@quickchatai/quickreview 1.2.0 → 1.3.2

package/src/loginrefresh/handover.ts

@@ -0,0 +1,138 @@
+// The login handover, in Node: what docker/entrypoint.sh's login mode does
+// around pi's /login (login_handover_begin / login_handover_end), for a login
+// made outside the container, by the home's re-login (src/home/loginowner.ts).
+//
+// On a single box the daemon's refresher owns the host pi home's auth.json
+// while auto-review runs (one login per box). A login that rewrites
+// that file beside it would race its refresh: whichever wrote last wins, and a
+// refresh landing after the login would put the old grant back. So a login
+// first asks the refresher to pause: it writes `auth.json.pause` and waits for
+// `"paused": true` in the refresher's status file. A paused refresher neither
+// refreshes nor writes, and KEEPS its lock, so no second refresher can start
+// during the login. Releasing removes the pause file; the refresher re-reads
+// the new login at once and resumes. A pause file left behind (the home killed
+// mid-login) is lifted by the refresher after 15 minutes; while the hold
+// lasts, the file's time is renewed so a slow device login is never cut off.
+//
+// Where no refresher holds the lock (auto-review off) nothing is paused: the
+// home's own pi owns the login then, and its /login runs under pi's own lock.
+// Nothing here reads or writes auth.json.
+import { readFileSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { loginLockHeld } from "./lock.js";
+import { LOCK_FILE, PAUSE_FILE, STATUS_FILE } from "./refresher.js";
+
+/** How long a login waits for the refresher to pause (the entrypoint's 60 s). */
+export const PAUSE_WAIT_MS = 60_000;
+/** How often the status file is read while waiting (the refresher looks at the
+ * pause file every 2 s). */
+export const PAUSE_POLL_MS = 500;
+/** How often a held pause file's time is renewed: well inside the
+ * refresher's 15 minutes. */
+export const PAUSE_RENEW_MS = 5 * 60_000;
+
+export type RefresherHold =
+  /** `held`: a refresher was running and is paused now; false: none runs. */
+  { ok: true; held: boolean; release(): void } | { ok: false; why: string };
+
+export interface HoldOptions {
+  flockBin?: string;
+  /** When the lock cannot be probed (no flock here): does a refresher run?
+   * null: unknown. */
+  refresherRuns?: () => Promise<boolean | null>;
+  waitMs?: number;
+  pollMs?: number;
+  renewMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+}
+
+const realSleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
+
+/** Does a refresher hold the login in `agentDir` now? null: unknown. */
+export async function refresherRuns(
+  agentDir: string,
+  o: Pick<HoldOptions, "flockBin" | "refresherRuns"> = {},
+): Promise<boolean | null> {
+  const held = loginLockHeld(join(agentDir, LOCK_FILE), o.flockBin ? { flockBin: o.flockBin } : {});
+  if (held !== null) return held;
+  return o.refresherRuns ? o.refresherRuns() : null;
+}
+
+/** The refresher's status file says it is paused. */
+function pausedNow(statusPath: string): boolean {
+  try {
+    const v = JSON.parse(readFileSync(statusPath, "utf8")) as { paused?: unknown } | null;
+    return v?.paused === true;
+  } catch {
+    return false;
+  }
+}
+
+function removeQuietly(path: string): void {
+  try {
+    unlinkSync(path);
+  } catch {
+    /* lifted already */
+  }
+}
+
+/**
+ * Pause the refresher of the login in `agentDir` for a login, when one runs.
+ * Answers once it is paused (or none runs), with the release; refuses when it
+ * does not pause in time (the pause file is then removed again) or when
+ * whether one runs cannot be told.
+ */
+export async function holdRefresher(agentDir: string, o: HoldOptions = {}): Promise<RefresherHold> {
+  const runs = await refresherRuns(agentDir, o);
+  if (runs === null)
+    return {
+      ok: false,
+      why: "whether auto-review's login refresher runs can't be told on this machine",
+    };
+  if (!runs) return { ok: true, held: false, release: () => {} };
+  const pause = join(agentDir, PAUSE_FILE);
+  const status = join(agentDir, STATUS_FILE);
+  try {
+    writeFileSync(pause, "", { mode: 0o660 });
+  } catch (err) {
+    return {
+      ok: false,
+      why: `can't write ${pause}: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
+  const sleep = o.sleep ?? realSleep;
+  const now = o.now ?? Date.now;
+  const waitMs = o.waitMs ?? PAUSE_WAIT_MS;
+  const until = now() + waitMs;
+  while (!pausedNow(status)) {
+    if (now() >= until) {
+      removeQuietly(pause);
+      return {
+        ok: false,
+        why: `auto-review's login refresher did not pause within ${Math.round(waitMs / 1000)} s (${status})`,
+      };
+    }
+    await sleep(o.pollMs ?? PAUSE_POLL_MS);
+  }
+  const renew = setInterval(() => {
+    try {
+      const t = new Date();
+      utimesSync(pause, t, t);
+    } catch {
+      /* lifted meanwhile */
+    }
+  }, o.renewMs ?? PAUSE_RENEW_MS);
+  renew.unref?.();
+  let released = false;
+  return {
+    ok: true,
+    held: true,
+    release: () => {
+      if (released) return;
+      released = true;
+      clearInterval(renew);
+      removeQuietly(pause);
+    },
+  };
+}

