@nissyai/desktop 0.2.68 → 0.2.71

package/bin/nissy.mjs

@@ -28,13 +28,17 @@ import {
   resolvePayloadSpec,
   UnsupportedPlatformError,
 } from "../src/resolve.mjs";
-import { confirmHealthyStart, prepareStore } from "../src/store.mjs";
+import { confirmHealthyStart, prepareStore, storeLayout } from "../src/store.mjs";
 import { MAC_STORE_OUTCOME, prepareMacStore, pruneMacStore } from "../src/mac-store.mjs";
 import {
+  clearHandoverMarker,
+  HANDOVER_MARKER_FILE,
   launcherCommand,
   launcherOptions,
   runLauncherCommand,
   stripLauncherFlags,
+  waitForProcessExit,
+  writeHandoverMarker,
 } from "../src/cli.mjs";
 import { DISTRIBUTION } from "../src/distribution.mjs";
 import { asarBeside, demoPreflight, demoTemplatePath, userDataDir } from "../src/demo-preflight.mjs";
@@ -65,8 +69,40 @@ const LAUNCHER_VERSION = (() => {
   }
 })();
 
+/**
+ * What a failed start falls back to: the Velopack build that handed over to this
+ * launcher (`--nissy-fallback`), so a handover that fails never leaves no Nissy running.
+ * Set below, once the argv is parsed; null for every ordinary launch.
+ */
+let fallbackExe = null;
+/** The handover marker this launcher wrote, or null. */
+let handoverMarker = null;
+/** The pid the app handing over asked us to wait for, or null. */
+let waitForPid = null;
+
+/** Start the fallback, once the process that handed over has gone (it holds the
+ *  single-instance lock until then). True when it was started. */
+function startFallback() {
+  const exe = fallbackExe;
+  if (exe === null) return false;
+  // Once: a late spawn error after a fallback already started must not start another.
+  fallbackExe = null;
+  if (waitForPid !== null) waitForProcessExit(waitForPid);
+  try {
+    const args = stripLauncherFlags(process.argv.slice(2)).filter((a) => a !== "--foreground");
+    spawn(exe, args, { detached: true, stdio: "ignore" }).unref();
+    console.error(`[${DISTRIBUTION.npmCommand}] started ${exe} instead`);
+    return true;
+  } catch (err) {
+    console.error(`[${DISTRIBUTION.npmCommand}] could not start ${exe} either: ${err.message}`);
+    return false;
+  }
+}
+
 function fail(message) {
   console.error(`[${DISTRIBUTION.npmCommand}] ${message}`);
+  if (handoverMarker !== null) clearHandoverMarker(handoverMarker);
+  startFallback();
   process.exit(1);
 }
 
@@ -129,7 +165,20 @@ if (launcherOwnCommand !== null) {
   );
 }
 
-const { afterPid, applyOnly } = launcherOptions(process.argv.slice(2));
+const { afterPid, applyOnly, fallback } = launcherOptions(process.argv.slice(2));
+fallbackExe = fallback;
+waitForPid = afterPid;
+// A handover from the Velopack bridge (Windows only): say so in the store until the app
+// is started, so a second launch of the Velopack build meanwhile is not taken for a
+// failed handover. See HANDOVER_MARKER_FILE.
+if (fallback !== null && afterPid !== null && process.platform === "win32") {
+  handoverMarker = join(
+    storeLayout({ platform: process.platform, home: homedir(), env: process.env, cacheName: DISTRIBUTION.cacheName })
+      .root,
+    HANDOVER_MARKER_FILE,
+  );
+  writeHandoverMarker(handoverMarker, { launcherPid: process.pid });
+}
 
 let spec;
 try {
@@ -397,8 +446,18 @@ try {
   storeLog(`demo pre-flight skipped: ${err.message}`);
 }
 
