@hienlh/ppm 0.21.0 → 0.22.1

package/src/services/remote-desktop/remote-desktop-x11.ts

@@ -0,0 +1,250 @@
+/**
+ * One shared Xlib connection for the X11 capture/input paths, over `bun:ffi` — no helper
+ * binary, matching `remote-desktop-input-win32.ts` (user32) and `-darwin.ts` (CoreGraphics).
+ *
+ * Two things here exist to keep a desktop problem from becoming a PPM problem:
+ *
+ * 1. **Xlib's default I/O error handler calls `exit()`.** If the X server goes away — a
+ *    logout, a GPU driver reset, `systemctl restart sddm` — libX11 prints `XIO: fatal IO
+ *    error` and terminates the *calling process*, which here is the whole PPM server: every
+ *    project, terminal and chat session dies because someone logged out of the desktop. Both
+ *    handlers are therefore replaced (`XSetIOErrorHandler` returns instead of falling through,
+ *    and libX11 ≥ 1.7's `XSetIOErrorExitHandler` cancels the exit that otherwise happens even
+ *    when the first one returns). Protocol errors (`BadWindow` from a monitor unplugged
+ *    mid-enumeration) go to a no-op `XSetErrorHandler` rather than the default's stderr spew.
+ *    The callbacks are held in module scope: a GC'd `JSCallback` would leave Xlib calling a
+ *    freed trampoline, which is a segfault rather than the crash it was installed to prevent.
+ *
+ *    On libX11 **1.6** that protection is only half there, and the code says so rather than
+ *    assuming otherwise: the third handler does not exist before 1.7 (2021), so an I/O error
+ *    still reaches the `exit()` the second handler returns into. It is loaded from its own
+ *    dlopen table for that reason — `bun:ffi`'s `dlopen` throws on the *first* missing symbol
+ *    and hands back none of the others, so one optional function in the main table would take
+ *    capture, input, privacy mode and monitor enumeration down together on every host older
+ *    than that (Ubuntu 20.04 ships 1.6.9).
+ *
+ * 2. **A connection that took an I/O error is not reusable.** There is no safe call left on it,
+ *    not even `XCloseDisplay`, so it is dropped un-closed (a few KB, once per X server
+ *    lifetime) and the next caller opens a fresh one.
+ *
+ * libXtst and libXrandr are optional: a host can have Xlib but no XTEST extension (input goes
+ * view-only) or no libXrandr (one whole-screen display instead of per-monitor). Neither is a
+ * reason to fail capture, so both load into `null` rather than throwing.
+ */
+import { resetLinuxSession, type LinuxSession } from "./remote-desktop-linux-session.ts";
+
+type Ffi = typeof import("bun:ffi");
+/** Xlib pointer/handle as bun:ffi hands it back. */
+type Ptr = number | bigint;
+
+const X11_SYMBOLS = {
+  XOpenDisplay: { args: ["cstring"], returns: "ptr" },
+  XDefaultRootWindow: { args: ["ptr"], returns: "u64" },
+  XDefaultScreen: { args: ["ptr"], returns: "i32" },
+  XDisplayWidth: { args: ["ptr", "i32"], returns: "i32" },
+  XDisplayHeight: { args: ["ptr", "i32"], returns: "i32" },
+  XFlush: { args: ["ptr"], returns: "i32" },
+  XSync: { args: ["ptr", "i32"], returns: "i32" },
+  XGetAtomName: { args: ["ptr", "u64"], returns: "ptr" },
+  XFree: { args: ["ptr"], returns: "i32" },
+  XStringToKeysym: { args: ["cstring"], returns: "u64" },
+  XKeysymToKeycode: { args: ["ptr", "u64"], returns: "u8" },
+  XDisplayKeycodes: { args: ["ptr", "ptr", "ptr"], returns: "i32" },
+  XGetKeyboardMapping: { args: ["ptr", "u8", "i32", "ptr"], returns: "ptr" },
+  XChangeKeyboardMapping: { args: ["ptr", "i32", "i32", "ptr", "i32"], returns: "i32" },
+  XQueryPointer: { args: ["ptr", "u64", "ptr", "ptr", "ptr", "ptr", "ptr", "ptr", "ptr"], returns: "i32" },
+  // Privacy mode: an X grab with `owner_events = False` routes every local key and button to
+  // the grabbing client, which simply drops them. Paired with `XTestGrabControl` below, which
+  // is what keeps the *remote* session's injected events working through that grab.
+  XGrabKeyboard: { args: ["ptr", "u64", "i32", "i32", "i32", "u64"], returns: "i32" },
+  XGrabPointer: { args: ["ptr", "u64", "i32", "u32", "i32", "i32", "u64", "u64", "u64"], returns: "i32" },
+  XUngrabKeyboard: { args: ["ptr", "u64"], returns: "i32" },
+  XUngrabPointer: { args: ["ptr", "u64"], returns: "i32" },
+  XSetErrorHandler: { args: ["ptr"], returns: "ptr" },
+  XSetIOErrorHandler: { args: ["ptr"], returns: "ptr" },
+} as const;
+
+/** libX11 ≥ 1.7 only, which is why it is a table of its own rather than one more line above.
+ *  Exported so a test can assert the split still holds: moving this key back into
+ *  `X11_SYMBOLS` is a one-line change that costs every pre-1.7 host its input. */
