@code-yeongyu/senpi 2026.8.30 → 2026.9.2

package/dist/modes/rpc/host-lifecycle.js

@@ -40,15 +40,17 @@
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { realpathSync, writeSync } from "node:fs";
-import { access, chmod, mkdir, readFile, rm, unlink } from "node:fs/promises";
+import { access, chmod, mkdir, readFile, rm, unlink, writeFile } from "node:fs/promises";
 import { createConnection, createServer } from "node:net";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, extname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { getAgentDir } from "../../config.js";
+import { getAgentDir, isBunBinary } from "../../config.js";
+import { readProcessStartTime } from "../app-server/daemon/process.js";
 import { createHostDaemonPaths } from "./host-ensure.js";
 import { HOST_CLEANUP_PATHS_ENV, HOST_SCRATCH_DIR_ENV, HOST_WATCH_FD_ENV, HOST_WATCH_PPID_ENV, } from "./host-watchdog.js";
 import { attachJsonlLineReader, MAX_RPC_LINE_CHARACTERS } from "./jsonl.js";
+import { authenticateSocket, createSocketSecret, readSocketSecret, resolveSocketTransportAddress, SOCKET_SECRET_FILE_ENV, sendSocketHandshake, socketSecretPath, } from "./socket-transport.js";
 /** Environment override for the cold-start policy: `transient` or `persistent`. */
 export const HOST_COLD_START_ENV = "SENPI_RPC_HOST_COLD_START";
 /** Environment override for the idle-exit window in milliseconds. */
@@ -56,6 +58,8 @@ export const HOST_IDLE_EXIT_MS_ENV = "SENPI_RPC_HOST_IDLE_EXIT_MS";
 /** Default idle-exit window: 15 minutes of continuous no-connection, no-turn idle. */
 export const DEFAULT_HOST_IDLE_EXIT_MS = 15 * 60_000;
 const CHILD_STOP_TIMEOUT_MS = 5_000;
+/** Win32 named-pipe shutdown can leave supervisor handles live after close starts. */
+const WINDOWS_SUPERVISOR_SHUTDOWN_HARD_EXIT_MS = 2_000;
 /**
  * Child stdio slot carrying the supervisor-lifetime pipe. The supervisor holds
  * the write end open and never writes; the kernel closes it when the supervisor
@@ -68,10 +72,24 @@ const CHILD_WATCH_FD = 3;
  * regardless of where the public socket lives, and private against other local
  * users, so it gets its own 0700 directory under the OS temp directory.
  */
-async function createInternalSocketPath() {
+async function createInternalSocketPath(baseDir = tmpdir()) {
+    if (process.platform === "win32") {
+        const dir = join(baseDir, `internal-${randomUUID()}`);
+        await mkdir(dir, { recursive: false, mode: 0o700 });
+        return {
+            socket: `\\\\.\\pipe\\senpi-rpc-internal-${randomUUID()}`,
+            dir,
+            secretPath: join(dir, "secret"),
+        };
+    }
     const dir = join(tmpdir(), `senpi-rpc-host-internal-${randomUUID().slice(0, 8)}`);
     await mkdir(dir, { recursive: false, mode: 0o700 });
-    return { socket: join(dir, "host.sock"), dir };
+    await writeFile(join(dir, ".owner"), JSON.stringify({
+        pid: process.pid,
+        processStartTime: await readProcessStartTime(process.pid),
+        createdAt: Date.now(),
+    }), { mode: 0o600 });
+    return { socket: join(dir, "host.sock"), dir, secretPath: join(dir, ".secret") };
 }
 export function parseColdStart(value) {
     return value === "transient" || value === "persistent" ? value : undefined;
@@ -95,6 +113,17 @@ export function resolveHostPolicy(settings, env) {
         DEFAULT_HOST_IDLE_EXIT_MS;
     return { coldStart, idleExitMs };
 }
+/**
+ * How the supervisor reads its child's exit. The RPC host exits 0 only through
+ * its own clean shutdown path - including its idle/empty-host policy - so that
+ * is an intentional stop, not a crash: the supervisor mirrors its own idle exit
+ * instead of reporting failure. Any non-zero code or signal stays a crash.
