@nimbus-sh/worker 0.4.0 → 0.6.0

package/dist/session/rpc.js

@@ -21,13 +21,12 @@
  * these ~3 sites would each need ctx threaded through; cast at boundary
  * is acceptable per plan §IX recommendation 1.
  */
-import { enc, dec } from '@nimbus-sh/core/_shared/bytes.js';
+import { enc } from '@nimbus-sh/core/_shared/bytes.js';
 import { normalizeTerminalNewlines } from '@nimbus-sh/core/_shared/terminal.js';
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { getInnerDoClass } from '@nimbus-sh/fabric/inner-do-registry.js';
 import { NpmCache } from '../npm/cache.js';
 import { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js';
-import { SqliteRuntimeFsBridge } from '@nimbus-sh/core/runtime/sqlite-runtime-fs-bridge.js';
 import { notifyTerminalEvent } from '../runtime/process-logs-api.js';
 import { IsolatePool } from '@nimbus-sh/fabric/isolate-pool.js';
 import { residentBootSpecSchema, } from '@nimbus-sh/fabric/process-fabric.js';
@@ -40,7 +39,6 @@ import { classifyError } from '@nimbus-sh/platform/oom-classify.js';
 import { acquireSupervisorReadAllocation, } from '@nimbus-sh/platform/heavy-alloc-coord.js';
 import { rpcPayloadEnd, rpcPayloadStart, } from '@nimbus-sh/platform/diag-counters.js';
 import { CRED_KERNEL, CRED_SESSION_USER, } from '@nimbus-sh/core/runtime/os-contracts.js';
-import { getSymlinkRegistry } from '@nimbus-sh/core/vfs/symlink-registry.js';
 import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
 import { FS_LIST_PAGE_LIMIT, FS_READ_BATCH_PATH_LIMIT, FS_READ_BATCH_REQUEST_BYTES, } from '@nimbus-sh/core/constants.js';
 import { routeSessionLoopback } from './loopback.js';
@@ -68,11 +66,6 @@ const WriteBatchPayloadSchema = z.object({
     chunks: z.array(WriteBatchChunkSchema).default([]),
     deletePaths: z.array(z.string()).optional(),
 }).passthrough();
-/**
- * Bridge key for the pid-less (host caller) filesystem view. ProcessTable
- * allocates pids from 1 upwards, so 0 can never collide with a process.
- */
-const HOST_CALLER_KEY = 0;
 function processPid(pid) {
     if (!Number.isInteger(pid) || typeof pid !== 'number' || pid <= 0) {
         throw new Error('filesystem RPC requires a valid process pid');
@@ -92,26 +85,7 @@ function processPid(pid) {
 function callerCred(self, pid) {
     return pid === undefined ? CRED_SESSION_USER : self.processes.cred(processPid(pid));
 }
-function processVfs(self, pid) {
-    self.ensureSqliteFs();
-    return self.sqliteFs.as(callerCred(self, pid));
-}
-function runtimeFs(self, pid) {
-    const key = pid === undefined ? HOST_CALLER_KEY : processPid(pid);
-    const vfs = processVfs(self, pid);
-    if (!self.runtimeFsBridges)
-        self.runtimeFsBridges = new Map();
-    let bridge = self.runtimeFsBridges.get(key);
-    if (!bridge) {
-        bridge = new SqliteRuntimeFsBridge(vfs, self.sqliteFs);
-        self.runtimeFsBridges.set(key, bridge);
-    }
-    else {
-        bridge.updateCredential(vfs);
-    }
-    return bridge;
-}
-function checkedReadPayloadBytes(bytes) {
+export function checkedReadPayloadBytes(bytes) {
     if (!Number.isSafeInteger(bytes) || bytes < 0) {
         throw new RangeError(`filesystem RPC read size must be a non-negative safe integer: ${bytes}`);
     }
@@ -129,13 +103,13 @@ function checkedReadPayloadBytes(bytes) {
  * `stat` here is a local SQLite lookup inside the DO — the same one
  * `_rpcReadFile` makes for the same reason — not a second round trip.
