@ctrl-spc/cs 0.7.13 → 0.7.15

package/dist/daemon-lock.js

@@ -1,48 +1,155 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { configDir } from './config.js';
-import { processIsAlive } from './win-shell.js';
-/**
- * One `cs start` per config dir.
- *
- * Two daemons on one machine share one `cliv2_agents` row and take turns
- * overwriting it every heartbeat. The case that produced it: `cs start` was
- * running, `npm i -g` replaced dist under it, and a second `cs start` came up
- * on the new code. The row then flipped between 0.7.0 and 0.7.4 every few
- * seconds and the Machines popover flickered with it.
- *
- * Keyed on the config dir, not the machine id, so the documented two-instance
- * setup (`CTRL_SPC_V2_CONFIG_DIR` plus `CTRL_SPC_V2_MACHINE_ID`) still works.
- *
- * ponytail: a pid file, not an OS lock. A pid recycled onto an unrelated
- * process after a crash reads as "already running" until that process exits;
- * `rm ~/.config/ctrl-spc-v2/daemon.pid` is the way out. Upgrade to an
- * exclusive-open lock if that is ever hit in practice.
- */
-function lockPath() {
-    return join(configDir(), 'daemon.pid');
-}
-/** Claims the lock for this process, or returns the pid of the daemon that holds it. */
-export function claimDaemonLock() {
-    const path = lockPath();
-    if (existsSync(path)) {
-        const pid = Number(readFileSync(path, 'utf8').trim());
-        if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && processIsAlive(pid)) {
-            return { held: true, pid };
-        }
+import { closeSync, existsSync, fsyncSync, linkSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { configDir, ensureLifecycleDir, lifecycleDir } from './config.js';
+import { inspectProcess, processIdentityMatches, findHandoverProcesses } from './win-shell.js';
+const identity = z.object({
+    pid: z.number().int().positive(), ppid: z.number().int().nonnegative(),
+    pgid: z.number().int().positive().optional(), owner: z.string().min(1),
+    birth: z.string().min(1), commandHash: z.string().regex(/^[a-f0-9]{64}$/),
+    macProcessVersion: z.number().int().positive().max(0xffffffff).optional(),
+});
+const runtimeSchema = z.object({
+    schema: z.literal(1), nonce: z.string().uuid(), config: z.string(), machineId: z.string(),
+    process: identity, entry: z.string(), version: z.string(), port: z.number().int().min(1).max(65535),
+    state: z.enum(['starting', 'running', 'stopping', 'degraded']),
+});
+const operationSchema = z.object({
+    schema: z.literal(1), id: z.string().uuid(), owner: identity,
+    action: z.enum(['start', 'stop', 'restart']),
+    successor: z.string().uuid().nullable(), successorPid: z.number().int().positive().nullable(),
+    entry: z.string().nullable(),
+});
+const migrationSchema = z.object({
+    schema: z.literal(1), boot: z.string().min(1), installation: z.string(), prepared: z.boolean(),
+    completed: z.boolean(), machineId: z.string(), accountId: z.string().nullable(),
+});
+function path(name) { return join(lifecycleDir(), name); }
+function read(name, schema) {
+    let text;
+    try {
+        text = readFileSync(path(name), 'utf8');
     }
-    mkdirSync(configDir(), { recursive: true });
-    writeFileSync(path, String(process.pid));
-    return { held: false };
-}
-/** Removes the lock if this process wrote it. Never throws: it runs during shutdown. */
-export function releaseDaemonLock() {
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new Error('Local service control records could not be read.', { cause: error });
+    }
+    let parsed;
     try {
-        const path = lockPath();
-        if (Number(readFileSync(path, 'utf8').trim()) === process.pid)
-            rmSync(path);
+        parsed = JSON.parse(text);
     }
     catch {
-        // no lock, or not ours
+        throw new Error('Local service control records are incomplete. No unverified process will be controlled.');
+    }
+    const result = schema.safeParse(parsed);
+    if (!result.success)
+        throw new Error('Local service control records are incomplete. No unverified process will be controlled.');
+    return result.data;
+}
+/** Publish complete records only. A temporary file never grants ownership. */
+function publish(name, value, exclusive) {
+    const temp = join(ensureLifecycleDir(), name + '.' + randomUUID() + '.tmp');
