
-                    }
-                    catch {
-                        /* already dead */
-                    }
-                    stopped = await waitSocketFree(sock, timeoutMs);
-                }
-                if (!stopped) {
-                    fail(`daemon pid ${pid} did not stop within ${timeoutMs}ms even after SIGKILL — run \`load-lock doctor\``, 70);
-                }
-                try {
-                    if (!isWindows() && existsSync(sock))
-                        unlinkSync(sock);
-                }
-                catch {
-                    /* ignore */
-                }
-                try {
-                    rmSync(join(dir, "daemon.json"), { force: true });
-                }
-                catch {
-                    /* ignore */
-                }
-                process.stdout.write(`load-lock: daemon (pid ${pid}) stopped${how === "SIGKILL" ? " (required SIGKILL after SIGTERM)" : ""}\n`);
+                // Hardened stop: SIGTERM → bounded wait → SIGKILL → verified-free
+                // endpoint; crash leftovers cleaned either way.
+                process.stdout.write(`load-lock: ${await serviceStop(N("timeout", 5000)).catch(phase)}\n`);
                 return;
             }
             if (sub === "start") {
                 // Connecting auto-spawns a detached daemon (see shared/client.ts);
                 // hello confirms it is up. Refusals name the conflicting pid.
-                const timeoutMs = N("timeout", 10_000);
-                const sock = socketPath();
-                const installed = packageVersion();
-                try {
-                    const r = (await withClient((c) => c.request("hello", {}, timeoutMs)));
-                    const dv = typeof r.daemonVersion === "string" ? r.daemonVersion : undefined;
-                    if (dv && compareVersions(dv, installed) < 0) {
-                        // The handshake just ordered this old daemon to self-restart;
-                        // confirm it comes back on updated code.
-                        const up = await awaitDaemonUpgraded(sock, 8000, installed);
-                        if (up) {
-                            process.stdout.write(`load-lock: daemon self-restarted ${r.pid} -> ${up.pid} (v${dv} -> v${up.daemonVersion}), running on ${sock}\n`);
-                        }
-                        else {
-                            process.stdout.write(`load-lock: daemon running on pid ${r.pid} (${sock}), daemon v${dv} — older than this CLI v${installed}; ` +
-                                `self-restart ordered but not confirmed (its copy may not be updated in place — see docs/OPERATIONS.md)\n`);
-                        }
-                        return;
-                    }
-                    process.stdout.write(`load-lock: daemon running on pid ${r.pid} (${sock})${dv ? `, daemon v${dv}` : ""}\n`);
-                    return;
-                }
-                catch (e) {
-                    if (await probeTransport(sock)) {
-                        // Something owns the endpoint. Name it.
-                        const hello = await rawHello(sock, 1500);
-                        if (hello && typeof hello.pid === "number") {
-                            fail(`start refused: socket answered from pid ${hello.pid} — another daemon owns ${sock}; ` +
-                                `if it is stale, run \`load-lock service stop\` first`, 70);
-                        }
-                        const info = readDaemonInfo(stateDir());
-                        if (info && typeof info.pid === "number") {
-                            fail(`socket ${sock} answers but the daemon did not respond (daemon.json names pid ${info.pid}) — likely hung; ` +
-                                `run \`load-lock service stop\``, 70);
-                        }
-                        fail(`start refused: ${sock} is in use but nothing responsive owns it — run \`load-lock doctor\``, 70);
-                    }
-                    throw e;
-                }
+                process.stdout.write(`load-lock: ${await serviceStart(N("timeout", 10_000)).catch(phase)}\n`);
+                return;
+            }
+            if (sub === "restart") {
+                // Hardened stop, then honest start — both phases reported; a
+                // failure names the phase and reason (issue #38).
+                const r = await serviceRestart(N("timeout", 5000), 10_000).catch(phase);
+                process.stdout.write(`load-lock: ${r.stop}\nload-lock: ${r.start}\n`);
+                return;
             }
             if (sub === "status") {
                 const r = (await withClient((c) => c.request("hello", {})));
@@ -595,9 +421,23 @@ async function main() {
                 });
                 return;
             }
-            fail(`service: unknown subcommand "${sub}" (use start | stop | status)`);
+            fail(`service: unknown subcommand "${sub}" (use start | stop | restart | status)`);
             return;
         }
+        // ---------------------------------------------------------------- update
+        case "update": {
+            // issue #38: registry check → classify self → apply via the detected
+            // package manager (or refuse honestly) → `service restart` on
+            // success. Exit code comes from updateCommand (1 = update available
+            // under --check; 70 = failure/refusal in apply mode).
+            const code = await updateCommand({ check: B("check"), json: B("json") });
+            if (code !== 0)
+                process.exit(code);
+            return;
+        }
+        case "version":
+            process.stdout.write(packageVersion() + "\n");
+            return;
         case "doctor": {
             const report = {};
             report.node = process.version;

package/dist/cli/service.d.ts

@@ -0,0 +1,56 @@
+/** A service-phase failure with the exit code the CLI should use. */
+export declare class ServiceError extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number);
+}
+/** daemon.json contents, or null when missing/unreadable. */
+export declare function readDaemonInfo(dir: string): {
+    pid?: number;
+    startedAt?: number;
+    socket?: string;
+} | null;
+/**
+ * Version-less hello over a raw socket connection: deliberately does NOT
+ * send clientVersion, so asking a daemon for its identity never orders it
+ * to self-restart (used by `service stop` and post-restart confirmation).
+ * Best-effort: resolves null on any failure.
+ */
+export declare function rawHello(sockPath: string, timeoutMs?: number): Promise<{
+    pid?: number;
+    daemonVersion?: string;
+    protocolVersion?: number;
+} | null>;
+/**
+ * After ordering a self-restart, wait for the daemon to come back running
+ * at least `installed` (the version of this CLI copy). Resolves its hello
+ * result, or null if it did not come back (or an older/pre-handshake
+ * daemon answered again — e.g. the daemon's copy is not actually updated).
+ */
+export declare function awaitDaemonUpgraded(sockPath: string, timeoutMs: number, installed: string): Promise<{
+    pid?: number;
+    daemonVersion?: string;
+} | null>;
+/**
+ * Hardened stop: signal the daemon, wait bounded for its socket to go
+ * silent, escalate to SIGKILL, and only report success once the endpoint
+ * is verifiably free. A leftover silent socket file or daemon.json (crash
+ * leftovers) is cleaned up either way. Returns the report line; throws
+ * ServiceError on failure.
+ */
+export declare function serviceStop(timeoutMs: number): Promise<string>;
+/**
+ * Honest start: connecting auto-spawns a detached daemon (see
+ * shared/client.ts); hello confirms it is up. Refusals name the
+ * conflicting pid. Returns the report line; throws ServiceError on
+ * failure.
+ */
+export declare function serviceStart(timeoutMs: number): Promise<string>;
+/**
+ * `service restart` (issue #38): hardened stop, then honest start — both
+ * phases reported; a failure names the phase and reason. Stopping when
+ * nothing runs is fine: the start phase simply spawns a fresh daemon.
+ */
+export declare function serviceRestart(stopTimeoutMs?: number, startTimeoutMs?: number): Promise<{
+    stop: string;
+    start: string;
+}>;