  */
-async function rangeReadBytes(fs, path, offset, length) {
+export async function rangeReadBytes(fs, path, offset, length) {
     const stat = await fs.stat(path);
     if (!stat)
         return 0;
     return Math.max(0, Math.min(length, stat.size - offset));
 }
-async function withReadAllocation(bytes, read) {
+export async function withReadAllocation(bytes, read) {
     const payloadBytes = checkedReadPayloadBytes(bytes);
     if (payloadBytes === 0)
         return read();
@@ -149,15 +123,13 @@ async function withReadAllocation(bytes, read) {
         lease.release();
     }
 }
+/**
+ * `files.readFile` — the read with the supervisor's allocation lease.
+ * The body lives in `buildSessionSupervisorOps`'s `readFile` override so
+ * direct `_rpc*` calls and the supervisor envelope share it.
+ */
 export async function _rpcReadFile(self, path, pid) {
-    const fs = runtimeFs(self, pid);
-    const stat = await fs.stat(path);
-    if (!stat)
-        return null;
-    return withReadAllocation(stat.size, async () => {
-        const bytes = await fs.readFile(path);
-        return bytes ? dec.decode(bytes) : null;
-    });
+    return self.supervisorOp({ op: 'readFile', args: [path], pid });
 }
 /**
  * Read a file as raw bytes (Uint8Array). Used by git network facet for
@@ -165,11 +137,7 @@ export async function _rpcReadFile(self, path, pid) {
  * round-tripping through readFile (string) would corrupt bytes.
  */
 export async function _rpcReadFileBytes(self, path, pid) {
-    const fs = runtimeFs(self, pid);
-    const stat = await fs.stat(path);
-    if (!stat)
-        return null;
-    return withReadAllocation(stat.size, () => fs.readFile(path));
+    return self.supervisorOp({ op: 'readFileBytes', args: [path], pid });
 }
 /**
  * Phase-3 inner-DO fetch dispatcher. Called by NimbusDOStub.fetch()
@@ -235,13 +203,10 @@ export async function _rpcInnerDoFetch(self, req) {
     }
 }
 export async function _rpcWriteFile(self, path, content, pid) {
-    // binary-fs wave: SqliteVFS.writeFile already accepts string | Uint8Array
-    // (sqlite-vfs.ts:937), so we forward the content shape unchanged. RPC
-    // structured-clone preserves Uint8Array across the boundary; structured-
-    // clone doesn't accept Buffer subclass instances, so fs.writeFileSync on
-    // a Buffer flows through node-shims.ts:writeFileSync which stores it as
-    // a plain Uint8Array on the cell — the shape that arrives here.
-    return runtimeFs(self, pid).writeFile(path, content);
+    // binary-fs wave: the bridge's writeFile already accepts
+    // string | Uint8Array — the shape arrives unchanged across structured
+    // clone.
+    return self.supervisorOp({ op: 'writeFile', args: [path, content], pid });
 }
 /**
  * Write one host-governed file at a session root and let ordinary Unix
@@ -275,53 +240,52 @@ export async function _rpcWriteProtectedRootFile(self, rootPath, path, content)
     fs.chmod(protectedPath, 0o444);
 }
 export async function _rpcStat(self, path, pid) {
-    return runtimeFs(self, pid).stat(path);
+    return self.supervisorOp({ op: 'stat', args: [path], pid });
 }
 export async function _rpcLstat(self, path, pid) {
-    return runtimeFs(self, pid).stat(path, { followSymlinks: false });
+    return self.supervisorOp({ op: 'lstat', args: [path], pid });
 }
 export async function _rpcHasLegacySymlinkUnder(self, path, pid) {
-    runtimeFs(self, pid);
-    return getSymlinkRegistry(self.sqliteFs).hasAtOrBelow(path);
+    return self.supervisorOp({ op: 'hasLegacySymlinkUnder', args: [path], pid });
 }
 export async function _rpcUtimes(self, path, atimeMs, mtimeMs, pid) {
-    await runtimeFs(self, pid).utimes(path, atimeMs, mtimeMs);
+    await self.supervisorOp({ op: 'utimes', args: [path, atimeMs, mtimeMs], pid });
 }
 export async function _rpcChmod(self, path, mode, pid) {
-    await runtimeFs(self, pid).chmod(path, mode);
+    await self.supervisorOp({ op: 'chmod', args: [path, mode], pid });
 }
 export async function _rpcAccess(self, path, mode, pid) {
-    await runtimeFs(self, pid).access(path, mode);
