@cydm/happy-elves 0.1.0-beta.66 → 0.1.0-beta.67

package/apps/cli/dist/commands/lib/bootstrap-config.js

@@ -3,8 +3,9 @@ import path from "node:path";
 import { ControllerClient } from "../../../../../packages/client/dist/index.js";
 import { generateAccountSecret, randomId } from "../../../../../packages/shared/dist/index.js";
 import { CliError } from "../../errors.js";
-import { configDir, configPath, defaultHostedControllerUrl, defaultHostedRelayUrl } from "./paths.js";
+import { configDir, configPath, defaultHostedControllerUrl, defaultHostedRelayUrl, startDaemonTimeoutMs } from "./paths.js";
 import { normalizeRelayUrl, requireRelayUrl, writeConfig, writeDaemonConfig } from "./config.js";
+import { readControllerSnapshotWithRetry } from "./bootstrap-daemon.js";
 import { cliErrorFromFetch, isAuthTokenInvalid, parsePairingClaimResponse, parsePairingStartResponse, readExistingControllerConfig, readExistingDaemonConfig, readRelayJson, throwRelayHttpError } from "./relay-http.js";
 function backupTimestamp() {
     return new Date().toISOString().replace(/[:.]/g, "-");
@@ -63,7 +64,9 @@ export async function ensureControllerConfig(params) {
         }
         else {
             try {
-                await new ControllerClient(existing).snapshot();
+                await readControllerSnapshotWithRetry(new ControllerClient(existing), {
+                    timeoutMs: startDaemonTimeoutMs,
+                });
                 return { config: existing, created: false, reconfigured: false };
             }
             catch (error) {

package/apps/cli/dist/commands/lib/bootstrap-daemon.d.ts

@@ -1,4 +1,4 @@
-import type { ControllerClient } from "../../../../../packages/client/dist/index.js";
+import { type ControllerClient, type ControllerSnapshot } from "../../../../../packages/client/dist/index.js";
 import type { MachineSnapshot } from "../../../../../packages/shared/dist/index.js";
 import { localDaemonStatus, stopLocalDaemon } from "./local-daemon.js";
 export declare function ensureDaemonRunning(relayUrl: string, cwd?: string): Promise<{
@@ -6,10 +6,52 @@ export declare function ensureDaemonRunning(relayUrl: string, cwd?: string): Pro
     started: boolean;
     startedPid?: number;
 }>;
+export type DaemonReadinessResult = {
+    phase: "relay-authenticated" | "process-exited" | "relay-pending";
+    local: Awaited<ReturnType<typeof localDaemonStatus>>;
+    machine?: MachineSnapshot;
+    lastRelayErrorCode?: string;
+};
+type DaemonReadinessOptions = {
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    /**
+     * A newly spawned or restarted daemon must advance the relay projection
+     * before it is considered ready. This prevents an online snapshot left by
+     * the previous connection from satisfying a new start.
+     */
+    baseline?: Pick<MachineSnapshot, "online" | "lastSeen">;
+    requireFreshProjection?: boolean;
+    readLocalStatus?: typeof localDaemonStatus;
+    sleep?: (timeoutMs: number) => Promise<void>;
+};
+type BaselineSnapshotOptions = {
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    sleep?: (timeoutMs: number) => Promise<void>;
+    now?: () => number;
+};
+/**
+ * Capture the relay projection that predates a possible daemon spawn. This is
+ * a separate bounded phase so a transient relay restart cannot make `start`
+ * fail before the daemon is even launched, while the later readiness phase
+ * still receives its full independent budget.
+ */
+export declare function readDaemonProjectionBaseline(client: Pick<ControllerClient, "snapshot">, machineId: string, options?: BaselineSnapshotOptions): Promise<MachineSnapshot | undefined>;
+/** Retry the authenticated bootstrap read without allowing one hung fetch to
+ * escape the overall startup deadline. */
+export declare function readControllerSnapshotWithRetry(client: Pick<ControllerClient, "snapshot">, options?: BaselineSnapshotOptions): Promise<ControllerSnapshot>;
 export declare function restartDaemonForNewConfig(relayUrl: string, cwd?: string): Promise<{
     stopped: Awaited<ReturnType<typeof stopLocalDaemon>>;
     local: Awaited<ReturnType<typeof localDaemonStatus>>;
     started: boolean;
     startedPid?: number;
 }>;
-export declare function waitForMachineProjection(client: ControllerClient, machineId: string, timeoutMs?: number): Promise<MachineSnapshot | undefined>;
+/**
+ * Wait for the authority boundary that actually makes the daemon usable: an
+ * online machine projection emitted after the relay authenticates its machine
+ * token. A verified PID alone only means the process reached its startup
+ * window; runtime discovery and relay authentication may still be pending.
+ */
+export declare function waitForDaemonReadiness(client: Pick<ControllerClient, "snapshot">, machineId: string, options?: DaemonReadinessOptions): Promise<DaemonReadinessResult>;
+export {};