+export const X11_EXIT_SYMBOLS = {
+  XSetIOErrorExitHandler: { args: ["ptr", "ptr", "ptr"], returns: "void" },
+} as const;
+
+const XTST_SYMBOLS = {
+  XTestQueryExtension: { args: ["ptr", "ptr", "ptr", "ptr", "ptr"], returns: "i32" },
+  XTestFakeMotionEvent: { args: ["ptr", "i32", "i32", "i32", "u64"], returns: "i32" },
+  XTestFakeButtonEvent: { args: ["ptr", "u32", "i32", "u64"], returns: "i32" },
+  XTestFakeKeyEvent: { args: ["ptr", "u32", "i32", "u64"], returns: "i32" },
+  /** Makes this client's XTEST events *impervious to grabs* — the one call that lets privacy
+   *  mode hold a keyboard/pointer grab without also blocking the remote session's own input. */
+  XTestGrabControl: { args: ["ptr", "i32"], returns: "i32" },
+} as const;
+
+const XRANDR_SYMBOLS = {
+  XRRGetMonitors: { args: ["ptr", "u64", "i32", "ptr"], returns: "ptr" },
+  XRRFreeMonitors: { args: ["ptr"], returns: "void" },
+  // Resolution switching. `…Current` rather than `XRRGetScreenResources`: the latter re-polls
+  // every output over DDC, which takes tens of milliseconds and can wake a sleeping monitor.
+  XRRGetScreenResourcesCurrent: { args: ["ptr", "u64"], returns: "ptr" },
+  XRRFreeScreenResources: { args: ["ptr"], returns: "void" },
+  XRRGetOutputInfo: { args: ["ptr", "ptr", "u64"], returns: "ptr" },
+  XRRFreeOutputInfo: { args: ["ptr"], returns: "void" },
+  XRRGetCrtcInfo: { args: ["ptr", "ptr", "u64"], returns: "ptr" },
+  XRRFreeCrtcInfo: { args: ["ptr"], returns: "void" },
+  XRRSetCrtcConfig: {
+    args: ["ptr", "ptr", "u64", "u64", "i32", "i32", "u64", "u16", "ptr", "i32"],
+    returns: "i32",
+  },
+  XRRSetScreenSize: { args: ["ptr", "u64", "i32", "i32", "i32", "i32"], returns: "void" },
+} as const;
+
+/** DPMS lives in libXext, not libX11. Used to turn the host's monitor off for privacy mode
+ *  while leaving the framebuffer — and therefore the capture — alone. */
+const DPMS_SYMBOLS = {
+  DPMSQueryExtension: { args: ["ptr", "ptr", "ptr"], returns: "i32" },
+  DPMSCapable: { args: ["ptr"], returns: "i32" },
+  DPMSEnable: { args: ["ptr"], returns: "i32" },
+  DPMSForceLevel: { args: ["ptr", "u16"], returns: "i32" },
+  DPMSInfo: { args: ["ptr", "ptr", "ptr"], returns: "i32" },
+} as const;
+
+/* eslint-disable @typescript-eslint/no-explicit-any -- dlopen's symbol types are per-call */
+type X11Lib = { [K in keyof typeof X11_SYMBOLS]: any };
+type X11ExitLib = { [K in keyof typeof X11_EXIT_SYMBOLS]: any };
+type XtstLib = { [K in keyof typeof XTST_SYMBOLS]: any };
+type XrandrLib = { [K in keyof typeof XRANDR_SYMBOLS]: any };
+type DpmsLib = { [K in keyof typeof DPMS_SYMBOLS]: any };
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
+export interface X11Connection {
+  ffi: Ffi;
+  x11: X11Lib;
+  /** null when the host has no libXtst — capture works, input does not. */
+  xtst: XtstLib | null;
+  /** null when the host has no libXrandr — one whole-screen display instead of per-monitor. */
+  xrandr: XrandrLib | null;
+  /** null when the host has no libXext, or its X server has no DPMS extension — privacy mode
+   *  then blocks local input without blanking the monitor. */
+  dpms: DpmsLib | null;
+  dpy: Ptr;
+  root: bigint;
+  screen: number;
+  /** XTEST is present AND usable on this connection. */
+  hasXTest: boolean;
+  /** Which display this was opened against, so a later session change cannot reuse it. */
+  display: string;
+}
+
+let ffiModule: Ffi | null = null;
+let connection: X11Connection | null = null;
+/** Kept forever: Xlib holds raw pointers to these trampolines for the process lifetime. Named
+ *  rather than an array, because the one read outside `installErrorHandlers` used to be
+ *  `liveCallbacks[2]` — a fourth handler would have handed the wrong trampoline to Xlib, with
+ *  a wrong signature, and nothing to say so until it was called. */
+let errorCallbacks: { onError: Trampoline; onIoError: Trampoline; onIoExit: Trampoline } | null = null;
+let connectionLost = false;
+
+/** One `JSCallback`, whose `.ptr` is the address Xlib keeps for the process lifetime. */
+type Trampoline = InstanceType<Ffi["JSCallback"]>;
+
+function tryDlopen<T>(ffi: Ffi, names: string[], symbols: object): T | null {
+  for (const name of names) {
+    try { return ffi.dlopen(name, symbols as never).symbols as T; } catch { /* try the next soname */ }
+  }
+  return null;
+}
+
+/** Replace the three handlers that would otherwise print to stderr or kill the process. */
+function installErrorHandlers(ffi: Ffi, x11: X11Lib): void {
+  if (errorCallbacks) return;
+  const { JSCallback } = ffi;
+
