@hyperdrive.bot/fleet-server 0.3.157 → 0.3.158

package/dist/src/utils/spawn-broker.js

@@ -0,0 +1,299 @@
+import { fork } from "node:child_process";
+import { EventEmitter } from "node:events";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+const FAILURE_COOLDOWN_MS = 60000;
+const MAX_CONSECUTIVE_FAILURES = 3;
+export function isSpawnBrokerEnabled() {
+    if (process.platform === "win32")
+        return false;
+    const flag = process.env.PASEO_SPAWN_BROKER;
+    return flag !== "0" && flag !== "false";
+}
+function resolveBrokerChildPath() {
+    // The helper is a plain .mjs file that sits next to this module both in src/ (tests,
+    // tsx dev) and in dist/server/utils/ (build:lib copies it), so the published package
+    // ships it at node_modules/@hyperdrive.bot/fleet-server/dist/server/utils/.
+    return fileURLToPath(new URL("./spawn-broker-child.mjs", import.meta.url));
+}
+/**
+ * A process run by the broker. Emits the same events, in the same order, as a
+ * direct ChildProcess with stdio ["ignore", "pipe", "pipe"]. If the broker fails
+ * before the process is confirmed started, it transparently falls back to a
+ * direct spawn so the caller never sees the difference.
+ */
+export class BrokeredChildProcess extends EventEmitter {
+    constructor(id, broker, directSpawn, policy) {
+        super();
+        this.stdout = new EventEmitter();
+        this.stderr = new EventEmitter();
+        this.killed = false;
+        this.brokered = true;
+        this.started = false;
+        this.closed = false;
+        this.fallbackChild = null;
+        this.pendingKill = null;
+        this.id = id;
+        this.broker = broker;
+        this.directSpawn = directSpawn;
+        this.retryOnDirect = policy.retryOnDirect;
+    }
+    kill(signal = "SIGTERM") {
+        if (this.closed)
+            return false;
+        this.killed = true;
+        if (this.fallbackChild) {
+            return this.fallbackChild.kill(signal);
+        }
+        this.pendingKill = signal;
+        this.broker.sendKill(this.id, signal);
+        return true;
+    }
+    /** @internal */
+    handleMessage(message) {
+        if (this.closed || this.fallbackChild)
+            return;
+        switch (message.type) {
+            case "spawned":
+                this.started = true;
+                this.pid = message.pid;
+                this.emit("spawn");
+                return;
+            case "data": {
+                const target = message.fd === 1 ? this.stdout : this.stderr;
+                target.emit("data", Buffer.from(message.data, "base64"));
+                return;
+            }
+            case "error": {
+                const error = Object.assign(new Error(message.error.message), {
+                    code: message.error.code,
+                    errno: message.error.errno,
+                    syscall: message.error.syscall,
+                    path: message.error.path,
+                });
+                this.emit("error", error);
+                return;
+            }
+            case "close":
+                this.closed = true;
+                this.broker.release(this.id);
+                this.emit("exit", message.exitCode, message.signal);
+                this.emit("close", message.exitCode, message.signal);
+                return;
+        }
+    }
+    /** @internal Broker died or could not be reached. */
+    handleBrokerLost() {
+        if (this.closed || this.fallbackChild)
+            return;
+        if (this.started) {
+            // The process really ran (the broker kills its children when it dies), so
+            // re-running it could repeat a side effect. Report it as killed instead.
+            this.closed = true;
+            this.emit("exit", null, "SIGKILL");
+            this.emit("close", null, "SIGKILL");
+            return;
+        }
+        if (this.retryOnDirect) {
+            this.startFallback();
+            return;
+        }
+        // The request may already have run (and been killed) inside the helper, so a
+        // mutating command must not run a second time: surface the loss instead.