package/apps/cli/dist/commands/lib/bootstrap-daemon.js

@@ -1,3 +1,4 @@
+import { ControllerClientError } from "../../../../../packages/client/dist/index.js";
 import { CliError } from "../../errors.js";
 import { startDaemonTimeoutMs } from "./paths.js";
 import { readDaemonConfig } from "./config.js";
@@ -24,6 +25,43 @@ export async function ensureDaemonRunning(relayUrl, cwd = process.cwd()) {
     }
     throw new CliError("Daemon did not become ready in time. Run happy-elves daemon doctor and happy-elves daemon logs.", "DAEMON_START_FAILED");
 }
+/**
+ * Capture the relay projection that predates a possible daemon spawn. This is
+ * a separate bounded phase so a transient relay restart cannot make `start`
+ * fail before the daemon is even launched, while the later readiness phase
+ * still receives its full independent budget.
+ */
+export async function readDaemonProjectionBaseline(client, machineId, options = {}) {
+    const snapshot = await readControllerSnapshotWithRetry(client, options);
+    return snapshot.machines.find((machine) => machine.id === machineId);
+}
+/** Retry the authenticated bootstrap read without allowing one hung fetch to
+ * escape the overall startup deadline. */
+export async function readControllerSnapshotWithRetry(client, options = {}) {
+    const timeoutMs = options.timeoutMs ?? startDaemonTimeoutMs;
+    const pollIntervalMs = options.pollIntervalMs ?? 300;
+    const wait = options.sleep ?? ((durationMs) => new Promise((resolve) => setTimeout(resolve, durationMs)));
+    const now = options.now ?? Date.now;
+    const deadline = now() + Math.max(0, timeoutMs);
+    let attempted = false;
+    let lastTransientError;
+    while (true) {
+        const remainingMs = Math.max(0, deadline - now());
+        if (attempted && remainingMs === 0) {
+            throw lastTransientError ?? snapshotDeadlineError();
+        }
+        attempted = true;
+        try {
+            return await settleSnapshotWithin(client, remainingMs);
+        }
+        catch (error) {
+            if (!retryableReadinessSnapshotError(error) || now() >= deadline)
+                throw error;
+            lastTransientError = error;
+            await wait(Math.min(pollIntervalMs, Math.max(0, deadline - now())));
+        }
+    }
+}
 export async function restartDaemonForNewConfig(relayUrl, cwd = process.cwd()) {
     const stopped = await stopLocalDaemon();
     if (stopped.running) {
@@ -32,15 +70,128 @@ export async function restartDaemonForNewConfig(relayUrl, cwd = process.cwd()) {
     const started = await ensureDaemonRunning(relayUrl, cwd);
     return { stopped, ...started };
 }
-export async function waitForMachineProjection(client, machineId, timeoutMs = 5000) {
+/**
+ * Wait for the authority boundary that actually makes the daemon usable: an
+ * online machine projection emitted after the relay authenticates its machine
+ * token. A verified PID alone only means the process reached its startup
+ * window; runtime discovery and relay authentication may still be pending.
+ */
+export async function waitForDaemonReadiness(client, machineId, options = {}) {
+    const timeoutMs = options.timeoutMs ?? startDaemonTimeoutMs;
+    const pollIntervalMs = options.pollIntervalMs ?? 300;
+    const readLocalStatus = options.readLocalStatus ?? localDaemonStatus;
+    const wait = options.sleep ?? ((durationMs) => new Promise((resolve) => setTimeout(resolve, durationMs)));
     const deadline = Date.now() + timeoutMs;
-    let lastSeen;
-    while (Date.now() <= deadline) {
-        const snapshot = await client.snapshot();
-        lastSeen = snapshot.machines.find((machine) => machine.id === machineId);
-        if (lastSeen?.online)
-            return lastSeen;
-        await new Promise((resolve) => setTimeout(resolve, 300));
+    let machine;
+    let local;
+    let lastRelayErrorCode;
+    let attempted = false;