+ */
+export function classifyChildExit(code, signal) {
+    if (code === 0 && signal === null)
+        return { reason: "rpc host exited on its own idle policy", exitCode: 0 };
+    return { reason: `rpc host process exited unexpectedly (${code ?? signal})`, exitCode: 1 };
+}
 /**
  * Pure idle-window decision core. `update()` must be called with the CURRENT
  * activity state; the window only counts continuously idle time and any
@@ -121,6 +150,40 @@ export class IdleExitDecider {
         return this.now() - this.idleSince >= this.idleExitMs ? "exit" : "idle";
     }
 }
+/** Hidden internal launch route: wire-invisible, never advertised by the public CLI surface. */
+export const INTERNAL_SUPERVISOR_FLAG = "--internal-rpc-host-supervisor";
+/**
+ * Engine-global flags a rebranded wrapper may legitimately prepend when it
+ * re-dispatches this binary. `packages/omo-native` injects `--extension <dir>`
+ * for every non-early command, which pushed the sentinel off argv[0].
+ */
+const INJECTABLE_PREFIX_FLAGS = new Set(["--extension"]);
+/**
+ * Returns the internal supervisor payload when argv selects that route.
+ *
+ * The route dispatches when the sentinel is argv[0] OR is preceded only by
+ * known injectable prefix flags and their values - the one perturbation
+ * wrappers legitimately perform. Everything else disqualifies it: a positional
+ * operand, `--`, or an unknown flag before the sentinel all return undefined,
+ * so a user-supplied value that happens to equal the sentinel can never reach
+ * the supervisor.
+ *
+ * The skipped prefix is deliberately NOT forwarded to the host: a wrapper
+ * re-injects its own prefix on every re-entry, so the host child receives it
+ * from the wrapper rather than twice from here.
+ */
+export function findInternalSupervisorArgs(argv) {
+    for (let index = 0; index < argv.length; index++) {
+        const arg = argv[index];
+        if (arg === INTERNAL_SUPERVISOR_FLAG)
+            return argv.slice(index + 1);
+        // A prefix flag only counts when its value is actually present.
+        if (!INJECTABLE_PREFIX_FLAGS.has(arg) || index + 1 >= argv.length)
+            return undefined;
+        index++;
+    }
+    return undefined;
+}
 /** `--socket <path>` selects the public socket; every other argument is forwarded to the host CLI. */
 export function parseSupervisorArgs(argv) {
     const hostArgs = [];
@@ -163,67 +226,136 @@ export function resolveCliMainPath() {
     const extension = modulePath.endsWith(".ts") ? ".ts" : ".js";
     return resolve(dirname(modulePath), "..", "..", `cli-main${extension}`);
 }
+/**
+ * Resolves the host child spawn. Explicit child commands (desktop launchers)
+ * are forwarded untouched. The default re-enters the committed CLI entry
+ * through the runtime, except in compiled standalone binaries, which always
+ * boot their embedded entrypoint and would parse a script path as CLI
+ * arguments - there the executable itself is the CLI, so the mode flags are
+ * passed directly. Exported for tests.
+ */
+export function resolveHostChildLaunch(launch, internalSocket, compiled = isBunBinary) {
+    if (launch.childCommand) {
+        return {
+            command: launch.childCommand,
+            args: [...(launch.childArgs ?? []), "--listen", `unix://${internalSocket}`],
+        };
+    }
+    return {
+        command: process.execPath,
+        args: [
+            ...(compiled ? [] : [...process.execArgv, resolveCliMainPath()]),
+            "--mode",
+            "rpc",
+            "--multi-session",
+            "--listen",
+            `unix://${internalSocket}`,
+            ...launch.hostArgs,
+        ],
+    };
+}
+/** Mirrors cross-spawn: survives cmd.exe parsing and `CommandLineToArgvW`. */
+function quoteWindowsShellArg(value) {
+    const escaped = value
+        .replace(/(\\*)"/g, '$1$1\\"')
+        .replace(/(\\*)$/, "$1$1")
+        .replace(/([()%!^"<>&|;,])/g, "^$1");
+    return `"${escaped}"`;
+}
+/**
+ * Windows refuses to spawn a `.cmd`/`.bat` without a shell, and Node's
+ * `shell: true` concatenates argv without escaping it. Escape each original
+ * value before adding the surrounding quotes so `.cmd`/`.bat` launchers survive
+ * cmd.exe parsing without double-escaping.
+ * Exported for tests.
