@galda/cli 0.10.16 → 0.10.19

package/engine/relay-client.mjs

@@ -8,10 +8,11 @@
 //
 //   RELAY_URL=wss://relay.example/agent RELAY_AGENT_TOKEN=… node engine/relay-client.mjs
 
-import { readFileSync, existsSync, watch } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync, watch, unlinkSync } from 'node:fs';
 import { resolve, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { licenseTokenIdentity, relayReconnectDecision } from './lib.mjs';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const DATA_DIR = process.env.MANAGER_HOME
@@ -39,6 +40,31 @@ let currentWs = null;
 let reconnectTimer = null;
 let lastToken = readToken();
 
+// Stand-down state (see lib.mjs relayReconnectDecision). When another device
+// running the SAME account takes the relay slot, the relay evicts us with 4000;
+// we go stoodDown and remember whose slot we lost, so a later token re-mint of
+// that same account does NOT make us re-dial and re-evict them (the infinite
+// loop). currentIdentity = the account we last dialed with.
+let relayState = { stoodDown: false, standingIdentity: null };
+let currentIdentity = licenseTokenIdentity(readToken());
+
+// Publish the relay connection state to a file the local server can read and
+// surface at /api (P4's "in use on another device → switch here" banner). Kept
+// as a tiny best-effort file because the server (:4400) and this relay-client
+// are separate processes that only share DATA_DIR.
+const STATUS_FILE = join(DATA_DIR, 'relay-status.json');
+const TAKEOVER_FILE = join(DATA_DIR, 'relay-takeover.req');
+function publishStatus(status) {
+  try {
+    writeFileSync(STATUS_FILE, JSON.stringify({
+      status,                                   // 'online' | 'connecting' | 'standing-down' | 'idle'
+      identity: currentIdentity || null,
+      stoodDown: relayState.stoodDown,
+      at: Date.now(),
+    }));
+  } catch { /* best-effort */ }
+}
+
 function scheduleReconnect(retryMs) {
   if (reconnectTimer) return; // exactly one pending reconnect — never stack timers
   reconnectTimer = setTimeout(() => { reconnectTimer = null; connect(Math.min(retryMs * 2, 15000)); }, retryMs);
@@ -52,15 +78,21 @@ function connect(retryMs = 1000) {
   // license.token watcher below calls connect() the instant sign-in writes the
   // token. A signed-in agent that merely drops still reconnects (token present).
   if (!DEV_EMAIL && !readToken()) return;
+  // Stood down: another device holds this account's slot. Do NOT dial — that is
+  // the re-evict that starts the mutual-kick loop. Only an explicit takeover
+  // (writes relay-takeover.req) or a real account switch clears this.
+  if (relayState.stoodDown) return;
   // Single-socket invariant: never open a second socket while one is CONNECTING
   // (0) or OPEN (1). Two live sockets with the same identity make the relay evict
   // each other (server.mjs "replaced by a newer connection") → an infinite flap.
   if (currentWs && (currentWs.readyState === 0 || currentWs.readyState === 1)) return;
   if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+  currentIdentity = DEV_EMAIL ? DEV_EMAIL.trim().toLowerCase() : licenseTokenIdentity(readToken());
   const auth = DEV_EMAIL ? `devEmail=${encodeURIComponent(DEV_EMAIL)}` : `token=${encodeURIComponent(readToken())}`;
   const ws = new WebSocket(`${RELAY}?${auth}`);
   currentWs = ws;
-  ws.onopen = () => { retryMs = 1000; console.log(`[agent] connected to relay ${RELAY}`); };
+  publishStatus('connecting');
+  ws.onopen = () => { retryMs = 1000; publishStatus('online'); console.log(`[agent] connected to relay ${RELAY}`); };
   ws.onmessage = async (ev) => {
     let m; try { m = JSON.parse(ev.data); } catch { return; }
     if (m.type === 'abort') { live.get(m.id)?.abort(); live.delete(m.id); return; }
@@ -102,45 +134,82 @@ function connect(retryMs = 1000) {
   };
   ws.onclose = (ev) => {
     if (ws !== currentWs) return; // a superseded socket (we already moved on) — don't reconnect
+    currentWs = null;
     // Close 4000 = the relay evicted us because a NEWER agent for the SAME account
-    // connected (server.mjs "replaced by a newer connection"). If we reconnect we
-    // evict THAT one → the two instances mutual-kick forever, which surfaces to the
-    // user as app.galda.app reload-looping. Stand down: the newest instance is
-    // authoritative. (A normal network drop uses a different code and still
-    // reconnects; sign-in via the watcher below can still retake.)
-    if (ev && ev.code === 4000) {
-      console.log('[agent] relay: superseded by a newer instance of this account — standing down (run only one manager per account)');
-      currentWs = null;
+    // connected (server.mjs "replaced by a newer connection"). Stand down STICKILY:
+    // remember whose slot we lost so a later re-mint of that account's token can't
+    // silently re-dial and re-evict them (the app.galda.app reload "無限ループ").
+    // A normal network drop reconnects; an explicit takeover / real account switch
+    // clears the stand-down. See lib.mjs relayReconnectDecision.
+    const d = relayReconnectDecision(relayState, ev && ev.code === 4000
+      ? { type: 'evicted', identity: currentIdentity }
+      : { type: 'dropped' });
+    relayState = d.state;
+    if (d.reason === 'superseded') {
+      publishStatus('standing-down');
+      console.log('[agent] relay: this account is live on another device — standing down here. Use "switch to this device" to take over.');
       return;
     }
+    if (!d.dial) { publishStatus('standing-down'); return; }
+    publishStatus('connecting');
     console.log(`[agent] relay connection lost — retrying in ${retryMs}ms`);
     scheduleReconnect(retryMs);
   };
   ws.onerror = () => { /* onclose follows */ };
 }
 