+    while (!attempted || Date.now() < deadline) {
+        attempted = true;
+        local = await readLocalStatus();
+        assertLocalDaemonVerified(local);
+        if (!local.running) {
+            return { phase: "process-exited", local, machine };
+        }
+        let snapshot;
+        try {
+            snapshot = await settleSnapshotWithin(client, Math.max(0, deadline - Date.now()));
+            lastRelayErrorCode = undefined;
+        }
+        catch (error) {
+            if (!retryableReadinessSnapshotError(error))
+                throw error;
+            lastRelayErrorCode = error.code;
+            const remainingMs = Math.max(0, deadline - Date.now());
+            if (remainingMs === 0)
+                break;
+            await wait(Math.min(pollIntervalMs, remainingMs));
+            continue;
+        }
+        machine = snapshot.machines.find((candidate) => candidate.id === machineId);
+        if (machine?.online && projectionIsFresh(machine, options)) {
+            // Close the process/projection TOCTOU window: the relay may still expose
+            // a fresh online row for a daemon that exited while snapshot() was in
+            // flight. Re-verify the local owner before declaring startup complete.
+            const confirmedLocal = await readLocalStatus();
+            assertLocalDaemonVerified(confirmedLocal);
+            if (!confirmedLocal.running) {
+                return { phase: "process-exited", local: confirmedLocal, machine };
+            }
+            return { phase: "relay-authenticated", local: confirmedLocal, machine };
+        }
+        await wait(Math.min(pollIntervalMs, Math.max(0, deadline - Date.now())));
+    }
+    return {
+        phase: "relay-pending",
+        local: local ?? await readLocalStatus(),
+        machine,
+        ...(lastRelayErrorCode ? { lastRelayErrorCode } : {}),
+    };
+}
+function retryableReadinessSnapshotError(error) {
+    if (!(error instanceof ControllerClientError))
+        return false;
+    if (error.code.startsWith("AUTH_") ||
+        error.code.startsWith("SCOPED_TOKEN_") ||
+        error.code === "ORIGIN_FORBIDDEN" ||
+        error.code === "INVALID_ARGUMENT" ||
+        error.code === "RELAY_RESPONSE_INVALID") {
+        return false;
     }
-    return lastSeen;
+    // Structured relay failures retain their stable code (for example,
+    // INTERNAL_ERROR), so HTTP status is the authority for retrying 5xx. Never
+    // infer retryability from a server error code alone: authentication and all
+    // other 4xx failures must fail immediately.
+    if (error.httpStatus !== undefined)
+        return error.httpStatus >= 500 && error.httpStatus <= 599;
+    return error.code === "RELAY_UNREACHABLE";
+}
+function snapshotDeadlineError() {
+    return new ControllerClientError("Timed out waiting for the relay bootstrap snapshot", "RELAY_UNREACHABLE");
+}
+async function settleSnapshotWithin(client, timeoutMs) {
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        const abortController = new AbortController();
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            abortController.abort();
+            reject(snapshotDeadlineError());
+        }, timeoutMs);
+        let snapshot;
+        try {
+            snapshot = client.snapshot({ signal: abortController.signal });
+        }
+        catch (error) {
+            settled = true;
+            clearTimeout(timer);
+            reject(error);
+            return;
+        }
+        void snapshot.then((value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+function projectionIsFresh(machine, options) {
+    if (options.requireFreshProjection !== true)
+        return true;
+    if (!options.baseline)
+        return true;
+    if (options.baseline.online !== true)
+        return true;
+    return machine.lastSeen > options.baseline.lastSeen;
 }

