@gmickel/gno 2.9.1 → 2.10.0

package/src/core/sighup-disposition.ts

@@ -0,0 +1,66 @@
+/**
+ * Whether a resident may take over SIGHUP (fn-210).
+ *
+ * Registering any SIGHUP listener replaces the inherited disposition, so a
+ * resident started under `nohup` (or `trap '' HUP`) would start shutting down
+ * when its terminal closes. The disposition is read once with sigaction(2):
+ * if SIGHUP was ignored at start, it stays ignored. When it cannot be read
+ * (Windows, no FFI), the default is kept and no handler is installed.
+ *
+ * @module src/core/sighup-disposition
+ */
+
+const SIGHUP = 1;
+/** `SIG_IGN` is handler value 1 on Linux and macOS. */
+const SIG_IGN = 1n;
+/** Comfortably larger than `struct sigaction` on Linux and macOS. */
+const SIGACTION_BYTES = 256;
+const LIBC_NAMES: Record<string, string[]> = {
+  linux: ["libc.so.6", "libc.so"],
+  darwin: ["libc.dylib", "libSystem.B.dylib"],
+};
+
+let cached: boolean | undefined;
+
+function readSighupIgnored(): boolean | null {
+  const names = LIBC_NAMES[process.platform];
+  if (!names) return null;
+  try {
+    // bun:ffi is built into Bun (no native dependency).
+    const { dlopen, FFIType, ptr } =
+      require("bun:ffi") as typeof import("bun:ffi");
+    for (const name of names) {
+      try {
+        const libc = dlopen(name, {
+          sigaction: {
+            args: [FFIType.i32, FFIType.ptr, FFIType.ptr],
+            returns: FFIType.i32,
+          },
+        });
+        try {
+          const old = new BigUint64Array(SIGACTION_BYTES / 8);
+          if (libc.symbols.sigaction(SIGHUP, null, ptr(old)) !== 0) return null;
+          // The handler is the first member of struct sigaction on both.
+          return old[0] === SIG_IGN;
+        } finally {
+          libc.close();
+        }
+      } catch {
+        // Try the next library name.
+      }
+    }
+  } catch {
+    // No FFI in this runtime.
+  }
+  return null;
+}
+
+/**
+ * True when SIGHUP was not ignored at start and its disposition is known, so
+ * a resident can shut down gracefully on it. Read before any SIGHUP listener
+ * is installed; the answer is cached.
+ */
+export function sighupHandlerAllowed(): boolean {
+  if (cached === undefined) cached = readSighupIgnored() === false;
+  return cached;
+}

package/src/core/time-slice.ts

@@ -0,0 +1,34 @@
+/**
+ * Cooperative time slicing for long synchronous work on a resident's main
+ * thread.
+ *
+ * Bun runs SQLite synchronously, so a loop of store calls never lets the
+ * event loop serve a request until it ends, however many `await`s it
+ * contains (they resolve as microtasks). Call `maybeYield()` between units of
+ * work: once the current slice has run longer than its budget, it yields a
+ * macrotask turn so pending requests (status, search) are answered.
+ *
+ * @module src/core/time-slice
+ */
+
+/** Longest a slice runs before yielding; keeps status well under 100 ms. */
+export const DEFAULT_TIME_SLICE_MS = 20;
+
+export interface TimeSlicer {
+  /** Yield to the event loop if the current slice is over budget. */
+  maybeYield(): Promise<void>;
+}
+
+export function createTimeSlicer(
+  budgetMs = DEFAULT_TIME_SLICE_MS,
+  now: () => number = performance.now.bind(performance)
+): TimeSlicer {
+  let sliceStart = now();
+  return {
+    async maybeYield() {
+      if (now() - sliceStart < budgetMs) return;
+      await new Promise<void>((resolve) => setImmediate(resolve));
+      sliceStart = now();
+    },
+  };
+}

package/src/ingestion/file-processor.ts

@@ -19,6 +19,14 @@
  * If no backend can start, the file fails closed with
  * ISOLATION_UNAVAILABLE; it is never prepared unbounded.
  *
+ * A message that cannot be deserialized on the way to or from the processor
+ * (fn-213) fails the file with PROCESSOR_MESSAGE_FAILED and replaces the
+ * processor, and one stderr line names the direction, backend, file and
+ * step. Bun 1.4.0 and later report it as a `messageerror` event on the
+ * receiving side of a worker; over the child's IPC channel Bun closes the
+ * channel on both ends instead, so the child backend cannot tell which
+ * direction failed.
+ *
  * One processor is reused across files (starting one costs about a third of
  * a second of module loading). It is replaced after an overrun, after a
  * file that leaves memory above half the budget, and after a short idle
@@ -78,8 +86,26 @@ export interface ReadyMessage {
   type: "ready";
 }
 