+  // Protocol error (BadWindow/BadMatch): return 0, the same as the default handler minus stderr.
+  const onError = new JSCallback(() => 0, { args: ["ptr", "ptr"], returns: "i32" });
+  // I/O error: server gone. Mark dead and return — libX11 would otherwise fall through to exit.
+  const onIoError = new JSCallback(() => { connectionLost = true; return 0; }, { args: ["ptr"], returns: "i32" });
+  // The exit that happens anyway once the handler above returns. Cancelled by doing nothing.
+  const onIoExit = new JSCallback(() => { connectionLost = true; }, { args: ["ptr", "ptr"], returns: "void" });
+
+  x11.XSetErrorHandler(onError.ptr);
+  x11.XSetIOErrorHandler(onIoError.ptr);
+  // Written last, and this is the whole of the "installed" flag: the old boolean was set
+  // *before* the two calls above, so anything that read it in between was told the process was
+  // protected while the default handlers were still in place.
+  errorCallbacks = { onError, onIoError, onIoExit };
+}
+
+/** The shared connection for `session`, or null when Xlib is missing or the server refuses us
+ *  (no `$DISPLAY` server running, an auth cookie we cannot read). */
+export async function getX11(session: LinuxSession): Promise<X11Connection | null> {
+  if (session.kind !== "x11") return null;
+  if (connectionLost) { connection = null; connectionLost = false; }
+  // Matched on the display, not merely on there being a connection. The session is re-probed
+  // periodically now, so it can name a different display on a still-live server — a second
+  // seat, a nested Xephyr, `:0` becoming `:1`. Handing back the old `Display*` then sends
+  // every keystroke and click into the display nobody is looking at, silently and for good:
+  // nothing errors, because the old server is still there.
+  // Dropped rather than closed, the way `resetX11` and the module header already decide: Xlib's
+  // I/O error handler can `exit()` the server process, so `XCloseDisplay` is never called here.
+  if (connection && connection.display !== session.display) connection = null;
+  if (connection) return connection;
+
+  if (!ffiModule) ffiModule = await import("bun:ffi");
+  const ffi = ffiModule;
+  const x11 = tryDlopen<X11Lib>(ffi, ["libX11.so.6", "libX11.so"], X11_SYMBOLS);
+  if (!x11) return null;
+  // Same library, second `dlopen`: null here means libX11 1.6, not a missing libX11.
+  const x11Exit = tryDlopen<X11ExitLib>(ffi, ["libX11.so.6", "libX11.so"], X11_EXIT_SYMBOLS);
+  installErrorHandlers(ffi, x11);
+
+  const dpy = x11.XOpenDisplay(Buffer.from(`${session.display}\0`));
+  if (!dpy) return null;
+
+  const xtst = tryDlopen<XtstLib>(ffi, ["libXtst.so.6", "libXtst.so"], XTST_SYMBOLS);
+  const xrandr = tryDlopen<XrandrLib>(ffi, ["libXrandr.so.2", "libXrandr.so"], XRANDR_SYMBOLS);
+  const xext = tryDlopen<DpmsLib>(ffi, ["libXext.so.6", "libXext.so"], DPMS_SYMBOLS);
+
+  let hasXTest = false;
+  if (xtst) {
+    const out = new Int32Array(1);
+    hasXTest = xtst.XTestQueryExtension(dpy, ffi.ptr(out), ffi.ptr(out), ffi.ptr(out), ffi.ptr(out)) !== 0;
+  }
+
+  // The exit handler needs the Display, so it is installed after the connection exists — and
+  // only where the symbol resolved. The guard was on whether a *callback* existed, which is
+  // always true and says nothing about whether libX11 has the function to pass it to.
+  if (x11Exit && errorCallbacks) x11Exit.XSetIOErrorExitHandler(dpy, errorCallbacks.onIoExit.ptr, null);
+
+  // libXext being present is not enough: a server can be built without the DPMS extension, and
+  // `DPMSForceLevel` against one of those is a no-op that returns success.
+  let dpms: DpmsLib | null = null;
+  if (xext) {
+    const out = new Int32Array(2);
+    const present = xext.DPMSQueryExtension(dpy, ffi.ptr(out), ffi.ptr(out.subarray(1))) !== 0;
+    if (present && xext.DPMSCapable(dpy) !== 0) dpms = xext;
+  }
+
+  connection = {
+    ffi, x11, xtst, xrandr, dpms, dpy,
+    root: BigInt(x11.XDefaultRootWindow(dpy)),
+    screen: x11.XDefaultScreen(dpy),
+    hasXTest,
+    display: session.display,
+  };
+  return connection;
+}
+
+/** `bun:ffi` types every address as a branded `Pointer`, but walking a C array means doing
+ *  arithmetic on a plain number. One cast, here, instead of at every struct field. */
+export function asPointer(address: number): import("bun:ffi").Pointer {
+  return address as unknown as import("bun:ffi").Pointer;
+}
+
+/** Drop the cached connection (tests, and after a session change) and, with it, the memoized
+ *  session it was opened against. */
+export function resetX11(): void {
+  connection = null;
+  connectionLost = false;
+  resetLinuxSession();
+}