+        this.closed = true;
+        const error = Object.assign(new Error("Spawn broker exited before confirming the process started"), { code: "ERR_SPAWN_BROKER_LOST" });
+        queueMicrotask(() => this.emit("error", error));
+    }
+    /** @internal */
+    startFallback() {
+        this.brokered = false;
+        let child;
+        try {
+            child = this.directSpawn();
+        }
+        catch (error) {
+            this.closed = true;
+            queueMicrotask(() => this.emit("error", error));
+            return;
+        }
+        this.fallbackChild = child;
+        this.pid = child.pid;
+        child.stdout?.on("data", (chunk) => this.stdout.emit("data", chunk));
+        child.stderr?.on("data", (chunk) => this.stderr.emit("data", chunk));
+        child.on("error", (error) => this.emit("error", error));
+        child.on("exit", (code, signal) => this.emit("exit", code, signal));
+        child.on("close", (code, signal) => {
+            this.closed = true;
+            this.emit("close", code, signal);
+        });
+        if (this.pendingKill !== null) {
+            child.kill(this.pendingKill);
+        }
+    }
+}
+export class SpawnBroker {
+    constructor(childPath = resolveBrokerChildPath()) {
+        this.child = null;
+        this.pending = new Map();
+        this.nextId = 1;
+        this.consecutiveFailures = 0;
+        this.disabledUntil = 0;
+        this.exitHookInstalled = false;
+        this.childPath = childPath;
+    }
+    get pendingCount() {
+        return this.pending.size;
+    }
+    get brokerPid() {
+        return this.child?.pid;
+    }
+    spawn(request, directSpawn, policy = { retryOnDirect: false }) {
+        const proc = new BrokeredChildProcess(this.nextId++, this, directSpawn, policy);
+        const child = this.ensureChild();
+        if (!child) {
+            // The request never left this process, so a direct spawn cannot double-run it.
+            proc.startFallback();
+            return proc;
+        }
+        this.pending.set(proc.id, proc);
+        this.updateRef();
+        try {
+            child.send({ type: "spawn", id: proc.id, ...request }, (error) => {
+                if (error)
+                    this.handleChildLost(child);
+            });
+        }
+        catch {
+            this.handleChildLost(child);
+        }
+        return proc;
+    }
+    /** @internal */
+    sendKill(id, signal) {
+        const child = this.child;
+        if (!child || !child.connected)
+            return;
+        try {
+            child.send({ type: "kill", id, signal });
+        }
+        catch {
+            // handled by the disconnect path
+        }
+    }
+    /** @internal */
+    release(id) {
+        this.pending.delete(id);
+        this.updateRef();
+    }
+    /** Stop the helper. Pending requests fall back or report SIGKILL. */
+    dispose() {
+        const child = this.child;
+        if (child) {
+            this.handleChildLost(child);
+            child.kill("SIGTERM");
+        }
+    }
+    /** Test hook: make the helper exit abruptly. */
+    crashForTest() {
+        this.child?.send({ type: "crash-for-test" });
+    }
+    ensureChild() {
+        if (this.child)
+            return this.child;
+        if (Date.now() < this.disabledUntil)
+            return null;
+        if (!existsSync(this.childPath)) {
+            this.recordFailure();
+            return null;
+        }
+        let child;
+        try {
+            child = fork(this.childPath, [], {
+                execArgv: [],
+                stdio: ["ignore", "ignore", "inherit", "ipc"],
+                serialization: "json",
+                // Electron desktop: the daemon runs as the Electron binary with
+                // ELECTRON_RUN_AS_NODE=1, and Electron's fork re-injects that variable, so a
+                // PATH-only env still boots the helper as plain Node.
+                env: {
+                    PATH: process.env.PATH ?? "",
+                    ...(process.env.PASEO_SPAWN_BROKER_TEST_HOOKS === "1"
+                        ? { PASEO_SPAWN_BROKER_TEST_HOOKS: "1" }
+                        : {}),
+                },
+            });
+        }
+        catch {
+            this.recordFailure();
+            return null;
+        }
+        this.child = child;
+        child.on("message", (message) => {
+            this.consecutiveFailures = 0;
+            this.pending.get(message.id)?.handleMessage(message);
+        });
+        child.on("error", () => this.handleChildLost(child));
+        child.on("exit", () => this.handleChildLost(child));
+        child.on("disconnect", () => this.handleChildLost(child));
+        this.installExitHook();
+        this.updateRef();
+        return child;
+    }
+    handleChildLost(child) {
+        if (this.child !== child)
+            return;
+        this.child = null;
+        this.recordFailure();
+        const lost = [...this.pending.values()];
+        this.pending.clear();
+        for (const proc of lost) {
+            proc.handleBrokerLost();
+        }
+    }
+    recordFailure() {
+        this.consecutiveFailures += 1;
+        if (this.consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) {
+            this.disabledUntil = Date.now() + FAILURE_COOLDOWN_MS;
+            this.consecutiveFailures = 0;
+        }
+    }
+    updateRef() {
+        const child = this.child;
+        if (!child)
+            return;
+        // Never keep the daemon alive just for the helper; hold a ref only while a
+        // request is in flight so awaiting callers are not cut off.
