@camstack/addon-pipeline 1.2.302 → 1.2.303

package/dist/session-decode/decode-worker-main.js

@@ -34,37 +34,131 @@ var OutboundSendTracker = class {
 };
 function createWorkerExit(deps) {
 	let exiting = false;
-	return (code) => {
-		if (exiting) return;
+	let exited = false;
+	let exitCode = 0;
+	const finish = () => {
+		if (exited) return;
+		exited = true;
+		deps.exit(exitCode);
+	};
+	return (code, urgency = "flush") => {
+		if (exiting) {
+			if (urgency === "now") finish();
+			return;
+		}
 		exiting = true;
-		let exitCode = code;
+		exitCode = code;
 		try {
 			deps.steps.quiesce();
 		} catch {
 			exitCode = 1;
-		} finally {
-			try {
-				deps.steps.flushFinalLines();
-			} catch {
-				exitCode = 1;
-			} finally {
-				deps.sends.whenIdle(deps.boundMs ?? 250).then(() => deps.exit(exitCode));
-			}
 		}
+		try {
+			deps.steps.flushFinalLines();
+		} catch {
+			exitCode = 1;
+		}
+		if (urgency === "now") {
+			finish();
+			return;
+		}
+		deps.sends.whenIdle(deps.boundMs ?? 250).then(finish);
 	};
 }
 /**
-* Route every event that ends the worker through the one bounded exit:
-* SIGTERM (the parent's `kill()`) and a lost channel exit 0, an uncaught
-* error is reported and exits 1. Before D652 there was no SIGTERM handler and
-* a `kill()` ended the process with its last lines still queued.
+* Reports every fault, rate-limited: the first {@link FAULT_REPORT_LIMIT} in
+* each {@link FAULT_REPORT_WINDOW_MS} window go out, and the rest are counted
+* and reported as one line by {@link flushSuppressed} at exit (D666).
+*
+* A report that throws is swallowed here. If it were rethrown, it would become
+* the next uncaught error, and reporting that one would write again. That is
+* the loop that kept the Mac agent's orphans spinning.
+*/
+var FaultReporter = class {
+	report;
+	reportSuppressed;
+	now;
+	windowStart = Number.NEGATIVE_INFINITY;
+	inWindow = 0;
+	suppressed = 0;
+	constructor(report, reportSuppressed, now = Date.now) {
+		this.report = report;
+		this.reportSuppressed = reportSuppressed;
+		this.now = now;
+	}
+	/** Report one fault unless the window is full; true when it was reported. */
+	fault(kind, err) {
+		const at = this.now();
+		if (at - this.windowStart >= 6e4) {
+			this.windowStart = at;
+			this.inWindow = 0;
+		}
+		if (this.inWindow >= 5) {
+			this.suppressed += 1;
+			return false;
+		}
+		this.inWindow += 1;
+		this.attempt(() => this.report(kind, err));
+		return true;
+	}
+	/** The count of faults not reported, as one line. Nothing when there were none. */
+	flushSuppressed() {
+		const count = this.suppressed;
+		if (count === 0) return;
+		this.suppressed = 0;
+		this.attempt(() => this.reportSuppressed(count));
+	}
+	attempt(write) {
+		try {
+			write();
+		} catch {}
+	}
+};
+/**
+* Route every event that ends the worker through the one exit (D652, D666):
+*
+* - SIGTERM (the parent's `kill()`) flushes, bounded; a SECOND SIGTERM exits now.
+* - a lost channel, and a changed ppid, exit NOW — the parent is gone.
+* - stdio lost is never an uncaught exception. While the channel is up it is
+*   NOT an exit: raw stderr is the secondary log path (the IPC copy is what
+*   reaches the runner's logger), so the worker says so once over IPC and
+*   keeps decoding; exiting would only make the runner re-dial into the same
+*   dead stderr. With the channel down too, it exits now.
+* - an uncaught error is reported (rate-limited) and exits 1: flushed the
+*   first time, now for every later one — a process that keeps faulting must
+*   not keep formatting stacks.
+* - an unhandled rejection is reported (rate-limited) and does not end the worker.
+*
+* When the parent is gone there is NO sink for the exit reason: stderr's
+* reader died with it and the channel is closed. The exit is not logged, and
+* must not try to be — trying is what looped.