package/src/loginrefresh/lock.ts

@@ -1,5 +1,12 @@
 // The single-instance lock: an exclusive flock on a SEPARATE lock file
-// (`pihome/agent/auth.json.lock`), held for the refresher's whole life.
+// (`pihome/agent/loginrefresh.lock`), held for the refresher's whole life.
+//
+// Why not `auth.json.lock`: that path is pi's. pi guards auth.json with
+// proper-lockfile, whose lock is a DIRECTORY `<file>.lock` (mkdir; a stale one
+// is rmdir'd). A plain file at that path makes every pi CLI fail at startup
+// (`ENOTDIR: not a directory, rmdir '…/auth.json.lock'`), so this lock is named
+// for this process and never `<anything pi locks>.lock`. Earlier builds did use
+// `auth.json.lock`; `removeLegacyLockFile` clears what they left behind.
 //
 // Why not a lock on auth.json: every refresh replaces auth.json by rename
 // (atomic.ts), so a lock on it stays on the old inode, a second refresher could
@@ -12,8 +19,17 @@
 // lock lasts exactly as long as the pipe's write end does: release() closes it,
 // and a refresher that is killed in any way closes it too (the kernel closes its
 // descriptors), so a crash can never leave the lock held by an orphan.
-import { spawn } from "node:child_process";
-import { chmodSync, chownSync, closeSync, mkdirSync, openSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import {
+  chmodSync,
+  chownSync,
+  closeSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  unlinkSync,
+} from "node:fs";
 import { dirname } from "node:path";
 
 /** flock's exit status when the lock is held by someone else (-E). */
@@ -102,3 +118,56 @@ export function acquireLoginLock(
     });
   });
 }
+
+/** What `removeLegacyLockFile` found at the old lock path. */
+export type LegacyLockOutcome = "absent" | "not-a-file" | "removed" | "unremovable";
+
+/**
+ * Remove the plain lock FILE an earlier refresher left at `path` (the old
+ * `auth.json.lock`, which is pi's proper-lockfile path and breaks every pi CLI
+ * while it is a file). Only a regular file is removed: a directory there is
+ * pi's own live lock and a symlink is not ours, so both are left alone. Throws
+ * `LoginLockHeld` when a refresher of an earlier build still holds a flock on
+ * it (the two would otherwise run side by side on different lock files).
+ */
+export function removeLegacyLockFile(
+  path: string,
+  o: { flockBin?: string } = {},
+): LegacyLockOutcome {
+  let isFile: boolean;
+  try {
+    isFile = lstatSync(path).isFile();
+  } catch {
+    return "absent";
+  }
+  if (!isFile) return "not-a-file";
+  const probe = spawnSync(
+    o.flockBin ?? "flock",
+    ["-n", "-E", String(LOCK_HELD_EXIT), path, "true"],
+    { stdio: "ignore" },
+  );
+  if (probe.status === LOCK_HELD_EXIT) throw new LoginLockHeld(path);
+  try {
+    unlinkSync(path);
+    return "removed";
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === "ENOENT" ? "absent" : "unremovable";
+  }
+}
+
+/**
+ * Does a refresher hold the lock at `path` now? true or false; null when it
+ * cannot be told (no flock on this machine, or flock failed). A probe, never a
+ * holder: no lock file is created where there is none (none: nobody holds it).
+ */
+export function loginLockHeld(path: string, o: { flockBin?: string } = {}): boolean | null {
+  if (!existsSync(path)) return false;
+  const probe = spawnSync(
+    o.flockBin ?? "flock",
+    ["-n", "-E", String(LOCK_HELD_EXIT), path, "true"],
+    { stdio: "ignore" },
+  );
+  if (probe.error) return null;
+  if (probe.status === LOCK_HELD_EXIT) return true;
+  return probe.status === 0 ? false : null;
+}