+/** Posted by the worker when a job it was sent could not be deserialized. */
+export interface UndeliverableJobMessage {
+  type: "undeliverable-job";
+}
+
+/** Which message could not be delivered; the child backend cannot tell. */
+export type DeliveryDirection = "job" | "result" | "unknown";
+
+/** Why a processor stopped working. */
+interface ProcessorFailure {
+  reason: string;
+  /** Set when a message could not be delivered. */
+  delivery?: DeliveryDirection;
+}
+
 export type FileProcessorBackendKind = "worker" | "child";
 
+/** Error code of a file whose message to or from the processor was lost. */
+export const PROCESSOR_MESSAGE_FAILED = "PROCESSOR_MESSAGE_FAILED";
+
 /** Error codes of a file stopped at its budget. */
 export const BUDGET_ERROR_CODES: ReadonlySet<string> = new Set([
   "TIMEOUT",
@@ -149,7 +175,7 @@ interface Processor {
   /** Settles once the processor has loaded and can take a file. */
   readonly ready: Promise<void>;
   /** Settles, with a reason, if the processor dies or errors. */
-  readonly failed: Promise<string>;
+  readonly failed: Promise<ProcessorFailure>;
   /** Send one file; its messages go to `onMessage`. */
   run(
     request: PrepareFileRequest,
@@ -164,6 +190,8 @@ interface Processor {
   /** Child process id (child backend), for shutdown and tests. */
   readonly pid: number | null;
   stop(): void;
+  /** Tests only: raise the event Bun raises for an undeliverable message. */
+  simulateUndeliverable?(direction: "job" | "result"): void;
 }
 
 const phaseName = (index: number): string => PREPARE_PHASES[index] ?? "startup";
@@ -176,25 +204,38 @@ function startWorker(): Processor {
   const phaseSlot = new Int32Array(new SharedArrayBuffer(4));
   let onMessage: ((message: FileWorkerMessage) => void) | null = null;
   let markReady: () => void = () => undefined;
-  let markFailed: (reason: string) => void = () => undefined;
+  let markFailed: (failure: ProcessorFailure) => void = () => undefined;
   let dead = false;
   const ready = new Promise<void>((resolve) => {
     markReady = resolve;
   });
-  const failed = new Promise<string>((resolve) => {
-    markFailed = (reason) => {
+  const failed = new Promise<ProcessorFailure>((resolve) => {
+    markFailed = (failure) => {
       dead = true;
-      resolve(reason);
+      resolve(failure);
     };
   });
   worker.onmessage = (
-    event: MessageEvent<FileWorkerMessage | ReadyMessage>
+    event: MessageEvent<
+      FileWorkerMessage | ReadyMessage | UndeliverableJobMessage
+    >
   ) => {
     if (event.data.type === "ready") markReady();
-    else onMessage?.(event.data);
+    else if (event.data.type === "undeliverable-job") {
+      markFailed({
+        reason: "the file worker could not deserialize its job",
+        delivery: "job",
+      });
+    } else onMessage?.(event.data);
+  };
+  worker.onmessageerror = () => {
+    markFailed({
+      reason: "a message from the file worker could not be deserialized",
+      delivery: "result",
+    });
   };
   worker.onerror = (event: ErrorEvent) => {
-    markFailed(event.message || "file worker failed");
+    markFailed({ reason: event.message || "file worker failed" });
   };
   return {
     kind: "worker",
@@ -212,7 +253,12 @@ function startWorker(): Processor {
     pid: null,
     stop() {
       worker.terminate();
-      markFailed("file processor was stopped");
+      markFailed({ reason: "file processor was stopped" });
+    },
+    simulateUndeliverable(direction) {
+      if (direction === "result") {
+        worker.dispatchEvent(new MessageEvent("messageerror"));
+      } else worker.postMessage({ simulateUndeliverable: true });
     },
   };
 }
@@ -267,12 +313,21 @@ function startChild(): Processor {
   child.unref();
   liveChildren.add(child);
   ensureShutdownHooks();
-  const failed = child.exited.then((code) => {
+  const failed = child.exited.then((code): ProcessorFailure => {
     exited = true;
     liveChildren.delete(child);
-    return stopping
-      ? "file processor was stopped"
-      : `file processor child exited (${code})`;
+    if (stopping) return { reason: "file processor was stopped" };
+    // Bun closes the channel on both ends when either side receives a
+    // message it cannot deserialize. The child exits cleanly only once its
+    // channel is gone (file-child.ts), and a crash never exits cleanly; the
+    // exit can be reported before Bun's own disconnect callback.
+    if (code === 0) {
+      return {
+        reason: "the IPC channel to the file processor child closed",
+        delivery: "unknown",
+      };
+    }
+    return { reason: `file processor child exited (${code})` };
   });
   return {
     kind: "child",
@@ -367,6 +422,19 @@ export function activeFileProcessorPid(): number | null {
   return processor?.pid ?? null;
 }
 