+// The app handing over on Windows (the Velopack bridge) starts this launcher detached
+// and exits: wait for it to be gone, or the app started here would find the old one
+// still holding the single-instance lock and quit. Bounded, and a timeout still starts
+// the app: the worst case is the behaviour without the wait. macOS waited above, inside
+// the mac store.
+if (mac === null && afterPid !== null && !waitForProcessExit(afterPid)) {
+  storeLog(`pid ${String(afterPid)} was still running; starting anyway`);
+}
+
 if (foreground) {
   const child = spawn(command, args, { stdio: "inherit", env: childEnv });
+  if (handoverMarker !== null) clearHandoverMarker(handoverMarker);
   child.on("error", (err) => {
     fail(`failed to spawn payload: ${err.message}`);
   });
@@ -482,9 +541,20 @@ if (foreground) {
   //
   // This is still the weak version of the handshake — see confirmHealthyStart.
   const onTrial = staged !== null && staged.awaitingConfirmation === true;
-  if (onTrial) {
+  // A handover waits the same few seconds, on trial or not: an app that is gone by
+  // then never started, and the Velopack build it replaced is started instead.
+  if (onTrial || fallbackExe !== null) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, HEALTH_WAIT_MS);
   }
+  // Cleared after the wait, not at the spawn: by now the app holds the single-instance
+  // lock (or has gone), so a Velopack start can no longer be mistaken for either. And
+  // before the fallback, as `fail()` does: the Velopack build it starts must not find a
+  // live marker and step aside for a launch that has already failed.
+  if (handoverMarker !== null) clearHandoverMarker(handoverMarker);
+  if (fallbackExe !== null && !stillRunning(child.pid)) {
+    console.error(`[${DISTRIBUTION.npmCommand}] the app exited straight after starting`);
+    startFallback();
+  }
   confirmHealthyStart({
     platform: process.platform,
     home: homedir(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nissyai/desktop",
-  "version": "0.2.68",
+  "version": "0.2.71",
   "type": "module",
   "description": "Launcher for the Nissy desktop app. Resolves the host's app payload and spawns it. Run via `npx @nissyai/desktop`; a global install (`npm i -g @nissyai/desktop`) exposes the `nissy` command.",
   "license": "SEE LICENSE IN LICENSE",
@@ -12,6 +12,9 @@
   "bin": {
     "nissy": "bin/nissy.mjs"
   },
+  "engines": {
+    "node": ">=18"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -20,8 +23,8 @@
     "src/"
   ],
   "optionalDependencies": {
-    "@nissyai/app-win32-x64": "0.2.68",
-    "@nissyai/app-darwin-arm64": "0.2.68",
-    "@nissyai/app-darwin-x64": "0.2.68"
+    "@nissyai/app-win32-x64": "0.2.71",
+    "@nissyai/app-darwin-arm64": "0.2.71",
+    "@nissyai/app-darwin-x64": "0.2.71"
   }
 }

package/src/cli.d.mts

@@ -6,8 +6,29 @@
 
 export declare const AFTER_PID_FLAG: "--nissy-after-pid";
 export declare const APPLY_ONLY_FLAG: "--nissy-apply-only";
+export declare const FALLBACK_FLAG: "--nissy-fallback";
 export declare function launcherOptions(argv: readonly string[]): {
   afterPid: number | null;
   applyOnly: boolean;
+  fallback: string | null;
 };
 export declare function stripLauncherFlags(argv: readonly string[]): string[];
+export declare const HANDOVER_MARKER_FILE: "handover-starting.json";
+export declare function writeHandoverMarker(
+  file: string,
+  options: { launcherPid: number; image?: string; now?: () => number },
+): void;
+export declare function clearHandoverMarker(file: string): void;
+export declare function readHandoverMarker(
+  file: string,
+): { launcherPid: number; at: number; image: string | null } | null;
+export declare const AFTER_PID_WAIT_MS: number;
+export declare function waitForProcessExit(
+  pid: number,
+  options?: {
+    timeoutMs?: number;
+    alive?: (pid: number) => boolean;
+    sleep?: (ms: number) => void;
+    now?: () => number;
+  },
+): boolean;

package/src/cli.mjs

@@ -12,6 +12,9 @@
 // not belong in the middle of it. Pure apart from the store it is handed, so the
 // tests do not need a real install.
 
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname } from "node:path";
+
 import {
   compareVersions,
   isCompleteVersion,
@@ -45,23 +48,126 @@ export const ROLLBACK_FLAG = "--rollback";
  */
 export const AFTER_PID_FLAG = "--nissy-after-pid";
 export const APPLY_ONLY_FLAG = "--nissy-apply-only";
+/**
+ * `--nissy-fallback=<exe>`: what to start if the npm build cannot be started. Set by
+ * the Velopack bridge when it hands over, naming the Velopack executable it is about
+ * to exit from, so a handover that fails never leaves no Nissy running.
+ */
+export const FALLBACK_FLAG = "--nissy-fallback";
 
