@celilo/console-server 0.6.0 → 0.6.2

package/spa/index.html

@@ -4,7 +4,15 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>celilo</title>
-    <script type="module" crossorigin src="/assets/index-xOtoHA1j.js"></script>
+    <!-- Inline so there is no file to ship and no second request. The glyph is
+         drawn by the VIEWER's emoji font, so it will not look identical across
+         platforms, and a system without the woman-technologist ZWJ sequence
+         falls back to two glyphs side by side rather than one. -->
+    <link
+      rel="icon"
+      href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>👩‍💻</text></svg>"
+    />
+    <script type="module" crossorigin src="/assets/index-bR5M5myY.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-eLF_dgP-.css">
   </head>
   <body>

package/src/upstream.ts

@@ -28,7 +28,12 @@
  */
 
 import type { DisplayWriter } from '@celilo/cli-display';
-import { type RemoteTransport, runRemoteClient, sshTransportWith } from '@celilo/core';
+import {
+  type RemoteSession,
+  type RemoteTransport,
+  openRemoteSession,
+  sshTransportWith,
+} from '@celilo/core';
 
 /** Why a read could not be served. Every case is renderable; none is silence. */
 export type UnavailableReason =
@@ -65,9 +70,18 @@ export interface UpstreamOptions {
 /** Exit code the API uses for "this principal may not do that". */
 const EXIT_DENIED = 126;
 
+type RemoteOutcomeOf = Awaited<ReturnType<RemoteSession['run']>>;
+
 interface CacheEntry {
+  /** When the value SETTLED. Meaningless while `pending`. */
   at: number;
-  value: unknown;
+  /**
+   * The promise, not the resolved value — so concurrent callers for the same
+   * argv join one request instead of each starting their own.
+   */
+  value: Promise<unknown>;
+  /** In flight. A pending entry is joined regardless of the TTL. */
+  pending: boolean;
 }
 
 export class Upstream {
@@ -75,6 +89,22 @@ export class Upstream {
   private readonly ttl: number;
   private readonly now: () => number;
 
+  /**
+   * One connection, reused across reads.
+   *
+   * `api-serve` is a persistent server and its start-up dominates a read: on
+   * celilo-mgr it greets at ~1.8s and then answers commands in 1.25s and 0.06s
+   * on the SAME connection. Opening a fresh one per read re-paid that every
+   * time, which is most of why a console panel cost 5-11s against a 15s client
+   * timeout.
+   *
+   * ONE session, not a pool: the server runs a single command at a time
+   * (`serve.ts` holds one `commandRunning` slot), so a pool would not raise
+   * throughput, only connection count — and connection count is exactly what
+   * celilo#921 was about.
+   */
+  private session: RemoteSession | null = null;
+
   constructor(private readonly options: UpstreamOptions) {
     this.ttl = options.cacheTtlMs ?? 2_000;
     this.now = options.now ?? Date.now;
@@ -90,10 +120,41 @@ export class Upstream {
   async read<T>(argv: readonly string[]): Promise<T> {
     const key = argv.join(' ');
     const hit = this.cache.get(key);
-    if (hit && this.now() - hit.at < this.ttl) return hit.value as T;
+    // A PENDING entry is joined whatever the TTL says. This cache used to store
+    // the resolved value and `await` before setting it, so every caller that
+    // arrived while a read was in flight missed and started its own. The console
+    // polls every 5s and mounts several panels at once, and each panel opens its
+    // OWN ssh connection because ControlMaster is deliberately off (celilo#921),
+    // so identical argv went to celilo three or four times per cycle. Measured
+    // on the live console 2026-09-27: 28 `console:status` ops against 18
+    // `alerts:list` + 10 `backup:list`, with panels at 12-14s against a 15s
+    // client timeout.
+    //
+    // Joining only on a fresh TTL would not fix it: a read takes ~4s here and
+    // the TTL is 2s, so the entry expires WHILE IN FLIGHT and the next caller
+    // duplicates it anyway. With reads slower than the TTL that is the common
+    // case, not an edge one — hence `pending`.
+    if (hit && (hit.pending || this.now() - hit.at < this.ttl)) return hit.value as Promise<T>;
+
+    const value = this.runJson<T>(argv);
+    const entry: CacheEntry = { at: this.now(), value, pending: true };
+    this.cache.set(key, entry);
+
+    value.then(
+      () => {
+        // The TTL runs from when the value SETTLED, not when the request
+        // started; otherwise a read slower than the TTL is stale on arrival.
+        entry.at = this.now();
+        entry.pending = false;
+      },
+      () => {
+        // A failed read must not be served for the rest of the window, and must
+        // not leave a permanently-pending entry that every later caller joins.
+        // Retry it; do not remember it.
+        if (this.cache.get(key) === entry) this.cache.delete(key);
+      },
+    );
 
-    const value = await this.runJson<T>(argv);
-    this.cache.set(key, { at: this.now(), value });
     return value;
   }
 
@@ -116,6 +177,34 @@ export class Upstream {
     this.cache.clear();
   }
 
+  private ensureSession(): RemoteSession {
+    const live = this.session;
+    if (live !== null && !live.closed) return live;
+    const session = openRemoteSession(this.options.dest, {
+      openTransport: this.options.openTransport ?? sshTransportWith(this.options.identityFile),
+      // Reached only if celilo asks the console a question. Nothing here can
+      // answer one, so say so loudly rather than parking a request forever.
+      // Session-scoped now rather than per-command, so it cannot name the argv;
+      // the reason is the same for every command the console issues.
+      renderInterview: () => {
+        throw new UpstreamUnavailable(
+          'interview',
+          [],
+          'A command raised an interview question. The console has no responder and never invokes operations that can ask one.',
+        );
+      },
+      onBlocked: 'return',
+    });
+    this.session = session;
+    return session;
+  }
+
+  /** Drop the connection. The next read opens a fresh one. */
+  closeSession(): void {
+    this.session?.close();
+    this.session = null;
+  }
+
   private async runJson<T>(argv: readonly string[]): Promise<T> {
     const output = await this.runText(argv);
     try {
@@ -139,23 +228,14 @@ export class Upstream {
       isTTY: false,
     };
 
-    let outcome: Awaited<ReturnType<typeof runRemoteClient>>;
+    let outcome: RemoteOutcomeOf;
     try {
-      outcome = await runRemoteClient(this.options.dest, [...argv], {
-        openTransport: this.options.openTransport ?? sshTransportWith(this.options.identityFile),
-        out,
-        // Reached only if celilo asks the console a question. Nothing here can
-        // answer one, so say so loudly rather than parking a request forever.
-        renderInterview: () => {
-          throw new UpstreamUnavailable(
-            'interview',
-            argv,
-            `\`${argv.join(' ')}\` raised an interview question. The console has no responder and never invokes operations that can ask one.`,
-          );
-        },
-        onBlocked: 'return',
-      });
+      outcome = await this.ensureSession().run(argv, { out });
     } catch (error) {
+      // The connection is suspect once a read has thrown through it — the
+      // server may have restarted or the transport died mid-command. Drop it so
+      // the NEXT read reconnects instead of writing into a pipe nobody reads.
+      this.closeSession();
       if (error instanceof UpstreamUnavailable) throw error;
       throw new UpstreamUnavailable(
         'unreachable',