+/**
+ * Tests only: make the running worker processor raise the event Bun raises
+ * when a message cannot be deserialized (a real payload cannot be made to
+ * fail from JavaScript). False when no worker processor is running.
+ */
+export function simulateUndeliverableMessage(
+  direction: "job" | "result"
+): boolean {
+  if (!processor?.simulateUndeliverable) return false;
+  processor.simulateUndeliverable(direction);
+  return true;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Processor lifecycle
 // ─────────────────────────────────────────────────────────────────────────────
@@ -429,11 +497,30 @@ const awaitReady = (active: Processor): Promise<string | null> => {
   });
   return Promise.race([
     active.ready.then(() => null),
-    active.failed,
+    active.failed.then((failure) => failure.reason),
     timedOut,
   ]).finally(() => clearTimeout(timer));
 };
 
+/** Failure of a file whose message to or from the processor was lost. */
+function undeliverableFailure(
+  request: PrepareFileRequest,
+  kind: FileProcessorBackendKind,
+  phase: string,
+  failure: ProcessorFailure
+): PrepareFailure {
+  const direction = failure.delivery ?? "unknown";
+  const file = `${request.input.collection}/${request.input.relativePath}`;
+  console.error(
+    `gno: file processor message lost (direction ${direction}, backend ${kind}) for ${file} during ${phase}: ${failure.reason}; the processor was replaced`
+  );
+  return {
+    code: PROCESSOR_MESSAGE_FAILED,
+    message: `The file processor could not deliver a message during ${phase} (${failure.reason}); the processor was replaced`,
+    details: { direction, backend: kind, phase },
+  };
+}
+
 const runOne = async (
   request: PrepareFileRequest,
   budget: FileBudgetLimits,
@@ -511,9 +598,23 @@ const runOne = async (
     const sampler = setInterval(() => {
       void checkMemory();
     }, MEMORY_SAMPLE_INTERVAL_MS);
-    void active.failed.then((reason) =>
-      finish({ ok: false, error: { code: "INTERNAL", message: reason } }, false)
-    );
+    void active.failed.then((failure) => {
+      if (settled) return;
+      finish(
+        {
+          ok: false,
+          error: failure.delivery
+            ? undeliverableFailure(
+                request,
+                active.kind,
+                active.phase(),
+                failure
+              )
+            : { code: "INTERNAL", message: failure.reason },
+        },
+        false
+      );
+    });
     // A process already over the budget does not start another file.
     const rss = process.memoryUsage.rss();
     if (rss > budget.maxMemoryBytes) {

package/src/ingestion/graph-reconciliation.ts

@@ -19,6 +19,7 @@ import {
   normalizeWikiName,
   parseTargetParts,
 } from "../core/links";
+import { createTimeSlicer } from "../core/time-slice";
 import {
   createInMemoryWorkspaceResolver,
   membershipsFromCollectionRows,
@@ -137,6 +138,9 @@ function relationResolver(
   };
 }
 
+/** Changed identities per incoming-link lookup (one statement each). */
+const INCOMING_LINK_CHUNK = 8;
+
 export async function projectGraph(
   store: StorePort,
   options: SyncOptions,
@@ -144,6 +148,7 @@ export async function projectGraph(
   forceFull = false
 ): Promise<ProjectionError[]> {
   const errors: ProjectionError[] = [];
+  const slicer = createTimeSlicer();
   try {
     const graph = store.graphReferenceStore?.();
     let fingerprint = "";
@@ -221,10 +226,16 @@ export async function projectGraph(
       // No durable per-source link journal exists; conservatively rebuild in that case.
       if (changed.size === 0 && state.dirty) selected = undefined;
       else {
-        for (const id of graph.incomingLinkSources(
-          [...changed.values()].flat()
-        ))
-          selected.add(id);
+        // One statement over every changed identity scales with links x
+        // targets and cannot yield; chunk it so the event loop gets turns.
+        const identities = [...changed.values()].flat();
+        for (let i = 0; i < identities.length; i += INCOMING_LINK_CHUNK) {
+          await slicer.maybeYield();
+          for (const id of graph.incomingLinkSources(
+            identities.slice(i, i + INCOMING_LINK_CHUNK)
+          ))
+            selected.add(id);
+        }
         const resolveOld = relationResolver(
           previous.map((row) => row.document),
           memberships
@@ -264,7 +275,10 @@ export async function projectGraph(
       );
       if (!backfill.ok) throw new Error(backfill.error.message);
       for (const [index, doc] of targets.entries()) {
+        // Every 25 documents at least, and sooner when slow documents
+        // (large link resolution) would hold the event loop past its budget.
         if (index > 0 && index % 25 === 0) await Bun.sleep(0);
+        else await slicer.maybeYield();
         if (!doc.active) {
           const cleared = await store.setDocEdges(
             doc.id,