package/src/loginrefresh/refresher.ts

@@ -6,8 +6,18 @@
 // (main.ts) the daemon spawns and supervises by path, so the daemon imports
 // neither pi nor src/engine/.
 //
-//   Lock      an exclusive flock on `auth.json.lock` for its whole life (lock.ts);
-//             a second refresher is refused, before and after any refresh.
+//   Lock      an exclusive flock on `loginrefresh.lock` for its whole life (lock.ts);
+//             a second refresher is refused, before and after any refresh. Never
+//             `auth.json.lock`: that is pi's own proper-lockfile path (a
+//             directory), and a file there breaks every pi CLI. A plain file an
+//             earlier build left there is removed at start.
+//   pi lock   not taken: the refresher does not hold pi's proper-lockfile lock
+//             around its read-refresh-write (proper-lockfile is pi's dependency,
+//             not ours). It needs none while it is healthy: it refreshes far
+//             ahead of pi's own window, so a pi on this file has nothing to
+//             refresh, and a login goes through the entrypoint's pause below. A
+//             raw `pi` + `/login` that bypasses the pause can lose its new
+//             login to a refresh that lands in the same moment.
 //   Refresh   every 10 minutes, any OAuth entry that is inside pi's refresh
 //             window plus a margin longer than the longest worker cap is
 //             refreshed through `deps.refresh` (pi-ai's own, pirefresh.ts) and
@@ -26,11 +36,14 @@
 import { existsSync, readFileSync, statSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { writeFileAtomic } from "./atomic.js";
-import { acquireLoginLock, type LoginLock } from "./lock.js";
+import { acquireLoginLock, removeLegacyLockFile, type LoginLock } from "./lock.js";
 import type { LoginRefreshFileStatus } from "./types.js";
 
 export const AUTH_FILE = "auth.json";
-export const LOCK_FILE = "auth.json.lock";
+/** The single-instance lock. Not `${AUTH_FILE}.lock`: that is pi's (lock.ts). */
+export const LOCK_FILE = "loginrefresh.lock";
+/** Where earlier builds kept the lock: pi's proper-lockfile path, cleared at start. */
+export const LEGACY_LOCK_FILE = "auth.json.lock";
 export const PAUSE_FILE = "auth.json.pause";
 export const STATUS_FILE = "loginrefresh.status.json";
 
@@ -134,10 +147,26 @@ export class LoginRefresher {
    * keep looking.
    */
   static async start(deps: RefresherDeps, o: { autoRun?: boolean } = {}): Promise<LoginRefresher> {
+    const flock = deps.flockBin ? { flockBin: deps.flockBin } : {};
     const lock = await acquireLoginLock(join(deps.agentDir, LOCK_FILE), {
-      ...(deps.flockBin ? { flockBin: deps.flockBin } : {}),
+      ...flock,
       gid: deps.gid,
     });
+    const legacy = join(deps.agentDir, LEGACY_LOCK_FILE);
+    let outcome: ReturnType<typeof removeLegacyLockFile>;
+    try {
+      outcome = removeLegacyLockFile(legacy, flock);
+    } catch (err) {
+      // a refresher of an earlier build still runs on the old lock
+      await lock.release();
+      throw err;
+    }
+    if (outcome === "removed")
+      deps.log(`login refresh: removed the old lock file ${legacy} (it is pi's lock path)`);
+    if (outcome === "unremovable")
+      deps.log(
+        `login refresh: could not remove the old lock file ${legacy}; pi fails until it goes`,
+      );
     const r = new LoginRefresher(deps, lock);
     r.publish();
     await r.tick();

package/src/loginrefresh/supervisor.ts

@@ -21,7 +21,7 @@
 // second refresher would rotate the refresh token under them.
 import { existsSync, readFileSync } from "node:fs";
 import { spawn as nodeSpawn } from "node:child_process";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 import {
   foldChildLines,
   restartDelayMs,
@@ -33,6 +33,28 @@ import {
 import { LOCK_HELD_EXIT } from "./lock.js";
 import type { LoginRefreshFileStatus, LoginRefreshStatus } from "./types.js";
 