-connect();
+// Redial the relay once, immediately, after detaching the old socket (so its
+// onclose is ignored: ws !== currentWs) — no racing reconnect chains.
+function redialNow() {
+  const old = currentWs;
+  currentWs = null;
+  if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+  try { old?.close(); } catch { /* already gone */ }
+  connect(1000);
+}
+
+// Explicit "switch to this device" (P4): the local server writes relay-takeover.req
+// when the user claims this device from the "in use on another device" banner. We
+// clear the stand-down and reclaim the slot on purpose.
+function handleTakeover() {
+  try { unlinkSync(TAKEOVER_FILE); } catch { /* already consumed */ }
+  // Only meaningful while stood down — if we already hold (or are dialing) the
+  // slot there is nothing to reclaim. This also absorbs fs.watch double-firing
+  // the request file (macOS emits multiple events) into a single reconnect.
+  if (!relayState.stoodDown) return;
+  const d = relayReconnectDecision(relayState, { type: 'takeover' });
+  relayState = d.state;
+  if (d.dial) { console.log('[agent] taking over this account on this device (user requested)'); redialNow(); }
+}
+
+if (!process.env.RELAY_CLIENT_NO_START) {
+  connect();
 
-// Sign-in reconnect: when license.token appears/changes (the user just linked
-// this device), drop the current socket so connect() re-dials with the new
-// identity. Without this the first-run socket stays bound to nobody and the
-// hosted board never comes alive until the CLI is restarted. Watch the DIR (the
-// file may not exist yet on first run); best-effort (fs.watch unsupported → the
-// onclose retry loop still re-reads the token on the next natural reconnect).
-try {
-  watch(DATA_DIR, (_ev, f) => {
-    if (f && f !== 'license.token') return;
-    const t = readToken();
-    if (t && t !== lastToken) {
+  // Watch DATA_DIR for two triggers (the file may not exist yet on first run;
+  // best-effort — if fs.watch is unavailable the onclose retry still re-reads the
+  // token on the next natural reconnect):
+  //  1) license.token appears/changes → sign-in or account switch. Route through
+  //     the reducer: a re-mint of the account we already stood down from does NOT
+  //     re-dial (kills the mutual-kick loop); a genuinely different account does.
+  //  2) relay-takeover.req → explicit user takeover.
+  try {
+    watch(DATA_DIR, (_ev, f) => {
+      if (f === 'relay-takeover.req' || (f == null && existsSync(TAKEOVER_FILE))) { handleTakeover(); return; }
+      if (f && f !== 'license.token') return;
+      const t = readToken();
+      if (!t || t === lastToken) return;
       lastToken = t;
+      const d = relayReconnectDecision(relayState, { type: 'tokenChanged', identity: licenseTokenIdentity(t) });
+      relayState = d.state;
+      if (!d.dial) {
+        publishStatus('standing-down');
+        console.log('[agent] license refreshed for the account already live on another device — staying down (use "switch to this device" to take over)');
+        return;
+      }
       console.log('[agent] signed in — reconnecting to relay with your identity');
-      // Detach the old socket FIRST so its onclose is ignored (ws !== currentWs),
-      // then reconnect once, immediately, with a fresh backoff — no racing chains.
-      const old = currentWs;
-      currentWs = null;
-      if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
-      try { old?.close(); } catch { /* already gone */ }
-      connect(1000);
-    }
-  });
-} catch { /* fs.watch unavailable on this platform */ }
+      redialNow();
+    });
+  } catch { /* fs.watch unavailable on this platform */ }
+}
+
+export { redialNow, handleTakeover };