@north-light/crouter 0.3.317 → 0.3.319

package/dist/core/canvas/boot.js

@@ -1,186 +1 @@
-// Detects a boot change (a host reboot, or — the case this exists for — a
-// VM/sandbox destroy+recreate) so callers can stop trusting any `pi_pid`
-// recorded before it.
-//
-// canvas.db is durable — it survives a VM/sandbox destroy+recreate or a host
-// reboot on whatever volume it lives on (see paths.ts / the storage-tiers
-// doc) — but `pi_pid` is a raw OS pid: once the process table resets, a small
-// stale pid can coincidentally collide with an unrelated process that now
-// happens to hold that number, so `isPidAlive` reads it "alive" when the
-// broker it once named is long gone. Left unchecked this fools BOTH the
-// daemon's own liveness poll (crtrd.ts) and reviveNode's double-launch guard
-// (revive.ts) into believing a dead broker is still running — the node then
-// stays permanently unrevivable until a human runs `node lifecycle revive --fresh`.
-//
-// The signal (primary): the Linux kernel's per-boot identity at
-// `/proc/sys/kernel/random/boot_id` — a fresh random UUID minted on every
-// kernel boot. A microVM recreate (a remote/guest deployment's shape) boots
-// a brand-new kernel, so `boot_id` changes; a plain daemon restart within the
-// same boot leaves it identical. This is an EXACT identity, so on Linux we need
-// no wall-clock window at all. NOTE this detects a *kernel boot*, not an
-// arbitrary container recreate: an ordinary container that shares the host
-// kernel keeps the host's `boot_id` across recreation, so this would NOT fire
-// there — that shape is out of scope.
-//
-// The signal (fallback, non-Linux dev only): `os.uptime()` resets to ~0 on a
-// reboot and is otherwise monotonic, so `now - uptime` estimates the current
-// boot's wall-clock start (the "boot epoch"). Used only when `boot_id` is
-// unavailable (e.g. macOS dev), where a genuine reboot/recreate is not a
-// production concern; the epoch comparison keeps a generous tolerance there.
-//
-// The last-seen identity is persisted in canvas.db (the same durable tier the
-// pids live in) as a single `canvas_meta` row, and the compare+sweep runs in
-// ONE `BEGIN IMMEDIATE` transaction so concurrent callers (daemon startup and a
-// manual/direct revive in another process) are serialized: a second caller
-// blocks on the write lock, then reads the marker the first already updated and
-// no-ops, so it can never clear a pid the first just recorded (single-writer).
-import { uptime } from 'node:os';
-import { openDb } from './db.js';
-// `readKernelBootId` lives in the db-free `boot-id.ts` so `canvas/pid.ts` can
-// import it without reaching `openDb`; re-exported here to preserve the
-// historical `import { readKernelBootId } from './boot.js'` surface.
-import { readKernelBootId } from './boot-id.js';
-export { readKernelBootId } from './boot-id.js';
-/** Wall-clock epoch drift (fallback signal only) beyond which two boot-start
- *  estimates are called DIFFERENT boots. Absorbs clock-sync jitter (NTP, a VM's
- *  first sync after boot) and `os.uptime()`'s ~1s resolution. Only consulted
- *  when the exact kernel `boot_id` is unavailable on BOTH sides (non-Linux
- *  dev). A false positive would clear a genuinely live pid and let reviveNode
- *  double-spawn onto the same session; a false negative just falls back to the
- *  manual `--fresh` status quo — so it is kept generous, biased against the
- *  dangerous direction. The production target (Linux microVM guests) never
- *  reaches this branch; there `boot_id` is exact. */
-const BOOT_EPOCH_TOLERANCE_MS = 60_000;
-/** Identity of the CURRENT OS boot. `now` is injectable for tests. */
-export function currentBootIdentity(now = Date.now()) {
-    return { bootId: readKernelBootId(), bootEpochMs: now - Math.round(uptime() * 1000) };
-}
-/** Pure decision core: does `current` belong to a DIFFERENT boot than the
- *  persisted `known`? `known === null` (no history — a fresh install, or the
- *  first run of a build that added this marker) is never a boot change: there
- *  is nothing to contradict it, and treating "no history" as a change could
- *  clear genuinely live pids that predate this feature.