+ */
+export function spawnableChildLaunch(launch, platform = process.platform) {
+    const extension = extname(launch.command).toLowerCase();
+    if (platform !== "win32" || (extension !== ".cmd" && extension !== ".bat")) {
+        return { ...launch, shell: false };
+    }
+    return {
+        command: quoteWindowsShellArg(launch.command),
+        args: launch.args.map(quoteWindowsShellArg),
+        shell: true,
+    };
+}
 export async function runHostSupervisor(launch) {
     const paths = createHostDaemonPaths(launch.agentDir ?? getAgentDir());
     const policy = resolveHostPolicy(await readSettingsFile(paths.settingsFile), process.env);
     const publicSocket = launch.socket;
-    const internal = await createInternalSocketPath();
+    const internal = await createInternalSocketPath(paths.dir);
     const internalSocket = internal.socket;
+    const internalSecretPath = internal.secretPath ?? socketSecretPath(internalSocket);
+    const internalSecret = process.platform === "win32" ? await createSocketSecret(internalSecretPath) : undefined;
+    const publicSecret = process.platform === "win32" ? await readSocketSecret(socketSecretPath(publicSocket)) : undefined;
     const clientSockets = new Set();
     const busySessions = new Map();
     let observerHealthy = false;
     let observerReconnectTimer;
+    let childExitWatchTimer;
     let shuttingDown = false;
     let shutdownPromise;
-    const child = spawn(launch.childCommand ?? process.execPath, launch.childCommand
-        ? [...(launch.childArgs ?? []), "--listen", `unix://${internalSocket}`]
-        : [
-            ...process.execArgv,
-            resolveCliMainPath(),
-            "--mode",
-            "rpc",
-            "--multi-session",
-            "--listen",
-            `unix://${internalSocket}`,
-            ...launch.hostArgs,
-        ], {
+    const childLaunch = spawnableChildLaunch(resolveHostChildLaunch(launch, internalSocket));
+    const child = spawn(childLaunch.command, childLaunch.args, {
         env: {
             ...process.env,
             ...(launch.agentDir ? { SENPI_CODING_AGENT_DIR: launch.agentDir } : {}),
             [HOST_WATCH_FD_ENV]: String(CHILD_WATCH_FD),
             [HOST_WATCH_PPID_ENV]: String(process.pid),
-            [HOST_SCRATCH_DIR_ENV]: internal.dir,
-            [HOST_CLEANUP_PATHS_ENV]: [publicSocket, paths.pidFile, paths.settingsFile].join("\n"),
+            ...(internal.dir ? { [HOST_SCRATCH_DIR_ENV]: internal.dir } : {}),
+            ...(internalSecret ? { [SOCKET_SECRET_FILE_ENV]: internalSecretPath } : {}),
+            [HOST_CLEANUP_PATHS_ENV]: [
+                paths.pidFile,
+                paths.settingsFile,
+                ...(process.platform === "win32" ? [] : [publicSocket]),
+            ].join("\n"),
         },
         // Slot 3 is the lifetime pipe: "pipe" gives the child a read end it can
         // wait on and keeps the write end owned by this process alone.
+        shell: childLaunch.shell,
         stdio: ["ignore", "ignore", "inherit", "pipe"],
+        // The supervisor is spawned detached, so on win32 it owns no console. A
+        // console-subsystem child started from it would allocate a fresh one,
+        // which Windows Terminal renders as an empty window that takes focus.
+        // CREATE_NO_WINDOW gives the child a console with no window instead.
+        windowsHide: true,
     });
     // Nothing is ever written; the pipe exists purely so its EOF is a reliable
     // death notification. Errors on it must not crash the supervisor.