+        const channel = child.channel;
+        if (this.pending.size > 0) {
+            child.ref();
+            channel?.ref?.();
+        }
+        else {
+            child.unref();
+            channel?.unref?.();
+        }
+    }
+    installExitHook() {
+        if (this.exitHookInstalled)
+            return;
+        this.exitHookInstalled = true;
+        process.once("exit", () => {
+            try {
+                this.child?.kill("SIGKILL");
+            }
+            catch {
+                // already gone
+            }
+        });
+    }
+}
+let sharedBroker = null;
+export function getSharedSpawnBroker() {
+    sharedBroker ?? (sharedBroker = new SpawnBroker());
+    return sharedBroker;
+}
+export function resetSharedSpawnBrokerForTest() {
+    sharedBroker?.dispose();
+    sharedBroker = null;
+}
+//# sourceMappingURL=spawn-broker.js.map

package/dist/src/utils/spawn.js

@@ -2,6 +2,7 @@ import { execFile, spawn } from "node:child_process";
 import { extname } from "node:path";
 import { promisify } from "node:util";
 import { createExternalCommandProcessEnv } from "../server/paseo-env.js";
+import { getSharedSpawnBroker, isSpawnBrokerEnabled, } from "./spawn-broker.js";
 import { isWindowsCommandScript, quoteWindowsArgument, quoteWindowsCommand, } from "./windows-command.js";
 const execFileAsync = promisify(execFile);
 function hasPathSeparator(value) {
@@ -16,17 +17,21 @@ function shouldUseWindowsShell(command, requestedShell) {
     }
     return process.platform === "win32" && !hasPathSeparator(command) && !extname(command);
 }
-export function spawnProcess(command, args, options) {
-    const { baseEnv, env, envOverlay, ...spawnOptions } = options ?? {};
+function resolveChildEnv(command, options) {
+    const { baseEnv, env, envOverlay } = options ?? {};
     const resolvedBaseEnv = env ?? baseEnv ?? process.env;
+    return options?.envMode === "internal"
+        ? { ...resolvedBaseEnv, ...envOverlay }
+        : createExternalCommandProcessEnv(command, resolvedBaseEnv, ...(envOverlay ? [envOverlay] : []));
+}
+export function spawnProcess(command, args, options) {
+    const { baseEnv: _baseEnv, env: _env, envOverlay: _envOverlay, ...spawnOptions } = options ?? {};
     const isWindows = process.platform === "win32";
     const shell = shouldUseWindowsShell(command, spawnOptions.shell);
     const shouldQuoteForShell = isWindows && shell !== false;
     const resolvedCommand = shouldQuoteForShell ? quoteWindowsCommand(command) : command;
     const resolvedArgs = shouldQuoteForShell ? args.map(quoteWindowsArgument) : args;
-    const childEnv = options?.envMode === "internal"
-        ? { ...resolvedBaseEnv, ...envOverlay }
-        : createExternalCommandProcessEnv(command, resolvedBaseEnv, ...(envOverlay ? [envOverlay] : []));
+    const childEnv = resolveChildEnv(command, options);
     return spawn(resolvedCommand, resolvedArgs, {
         ...spawnOptions,
         env: childEnv,
@@ -34,17 +39,53 @@ export function spawnProcess(command, args, options) {
         windowsHide: true,
     });
 }
+/**
+ * Spawn a short-lived command whose stdin is ignored and whose stdout/stderr are
+ * piped. Runs through the spawn broker helper process when available (so the
+ * daemon does not fork its own large image), and falls back to spawnProcess.
+ * Use spawnProcess instead when you need stdin, detached, a pty or a real
+ * ChildProcess handle.
