@ours.network/fleet 1.2.0-nightly.8 → 1.2.0-nightly.80

package/dist/supervisor/launchd.d.ts

@@ -1,6 +1,6 @@
 import { type Exec } from '../exec.js';
 import type { SupervisorBackend } from './types.js';
-export declare const labelFor: (name: string) => string;
+export declare const labelFor: (_name: string) => string;
 /**
  * What `launchctl print` said about a job, parsed ONCE so that the two questions
  * asked of it cannot drift apart. They are not the same question:

package/dist/supervisor/launchd.js

@@ -1,8 +1,10 @@
+import { assertNativeFleetScope } from './scope.js';
+import { clientConfigPath } from '../client-profile.js';
 import { existsSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { home, logsRoot } from '../paths.js';
 import { realExec } from '../exec.js';
-export const labelFor = (name) => `network.ours.fleet.${name}`;
+export const labelFor = (_name) => 'network.ours.fleet';
 /**
  * The spelling of the last-exit line is not stable across macOS releases
  * (`last exit code`, `last exit status`, `last exit reason`), so match the
@@ -21,16 +23,17 @@ const xml = (value) => value
     .replaceAll('"', '"')
     .replaceAll("'", ''');
 function plist(name, binPath) {
-    const log = join(logsRoot(), `${name}.log`);
-    const config = process.env.OURS_CONFIG;
+    const log = join(logsRoot(), 'fleet.log');
+    const config = clientConfigPath(process.env);
+    const env = { OURS_CONFIG: config, ...Object.fromEntries(['PATH', 'OURS_FLEET_HOME', 'OURS_FLEET_SOCKET_ROOT', 'CODEX_HOME', 'CODEX_PATH'].flatMap(key => process.env[key] !== undefined ? [[key, process.env[key]]] : [])) };
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key><string>${labelFor(name)}</string>
   <key>ProgramArguments</key>
-  <array><string>${binPath}</string><string>_run</string><string>${name}</string></array>
-${config ? `  <key>EnvironmentVariables</key><dict><key>OURS_CONFIG</key><string>${xml(config)}</string></dict>\n` : ''}  <!-- The runner owns the child-session restart loop. launchd must only
+  <array><string>${xml(process.execPath)}</string><string>${xml(binPath)}</string><string>_run-fleet</string></array>
+${`  <key>EnvironmentVariables</key><dict>${Object.entries(env).map(([key, value]) => `<key>${key}</key><string>${xml(value)}</string>`).join('')}</dict>\n`}  <!-- The runner owns the child-session restart loop. launchd must only
        recover the runner PROCESS crashing: a bare KeepAlive would resume the
        uncounted relaunch loop and restart a deliberately held-down agent. -->
   <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
@@ -79,6 +82,7 @@ export function makeLaunchdBackend(exec = realExec, uid = process.getuid?.() ??
     const domain = `gui/${uid}`;
     /** Read `launchctl print` once; both callers classify it for their own question. */
     const printJob = async (name) => {
+        assertNativeFleetScope(exec);
         const r = await exec('launchctl', ['print', `${domain}/${labelFor(name)}`]);
         const out = `${r.stdout}\n${r.stderr}`;
         if (r.code !== 0)
@@ -96,21 +100,26 @@ export function makeLaunchdBackend(exec = realExec, uid = process.getuid?.() ??
     };
     return {
         id: 'launchd',
-        async init() {
+        async init(binPath) {
+            assertNativeFleetScope(exec);
             mkdirSync(agentsDir(), { recursive: true });
             mkdirSync(logsRoot(), { recursive: true });
+            writeFileSync(plistPath('fleet'), plist('fleet', binPath));
             return [
                 `LaunchAgents dir ready: ${agentsDir()}`,
                 'note: launchd agents start at login (macOS has no linger equivalent)',
             ];
         },
         async install(name, binPath) {
-            mkdirSync(agentsDir(), { recursive: true });
-            mkdirSync(logsRoot(), { recursive: true });
-            // The plist's prior existence is the record of whether we created this.
-            const existed = existsSync(plistPath(name));
-            writeFileSync(plistPath(name), plist(name, binPath));
-            await exec('launchctl', ['bootout', `${domain}/${labelFor(name)}`]); // best-effort refresh
+            assertNativeFleetScope(exec);
+            if (!existsSync(plistPath(name)))
+                throw Error('FLEET_SERVICE_NOT_INSTALLED: run ours-fleet init');
+            const existed = true;
+            const loaded = await printJob(name);
+            if (loaded.loaded)
+                return { created: !existed, detail: 'Fleet service already loaded' };
+            if (!loaded.notFound)
+                throw new Error('Fleet launchd liveness unknown');
             // Undo only what WE wrote. A plist that was already there belongs to
             // whoever put it there, and rollback may never remove it.
             const undo = async () => {
@@ -153,16 +162,19 @@ export function makeLaunchdBackend(exec = realExec, uid = process.getuid?.() ??
                 : { created: true, detail: `installed ${labelFor(name)} (${start.detail})` };
         },
         async start(name) {
+            assertNativeFleetScope(exec);
             const r = await exec('launchctl', ['bootstrap', domain, plistPath(name)]);
             if (r.code !== 0)
                 await exec('launchctl', ['kickstart', `${domain}/${labelFor(name)}`]);
         },
         async stop(name) {
+            assertNativeFleetScope(exec);
             const r = await exec('launchctl', ['bootout', `${domain}/${labelFor(name)}`]);
             if (r.code !== 0)
                 throw new Error(`launchctl bootout ${labelFor(name)} failed: ${r.stderr.trim()}`);
         },
         async restart(name) {
+            assertNativeFleetScope(exec);
             const r = await exec('launchctl', ['kickstart', '-k', `${domain}/${labelFor(name)}`]);
             if (r.code !== 0)
                 throw new Error(`launchctl kickstart ${labelFor(name)} failed: ${r.stderr.trim()}`);
@@ -202,6 +214,7 @@ export function makeLaunchdBackend(exec = realExec, uid = process.getuid?.() ??
             };
         },
         async uninstall(name) {
+            assertNativeFleetScope(exec);
             const existed = existsSync(plistPath(name));
             await exec('launchctl', ['bootout', `${domain}/${labelFor(name)}`]); // idempotent
             rmSync(plistPath(name), { force: true });
@@ -210,7 +223,7 @@ export function makeLaunchdBackend(exec = realExec, uid = process.getuid?.() ??
                 : { removed: false, detail: `${labelFor(name)} was not installed` };
         },
         logsArgs(name, follow) {
-            const log = join(logsRoot(), `${name}.log`);
+            const log = join(logsRoot(), 'fleet.log');
             return { cmd: 'tail', args: follow ? ['-f', log] : ['-n', '200', log] };
         },
     };