     child.stdio[CHILD_WATCH_FD]?.on("error", () => { });
     child.once("exit", (code, signal) => {
-        if (!shuttingDown)
-            void shutdown(`rpc host process exited unexpectedly (${code ?? signal})`, 1);
+        if (shuttingDown)
+            return;
+        const { reason, exitCode } = classifyChildExit(code, signal);
+        void shutdown(reason, exitCode);
     });
     const server = createServer((client) => {
-        if (shuttingDown) {
-            client.destroy();
-            return;
-        }
-        const internal = createConnection(internalSocket);
-        clientSockets.add(client);
-        const detach = () => {
-            clientSockets.delete(client);
-            internal.destroy();
-            client.destroy();
+        const accept = () => {
+            if (shuttingDown) {
+                client.destroy();
+                return;
+            }
+            const internal = createConnection(resolveSocketTransportAddress(internalSocket, process.platform, internalSecret));
+            if (internalSecret)
+                sendSocketHandshake(internal, internalSecret);
+            clientSockets.add(client);
+            const detach = () => {
+                clientSockets.delete(client);
+                internal.destroy();
+                client.destroy();
+            };
+            client.pipe(internal);
+            internal.pipe(client);
+            client.once("close", detach);
+            client.once("error", detach);
+            internal.once("close", detach);
+            internal.once("error", detach);
         };
-        client.pipe(internal);
-        internal.pipe(client);
-        client.once("close", detach);
-        client.once("error", detach);
-        internal.once("close", detach);
-        internal.once("error", detach);
+        if (publicSecret)
+            authenticateSocket(client, publicSecret, accept);
+        else
+            accept();
     });
     server.once("error", (cause) => {
         if (!shuttingDown)
@@ -278,25 +410,40 @@ export async function runHostSupervisor(launch) {
             process.exit(exitCode);
         shuttingDown = true;
         clearInterval(ticker);
-        writeStderrLine(`senpi rpc host supervisor: ${reason} shutdown`);
-        for (const client of clientSockets)
-            client.destroy();
-        await closeServer(server);
-        // Unlink the private directory BEFORE the child stop, which can take seconds:
-        // an external SIGKILL landing during that wait (ensureHost escalates while
-        // replacing a host) would otherwise leave the directory behind. The child
-        // keeps serving through its already-open socket fd until it exits, and its
-        // own watchdog cleanup makes the removal idempotent.
-        await rm(internal.dir, { recursive: true, force: true });
-        await stopChild(child);
-        observer?.destroy();
-        if (publicSocketOwned)
-            await rm(publicSocket, { force: true });
-        // Mirror ensureHost's cleanupState: the pidfile and settings describe a
-        // live host only; the stderr log stays for diagnostics.
-        await rm(paths.pidFile, { force: true });
-        await rm(paths.settingsFile, { force: true });
-        process.exit(exitCode);
+        if (childExitWatchTimer)
+            clearInterval(childExitWatchTimer);
+        const hardExit = process.platform === "win32"
+            ? setTimeout(() => process.exit(exitCode), WINDOWS_SUPERVISOR_SHUTDOWN_HARD_EXIT_MS)
+            : undefined;
+        try {
+            writeStderrLine(`senpi rpc host supervisor: ${reason} shutdown`);
+            for (const client of clientSockets)
+                client.destroy();
+            await closeServer(server);
+            // Unlink the private directory BEFORE the child stop, which can take seconds:
+            // an external SIGKILL landing during that wait (ensureHost escalates while
+            // replacing a host) would otherwise leave the directory behind. The child
+            // keeps serving through its already-open socket fd until it exits, and its
+            // own watchdog cleanup makes the removal idempotent.
+            if (internal.dir)
+                await rm(internal.dir, { recursive: true, force: true });
+            await stopChild(child);
+            observer?.destroy();
+            if (publicSocketOwned && process.platform !== "win32")
+                await rm(publicSocket, { force: true });
+            // Mirror ensureHost's cleanupState: the pidfile and settings describe a
+            // live host only; the stderr log stays for diagnostics.
+            await rm(paths.pidFile, { force: true });
+            await rm(paths.settingsFile, { force: true });
+        }
+        finally {
+            if (hardExit)
+                clearTimeout(hardExit);
+            // Explicitly terminate after every supervisor shutdown trigger. Windows
+            // named-pipe handles can outlive their JavaScript wrappers, so cleanup
+            // failure must never leave the supervisor resident or the host orphaned.