+    await self.supervisorBridge(pid).access(path, mode);
 }
 export async function _rpcChown(self, path, uid, gid, pid, options) {
-    await runtimeFs(self, pid).chown(path, uid, gid, options);
+    await self.supervisorBridge(pid).chown(path, uid, gid, options);
 }
 export async function _rpcSetUmask(self, mask, pid) {
     return self.processes.setUmask(processPid(pid), mask);
 }
 export async function _rpcReaddir(self, path, pid) {
-    return runtimeFs(self, pid).readdir(path);
+    return self.supervisorOp({ op: 'readdir', args: [path], pid });
 }
 export async function _rpcExists(self, path, pid) {
-    return (await runtimeFs(self, pid).stat(path)) !== null;
+    return self.supervisorOp({ op: 'exists', args: [path], pid });
 }
 export async function _rpcMkdir(self, path, pid) {
-    await runtimeFs(self, pid).mkdir(path, { recursive: true });
+    await self.supervisorOp({ op: 'mkdir', args: [path], pid });
 }
 export async function _rpcRmdir(self, path, pid) {
-    await runtimeFs(self, pid).rmdir(path);
+    await self.supervisorOp({ op: 'rmdir', args: [path], pid });
 }
 export async function _rpcRename(self, from, to, pid) {
-    await runtimeFs(self, pid).rename(from, to);
+    await self.supervisorOp({ op: 'rename', args: [from, to], pid });
 }
 export async function _rpcReadlink(self, path, pid) {
-    return runtimeFs(self, pid).readlink(path);
+    return self.supervisorOp({ op: 'readlink', args: [path], pid });
 }
 export async function _rpcSymlink(self, target, path, pid) {
-    await runtimeFs(self, pid).symlink(target, path);
+    await self.supervisorOp({ op: 'symlink', args: [target, path], pid });
 }
 const FsRangeOffsetSchema = z.number().int().min(0).finite();
-const FsReadRangeArgsSchema = z.object({
+export const FsReadRangeArgsSchema = z.object({
     path: z.string(),
     offset: FsRangeOffsetSchema,
     length: FsRangeOffsetSchema,
@@ -366,7 +330,7 @@ const FsListArgsSchema = z.object({
     limit: z.number().int().min(1).max(FS_LIST_PAGE_LIMIT).nullable(),
 });
 export async function _rpcFsRevision(self, path, pid) {
-    return runtimeFs(self, pid).revision(typeof path === 'string' ? path : undefined);
+    return self.supervisorOp({ op: 'fsRevision', args: [path], pid });
 }
 /**
  * The facet's WebSocket relay. A facet does not open its own sockets: the
@@ -416,23 +380,21 @@ export async function _rpcWsClose(self, id, code, reason, pid) {
  */
 export async function _rpcFsAcquire(self, epoch, cursor, pid) {
     const args = FsAcquireArgsSchema.parse({ epoch, cursor });
-    return runtimeFs(self, pid).acquire(args.epoch, args.cursor);
+    return self.supervisorBridge(pid).acquire(args.epoch, args.cursor);
 }
 /**
  * Enumerate the session filesystem for a process, one bounded page at a time.
  *
- * Goes through `runtimeFs(self, pid)` like every other fs RPC, so the listing
+ * Goes through `self.supervisorBridge(pid)` like every other fs RPC, so the listing
  * is filtered by the calling process's own credential rather than the kernel's
  * — a process must not learn of a path it could not stat.
  */
 export async function _rpcFsList(self, after, limit, pid) {
     const args = FsListArgsSchema.parse({ after: after ?? null, limit: limit ?? null });
-    return runtimeFs(self, pid).list(args.after, args.limit ?? undefined);
+    return self.supervisorBridge(pid).list(args.after, args.limit ?? undefined);
 }
 export async function _rpcFsReadRange(self, path, offset, length, pid) {
-    const args = FsReadRangeArgsSchema.parse({ path, offset, length });
-    const fs = runtimeFs(self, pid);
-    return withReadAllocation(await rangeReadBytes(fs, args.path, args.offset, args.length), () => fs.readRange(args.path, args.offset, args.length));
+    return self.supervisorOp({ op: 'fsReadRange', args: [path, offset, length], pid });
 }
 /**
  * The same read, through the same process credential and the same bridge, with
@@ -449,9 +411,7 @@ export async function _rpcFsReadRange(self, path, offset, length, pid) {
  * substrate that was supposed to relieve the coordinator damages it instead.