package/dist/supervisor/legacy.d.ts

@@ -0,0 +1,35 @@
+import { type Exec } from '../exec.js';
+import type { ResolvedRole } from '../config.js';
+type Desired = 'running' | 'stopped';
+export interface LegacyReadinessGate {
+    path: string;
+    argv: string[];
+    timeoutStartSec: number;
+    restartSec: number;
+}
+export interface LegacyPermanentMigrationInput {
+    roles: Pick<ResolvedRole, 'name' | 'identity'>[];
+    binPath: string;
+    platform: NodeJS.Platform;
+    configPath?: string;
+    exec?: Exec;
+    /** All-role preflight precedes this hook. Ensure the singleton is running and
+     * preserves every gate before returning; failure prevents native retirement. */
+    prepareParent(gates: LegacyReadinessGate[]): Promise<void>;
+    /** Isolated process-environment seam; production reads only OURS_FLEET_HOME. */
+    processHome?(pid: number): string;
+    /** Create if absent; an existing registration's desired state must survive retry. */
+    register(name: string, desired: Desired, configPath?: string): Promise<void>;
+}
+export interface LegacyPermanentMigrationResult {
+    name: string;
+    status: 'migrated' | 'already-migrated' | 'not-installed' | 'disabled';
+}
+/** Start the common parent after all-role preflight and before retirement. Only configured,
+ * identity-proven legacy registrations transfer; no identity/session writes.
+ * A receipt survives removal of the old native job and preserves its original
+ * running/stopped intent across retries. Native services are never inferred
+ * from role names alone. Uncertain or conflicting proof fails closed.
+ */
+export declare function migrateLegacyPermanentMembers(input: LegacyPermanentMigrationInput): Promise<LegacyPermanentMigrationResult[]>;
+export {};