 */
 function wireWorkerExit(deps) {
-	deps.on("SIGTERM", () => deps.exitWorker(0));
-	deps.on("disconnect", () => deps.exitWorker(0));
+	let sigterms = 0;
+	deps.on("SIGTERM", () => {
+		sigterms += 1;
+		deps.exitWorker(0, sigterms > 1 ? "now" : "flush");
+	});
+	deps.on("disconnect", () => deps.exitWorker(0, "now"));
+	deps.on("parentChanged", () => deps.exitWorker(0, "now"));
+	let stdioLost = false;
+	deps.on("stdioLost", (err) => {
+		if (!stdioLost) {
+			stdioLost = true;
+			try {
+				deps.onStdioLost(err);
+			} catch {}
+		}
+		if (!deps.parentConnected()) deps.exitWorker(0, "now");
+	});
+	let uncaught = 0;
 	deps.on("uncaughtException", (err) => {
-		deps.reportUncaught(err);
-		deps.exitWorker(1);
+		uncaught += 1;
+		deps.faults.fault("uncaughtException", err);
+		deps.exitWorker(1, uncaught > 1 ? "now" : "flush");
+	});
+	deps.on("unhandledRejection", (reason) => {
+		deps.faults.fault("unhandledRejection", reason);
 	});
 }
 //#endregion
@@ -2376,6 +2470,8 @@ var DecodeWorkerChild = class {
 	*/
 	native;
 	requestExit;
+	/** Set once the inherited stderr failed; raw writes stop (D666). */
+	stderrLost = false;
 	constructor(hooks = {}) {
 		this.requestExit = hooks.requestExit ?? (() => void 0);
 		this.native = hooks.disposer ?? new NativeDisposer((what) => this.emitStderr(`decode-worker-child: native dispose left to process exit — ${what}\n`, "debug"));
@@ -4230,7 +4326,11 @@ var DecodeWorkerChild = class {
 	*/
 	emitStderr(line, level) {
 		const tag = this.deviceId === null ? "[dev:?]" : `[dev:${this.deviceId}]`;
-		process.stderr.write(`${tag} ${line}`);
+		if (!this.stderrLost) try {
+			process.stderr.write(`${tag} ${line}`);
+		} catch {
+			this.stderrLost = true;
+		}
 		try {
 			this.send({
 				kind: "log",
@@ -4239,6 +4339,13 @@ var DecodeWorkerChild = class {
 			});
 		} catch {}
 	}
+	/**
+	* The inherited stderr failed (EPIPE — its reader died with the process that
+	* held it). From here on {@link emitStderr} forwards over IPC only (D666).
+	*/
+	markStderrLost() {
+		this.stderrLost = true;
+	}
 	sendError(message, frameId) {
 		this.emitStderr(`${message}\n`);
 		this.send(frameId === void 0 ? {
@@ -4252,54 +4359,140 @@ var DecodeWorkerChild = class {
 	}
 };
 //#endregion
+//#region src/session-decode/decode-worker-process.ts
+/**
+* The decode worker's PROCESS wiring — everything that ties one
+* {@link DecodeWorkerChild} to the process it runs in, and the ONE exit every
+* ending goes through (D652, D666).
+*
+* Extracted from `decode-worker-main.ts` so a test fixture runs exactly the
+* code production runs: the orphan loop of D666 lived in this wiring, and the
+* unit tests that drove its pure pieces with fake timers and a fake `on` could
+* not see an event loop that never reaches its timers.
+*
+* ‼ SANCTIONED RAW IPC ‼ — `process.on('message')` / `process.send` are the
+* correct mechanism for this private, directly-forked worker only; see the
+* note at the top of `decode-worker-child.ts`.
+*/
+/**
+* How often the worker checks that its parent is still the process that forked
+* it. A parent whose IPC end outlives it would otherwise never `disconnect`.
+*/
+var DECODE_WORKER_PPID_CHECK_MS = 1e3;
+/** Stack lines carried by a fault report — enough to place it, bounded. */
+var FAULT_STACK_LINES = 8;
+/**
+* Call `onChanged` (once) when `proc.ppid` no longer matches its value now.
+* Compares against the ppid at start, never against 1: an orphan is adopted
+* by tini inside docker and may be adopted by a subreaper on macOS. The timer
+* is unref'd — it never keeps the worker alive on its own. Returns a stop.
+*/
+function watchParentPid(proc, onChanged, intervalMs = DECODE_WORKER_PPID_CHECK_MS) {
+	const initialPpid = proc.ppid;
+	const timer = setInterval(() => {
+		const ppid = proc.ppid;
+		if (ppid === initialPpid) return;
+		clearInterval(timer);
+		onChanged(ppid);
+	}, intervalMs);
+	timer.unref();
+	return () => clearInterval(timer);
+}
+function errorCode(err) {
+	if (err instanceof Error && "code" in err && typeof err.code === "string") return err.code;
+	return errMessage(err);
+}
+/** The message, plus the first stack frames: the report is rate-limited, so it must place the fault. */
+function describeFault(err) {
+	if (!(err instanceof Error) || err.stack === void 0) return errMessage(err);
+	return err.stack.split("\n").slice(0, FAULT_STACK_LINES).join(" | ");
+}
+/**
+* Build the worker and wire `proc` to it: IPC messages, stdio loss, parent
+* loss, SIGTERM, uncaught errors and the ppid watchdog. Does NOT load native
+* modules — the entry calls `worker.warm()` itself.