  */
 export async function _rpcFsReadRangeUncached(self, path, offset, length, pid) {
-    const args = FsReadRangeArgsSchema.parse({ path, offset, length });
-    const fs = runtimeFs(self, pid);
-    return withReadAllocation(await rangeReadBytes(fs, args.path, args.offset, args.length), () => fs.readRange(args.path, args.offset, args.length, { cached: false }));
+    return self.supervisorOp({ op: 'fsReadRangeUncached', args: [path, offset, length], pid });
 }
 /**
  * Read many ranges in ONE round trip.
@@ -481,7 +441,7 @@ export async function _rpcFsReadBatch(self, requests, pid) {
     // Sizing pass. A path this process may not stat contributes nothing and
     // still gets its own entry below — denying one path must not deny the
     // batch, which is what N separate reads would have done.
-    const fs = runtimeFs(self, pid);
+    const fs = self.supervisorBridge(pid);
     let residentBytes = 0;
     for (const request of args) {
         try {
@@ -520,7 +480,7 @@ function readBatchEntryError(error) {
 }
 export async function _rpcFsWriteRange(self, path, offset, bytes, pid) {
     const args = FsWriteRangeArgsSchema.parse({ path, offset });
-    return runtimeFs(self, pid).writeRange(args.path, args.offset, normalizeWriteBatchChunkData(bytes));
+    return self.supervisorBridge(pid).writeRange(args.path, args.offset, normalizeWriteBatchChunkData(bytes));
 }
 export async function _rpcFsAppend(self, path, writerId, moduleId, operationId, bytes, pid) {
     const args = FsAppendArgsSchema.parse({ path, writerId, moduleId, operationId });
@@ -532,7 +492,7 @@ export async function _rpcFsAppend(self, path, writerId, moduleId, operationId,
     const data = normalizeWriteBatchChunkData(bytes);
     const digestBytes = new Uint8Array(await crypto.subtle.digest('SHA-256', data));
     const digest = Array.from(digestBytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
-    return runtimeFs(self, pid).appendOnce(args.path, processId, args.writerId, args.moduleId, sequence, digest, data);
+    return self.supervisorBridge(pid).appendOnce(args.path, processId, args.writerId, args.moduleId, sequence, digest, data);
 }
 export async function _rpcFsAppendAck(self, writerId, moduleId, operationId, pid) {
     const args = FsAppendAckArgsSchema.parse({ writerId, moduleId, operationId });
@@ -541,17 +501,16 @@ export async function _rpcFsAppendAck(self, writerId, moduleId, operationId, pid
         throw new Error('filesystem append operation exceeds the safe integer range');
     }
     const processId = processPid(pid);
-    await runtimeFs(self, processId).acknowledgeAppend(processId, args.writerId, args.moduleId, sequence);
+    await self.supervisorBridge(processId).acknowledgeAppend(processId, args.writerId, args.moduleId, sequence);
 }
 export async function _rpcFsTruncate(self, path, size, pid) {
-    const args = FsTruncateArgsSchema.parse({ path, size });
-    await runtimeFs(self, pid).truncate(args.path, args.size);
+    await self.supervisorOp({ op: 'fsTruncate', args: [path, size], pid });
 }
 export async function _rpcFsOpen(self, path, flags, pid) {
-    return runtimeFs(self, pid).open(path, flags || {});
+    return self.supervisorBridge(pid).open(path, flags || {});
 }
 export async function _rpcFsRead(self, handleId, offset, length, pid) {
-    return withReadAllocation(length, () => runtimeFs(self, pid).read(handleId, offset, length));
+    return withReadAllocation(length, () => self.supervisorBridge(pid).read(handleId, offset, length));
 }
 export async function _rpcFsWrite(self, handleId, offset, bytes, pid) {
     let data;
@@ -561,10 +520,10 @@ export async function _rpcFsWrite(self, handleId, offset, bytes, pid) {
         data = new Uint8Array(bytes);
     else
         data = new Uint8Array(bytes || []);
-    return runtimeFs(self, pid).write(handleId, offset, data);
+    return self.supervisorBridge(pid).write(handleId, offset, data);
 }
 export async function _rpcFsClose(self, handleId, pid) {
-    await runtimeFs(self, pid).close(handleId);
+    await self.supervisorBridge(pid).close(handleId);
 }
 /**
  * Called by CirrusHmrRPC.hmrSend. Runs in the DO's own context so
@@ -577,7 +536,7 @@ export async function _rpcHmrRelay(self, clientId, msg) {
     self.cirrusReal.hmr.relayToBrowser(clientId, msg);
 }
 export async function _rpcUnlink(self, path, pid) {
-    await runtimeFs(self, pid).unlink(path);
+    await self.supervisorOp({ op: 'unlink', args: [path], pid });
 }
 /**
  * Bulk-write files and directories via one transactionSync().
