@ornncompute/cli 0.2.12 → 0.2.14

package/README.md

@@ -371,6 +371,20 @@ If an installation fails, Ornn continues only when it can verify that
 the remaining CLI loads successfully. Otherwise it prints reinstall
 instructions. If another update is running, retry after it finishes.
 
+Updates publish an initialized `update-install-*.lock` directory in the Ornn
+config directory. Its unique owner file prevents competing processes from
+removing a replacement lock during recovery or release. Directory locks from
+processes that exit before installation are reclaimed on the next update
+attempt; live or inaccessible PIDs and malformed metadata remain locked. Legacy regular-file locks require
+manual cleanup after confirming that no updater is running: deleting them
+automatically could remove a live lock created by an older CLI. PID reuse can
+also require manual cleanup. An installation marker keeps the lock held if the
+CLI is killed during installation, because its package installer may still be
+running. Confirm that installer has stopped before removing the lock. Repeated
+Ctrl+C or SIGTERM releases the lock after installer teardown. An interrupted
+package installation may still require reinstalling the CLI if the package
+manager has already removed the previous version.
+
 ## Deployment
 
 `deploy-cli-pipeline.yml` publishes `@ornncompute/cli` from `main`. Staging

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/signals.mjs

@@ -1,12 +1,15 @@
+const FORWARDABLE_SIGNALS =
+  process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
+
 export function forwardSignals(signalSource, child, onSignal) {
-  const listeners = ["SIGINT", "SIGTERM"].map((signal) => {
+  const listeners = FORWARDABLE_SIGNALS.map((signal) => {
     const listener = () => {
       onSignal(signal);
       try {
         child?.kill?.(signal);
       } catch {}
     };
-    signalSource.once(signal, listener);
+    signalSource.on(signal, listener);
     return [signal, listener];
   });
   return () => {

package/src/startup.mjs

@@ -73,7 +73,7 @@ function failedProbe(stderr) {
 function unavailableLock(stderr) {
   warning(
     stderr,
-    "Automatic update unavailable; retry after any other ornn update finishes. If none is running, remove the stale update-install lock from your Ornn config directory or check that directory's permissions.",
+    "Automatic update unavailable; retry after any other ornn update finishes. If no updater or package installer is running, remove the stale update-install lock from your Ornn config directory or check that directory's permissions.",
   );
   return { kind: "exit", code: 1 };
 }
@@ -198,13 +198,13 @@ export async function prepareStartup(argv, options = {}) {
     spawnProcess: options.spawnProcess ?? spawn,
   };
 
-  let release;
+  let lock;
   try {
     try {
-      release = await acquireLock({ env, binPath: context.binPath ?? binPath });
+      lock = await acquireLock({ env, binPath: context.binPath ?? binPath });
     } catch {}
     if (interruptedSignal) return exitForSignal(interruptedSignal);
-    if (typeof release !== "function") return unavailableLock(stderr);
+    if (!lock) return unavailableLock(stderr);
 
     let target;
     try {
@@ -232,7 +232,10 @@ export async function prepareStartup(argv, options = {}) {
 
     let installResult;
     try {
-      installResult = await install({ context, version: target, ...subprocessOptions });
+      installResult = await lock.runInstall(() => {
+        if (interruptedSignal) return { signal: interruptedSignal };
+        return install({ context, version: target, ...subprocessOptions });
+      });
     } catch {}
     if (interruptedSignal || installResult?.signal) {
       return exitForSignal(interruptedSignal ?? installResult.signal);
@@ -265,7 +268,7 @@ export async function prepareStartup(argv, options = {}) {
     return { kind: "restart", binPath: replacementBin };
   } finally {
     removeSignals();
-    if (typeof release === "function") await Promise.resolve(release()).catch(() => {});
+    if (lock) await Promise.resolve(lock.release()).catch(() => {});
   }
 }
 