package/src/services/supervisor.ts

@@ -11,6 +11,7 @@ import {
   unlinkSync, statSync,
 } from "node:fs";
 import { getPpmDir } from "./ppm-dir.ts";
+import { stdioIsLogFile, consumeStdioIsLogEnv, rotateIfOversized, MAX_LOG_BYTES, STDIO_IS_LOG_ENV } from "./log-rotate.ts";
 import { isCompiledBinary } from "./autostart-generator.ts";
 import { cleanupStaleBinaryUpgradeArtifacts } from "./binary-upgrade-swap.ts";
 import {
@@ -60,6 +61,7 @@ const DB_BACKUP_STALE_WARN_MS = 21_600_000; // 6h — snapshots stopped happenin
 const SELF_REPLACE_TIMEOUT_MS = 30_000;     // 30s to wait for new supervisor
 const EDGE_PROBE_INTERVAL_MS = 10_000;      // the public port is dark while the edge is down — check often
 const SERVER_PORT_MIRROR_TIMEOUT_MS = 30_000; // how long to wait for the server to publish its port
+const LOG_ROTATE_INTERVAL_MS = 60_000;      // how often ppm.log is checked against its cap
 
 const logFile = () => resolve(getPpmDir(), "ppm.log");
 const restartingFlag = () => resolve(getPpmDir(), ".restarting");
@@ -154,12 +156,51 @@ let cloudConnected = false; // tracks whether we've initiated a cloud WS connect
 let originalArgv: string[] = [];
 