- *
- *  When BOTH sides carry a kernel `boot_id`, that exact identity decides it — no
- *  wall-clock window, so a real quick reboot/recreate (a short-lived prior boot
- *  whose start is <60s away) is still detected. Only when a `boot_id` is missing
- *  on either side (non-Linux dev) does it fall back to the epoch-drift window.
- *  Unit-testable without real uptime/fs. */
-export function bootChanged(current, known) {
-    if (known === null)
-        return false;
-    if (current.bootId !== null && known.bootId !== null) {
-        return current.bootId !== known.bootId;
-    }
-    return Math.abs(current.bootEpochMs - known.bootEpochMs) > BOOT_EPOCH_TOLERANCE_MS;
-}
-/** POSITIVE proof that `current` is the SAME boot the persisted `known` marker
- *  recorded — as distinct from `!bootChanged(...)`, which is merely "no change
- *  detected" and is also true when there is no history, a malformed marker, or
- *  only the coarse wall-clock fallback to go on. Proof requires an exact kernel
- *  `boot_id` present and equal on BOTH sides. This gates the one-time legacy
- *  identity migration: that sweep rewrites a legacy row's baseline as
- *  `<currentBootId>#<ticks>`, permanently blessing the recorded pid as a
- *  current-boot process, so it must run ONLY when we can prove the recorded pid
- *  really is from this boot — never on a mere ticks match under an unproven
- *  boot (the epoch fallback or an absent/malformed marker could otherwise bless
- *  an unrelated stranger process that happens to collide on pid+ticks). */
-export function bootProvenSame(current, known) {
-    return (known !== null &&
-        current.bootId !== null &&
-        known.bootId !== null &&
-        current.bootId === known.bootId);
-}
-const BOOT_MARKER_KEY = 'boot_identity';
-function readBootMarker(db) {
-    const row = db
-        .prepare('SELECT value FROM canvas_meta WHERE key = ?')
-        .get(BOOT_MARKER_KEY);
-    if (row === undefined)
-        return null;
-    try {
-        const parsed = JSON.parse(row.value);
-        if (typeof parsed.bootEpochMs !== 'number')
-            return null;
-        return {
-            bootId: typeof parsed.bootId === 'string' ? parsed.bootId : null,
-            bootEpochMs: parsed.bootEpochMs,
-        };
-    }
-    catch {
-        return null; // malformed — treat as "no history yet"
-    }
-}
-function writeBootMarker(db, identity) {
-    db.prepare('INSERT INTO canvas_meta (key, value) VALUES (?, ?) ' +
-        'ON CONFLICT(key) DO UPDATE SET value = excluded.value').run(BOOT_MARKER_KEY, JSON.stringify(identity));
-}
-/** Idempotent and safe to call from every revive entry point (daemon startup,
- *  reviveNode): compares the current boot's identity against the last one
- *  recorded, and if they differ, clears `pi_pid` on every node that has one —
- *  regardless of status, since reviveNode's double-launch guard reads `pi_pid`
- *  unconditionally, not just on active/idle rows. The first caller after a
- *  genuine boot change does the sweep and persists the new marker; every call
- *  after that (in this process or another) reads a matching marker and no-ops.
- *
- *  SINGLE-WRITER: the whole read-marker + sweep + write-marker runs in one
- *  `BEGIN IMMEDIATE` transaction. A concurrent caller (a manual revive racing
- *  daemon startup, in a separate process) blocks on the SQLite write lock until
- *  this commits, then reads the already-updated marker and no-ops — so it can
- *  never `clearPid` a broker pid the first caller's revive just recorded, which
- *  would otherwise hide a live broker behind `pi_pid=NULL` and risk a second
- *  broker on the same session.