+ */
+export function spawnNonInteractive(command, args, options) {
+    const direct = () => spawnProcess(command, args, {
+        cwd: options?.cwd,
+        env: options?.env,
+        baseEnv: options?.baseEnv,
+        envOverlay: options?.envOverlay,
+        envMode: options?.envMode,
+        shell: options?.shell,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    const shell = shouldUseWindowsShell(command, options?.shell);
+    if (!isSpawnBrokerEnabled() || shell !== false) {
+        return direct();
+    }
+    return getSharedSpawnBroker().spawn({
+        command,
+        args,
+        cwd: options?.cwd,
+        env: resolveChildEnv(command, options),
+        shell: false,
+        maxStdoutBytes: options?.maxStdoutBytes,
+        maxStderrBytes: options?.maxStderrBytes,
+    }, direct, { retryOnDirect: options?.retryOnDirect ?? false });
+}
+const DEFAULT_EXEC_MAX_BUFFER = 1024 * 1024;
 export async function execCommand(command, args, options) {
-    const { baseEnv, env, envOverlay } = options ?? {};
-    const resolvedBaseEnv = env ?? baseEnv ?? process.env;
     const isWindows = process.platform === "win32";
     const shell = shouldUseWindowsShell(command, options?.shell);
     const shouldQuoteForShell = isWindows && shell !== false;
+    if (!isSpawnBrokerEnabled() || shell !== false || shouldQuoteForShell) {
+        return execCommandDirect(command, args, options, shell);
+    }
+    return execCommandNonInteractive(command, args, options);
+}
+function execCommandDirect(command, args, options, shell) {
+    const isWindows = process.platform === "win32";
+    const shouldQuoteForShell = isWindows && shell !== false;
     const resolvedCommand = shouldQuoteForShell ? quoteWindowsCommand(command) : command;
     const resolvedArgs = shouldQuoteForShell ? args.map(quoteWindowsArgument) : args;
-    const childEnv = options?.envMode === "internal"
-        ? { ...resolvedBaseEnv, ...envOverlay }
-        : createExternalCommandProcessEnv(command, resolvedBaseEnv, ...(envOverlay ? [envOverlay] : []));
+    const childEnv = resolveChildEnv(command, options);
     return execFileAsync(resolvedCommand, resolvedArgs, {
         cwd: options?.cwd,
         env: childEnv,
@@ -56,6 +97,99 @@ export async function execCommand(command, args, options) {
         windowsHide: true,
     });
 }
+/**
+ * execFile semantics (timeout + killSignal, maxBuffer, "Command failed" errors
+ * carrying code/killed/signal/stdout/stderr) on top of spawnNonInteractive.
+ */
+function execCommandNonInteractive(command, args, options) {
+    const encoding = options?.encoding ?? "utf8";
+    const maxBuffer = options?.maxBuffer ?? DEFAULT_EXEC_MAX_BUFFER;
+    const killSignal = options?.killSignal ?? "SIGTERM";
+    const cmd = [command, ...args].join(" ");
+    return new Promise((resolve, reject) => {
+        const child = spawnNonInteractive(command, args, {
+            cwd: options?.cwd,
+            env: options?.env,
+            baseEnv: options?.baseEnv,
+            envOverlay: options?.envOverlay,
+            envMode: options?.envMode,
+            shell: false,
+            // One byte over the cap so the overflow is still detected here.
+            maxStdoutBytes: maxBuffer + 1,
+            maxStderrBytes: maxBuffer + 1,
+        });
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        let stdoutLength = 0;
+        let stderrLength = 0;
+        let killed = false;
+        let settled = false;
+        let exError = null;
+        let timer;
+        const decode = (chunks) => Buffer.concat(chunks).toString(encoding);
+        const kill = () => {
+            killed = true;
+            try {
+                child.kill(killSignal);
+            }
+            catch (error) {
+                exError = error;
+            }
+        };
+        const finish = (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            const stdout = decode(stdoutChunks);
+            const stderr = decode(stderrChunks);
+            if (!exError && code === 0 && signal === null) {
+                resolve({ stdout, stderr });
+                return;
+            }
+            const error = exError ?? new Error(`Command failed: ${cmd}\n${stderr}`);
+            if (!exError) {
+                error.code = code !== null && code < 0 ? String(code) : code;
+                error.killed = killed;
+                error.signal = signal;
+            }
+            error.cmd = cmd;
+            error.stdout = stdout;
+            error.stderr = stderr;
+            reject(error);
+        };
+        const onData = (chunks, stream) => (chunk) => {
+            if (settled)
+                return;
+            const length = stream === "stdout" ? stdoutLength : stderrLength;