 // ─── Logging ───────────────────────────────────────────────────────────
+
+/**
+ * Whether this process's own stderr already lands in ppm.log.
+ *
+ * Normally it does not — under systemd stderr is the journal, and the
+ * supervisor's lines belong there as well as in the log. But the replacement
+ * supervisor of a self-upgrade is spawned with `stdio: ["ignore", newLogFd,
+ * newLogFd]`, and from then on every line would be written to the file twice.
+ * Resolved once, lazily: fd 2 does not change underneath a running process.
+ */
+let stderrIsLogFile: boolean | null = null;
+
 function log(level: string, msg: string) {
   const ts = new Date().toISOString();
   const line = `[${ts}] [${level}] [supervisor] ${msg}\n`;
   try { appendFileSync(logFile(), line); } catch {}
-  // Always write supervisor logs to stderr so journalctl captures them
-  try { process.stderr.write(line); } catch {}
+  if (stderrIsLogFile === null) {
+    stderrIsLogFile = stdioIsLogFile(2, logFile());
+    consumeStdioIsLogEnv();
+  }
+  // Write supervisor logs to stderr so journalctl captures them — unless
+  // stderr is the log file itself, where that is the same line again.
+  if (!stderrIsLogFile) { try { process.stderr.write(line); } catch {} }
+}
+
+let logRotateTimer: ReturnType<typeof setInterval> | null = null;
+
+/**
+ * Keep ppm.log under its cap. Only the supervisor does this.
+ *
+ * It is the long-lived owner of the descriptor every child was handed, and two
+ * processes truncating one file would race. Deliberately *not* run once at
+ * startup: the first rotation of a log that has been left to grow copies the
+ * whole of it, and doing that during boot adds to the one stall this work is
+ * trying to remove. The first tick is a minute away and nothing is worse for
+ * waiting.
+ */
+function startLogRotation() {
+  if (logRotateTimer) return;
+  logRotateTimer = setInterval(() => {
+    if (rotateIfOversized(logFile())) {
+      log("INFO", `Rotated ppm.log at cap ${Math.round(MAX_LOG_BYTES / 1048576)} MB`);
+    }
+  }, LOG_ROTATE_INTERVAL_MS);
+  logRotateTimer.unref?.();
 }
 
 // ─── Backoff calc ──────────────────────────────────────────────────────
@@ -622,7 +663,8 @@ export async function spawnServer(
   serverChild = await withProbeSpawnGate(() => Bun.spawn({
     cmd,
     stdio: ["ignore", logFd, logFd],
-    env: process.env,
+    // The child cannot work out on Windows that fd 1 is already the log, so it is told.
+    env: { ...process.env, [STDIO_IS_LOG_ENV]: "1" },
     // No visible console window. Critical on Windows after an upgrade: the new
     // supervisor is spawned consoleless (detached), so without this its console
     // children — and the Claude SDK grandchildren they spawn — pop blank windows.
@@ -1509,7 +1551,7 @@ async function selfReplace(): Promise<{ success: boolean; error?: string }> {
     const proc = await withProbeSpawnGate(() => nodeSpawn(cmd[0]!, cmd.slice(1), {
       detached: true,
       stdio: ["ignore", newLogFd, newLogFd] as any,
-      env: process.env as NodeJS.ProcessEnv,
+      env: { ...process.env, [STDIO_IS_LOG_ENV]: "1" } as NodeJS.ProcessEnv,
       windowsHide: true,
     }));
     const killNewChild = () => { try { if (proc.pid) process.kill(proc.pid); } catch {} };
@@ -1873,6 +1915,7 @@ export async function runSupervisor(opts: {
   originalArgv = [...process.argv];
 
   const logFd = openSync(logFile(), "a");
+  startLogRotation();
   log("INFO", `Supervisor started (PID: ${process.pid}, port: ${opts.port}, share: ${opts.share})`);
 
   // ── Systemd self-heal: if the unit file is stale (e.g. still has