package/src/update-lock.mjs

@@ -0,0 +1,100 @@
+import { randomUUID } from "node:crypto";
+import {
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rename,
+  rm,
+  rmdir,
+  unlink,
+  writeFile,
+} from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+async function isStale(path) {
+  let pid;
+  try {
+    ({ pid } = JSON.parse(await readFile(path, "utf8")));
+  } catch {
+    return false;
+  }
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return false;
+  } catch (error) {
+    return error.code === "ESRCH";
+  }
+}
+
+async function removeOwner(lockPath, owner) {
+  await unlink(join(lockPath, owner)).catch(() => {});
+  // A replacement has a different owner file, so rmdir cannot remove it.
+  await rmdir(lockPath).catch(() => {});
+}
+
+async function reclaim(lockPath) {
+  let owners;
+  try {
+    owners = await readdir(lockPath);
+  } catch {
+    return;
+  }
+  if (owners.length === 0) {
+    await rmdir(lockPath).catch(() => {});
+  } else if (owners.length === 1 && (await isStale(join(lockPath, owners[0])))) {
+    await removeOwner(lockPath, owners[0]);
+  }
+}
+
+export async function acquireFileLock(lockPath) {
+  let pending;
+  const owner = randomUUID();
+  try {
+    await mkdir(dirname(lockPath), { mode: 0o700, recursive: true });
+    pending = await mkdtemp(`${lockPath}-`);
+    await writeFile(
+      join(pending, owner),
+      `${JSON.stringify({ pid: process.pid })}\n`,
+      {
+        mode: 0o600,
+      }
+    );
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      try {
+        // Publish metadata atomically; an occupied nonempty directory cannot be replaced.
+        await rename(pending, lockPath);
+        pending = null;
+        let released = false;
+        return {
+          async release() {
+            if (released) return;
+            released = true;
+            await removeOwner(lockPath, owner);
+          },
+          async runInstall(install) {
+            if (released) throw new Error("The update lock has already been released.");
+            const marker = join(lockPath, `${randomUUID()}.install`);
+            // A killed coordinator cannot prove its installer exited. Keep that lock held.
+            try {
+              await writeFile(marker, "", { mode: 0o600, flag: "wx" });
+              return await install();
+            } finally {
+              await unlink(marker).catch(() => {});
+            }
+          },
+        };
+      } catch (error) {
+        if (!["EEXIST", "ENOTEMPTY", "ENOTDIR", "EISDIR", "EPERM"].includes(error.code))
+          return null;
+        if (attempt === 0) await reclaim(lockPath);
+      }
+    }
+  } catch {
+    return null;
+  } finally {
+    if (pending) await rm(pending, { recursive: true, force: true }).catch(() => {});
+  }
+  return null;
+}

package/src/update.mjs

@@ -1,11 +1,12 @@
-import { createHash, randomUUID } from "node:crypto";
+import { createHash } from "node:crypto";
 import { existsSync, realpathSync } from "node:fs";
-import { mkdir, open, readFile, rm } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, posix, win32 } from "node:path";
 import { CliApiError } from "./api-client.mjs";
 import { getAuthConfigDir } from "./auth-store.mjs";
 import { forwardSignals } from "./signals.mjs";
+import { acquireFileLock } from "./update-lock.mjs";
 
 export const UPDATE_CHECK_TIMEOUT_MS = 3000;
 const UPDATE_LOCK_PREFIX = "update-install";
@@ -241,41 +242,7 @@ function updateLockPath(env, binPath) {
 
 export async function acquireUpdateLock({ env = process.env, binPath }) {
   const lockPath = updateLockPath(env, binPath);
-  if (!lockPath) {
-    return null;
-  }
-
-  let handle;
-  try {
-    await mkdir(dirname(lockPath), { mode: 0o700, recursive: true });
-    handle = await open(lockPath, "wx", 0o600);
-  } catch {
-    return null;
-  }
-
-  const token = randomUUID();
-  try {
-    await handle.writeFile(`${JSON.stringify({ pid: process.pid, token })}\n`, "utf8");
-    await handle.close();
-  } catch {
-    await handle.close().catch(() => {});
-    await rm(lockPath, { force: true }).catch(() => {});
-    return null;
-  }
-
-  let released = false;
-  return async () => {
-    if (released) {
-      return;
-    }
-    released = true;
-    try {
-      const current = JSON.parse(await readFile(lockPath, "utf8"));
-      if (current?.token === token) {
-        await rm(lockPath);
-      }
-    } catch {}
-  };
+  return lockPath ? acquireFileLock(lockPath) : null;
 }
 
 function installInvocation(context, version) {
@@ -459,13 +426,13 @@ export async function updateCommand({
     );
   }
 
-  const releaseLock = await acquireUpdateLock({ env, binPath: context.binPath });
-  if (!releaseLock) {
+  const lock = await acquireUpdateLock({ env, binPath: context.binPath });
+  if (!lock) {
     const lockPath = updateLockPath(env, context.binPath);
     throw new CliApiError(
       `Could not acquire the update lock. If another ornn update is running, wait for it to finish and retry.${
         lockPath
-          ? ` Otherwise remove the stale lock at ${lockPath} and retry.`
+          ? ` If no updater or package installer is running, remove the stale lock at ${lockPath} and retry.`
           : " Check the config directory permissions and retry."
       }`,
     );
@@ -491,7 +458,7 @@ export async function updateCommand({
     const version = latest ?? "latest";
     const [command, commandArgs] = installInvocation(context, version);
     stderr.write(`Running: ${command} ${commandArgs.join(" ")}\n`);
-    const result = await installVersion({ context, version, spawnProcess, platform, env });
+    const result = await lock.runInstall(() => installVersion({ context, version, spawnProcess, platform, env }));
     if (result.exitCode !== 0) {
       throw new CliApiError(
         updateFailureMessage({
@@ -532,7 +499,7 @@ export async function updateCommand({
     }
     return 0;
   } finally {
-    await releaseLock();
+    await lock.release();
   }
 }