@@ -601,7 +560,7 @@ export async function _rpcWriteBatch(self, payload, pid) {
         chunkId: c.chunkId,
         data: normalizeWriteBatchChunkData(c.data),
     }));
-    return processVfs(self, pid).writeBatch({
+    return self.sqliteFs.as(callerCred(self, pid)).writeBatch({
         inodes,
         chunks,
         deletePaths,
@@ -660,10 +619,8 @@ export async function _rpcWriteBatchStream(self, stream, mutationOwner, pid) {
     // total writeBatchStream RPCs at the coordinator (vs 620+ pre-fix).
     // Workerd's input-gate queue depth on the coordinator stays well
     // under the queue-age threshold without any user-space semaphore.
-    const decodeDrainStartedAt = performance.now();
-    return processVfs(self, pid).writeStream(stream, {
-        decodeDrainStartedAt,
-        mutationOwner,
+    return self.supervisorOp({
+        op: 'writeBatchStream', stream, mutationOwner, pid,
     });
 }
 /**
@@ -789,7 +746,7 @@ export async function _rpcReportExit(self, pid, code, tail) {
         self.webSocketRelay?.closeForPid(pid);
     }
     catch { }
-    self.runtimeFsBridges?.delete(pid);
+    self.supervisorForgetBridge?.(pid);
     if (tail)
         self.processes.appendOutput(pid, 'stderr', tail);
     // Guard against double-reporting: if we've already recorded exit
@@ -951,7 +908,7 @@ export function _reportExternalExit(self, pid, code, reason) {
         self.webSocketRelay?.closeForPid(pid);
     }
     catch { }
-    self.runtimeFsBridges?.delete(pid);
+    self.supervisorForgetBridge?.(pid);
     if (reason) {
         self.processes.appendOutput(pid, 'stderr', `[process killed: ${reason}]\n`);
     }
@@ -1009,9 +966,17 @@ export async function _rpcPrefetch(self, cwd, entryCode) {
     return prefetchForRequire(self.sqliteFs, entryCode, cwd).bundle;
 }
 export async function _rpcRegisterPort(self, pid, port) {
-    // Port registration stores the facet association
-    // The actual facet stub is stored by FacetManager separately
-    // A new registration retires the previous occupant's preview capability.
+    // Port registration stores the facet association — the actual facet stub
+    // is stored by FacetManager separately. Registration goes through the
+    // manager so a pid binding a reserved port inherits the reservation's
+    // durable contract: its journal row is stamped with the port's owner and
+    // the stored capability is re-adopted rather than retired.
+    if (self.facetManager) {
+        await self.facetManager.registerPort(pid, port);
+        return;
+    }
+    // No facet manager yet means nothing resident is running — a bare
+    // registration retires the previous occupant's preview capability.
     await clearPortCapability(self, port);
     self.portRegistry.register(port, pid);
 }
@@ -1027,7 +992,9 @@ export async function _rpcRouteLoopback(self, port, request) {
 export async function _rpcTransform(self, code, loader) {
     if (!self.esbuildService) {
         self.ensureSqliteFs();
-        self.esbuildService = new EsbuildService(self.sqliteFs);
+        if (!self.sqliteFs)
+            throw new Error('Session VFS is not initialized');
+        self.esbuildService = new EsbuildService(self.sqliteFs.as(CRED_KERNEL));
     }
     try {
         const result = await self.esbuildService.transform(code, {

package/dist/session/shell-socket.d.ts

@@ -0,0 +1,76 @@
+/**
+ * src/session/shell-socket.ts — who owns the session's terminal.