package/src/ingestion/prepare-worker.ts

@@ -8,6 +8,7 @@ import type {
   FileWorkerMessage,
   FileWorkerRequest,
   ReadyMessage,
+  UndeliverableJobMessage,
 } from "./file-processor";
 
 import { defaultChunker } from "./chunker";
@@ -16,14 +17,31 @@ import { PREPARE_PHASES, prepareFile } from "./prepare-file";
 
 declare const self: Worker;
 
-const post = (message: FileWorkerMessage | ReadyMessage): void => {
+const post = (
+  message: FileWorkerMessage | ReadyMessage | UndeliverableJobMessage
+): void => {
   self.postMessage(message);
 };
 
-self.onmessage = async (event: MessageEvent<FileWorkerRequest>) => {
+// A job that cannot be deserialized never reaches onmessage (Bun 1.4.0+
+// raises messageerror instead); tell the parent so the file fails at once.
+// A listener, not `onmessageerror`: Bun's worker scope never calls that
+// property.
+self.addEventListener("messageerror", () => {
+  post({ type: "undeliverable-job" });
+});
+
+self.onmessage = async (
+  event: MessageEvent<FileWorkerRequest | { simulateUndeliverable: true }>
+) => {
   // Only the parent that created this worker may drive it; a Bun Worker sees
   // its parent's messages with an empty origin.
   if (event.origin !== "") return;
+  if ("simulateUndeliverable" in event.data) {
+    // Tests only (simulateUndeliverableMessage): raise the real event.
+    self.dispatchEvent(new MessageEvent("messageerror"));
+    return;
+  }
   const { request, phaseSlot } = event.data;
   const outcome = await prepareFile(request, {
     convert: convertForPreparation,

package/src/ingestion/sync.ts

@@ -229,11 +229,73 @@ async function gitPull(path: string): Promise<void> {
 /**
  * Run collection update command (best effort).
  */
-async function runUpdateCmd(path: string, cmd: string): Promise<void> {
+/** Default cap on a collection's updateCmd; `updateCmdTimeoutMs` overrides it. */
+export const UPDATE_CMD_TIMEOUT_MS = 10 * 60_000;
+/**
+ * POSIX wrapper run as `sh -c WRAPPER sh <updateCmd>` in a new process group
+ * (detached spawn). It runs the command with stdin from /dev/null and blocks
+ * a subshell on gno's stdin pipe: when gno exits or is killed, by any signal
+ * including SIGKILL, the pipe closes and the subshell stops the whole group,
+ * so no part of the command (a hung `git` or `rsync`) outlives gno; anything
+ * still running 5 s after SIGTERM gets SIGKILL. The pipe goes through fd 3
+ * because an asynchronous list's stdin is /dev/null.
+ */
+const UPDATE_CMD_WRAPPER = [
+  "exec 3<&0",
+  '"$0" -c "$1" </dev/null 3<&- &',
+  "cmd=$!",
+  // The watcher ignores the TERM it sends, gives the command up to 5 s to
+  // exit, then SIGKILLs whatever is left of the group (itself included).
+  [
+    "( trap '' TERM; read -r _ <&3; kill -TERM 0",
+    'i=0; while kill -0 "$cmd" 2>/dev/null && [ "$i" -lt 10 ]; do sleep 0.5; i=$((i + 1)); done',
+    "kill -KILL 0 ) &",
+  ].join("; "),
+  "exec 3<&-",
+  'wait "$cmd"',
+].join("\n");
+
+async function runUpdateCmd(
+  path: string,
+  cmd: string,
+  timeoutMs = UPDATE_CMD_TIMEOUT_MS
+): Promise<void> {
+  const posix = process.platform !== "win32";
+  let child: Bun.Subprocess<"pipe", "ignore", "ignore">;
   try {
-    await Bun.$`sh -c ${cmd}`.cwd(path).quiet().nothrow();
+    child = Bun.spawn({
+      cmd: posix
+        ? ["sh", "-c", UPDATE_CMD_WRAPPER, "sh", cmd]
+        : ["sh", "-c", cmd],
+      cwd: path,
+      stdin: "pipe",
+      stdout: "ignore",
+      stderr: "ignore",
+      detached: posix,
+    });
   } catch {
-    // Ignore update command failures
+    // Ignore update command failures (no shell, bad cwd).
+    return;
+  }
+  const signalAll = (signal: NodeJS.Signals): void => {
+    try {
+      if (posix) process.kill(-child.pid, signal);
+      else child.kill(signal);
+    } catch {
+      // already gone
+    }
+  };
+  // On timeout, TERM the group. POSIX: that ends the wrapper, the finally
+  // below closes the lifeline, and the wrapper's watcher escalates whatever
+  // ignores TERM to SIGKILL. On Windows SIGTERM already terminates.
+  const timer = setTimeout(() => signalAll("SIGTERM"), timeoutMs);
+  try {
+    // Ignore update command failures (non-zero exit, timeout).
+    await child.exited;
+  } finally {
+    clearTimeout(timer);
+    // Closing the lifeline also reaps anything the command left running.
+    await Promise.resolve(child.stdin.end()).catch(() => undefined);
   }
 }
 