+*/
+function wireDecodeWorkerProcess(proc) {
+	const worker = new DecodeWorkerChild({ requestExit: (code) => exitWorker(code) });
+	proc.on("message", (message) => {
+		worker.handleMessage(message);
+	});
+	const faults = new FaultReporter((kind, err) => {
+		const what = kind === "uncaughtException" ? "uncaught exception" : "unhandled rejection";
+		worker.emitStderr(`decode-worker-child: ${what} — ${describeFault(err)}\n`);
+	}, (count) => {
+		worker.emitStderr(`decode-worker-child: ${count} further fault report(s) suppressed\n`);
+	});
+	/**
+	* quiesce (the disposer starts refusing, so nothing native is freed under a
+	* live read), queue the last lines, then exit — after a bounded wait for
+	* those lines while the parent is alive, in the same turn once it is gone.
+	*/
+	const exitWorker = createWorkerExit({
+		sends: worker.outbound,
+		steps: {
+			quiesce: () => worker.quiesceForExit(),
+			flushFinalLines: () => {
+				faults.flushSuppressed();
+				worker.flushFinalLines();
+			}
+		},
+		exit: (code) => proc.exit(code)
+	});
+	wireWorkerExit({
+		on: (event, listener) => {
+			switch (event) {
+				case "SIGTERM":
+					proc.on("SIGTERM", () => listener(void 0));
+					return;
+				case "disconnect":
+					proc.on("disconnect", () => listener(void 0));
+					return;
+				case "stdioLost":
+					proc.stdout.on("error", (err) => listener(err));
+					proc.stderr.on("error", (err) => listener(err));
+					return;
+				case "parentChanged":
+					watchParentPid(proc, (ppid) => listener(ppid));
+					return;
+				case "uncaughtException":
+					proc.on("uncaughtException", (err) => listener(err));
+					return;
+				case "unhandledRejection":
+					proc.on("unhandledRejection", (reason) => listener(reason));
+					return;
+			}
+		},
+		exitWorker,
+		faults,
+		onStdioLost: (err) => {
+			worker.markStderrLost();
+			worker.emitStderr(`decode-worker-child: stdio lost (${errorCode(err)}) — raw stderr off, IPC logging continues\n`, "warn");
+		},
+		parentConnected: () => proc.connected
+	});
+	return {
+		worker,
+		exitWorker
+	};
+}
+//#endregion
 //#region src/session-decode/decode-worker-main.ts
 /**
 * Decode-worker — the process ENTRY (its own vite build entry, the path
 * `fork-decode-worker.ts` forks). The worker itself is `DecodeWorkerChild` in
-* `decode-worker-child.ts`; this file only instantiates it and wires the process:
-* IPC messages, the native preload, the sharp warn sink, and the ONE bounded
-* exit every ending goes through (D652).
+* `decode-worker-child.ts`; its process wiring — IPC messages and the ONE exit
+* every ending goes through (D652, D666) — is `decode-worker-process.ts`, so a
+* test fixture runs the same wiring. This file adds only what needs native
+* modules or the sharp loader.
 *
 * ‼ SANCTIONED RAW IPC ‼ — `process.on('message')` / `process.send` are the
 * correct mechanism for this private, directly-forked worker only; see the
 * note at the top of `decode-worker-child.ts`.
 */
-var worker = new DecodeWorkerChild({ requestExit: (code) => exitWorker(code) });
+var { worker } = wireDecodeWorkerProcess(process);
 require_lazy_sharp.setSharpWarnSink((message) => {
 	worker.emitStderr(`decode-worker-child: ${message}\n`, "warn");
 });
-process.on("message", (message) => {
-	worker.handleMessage(message);
-});
 worker.warm();
-/**
-* The ONE way this worker exits: quiesce (the disposer starts refusing, so
-* nothing native is freed under a live read), queue the last lines, wait —
-* bounded — for them to leave, exit. `stop`, SIGTERM (the parent's `kill()`),
-* a lost channel and an uncaught error all land here, and a step that throws
-* still exits (with code 1). Before D652 there was no SIGTERM handler and a
-* `kill()` ended the process with those lines still queued.
-*/
-var exitWorker = createWorkerExit({
-	sends: worker.outbound,
-	steps: {
-		quiesce: () => worker.quiesceForExit(),
-		flushFinalLines: () => worker.flushFinalLines()
-	},
-	exit: (code) => process.exit(code)
-});
-wireWorkerExit({
-	on: (event, listener) => {
-		if (event === "SIGTERM") process.on("SIGTERM", () => listener(void 0));
-		else if (event === "disconnect") process.on("disconnect", () => listener(void 0));
-		else process.on("uncaughtException", (err) => listener(err));
-	},
-	exitWorker,
-	reportUncaught: (err) => {
-		worker.emitStderr(`decode-worker-child: uncaught exception — ${errMessage(err)}\n`);
-	}
-});
-process.on("unhandledRejection", (reason) => {
-	worker.emitStderr(`decode-worker-child: unhandled rejection — ${errMessage(reason)}\n`);
-});
 //#endregion