@lifeaitools/rdc-skills 0.25.9 → 0.25.10

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "63de440233deb666609d8b50d0cea47946e1cc2e"
+  "sha": "1a1e8ac827160ff90f4a5214a5266c81aef4f86d"
 }

package/hooks/check-rdc-environment.js

@@ -137,6 +137,44 @@ function processesHoldingPackage() {
   }
 }
 
+const stoppedStampPath = path.join(os.tmpdir(), 'rdc-skills-stopped-holders.json');
+
+function writeStoppedStamp(names) {
+  try {
+    fs.writeFileSync(stoppedStampPath, JSON.stringify({ names, ts: new Date().toISOString() }), 'utf8');
+  } catch { /* best effort — the finally-restart still covers the normal path */ }
+}
+
+function clearStoppedStamp() {
+  try { fs.unlinkSync(stoppedStampPath); } catch { /* nothing to clear */ }
+}
+
+/**
+ * Restart anything a PREVIOUS run stopped but never restarted.
+ *
+ * The only way a holder stays stopped is if that run died between `pm2 stop` and
+ * `pm2 restart` — a harness timeout kill, which neither `finally` nor
+ * process.on('exit') catches. Leaving the MCP down is strictly worse than the
+ * unhealthy state being repaired, so every run repairs the previous run's crash
+ * before doing anything else.
+ */
+function restartStrandedHolders() {
+  let names = [];
+  try {
+    names = JSON.parse(fs.readFileSync(stoppedStampPath, 'utf8')).names || [];
+  } catch {
+    return; // no stamp — nothing was left stopped
+  }
+  for (const name of names) {
+    if (!SAFE_PM2_NAME.test(name)) continue;
+    try {
+      shell(`pm2 restart ${q(name)}`, { timeout: 30000 });
+      hookLog('check-rdc-environment', 'SessionStart', 'restarted-stranded-holder', { name });
+    } catch { /* reported by the health check below */ }
+  }
+  clearStoppedStamp();
+}
+
 function repair(reason) {
   hookLog('check-rdc-environment', 'SessionStart', 'repair', { reason });
 
@@ -154,6 +192,13 @@ function repair(reason) {
     hookLog('check-rdc-environment', 'SessionStart', 'skipped-unsafe-pm2-name', { name });
     return false;
   });
+  // Record what we are about to stop BEFORE stopping it. `finally` covers an
+  // exception but NOT the harness killing this hook at its timeout — and
+  // process.on('exit') does not fire for a SIGKILL either. Without this stamp a
+  // timeout kill between `pm2 stop` and `pm2 restart` leaves the MCP STOPPED with
+  // nothing that knows to bring it back. restartStrandedHolders() (called at hook
+  // entry) is the crash-safe half of this pair.
+  writeStoppedStamp(holders);
   for (const name of holders) {
     try {
       shell(`pm2 stop ${q(name)}`, { timeout: 30000 });
@@ -181,6 +226,9 @@ function repair(reason) {
         /* surfaced by the health re-check below */
       }
     }
+    // Restarted (or tried to) — the stamp has served its purpose. Clearing it here
+    // means a stamp that SURVIVES is unambiguous evidence of a killed run.
+    clearStoppedStamp();
   }
 }
 
@@ -244,6 +292,10 @@ function block(message, details = {}) {
 }
 
 async function main() {
+  // Repair a PREVIOUS run's crash first: if it was killed between `pm2 stop` and
+  // `pm2 restart`, the MCP is still down and no health check can fix that.
+  restartStrandedHolders();
+
   const initialPkg = globalPackageJson();
   const initialHealth = await health();
   const reasons = [];
@@ -315,4 +367,12 @@ async function main() {
   process.exit(0);
 }
 
-main().catch((err) => block(`RDC skills environment check crashed: ${err.message}`));
+// Run ONLY when git/Claude invokes this file directly. Without the guard, merely
+// require()-ing it executes the whole hook — which is what the installer's own
+// load-check did, triggering a REAL `npm install -g` + pm2 stop/restart during the
+// install, and on an unhealthy box a recursive install→repair→install loop.
+if (require.main === module) {
+  main().catch((err) => block(`RDC skills environment check crashed: ${err.message}`));
+}
+
+module.exports = { main, repair, restartStrandedHolders };

package/hooks/lib/box-lock.js

@@ -96,8 +96,16 @@ function acquireBoxLock() {
       // 0/12, 1/12, 2/12 double-leader rounds across runs, which is the worst kind
       // of bug to ship: it passes CI and fails on a busy machine.
       settle(SETTLE_MS);
+      // Distinguish "someone else took it" from "the read failed". Standing down on
+      // a transient read error can elect ZERO leaders — nobody repairs the box while
+      // every session waits and then hard-blocks. Only a genuine byte MISMATCH means
+      // another session leads.
       let observed = null;
-      try { observed = fs.readFileSync(LOCK_PATH, 'utf8'); } catch { observed = null; }
+      let readOk = false;
+      for (let r = 0; r < 2 && !readOk; r++) {
+        try { observed = fs.readFileSync(LOCK_PATH, 'utf8'); readOk = true; } catch { settle(20); }
+      }
+      if (!readOk) continue;              // could not verify — retry the create
       if (observed !== body) return false; // someone reclaimed it; they lead
 
       lockHeld = true;
@@ -145,8 +153,21 @@ function acquireBoxLock() {
         let claimRaw = null;
         try { claimRaw = fs.readFileSync(claim, 'utf8'); } catch { claimRaw = null; }
         if (claimRaw !== heldRaw) {
-          // Not ours to take — put it back and stand down.
-          try { fs.renameSync(claim, LOCK_PATH); } catch { /* owner will re-create */ }
+          // Not ours to take — DISCARD the claim and stand down.
+          //
+          // Do NOT rename it back. renameSync silently OVERWRITES an existing
+          // destination, and the bytes we hold are the STALE ones (that is why we
+          // judged them reclaimable). Restoring them clobbers the live leader's
+          // fresh lock with a stale body, so the next session judges it
+          // reclaimable and becomes a SECOND LEADER while the true leader is
+          // mid `npm install -g` — the exact race this module exists to prevent,
+          // arriving through the restore path. Measured, and invisible to the
+          // concurrency probe because it seeds a dead-PID lock, so claimRaw
+          // always equals heldRaw and this branch never runs there.
+          //
+          // Whoever owns the path already owns the box. Losing the stale bytes
+          // costs nothing; putting them back can only mislead.
+          try { fs.unlinkSync(claim); } catch { /* already gone */ }
           return false;
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.25.9",
+  "version": "0.25.10",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",