+ *
+ * The /ws upgrade refuses a second browser terminal on one session, so it
+ * has to know whether the terminal already has an owner. `readyState ===
+ * OPEN` does not answer that. It describes this end of the socket. A tab
+ * that dies without a close frame leaves a socket that still reads OPEN
+ * with nobody on the other end, and an upgrade that fails after accepting
+ * its socket leaves one whose client half was never handed to anyone. No
+ * close frame can ever arrive for either. Refusing every reconnect
+ * against such a socket locks the session out for good.
+ *
+ * Ownership needs peer-originated evidence, and that evidence has to
+ * outlive a hibernation cycle, because isolate memory does not. Two
+ * sources qualify:
+ *
+ *   1. `seenAt` in the socket's attachment. The attachment survives
+ *      hibernation. Every inbound frame refreshes it, rate-limited to one
+ *      write per STAMP_INTERVAL_MS, so a fast typist costs one attachment
+ *      write per 15 s.
+ *   2. `ctx.getWebSocketAutoResponseTimestamp(ws)`. The runtime answers
+ *      the configured `ping` itself without waking the object, so a ping
+ *      never reaches case 1 and leaves no other trace. The browser
+ *      terminal does not ping — it probes with an ordinary frame, for
+ *      the reasons public/s/index.html gives — so this covers the other
+ *      clients rather than that one.
+ *
+ * A close or an error is better than either: the runtime is telling the
+ * object outright that this socket is finished, so `clearShellSocketStamp`
+ * drops the evidence there and the next upgrade needs no inference at all.
+ *
+ * A socket owns the terminal while the later of the two falls inside
+ * SHELL_OWNER_LIVENESS_MS. The window has to cover the longest silence a
+ * live tab can produce. Browsers throttle a background tab's timers to
+ * about one tick per minute, so 120 s clears that with margin. A tab
+ * quiet for longer has stopped running its own code, and the upgrade that
+ * takes the terminal also closes its socket — so it redials cleanly
+ * instead of holding a terminal it can no longer use.
+ */
+/** How long a shell socket owns the terminal after its peer was heard. */
+export declare const SHELL_OWNER_LIVENESS_MS = 120000;
+/** The part of `DurableObjectState` this module reads. */
+export interface AutoResponseHost {
+    getWebSocketAutoResponseTimestamp?(ws: WebSocket): Date | null;
+}
+/** Tag a freshly accepted terminal socket as this session's shell owner. */
+export declare function tagShellSocket(ws: WebSocket, now?: number): void;
+/**
+ * Drop the evidence that a peer was on this socket.
+ *
+ * Called when the runtime reports the socket closed or errored. Both say
+ * this socket is finished, so the next upgrade must not read a stamp the
+ * dying handler wrote moments earlier and refuse the reconnect. Keeps the
+ * kind, so the socket still classifies as the terminal's while it drains.
+ * A peer that turns out to be alive re-stamps on its next frame.
+ */
+export declare function clearShellSocketStamp(ws: WebSocket): void;
+/**
+ * Record that the peer on this socket is still there.
+ *
+ * Called on every inbound shell frame. Rewrites the attachment only once
+ * the recorded stamp has aged past STAMP_INTERVAL_MS. No-op on sockets
+ * that carry another kind.
+ */
+export declare function noteShellSocketActivity(ws: WebSocket, now?: number): void;
+/** True when another browser terminal currently holds this session. */
+export declare function hasLiveShellOwner(ctx: AutoResponseHost | undefined, sockets: readonly WebSocket[], now?: number): boolean;
+/**
+ * Close the shell sockets no peer holds any more.
+ *
+ * Called on an upgrade that is taking the terminal. Without it, a socket
+ * whose tab is gone stays accepted for the life of the object, and every
+ * warm rejoin adds another one.