 /** The launcher-only options in an argv. A malformed pid is ignored rather than
  *  trusted: waiting on the wrong process is worse than not waiting. */
 export function launcherOptions(argv) {
   let afterPid = null;
+  let fallback = null;
   for (const arg of argv) {
     if (arg.startsWith(`${AFTER_PID_FLAG}=`)) {
       const pid = Number(arg.slice(AFTER_PID_FLAG.length + 1));
       if (Number.isInteger(pid) && pid > 0) afterPid = pid;
+    } else if (arg.startsWith(`${FALLBACK_FLAG}=`)) {
+      const exe = arg.slice(FALLBACK_FLAG.length + 1);
+      if (exe.length > 0) fallback = exe;
     }
   }
-  return { afterPid, applyOnly: argv.includes(APPLY_ONLY_FLAG) };
+  return { afterPid, applyOnly: argv.includes(APPLY_ONLY_FLAG), fallback };
 }
 
 /** The argv with the launcher-only flags removed, for forwarding to the app. */
 export function stripLauncherFlags(argv) {
-  return argv.filter((arg) => arg !== APPLY_ONLY_FLAG && !arg.startsWith(`${AFTER_PID_FLAG}=`));
+  return argv.filter(
+    (arg) =>
+      arg !== APPLY_ONLY_FLAG && !arg.startsWith(`${AFTER_PID_FLAG}=`) && !arg.startsWith(`${FALLBACK_FLAG}=`),
+  );
+}
+
+/**
+ * The marker a handover's launcher keeps in the store while it starts the npm build.
+ *
+ * The first start after a handover seeds the store, a copy of the whole app that can
+ * take a while, and the user can open Nissy again meanwhile through a shortcut that
+ * still points at the Velopack build. That build reads this marker: a launcher that is
+ * still alive and recent means "starting", not "the npm build never started", so it
+ * steps aside instead of counting a failed handover. Cleared once the app is started.
+ * Carries the launcher's executable name as well as its pid, so a pid Windows has since
+ * given to another program is not mistaken for this launcher.
+ * MUST match `HANDOVER_MARKER_FILE` in the desktop's velopack-migration module.
+ */
+export const HANDOVER_MARKER_FILE = "handover-starting.json";
+
+/** Record that this launcher is starting the npm build after a handover. Best-effort:
+ *  without it a second launch costs one counted attempt, which is the old behaviour. */
+export function writeHandoverMarker(file, { launcherPid, image = basename(process.execPath), now = Date.now }) {
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, JSON.stringify({ launcherPid, at: now(), image }));
+  } catch {
+    // ignore
+  }
+}
+
+export function clearHandoverMarker(file) {
+  try {
+    rmSync(file, { force: true });
+  } catch {
+    // ignore
+  }
+}
+
+/** The marker's content, or null when it is absent or unreadable. */
+export function readHandoverMarker(file) {
+  try {
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    return Number.isInteger(parsed.launcherPid) && Number.isFinite(parsed.at)
+      ? {
+          launcherPid: parsed.launcherPid,
+          at: parsed.at,
+          image: typeof parsed.image === "string" && parsed.image.length > 0 ? parsed.image : null,
+        }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+/** How long the launcher waits for `--nissy-after-pid` to exit before starting the
+ *  app anyway. Velopack's own updater gives an exiting app the same minute. */
+export const AFTER_PID_WAIT_MS = 60_000;
+
+function processAlive(pid) {
+  try {
+    // Signal 0 checks without delivering; on Windows libuv answers from the process's
+    // exit code, so an exited process reads as gone.
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    // EPERM: it exists but belongs to someone else, so it is still there.
+    return err !== null && typeof err === "object" && err.code === "EPERM";
+  }
+}
+
+function sleepMs(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/**
+ * Wait, bounded, for `pid` to exit. Returns whether it did.
+ *
+ * On Windows this is how the app hands over without `app.relaunch`: it starts the
+ * launcher detached and hidden with its own pid, and exits. Starting the new app
+ * before the old one has gone would lose it the single-instance lock, and the new app
+ * would quit on the spot. macOS waits inside the mac store, for the bundle as well.
+ * Synchronous like the rest of the launcher.
+ */
+export function waitForProcessExit(
+  pid,
+  { timeoutMs = AFTER_PID_WAIT_MS, alive = processAlive, sleep = sleepMs, now = Date.now } = {},
+) {
+  const deadline = now() + timeoutMs;
+  for (;;) {
+    if (!alive(pid)) return true;
+    if (now() >= deadline) return false;
+    sleep(100);
+  }
 }
 
 /** Which command, if any, the argv asks for. */