@hyperdrive.bot/paseo-cli 0.3.8 → 0.3.10

package/dist/commands/daemon/index.js

@@ -57,7 +57,7 @@ export function createDaemonCommand() {
         .option("--check", "Report whether an update is available without installing it")
         .option("--force", "Reinstall even if current, or retry a version pinned after a failure")
         .option("--use-staged", "Activate a slot already present under <home>/versions instead of downloading it (still verified before activation)")
-        .option("--ready-timeout <seconds>", "How long the new version has to come up before rollback (default: 20)")
+        .option("--ready-timeout <seconds>", "Backstop for a daemon that starts but never reports ready; a daemon that dies is detected without waiting (default: 180)")
         .action(withOutput(runUpdateCommand));
     addJsonOption(daemon
         .command("set-password")

package/dist/commands/daemon/update.d.ts

@@ -8,6 +8,19 @@ interface UpdateResult {
     message: string;
 }
 export type UpdateCommandResult = SingleResult<UpdateResult>;
+interface ReadyOutcome {
+    ok: boolean;
+    observed: string | null;
+    /** Why the wait ended, so the rollback can say something true about it. */
+    reason?: "exited" | "never-started" | "timeout";
+}
+/**
+ * What to record against the version that failed, in the words of whatever
+ * actually went wrong. A pin outlives this command and is read by a human
+ * months later deciding whether to `--force` past it, so "it was slow" and
+ * "it could not stay alive" must not arrive as the same sentence.
+ */
+export declare function describeFailure(reason: ReadyOutcome["reason"], version: string, budgetMs: number): string;
 export declare function runUpdateCommand(options: CommandOptions, _command: Command): Promise<UpdateCommandResult>;
 export {};
 //# sourceMappingURL=update.d.ts.map