+ */
+export declare function closeStaleShellSockets(ctx: AutoResponseHost | undefined, sockets: readonly WebSocket[], now?: number): void;
+//# sourceMappingURL=shell-socket.d.ts.map

package/dist/session/shell-socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-socket.d.ts","sourceRoot":"","sources":["../../src/session/shell-socket.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAU/C,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC,CAAC,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;CAChE;AAwFD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAGzD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAKrF;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,GAAG,SAAS,EACjC,OAAO,EAAE,SAAS,SAAS,EAAE,EAC7B,GAAG,GAAE,MAAmB,GACvB,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,gBAAgB,GAAG,SAAS,EACjC,OAAO,EAAE,SAAS,SAAS,EAAE,EAC7B,GAAG,GAAE,MAAmB,GACvB,IAAI,CAKN"}

package/dist/session/shell-socket.js

@@ -0,0 +1,172 @@
+/**
+ * src/session/shell-socket.ts — who owns the session's terminal.
+ *
+ * The /ws upgrade refuses a second browser terminal on one session, so it
+ * has to know whether the terminal already has an owner. `readyState ===
+ * OPEN` does not answer that. It describes this end of the socket. A tab
+ * that dies without a close frame leaves a socket that still reads OPEN
+ * with nobody on the other end, and an upgrade that fails after accepting
+ * its socket leaves one whose client half was never handed to anyone. No
+ * close frame can ever arrive for either. Refusing every reconnect
+ * against such a socket locks the session out for good.
+ *
+ * Ownership needs peer-originated evidence, and that evidence has to
+ * outlive a hibernation cycle, because isolate memory does not. Two
+ * sources qualify:
+ *
+ *   1. `seenAt` in the socket's attachment. The attachment survives
+ *      hibernation. Every inbound frame refreshes it, rate-limited to one
+ *      write per STAMP_INTERVAL_MS, so a fast typist costs one attachment
+ *      write per 15 s.
+ *   2. `ctx.getWebSocketAutoResponseTimestamp(ws)`. The runtime answers
+ *      the configured `ping` itself without waking the object, so a ping
+ *      never reaches case 1 and leaves no other trace. The browser
+ *      terminal does not ping — it probes with an ordinary frame, for
+ *      the reasons public/s/index.html gives — so this covers the other
+ *      clients rather than that one.
+ *
+ * A close or an error is better than either: the runtime is telling the
+ * object outright that this socket is finished, so `clearShellSocketStamp`
+ * drops the evidence there and the next upgrade needs no inference at all.
+ *
+ * A socket owns the terminal while the later of the two falls inside
+ * SHELL_OWNER_LIVENESS_MS. The window has to cover the longest silence a
+ * live tab can produce. Browsers throttle a background tab's timers to
+ * about one tick per minute, so 120 s clears that with margin. A tab
+ * quiet for longer has stopped running its own code, and the upgrade that
+ * takes the terminal also closes its socket — so it redials cleanly
+ * instead of holding a terminal it can no longer use.
+ */
+/** How long a shell socket owns the terminal after its peer was heard. */
+export const SHELL_OWNER_LIVENESS_MS = 120_000;
+/** Smallest gap between two attachment writes on one socket. */
+const STAMP_INTERVAL_MS = 15_000;
+/** Tolerance for a `seenAt` that reads ahead of the current clock. */
+const CLOCK_SKEW_MS = 60_000;
+const SHELL_KIND = 'shell';
+function readAttachment(ws) {
+    try {
+        const read = Reflect.get(ws, 'deserializeAttachment');
+        if (typeof read !== 'function')
+            return null;
+        return Reflect.apply(read, ws, []);
+    }
+    catch {
+        return null;
+    }
+}
+function writeAttachment(ws, attachment) {
+    try {
+        const write = Reflect.get(ws, 'serializeAttachment');
+        if (typeof write === 'function')
+            Reflect.apply(write, ws, [attachment]);
+    }
+    catch { /* the socket is closing, or the runtime refused the write */ }
+}
+/**
+ * Read a shell socket's stamp in one attachment pass.
+ *
+ * Returns null when the socket carries another kind, and a stamp of null
+ * when it is a shell socket nothing has stamped yet. An attachment
+ * outlives the deploy that wrote it and is untrusted on the way back, so
+ * a stamp that is not a plain timestamp, or that reads further ahead than
+ * the clocks can differ, counts as no stamp at all.