@@ -1605,7 +1667,11 @@ export class SyncService {
         caller: { authenticated: true, operationAuthorized: true },
         contentClass: "source",
       });
-      await runUpdateCmd(collection.path, collection.updateCmd);
+      await runUpdateCmd(
+        collection.path,
+        collection.updateCmd,
+        collection.updateCmdTimeoutMs
+      );
     }
 
     if (options.gitPull && (await isGitRepo(collection.path))) {

package/src/serve/parent-lifeline.ts

@@ -0,0 +1,44 @@
+/**
+ * Parent lifeline for a resident started by another process (fn-207).
+ *
+ * A launcher that owns `gno serve` (the desktop shell) sets
+ * `GNO_PARENT_LIFELINE=stdin` and keeps a pipe on the child's stdin open.
+ * When the launcher exits or is killed, even with SIGKILL, the kernel closes
+ * that pipe; stdin reaches EOF and the resident shuts down as on SIGTERM.
+ * Event-driven on every platform, with no polling timer. Without the opt-in a
+ * resident keeps running when its parent goes away (e.g. `nohup gno serve`).
+ *
+ * @module src/serve/parent-lifeline
+ */
+
+export const PARENT_LIFELINE_ENV = "GNO_PARENT_LIFELINE";
+
+/**
+ * When the launcher opted in, call `onLost` once stdin reaches EOF. Returns a
+ * stop function that cancels the watch (normal shutdown). The opt-in is
+ * removed from the environment so this process's own children never inherit
+ * it.
+ */
+export function watchParentLifeline(onLost: () => void): () => void {
+  const mode = process.env[PARENT_LIFELINE_ENV];
+  delete process.env[PARENT_LIFELINE_ENV];
+  if (mode !== "stdin") return () => undefined;
+
+  let stopped = false;
+  const reader = Bun.stdin.stream().getReader();
+  void (async () => {
+    try {
+      // The launcher never writes; any bytes are drained and ignored.
+      while (!(await reader.read()).done) {
+        // keep reading until EOF
+      }
+    } catch {
+      // A read error means the pipe is gone, the same as EOF.
+    }
+    if (!stopped) onLost();
+  })();
+  return () => {
+    stopped = true;
+    void reader.cancel().catch(() => undefined);
+  };
+}

package/src/serve/public/components/BootstrapStatus.tsx

@@ -65,8 +65,8 @@ export function BootstrapStatus({
 
   return (
     <section className="space-y-4">
-      <div className="flex items-start justify-between gap-4">
-        <div>
+      <div className="flex flex-col gap-4 sm:flex-row sm:items-start sm:justify-between">
+        <div className="min-w-0">
           <div className="mb-2 flex items-center gap-2">
             <PackageIcon className="size-4 text-primary" />
             <h2 className="font-semibold text-2xl">Bootstrap & Storage</h2>
@@ -77,7 +77,7 @@ export function BootstrapStatus({
           </p>
         </div>
         {missingModels > 0 && !bootstrap.models.downloading && (
-          <Button onClick={onDownloadModels} size="sm">
+          <Button className="self-start" onClick={onDownloadModels} size="sm">
             <DownloadIcon className="mr-2 size-4" />
             Download missing models
           </Button>