+    const fd = openSync(temp, 'wx', 0o600);
+    try {
+        writeFileSync(fd, JSON.stringify(value));
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    try {
+        if (exclusive)
+            linkSync(temp, path(name));
+        else
+            renameSync(temp, path(name));
+    }
+    finally {
+        rmSync(temp, { force: true });
     }
 }
+export function readRuntime() {
+    const record = read('runtime.json', runtimeSchema);
+    if (record && record.config !== resolve(configDir()))
+        throw new Error('The service record belongs to another local instance.');
+    if (record && process.env.CTRL_SPC_V2_MACHINE_ID && record.machineId !== process.env.CTRL_SPC_V2_MACHINE_ID)
+        throw new Error('The service record belongs to another machine identity. Use that instance’s config and machine settings.');
+    return record;
+}
+export function readOperation() { return read('operation.json', operationSchema); }
+export function readMigration() { return read('upgrade.json', migrationSchema); }
+export function writeMigration(record) { publish('upgrade.json', migrationSchema.parse(record), false); }
+export function publishRuntime(record) {
+    publish('runtime.json', runtimeSchema.parse(record), true);
+    writeFileSync(join(configDir(), 'daemon.pid'), String(record.process.pid), { mode: 0o600 });
+}
+export function updateRuntime(record) {
+    if (readRuntime()?.nonce !== record.nonce)
+        throw new Error('This process no longer owns the service record.');
+    publish('runtime.json', runtimeSchema.parse(record), false);
+}
+export function removeRuntime(nonce) {
+    const record = readRuntime();
+    if (!record || record.nonce !== nonce)
+        return;
+    rmSync(path('runtime.json'));
+    if (legacyPid() === record.process.pid)
+        rmSync(join(configDir(), 'daemon.pid'), { force: true });
+}
+export function legacyPid() {
+    const file = join(configDir(), 'daemon.pid');
+    if (!existsSync(file))
+        return null;
+    const value = Number(readFileSync(file, 'utf8').trim());
+    if (!Number.isInteger(value) || value <= 0)
+        throw new Error('The older service record is incomplete; prepare the one-time upgrade with cs restart.');
+    return value;
+}
+export async function claimLifecycleOperation(action, deadline) {
+    const owner = await inspectProcess(process.pid, deadline);
+    if (!owner)
+        throw new Error('Cannot verify this command process.');
+    const record = { schema: 1, id: randomUUID(), owner, action, successor: null, successorPid: null, entry: null };
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            publish('operation.json', record, true);
+            return record;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        const prior = readOperation();
+        if (!prior)
+            continue;
+        const actual = await inspectProcess(prior.owner.pid, deadline);
+        if (actual && processIdentityMatches(prior.owner, actual))
+            throw new Error('Another service command is in progress. Run cs status to check its result.');
+        if (prior.successor) {
+            const runtime = readRuntime();
+            if (runtime?.nonce === prior.successor) {
+                const child = await inspectProcess(runtime.process.pid, deadline);
+                if (child && processIdentityMatches(runtime.process, child)) {
+                    removeOperation(prior.id);
+                    continue;
+                }
+            }
+            const candidates = (await findHandoverProcesses(prior.successor, deadline)).filter((candidate) => candidate.owner === prior.owner.owner);
+            if (candidates.length) {
+                throw new Error('A prior restart is still being reconciled. Run cs status before retrying; no second service was started.');
+            }
+        }
+        removeOperation(prior.id);
+    }
+    throw new Error('Service ownership changed while the command was starting. Run cs status and retry.');
+}
+export function updateOperation(record) {
+    if (readOperation()?.id !== record.id)
+        throw new Error('The lifecycle operation is no longer owned by this command.');
+    publish('operation.json', operationSchema.parse(record), false);
+}
+export function removeOperation(id) {
+    if (readOperation()?.id === id)
+        rmSync(path('operation.json'));
+}