+            const room = maxBuffer - length;
+            if (chunk.length > room) {
+                chunks.push(chunk.subarray(0, Math.max(0, room)));
+                const error = new RangeError(`${stream} maxBuffer length exceeded`);
+                error.code = "ERR_CHILD_PROCESS_STDIO_MAXBUFFER";
+                exError = error;
+                kill();
+                return;
+            }
+            chunks.push(chunk);
+            if (stream === "stdout")
+                stdoutLength += chunk.length;
+            else
+                stderrLength += chunk.length;
+        };
+        child.stdout?.on("data", onData(stdoutChunks, "stdout"));
+        child.stderr?.on("data", onData(stderrChunks, "stderr"));
+        child.on("error", (error) => {
+            exError = error;
+            finish(null, null);
+        });
+        child.on("close", (code, signal) => finish(code, signal));
+        if (options?.timeout && options.timeout > 0) {
+            timer = setTimeout(kill, options.timeout);
+        }
+    });
+}
 export function platformShell() {
     if (process.platform === "win32") {
         return { command: "cmd.exe", flag: ["/c"] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperdrive.bot/fleet-server",
-  "version": "0.3.157",
+  "version": "0.3.158",
   "description": "Paseo backend server",
   "license": "Apache-2.0",
   "files": [
@@ -39,8 +39,8 @@
     "clean": "node ../../scripts/clean-package-dist.mjs",
     "build": "npm run build:lib && npm run build:scripts",
     "build:clean": "npm run clean && npm run build",
-    "build:lib": "tsc -p tsconfig.server.json --incremental false && node -e \"const fs=require('node:fs'); fs.mkdirSync('dist/server/server/speech/providers/local/sherpa/assets',{recursive:true}); fs.copyFileSync('src/server/speech/providers/local/sherpa/assets/silero_vad.onnx','dist/server/server/speech/providers/local/sherpa/assets/silero_vad.onnx'); fs.cpSync('src/terminal/shell-integration','dist/server/terminal/shell-integration',{recursive:true}); fs.cpSync('src/terminal/shell-integration','dist/src/terminal/shell-integration',{recursive:true}); fs.copyFileSync('src/terminal/terminal-ts-loader.mjs','dist/server/terminal/terminal-ts-loader.mjs');\"",
-    "build:scripts": "tsc -p tsconfig.scripts.json --incremental false && node -e \"const fs=require('node:fs'); fs.mkdirSync('dist/scripts',{recursive:true}); fs.copyFileSync('scripts/mcp-stdio-socket-bridge-cli.mjs','dist/scripts/mcp-stdio-socket-bridge-cli.mjs');\"",
+    "build:lib": "tsc -p tsconfig.server.json --incremental false && node -e \"const fs=require('node:fs'); fs.mkdirSync('dist/server/server/speech/providers/local/sherpa/assets',{recursive:true}); fs.copyFileSync('src/server/speech/providers/local/sherpa/assets/silero_vad.onnx','dist/server/server/speech/providers/local/sherpa/assets/silero_vad.onnx'); fs.cpSync('src/terminal/shell-integration','dist/server/terminal/shell-integration',{recursive:true}); fs.cpSync('src/terminal/shell-integration','dist/src/terminal/shell-integration',{recursive:true}); fs.copyFileSync('src/terminal/terminal-ts-loader.mjs','dist/server/terminal/terminal-ts-loader.mjs'); fs.mkdirSync('dist/server/utils',{recursive:true}); fs.copyFileSync('src/utils/spawn-broker-child.mjs','dist/server/utils/spawn-broker-child.mjs');\"",
+    "build:scripts": "tsc -p tsconfig.scripts.json --incremental false && node -e \"const fs=require('node:fs'); fs.mkdirSync('dist/scripts',{recursive:true}); fs.copyFileSync('scripts/mcp-stdio-socket-bridge-cli.mjs','dist/scripts/mcp-stdio-socket-bridge-cli.mjs'); fs.mkdirSync('dist/src/utils',{recursive:true}); fs.copyFileSync('src/utils/spawn-broker-child.mjs','dist/src/utils/spawn-broker-child.mjs');\"",
     "prepack": "npm run build:clean && npm --prefix ../.. run build:daemon-web-ui",
     "start": "node dist/scripts/supervisor-entrypoint.js",
     "typecheck": "tsgo -p tsconfig.server.typecheck.json --noEmit",
@@ -66,11 +66,11 @@
     "@agentclientprotocol/sdk": "^0.17.1",
     "@anthropic-ai/claude-agent-sdk": "^0.3.195",
     "@anthropic-ai/sdk": "^0.104.2",
-    "@hyperdrive.bot/fleet-client": "0.3.157",
-    "@hyperdrive.bot/fleet-extension-sdk": "0.3.157",
-    "@hyperdrive.bot/fleet-highlight": "0.3.157",
-    "@hyperdrive.bot/fleet-protocol": "0.3.157",
-    "@hyperdrive.bot/fleet-relay": "0.3.157",
+    "@hyperdrive.bot/fleet-client": "0.3.158",
+    "@hyperdrive.bot/fleet-extension-sdk": "0.3.158",
+    "@hyperdrive.bot/fleet-highlight": "0.3.158",
+    "@hyperdrive.bot/fleet-protocol": "0.3.158",
+    "@hyperdrive.bot/fleet-relay": "0.3.158",
     "@isaacs/ttlcache": "^2.1.4",
     "@modelcontextprotocol/sdk": "^1.20.1",
     "@opencode-ai/sdk": "1.2.6",