package/apps/cli/dist/commands/lib/bootstrap.js

@@ -2,12 +2,12 @@ import os from "node:os";
 import path from "node:path";
 import { ControllerClient } from "../../../../../packages/client/dist/index.js";
 import { CliError } from "../../errors.js";
-import { configDir, configPath } from "./paths.js";
+import { configDir, configPath, startDaemonTimeoutMs } from "./paths.js";
 import { ok } from "./json.js";
 import { assertLocalDaemonVerified, localDaemonStatus } from "./local-daemon.js";
 import { cliErrorFromFetch, readExistingControllerConfig } from "./relay-http.js";
 import { controllerBaseUrl, ensureControllerConfig, ensureDaemonPaired, startRelayUrl } from "./bootstrap-config.js";
-import { ensureDaemonRunning, restartDaemonForNewConfig, waitForMachineProjection } from "./bootstrap-daemon.js";
+import { ensureDaemonRunning, readDaemonProjectionBaseline, restartDaemonForNewConfig, waitForDaemonReadiness } from "./bootstrap-daemon.js";
 import { openUrl, writeHumanStartOutput } from "./bootstrap-output.js";
 export async function startBootstrap(flags) {
     const existingController = await readExistingControllerConfig().catch((error) => {
@@ -27,13 +27,28 @@ export async function startBootstrap(flags) {
         deviceName,
     });
     const daemonState = await ensureDaemonPaired(controllerState.config, machineName);
+    const client = new ControllerClient(controllerState.config);
+    const baseline = await readDaemonProjectionBaseline(client, daemonState.config.machineId, {
+        timeoutMs: startDaemonTimeoutMs,
+    });
     const daemon = daemonBefore.running && daemonState.reconfigured
         ? await restartDaemonForNewConfig(controllerState.config.relayUrl, cwd)
         : await ensureDaemonRunning(controllerState.config.relayUrl, cwd);
-    const client = new ControllerClient(controllerState.config);
-    const machine = await waitForMachineProjection(client, daemonState.config.machineId);
-    if (!machine?.online) {
-        throw new CliError("Daemon started, but this machine did not appear online in the relay snapshot. Run happy-elves doctor and happy-elves daemon logs.", "DAEMON_ONLINE_TIMEOUT");
+    const readiness = await waitForDaemonReadiness(client, daemonState.config.machineId, {
+        baseline,
+        requireFreshProjection: daemon.started,
+        // Lifetime-lock acquisition/reclaim and relay-authenticated readiness are
+        // separate bounded phases. A legitimate slow lease recovery must not
+        // consume the runtime-discovery/relay budget that follows it.
+        timeoutMs: startDaemonTimeoutMs,
+    });
+    const machine = readiness.machine;
+    if (readiness.phase === "process-exited") {
+        throw new CliError("Daemon exited before it authenticated with the relay. Run happy-elves doctor and happy-elves daemon logs.", "DAEMON_START_FAILED");
+    }
+    if (readiness.phase !== "relay-authenticated" || !machine?.online) {
+        const relayDetail = readiness.lastRelayErrorCode ? ` Last relay error: ${readiness.lastRelayErrorCode}.` : "";
+        throw new CliError(`Daemon is running, but it did not authenticate with the relay before the startup deadline.${relayDetail} Run happy-elves doctor and happy-elves daemon logs.`, "DAEMON_ONLINE_TIMEOUT");
     }
     const invite = await client.createControllerInvite({
         deviceName: "Web controller",

package/apps/daemon/dist/gateway/commands.d.ts

@@ -0,0 +1,3 @@
+import { type MachineCommand } from "../../../../packages/shared/dist/index.js";
+import type { DaemonConfig } from "../types.js";
+export declare function handleGatewayCommand(ws: WebSocket, config: DaemonConfig, command: MachineCommand): Promise<void>;