package/dist/commands/daemon/update.js

@@ -44,11 +44,58 @@ function parseChannel(raw) {
 function resolveRunningVersion(paseoHome) {
     return readSlotVersion(paseoHome, "current") ?? resolveCliVersion();
 }
+/** How long the supervisor has to claim the pid lock before we call it a no-show. */
+const SUPERVISOR_APPEAR_GRACE_MS = 15000;
+/**
+ * Backstop for a daemon that is alive but never reports ready.
+ *
+ * Deliberately far above the 48.7s slowest real restart measured on a live
+ * daemon, because with the supervisor's exit now detected directly this bound
+ * is only reached by a genuine hang, where waiting is the right answer. It is
+ * not a guess at how long a healthy start takes.
+ */
+const DEFAULT_READY_BUDGET_MS = 180000;
+/**
+ * Wait for the restarted daemon to report the version we just activated.
+ *
+ * A deadline alone cannot do this job, because it cannot tell a slow start from
+ * a dead one. Both look like silence, and the two want opposite responses:
+ * waiting longer fixes the first and only delays the second. Measured on a live
+ * daemon, six real restarts took 1.2s to 48.7s to report ready - a 25x spread,
+ * with the slowest a perfectly healthy externally-requested restart. Any
+ * constant that is short enough to fail fast on a dead worker is short enough to
+ * roll back a good version for being slow.
+ *
+ * So the deadline is demoted to a backstop and the supervisor's own liveness
+ * carries the signal. Once the supervisor has claimed the pid lock, its
+ * disappearance means it gave up respawning the worker (the restart budget is
+ * exhausted), which is decisive and immediate. That is what makes it safe for
+ * the backstop to be generous.
+ */
 async function waitForDaemonVersion(paseoHome, expected, budgetMs) {
-    const deadline = Date.now() + budgetMs;
+    const startedAt = Date.now();
+    const deadline = startedAt + budgetMs;
+    // Never spend more than half the budget waiting for the supervisor to merely
+    // appear, so a caller who passes a short timeout still gets the specific
+    // "it did not restart at all" answer rather than a generic expiry.
+    const appearGraceMs = Math.min(SUPERVISOR_APPEAR_GRACE_MS, Math.floor(budgetMs / 2));
     let observed = null;
+    let sawSupervisor = false;
     while (Date.now() < deadline) {
         const state = resolveLocalDaemonState({ home: paseoHome });
+        if (state.running) {
+            sawSupervisor = true;
+        }
+        else if (sawSupervisor) {
+            // It was up and now it is not. The supervisor only leaves after it stops
+            // respawning ("Restart budget exceeded"), so the new version cannot be
+            // kept alive. Nothing about the remaining budget can change that.
+            return { ok: false, observed, reason: "exited" };
+        }
+        else if (Date.now() - startedAt > appearGraceMs) {
+            // Never claimed the lock at all: the restart itself did not take.
+            return { ok: false, observed, reason: "never-started" };
+        }
         // `state.running` only means the SUPERVISOR is alive, which is true even while
         // it crash-loops a worker that dies on boot, and `current` is whatever we just
         // pointed it at. Neither says the daemon is serving.
@@ -65,7 +112,7 @@ async function waitForDaemonVersion(paseoHome, expected, budgetMs) {
         }
         await new Promise((resolve) => setTimeout(resolve, 500));
     }
-    return { ok: false, observed };
+    return { ok: false, observed, reason: "timeout" };
 }
 function single(data) {
     return { type: "single", data, schema: updateResultSchema };
@@ -137,7 +184,23 @@ async function stageAndVerify(paseoHome, targetVersion, reuseExisting) {
     };
     throw error;
 }
-async function restartDaemon(home) {
+/**
+ * Listen target the daemon is actually bound to, read from the pid lock before
+ * we stop it.
+ *
+ * Restarting without this silently moves the daemon: `paseo daemon start` does
+ * not read `daemon.listen` from config.json, so a child spawned with only
+ * `home` binds the built-in default (0.0.0.0:6767) no matter where the daemon
+ * it replaced was listening. On a box that already has something on 6767 the
+ * new worker dies with EADDRINUSE, burns the supervisor restart budget, and the
+ * update reports "the new version did not come up" - pinning a version that was
+ * never at fault.
+ */
+function resolveBoundListen(paseoHome) {
+    const listen = resolveLocalDaemonState({ home: paseoHome }).pidInfo?.listen;
+    return typeof listen === "string" && listen.length > 0 ? listen : undefined;
+}
+async function restartDaemon(home, listen) {
     try {
         await stopLocalDaemon({ home, timeoutMs: 15000, force: false });
     }
@@ -146,7 +209,22 @@ async function restartDaemon(home) {
         // HTTP server didn't close in time" and exits a moment later. Force it.
         await stopLocalDaemon({ home, timeoutMs: 15000, force: true });
     }
-    await startLocalDaemonDetached({ home });
+    await startLocalDaemonDetached({ home, ...(listen ? { listen } : {}) });
+}
+/**
+ * What to record against the version that failed, in the words of whatever
+ * actually went wrong. A pin outlives this command and is read by a human
+ * months later deciding whether to `--force` past it, so "it was slow" and
+ * "it could not stay alive" must not arrive as the same sentence.
+ */
+export function describeFailure(reason, version, budgetMs) {
+    if (reason === "exited") {
+        return `the daemon could not keep ${version} running (the supervisor stopped respawning it)`;
+    }
+    if (reason === "never-started") {
+        return `the daemon did not restart at all after activating ${version}`;
+    }
+    return `${version} did not report ready within ${Math.round(budgetMs / 1000)}s`;
 }
 /**
  * Restart onto the freshly-swapped slot and hold it to a deadline. If it does
@@ -157,25 +235,29 @@ async function restartDaemon(home) {
  * did not.
  */
 async function restartWithRollback(paseoHome, home, targetVersion, fallbackVersion, channel, readyBudgetMs) {
-    await restartDaemon(home);
+    // Read once, before the first stop: after that the pid lock is gone and the
+    // target the daemon was serving on is unrecoverable.
+    const listen = resolveBoundListen(paseoHome);
+    await restartDaemon(home, listen);
     const ready = await waitForDaemonVersion(paseoHome, targetVersion, readyBudgetMs);
     if (ready.ok)
         return null;
-    const { rolledBackTo } = rollback(paseoHome, targetVersion, `daemon did not report ${targetVersion} within ${readyBudgetMs}ms`);
+    const failure = describeFailure(ready.reason, targetVersion, readyBudgetMs);
+    const { rolledBackTo } = rollback(paseoHome, targetVersion, failure);
     try {
         await stopLocalDaemon({ home, timeoutMs: 15000, force: true });
     }
     catch {
         /* already down */
     }
-    await startLocalDaemonDetached({ home });
+    await startLocalDaemonDetached({ home, ...(listen ? { listen } : {}) });
     return single({
         action: "rolled-back",
         currentVersion: rolledBackTo ?? fallbackVersion,
         targetVersion,
         channel,
-        message: `${targetVersion} did not come up within ${readyBudgetMs}ms. Rolled back to ` +
-            `${rolledBackTo ?? "the bundled version"} and pinned ${targetVersion}.`,
+        message: `Rolled back: ${failure}. Restored ${rolledBackTo ?? "the bundled version"} ` +
+            `and pinned ${targetVersion}.`,
     });
 }
 export async function runUpdateCommand(options, _command) {
@@ -185,7 +267,7 @@ export async function runUpdateCommand(options, _command) {
     const force = options.force === true;
     const readyBudgetMs = typeof options.readyTimeout === "string" && options.readyTimeout.trim().length > 0
         ? Math.ceil(Number(options.readyTimeout) * 1000)
-        : 20000;
+        : DEFAULT_READY_BUDGET_MS;
     const currentVersion = resolveRunningVersion(paseoHome);
     const state = readUpdateState(paseoHome);
     const targetVersion = await resolveTargetVersion(paseoHome, channel, options.to);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperdrive.bot/paseo-cli",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "Paseo CLI - control your AI coding agents from the command line",
   "bin": {
     "paseo": "bin/paseo"
@@ -27,9 +27,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.0.0",
-    "@hyperdrive.bot/paseo-client": "0.3.8",
-    "@hyperdrive.bot/paseo-protocol": "0.3.8",
-    "@hyperdrive.bot/paseo-server": "0.3.8",
+    "@hyperdrive.bot/paseo-client": "0.3.10",
+    "@hyperdrive.bot/paseo-protocol": "0.3.10",
+    "@hyperdrive.bot/paseo-server": "0.3.10",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "mime-types": "^2.1.35",