+ */
+function readShellStamp(ws, now) {
+    const attachment = readAttachment(ws);
+    if (typeof attachment !== 'object' || attachment === null)
+        return null;
+    const record = attachment;
+    if (record.kind !== SHELL_KIND)
+        return null;
+    const seenAt = record.seenAt;
+    if (typeof seenAt !== 'number' || !Number.isFinite(seenAt) || seenAt > now + CLOCK_SKEW_MS) {
+        return { seenAt: null };
+    }
+    return { seenAt };
+}
+/** When the runtime last answered a ping on this socket, if it ever did. */
+function autoResponseAt(ctx, ws, now) {
+    // Null whenever the runtime has never auto-answered on this socket.
+    const at = ctx?.getWebSocketAutoResponseTimestamp?.(ws) ?? null;
+    if (!at)
+        return null;
+    const ms = at.getTime();
+    if (!Number.isFinite(ms) || ms > now + CLOCK_SKEW_MS)
+        return null;
+    return ms;
+}
+/** True while a peer is still proven to be on this shell socket. */
+function ownsTerminal(ctx, ws, stamp, now) {
+    const answered = autoResponseAt(ctx, ws, now);
+    const heard = stamp.seenAt === null
+        ? answered
+        : (answered === null ? stamp.seenAt : Math.max(stamp.seenAt, answered));
+    return heard !== null && now - heard < SHELL_OWNER_LIVENESS_MS;
+}
+/** The open shell sockets, each with the stamp it carries. */
+function openShellSockets(sockets, now) {
+    const found = [];
+    for (const ws of sockets) {
+        if (ws.readyState !== WebSocket.OPEN)
+            continue;
+        const stamp = readShellStamp(ws, now);
+        if (stamp)
+            found.push({ ws, stamp });
+    }
+    return found;
+}
+/** Tag a freshly accepted terminal socket as this session's shell owner. */
+export function tagShellSocket(ws, now = Date.now()) {
+    writeAttachment(ws, { kind: SHELL_KIND, seenAt: now });
+}
+/**
+ * Drop the evidence that a peer was on this socket.
+ *
+ * Called when the runtime reports the socket closed or errored. Both say
+ * this socket is finished, so the next upgrade must not read a stamp the
+ * dying handler wrote moments earlier and refuse the reconnect. Keeps the
+ * kind, so the socket still classifies as the terminal's while it drains.
+ * A peer that turns out to be alive re-stamps on its next frame.
+ */
+export function clearShellSocketStamp(ws) {
+    if (readShellStamp(ws, Date.now()) === null)
+        return;
+    writeAttachment(ws, { kind: SHELL_KIND });
+}
+/**
+ * Record that the peer on this socket is still there.
+ *
+ * Called on every inbound shell frame. Rewrites the attachment only once
+ * the recorded stamp has aged past STAMP_INTERVAL_MS. No-op on sockets
+ * that carry another kind.
+ */
+export function noteShellSocketActivity(ws, now = Date.now()) {
+    const stamp = readShellStamp(ws, now);
+    if (!stamp)
+        return;
+    if (stamp.seenAt !== null && now - stamp.seenAt < STAMP_INTERVAL_MS)
+        return;
+    writeAttachment(ws, { kind: SHELL_KIND, seenAt: now });
+}
+/** True when another browser terminal currently holds this session. */
+export function hasLiveShellOwner(ctx, sockets, now = Date.now()) {
+    return openShellSockets(sockets, now).some(({ ws, stamp }) => ownsTerminal(ctx, ws, stamp, now));
+}
+/**
+ * Close the shell sockets no peer holds any more.
+ *
+ * Called on an upgrade that is taking the terminal. Without it, a socket
+ * whose tab is gone stays accepted for the life of the object, and every
+ * warm rejoin adds another one.
+ */
+export function closeStaleShellSockets(ctx, sockets, now = Date.now()) {
+    for (const { ws, stamp } of openShellSockets(sockets, now)) {
+        if (ownsTerminal(ctx, ws, stamp, now))
+            continue;
+        try {
+            ws.close(1001, 'terminal taken over');
+        }
+        catch { /* already closing */ }
+    }
+}

package/dist/session/start-real-vite.js

@@ -53,7 +53,7 @@ export async function startRealVite(self, opts) {
         if (cfgPath) {
             try {
                 if (!self.esbuildService)
-                    self.esbuildService = new EsbuildService(self.sqliteFs);
+                    self.esbuildService = new EsbuildService(kernelFs);
                 const bundleResult = await self.esbuildService.build([cfgPath], {
                     bundle: true,
                     format: 'esm',