- *
- *  `current` defaults to the real identity; tests inject a synthetic one against
- *  an isolated CRTR_HOME to simulate a boot change without a real reboot. */
-export function reconcileBootLiveness(current = currentBootIdentity()) {
-    const db = openDb();
-    db.exec('BEGIN IMMEDIATE');
-    try {
-        const known = readBootMarker(db);
-        if (!bootChanged(current, known)) {
-            if (known === null)
-                writeBootMarker(db, current); // seed first-ever marker
-            const sameBootProven = bootProvenSame(current, known);
-            db.exec('COMMIT');
-            return { changed: false, cleared: [], sameBootProven };
-        }
-        const rows = db
-            .prepare("SELECT execution_id, node_id FROM executions WHERE state != 'exited'")
-            .all();
-        const ended = db.prepare("UPDATE executions SET state = 'exited', ended_at = ?, exit_reason = 'boot-change' WHERE execution_id = ? AND state != 'exited'");
-        const cleared = [];
-        const at = new Date().toISOString();
-        for (const row of rows) {
-            if (ended.run(at, row.execution_id).changes > 0)
-                cleared.push(row.node_id);
-        }
-        writeBootMarker(db, current);
-        db.exec('COMMIT');
-        return { changed: true, cleared, sameBootProven: false };
-    }
-    catch (err) {
-        try {
-            db.exec('ROLLBACK');
-        }
-        catch {
-            /* best-effort — nothing was committed */
-        }
-        throw err;
-    }
-}
-/** The daemon's one-time startup boot composition, the single source of truth
- *  for its ORDERING and GATE: reconcile pid liveness FIRST (clearing any pids
- *  recorded before this boot), then run the legacy identity migration ONLY when
- *  reconciliation positively PROVED same-boot provenance (`sameBootProven`).
- *  Both `runDaemon` and the migration-gate regression tests call this, so a
- *  revert that inverts the gate, drops it, or reorders migration ahead of
- *  reconciliation is caught here rather than only in a test-side duplicate.
- *
- *  `migrate` is injected (see `MigrateLegacyPidIdentities`); `current` and
- *  `captureIdentity` pass through to the two steps for test injection. */
-export function reconcileAndMigrateBoot(migrate, current, captureIdentity) {
-    const reconcile = reconcileBootLiveness(current);
-    const migrated = reconcile.sameBootProven ? migrate(captureIdentity).migrated : [];
-    return { reconcile, migrated };
-}
+var l=Object.defineProperty;var n=(e,o)=>l(e,"name",{value:o,configurable:!0});import{uptime as p}from"node:os";import{openDb as E}from"./db.js";import{readKernelBootId as f}from"./boot-id.js";import{readKernelBootId as y}from"./boot-id.js";const b=6e4;function I(e=Date.now()){return{bootId:f(),bootEpochMs:e-Math.round(p()*1e3)}}n(I,"currentBootIdentity");function M(e,o){return o===null?!1:e.bootId!==null&&o.bootId!==null?e.bootId!==o.bootId:Math.abs(e.bootEpochMs-o.bootEpochMs)>b}n(M,"bootChanged");function x(e,o){return o!==null&&e.bootId!==null&&o.bootId!==null&&e.bootId===o.bootId}n(x,"bootProvenSame");const i="boot_identity";function h(e){const o=e.prepare("SELECT value FROM canvas_meta WHERE key = ?").get(i);if(o===void 0)return null;try{const t=JSON.parse(o.value);return typeof t.bootEpochMs!="number"?null:{bootId:typeof t.bootId=="string"?t.bootId:null,bootEpochMs:t.bootEpochMs}}catch{return null}}n(h,"readBootMarker");function s(e,o){e.prepare("INSERT INTO canvas_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(i,JSON.stringify(o))}n(s,"writeBootMarker");function O(e=I()){const o=E();o.exec("BEGIN IMMEDIATE");try{const t=h(o);if(!M(e,t)){t===null&&s(o,e);const a=x(e,t);return o.exec("COMMIT"),{changed:!1,cleared:[],sameBootProven:a}}const r=o.prepare("SELECT execution_id, node_id FROM executions WHERE state != 'exited'").all(),c=o.prepare("UPDATE executions SET state = 'exited', ended_at = ?, exit_reason = 'boot-change' WHERE execution_id = ? AND state != 'exited'"),d=[],u=new Date().toISOString();for(const a of r)c.run(u,a.execution_id).changes>0&&d.push(a.node_id);return s(o,e),o.exec("COMMIT"),{changed:!0,cleared:d,sameBootProven:!1}}catch(t){try{o.exec("ROLLBACK")}catch{}throw t}}n(O,"reconcileBootLiveness");function g(e,o,t){const r=O(o),c=r.sameBootProven?e(t).migrated:[];return{reconcile:r,migrated:c}}n(g,"reconcileAndMigrateBoot");export{M as bootChanged,x as bootProvenSame,I as currentBootIdentity,y as readKernelBootId,g as reconcileAndMigrateBoot,O as reconcileBootLiveness};