+            process.exit(exitCode);
+        }
     }
     let observer;
     let publicSocketOwned = false;
@@ -306,17 +453,20 @@ export async function runHostSupervisor(launch) {
     // would leave that directory behind.
     registerSupervisorSignals(shutdown);
     try {
-        await waitForListener(internalSocket, 30_000);
+        await waitForListener(internalSocket, 30_000, internalSecret);
         await connectObserver();
         await prepareSocketPath(publicSocket);
-        await listen(server, publicSocket);
+        await listen(server, publicSocket, publicSecret);
         publicSocketOwned = true;
     }
     catch (cause) {
         await shutdown(`startup failed: ${errorMessage(cause)}`, 1);
     }
     async function connectObserver() {
-        const next = createConnection(internalSocket);
+        const secret = internalSecret;
+        const next = createConnection(resolveSocketTransportAddress(internalSocket, process.platform, secret));
+        if (secret)
+            sendSocketHandshake(next, secret);
         await waitForConnect(next, 5_000);
         observer = next;
         observerHealthy = true;
@@ -337,6 +487,33 @@ export async function runHostSupervisor(launch) {
         next.once("close", lost);
         next.once("error", lost);
     }
+    if (process.platform === "win32" && child.pid !== undefined) {
+        const childStartTime = await readProcessStartTime(child.pid, process.platform, 1_000);
+        let missingIdentityChecks = 0;
+        let checkingChildIdentity = false;
+        const checkChildIdentity = () => {
+            if (shuttingDown || checkingChildIdentity || child.exitCode !== null || child.signalCode !== null)
+                return;
+            checkingChildIdentity = true;
+            void readProcessStartTime(child.pid, process.platform, 1_000)
+                .then((currentStartTime) => {
+                if (currentStartTime === undefined)
+                    missingIdentityChecks++;
+                else
+                    missingIdentityChecks = 0;
+                const identityChanged = childStartTime !== undefined && currentStartTime !== undefined && currentStartTime !== childStartTime;
+                if (identityChanged || missingIdentityChecks >= 2) {
+                    void shutdown("rpc host child exit observed by identity watchdog", 0);
+                }
+            })
+                .catch(() => { })
+                .finally(() => {
+                checkingChildIdentity = false;
+            });
+        };
+        childExitWatchTimer = setInterval(checkChildIdentity, 500);
+        childExitWatchTimer.unref?.();
+    }
     writeStderrLine(`senpi rpc host ready on unix://${publicSocket} (coldStart=${policy.coldStart}, idleExitMs=${policy.coldStart === "persistent" ? "never" : String(policy.idleExitMs)})`);
     await new Promise(() => { });
 }
@@ -390,18 +567,20 @@ function waitForChildExit(child, timeoutMs) {
         child.once("exit", onExit);
     });
 }
-async function waitForListener(socketPath, timeoutMs) {
+async function waitForListener(socketPath, timeoutMs, secret) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() <= deadline) {
-        if (await canConnect(socketPath))
+        if (await canConnect(socketPath, secret))
             return;
         await delay(50);
     }
     throw new Error(`${socketPath}: host did not start listening within ${timeoutMs}ms`);
 }
-function canConnect(socketPath) {
+function canConnect(socketPath, secret) {
     return new Promise((resolve) => {
-        const socket = createConnection(socketPath);
+        const socket = createConnection(resolveSocketTransportAddress(socketPath, process.platform, secret));
+        if (secret)
+            sendSocketHandshake(socket, secret);
         const settle = (value) => {
             socket.destroy();
             resolve(value);
@@ -434,6 +613,8 @@ function waitForConnect(socket, timeoutMs) {
     });
 }
 async function prepareSocketPath(socketPath) {
+    if (process.platform === "win32")
+        return;
     await mkdir(dirname(socketPath), { recursive: true, mode: 0o700 });
     try {
         await access(socketPath);
@@ -447,14 +628,23 @@ async function prepareSocketPath(socketPath) {
         throw new Error(`${socketPath}: address already in use by a live server.`);
     await unlink(socketPath);
 }
-function listen(server, socketPath) {
+function listen(server, socketPath, secret) {
     return new Promise((resolve, reject) => {
         server.once("error", reject);
-        server.listen(socketPath, async () => {
+        server.listen({
+            path: resolveSocketTransportAddress(socketPath, process.platform, secret),
+            readableAll: false,
+            writableAll: false,
+        }, async () => {
             server.off("error", reject);
-            if (!socketPath.startsWith("\0"))
-                await chmod(socketPath, 0o600);
-            resolve();
+            try {
+                if (process.platform !== "win32" && !socketPath.startsWith("\0"))
+                    await chmod(socketPath, 0o600);
+                resolve();
+            }
+            catch (cause) {
+                reject(cause);
+            }
         });
     });
 }