+/** Names the login's dir when it is not pi's agent dir. The single box's
+ * shared login (one login per box): the home's switch-on mounts the
+ * host pi home's agent dir at CONTAINER_LOGIN_DIR (docker-compose.yml,
+ * QCR_PI_LOGIN_DIR in the project .env) and the compose file names it here.
+ * Only the login moves: the refresher keeps auth.json there and every worker
+ * borrows from there, while settings, models.json and the lens agents stay in
+ * the container's own agent dir, whose settings the entrypoint provisions and
+ * which must never be the person's own. */
+export const LOGIN_DIR_ENV = "QCR_LOGIN_DIR";
+/** Where docker-compose.yml mounts the host's login. */
+export const CONTAINER_LOGIN_DIR = "/opt/qcr/login";
+
+/** The login's dir: `QCR_LOGIN_DIR` when it is an absolute path, else pi's
+ * agent dir (the login volume, as before). */
+export function loginDirOf(
+  env: Readonly<Record<string, string | undefined>>,
+  agentDir: string,
+): string {
+  const set = (env[LOGIN_DIR_ENV] ?? "").trim();
+  return set !== "" && isAbsolute(set) ? set : agentDir;
+}
+
 /** The restart ladder, ms: a refresher that cannot start (lock held, config) is
  * retried slowly; one that crashed after a good run is retried at once. */
 export const LOGIN_RESTART_LADDER_MS = [2_000, 10_000, 60_000];
@@ -44,7 +66,8 @@ export const LOGIN_STATUS_POLL_MS = 5_000;
 export interface LoginRefreshSupervisorDeps {
   /** The checkout root: where `dist/src/loginrefresh/main.js` lives. */
   repoRoot: string;
-  /** pi's agent dir (the login volume's `agent/`). */
+  /** The login's dir: pi's agent dir (the login volume's `agent/`), or the
+   * single box's shared login (`loginDirOf`). */
   agentDir: string;
   marginMin: number;
   /** The login group, when the daemon knows it. */

package/src/npmverbs.ts

@@ -5,8 +5,13 @@
 //   qcr login [provider]  pi's own /login, in the pinned pi (src/picli.ts),
 //                         into the user's pi agent dir. pi's UI is the flow:
 //                         qcr types /login for the person and steps aside.
+//                         When auto-review's refresher holds that login, it
+//                         is paused first and released after, as the home's
+//                         re-login does (src/loginrefresh/handover.ts).
 //   qcr pi [args]         the pinned pi with the qcr plugin preloaded
-//                         (`-e <the plugin package's dir>`), args passed on.
+//                         (`-e <the plugin package's dir>`) and the app's
+//                         own /selfimprove beside it (`-e` its shim,
+//                         `APP_PI_EXTENSIONS`), args passed on.
 //   qcr update            the package manager that installed qcr (npm, pnpm or
 //                         bun) updates it globally. The release image keeps its
 //                         own route (a release), and a checkout its git.
@@ -15,11 +20,12 @@
 // `npmVerbDeps()` is the real assembly.
 import { spawnSync, type SpawnSyncOptions } from "node:child_process";
 import { existsSync, realpathSync } from "node:fs";
-import { homedir } from "node:os";
 import { delimiter, join } from "node:path";
 import { pluginPackageDir } from "./coreext.js";
 import { detectInstall, type Installer } from "./installkind.js";
+import type { RefresherHold } from "./loginrefresh/handover.js";
 import { readLogins } from "./loginhint.js";
+import { piAgentDir } from "./piagentdir.js";
 import { piCliPath } from "./picli.js";
 
 /** The npm package this CLI is published as. */
@@ -44,12 +50,9 @@ export function updateCommand(installer: Installer, pkg: string = CLI_PACKAGE):
   }
 }
 
-/** pi's agent dir: `$PI_CODING_AGENT_DIR`, else `~/.pi/agent`, as pi reads it. */
-export function piAgentDir(env: Readonly<Record<string, string | undefined>>): string {
-  const set = (env["PI_CODING_AGENT_DIR"] ?? "").trim();
-  if (set !== "") return set;
-  return join((env["HOME"] ?? "").trim() || homedir(), ".pi", "agent");
-}
+// pi's agent dir lives in a leaf of its own, so the home reads the same rule
+// without these verbs.
+export { piAgentDir };
 
 /** The providers pi holds a credential for in `agentDir`, from its auth.json;
  * empty when there is none or it cannot be read. Never a token. */
@@ -86,6 +89,9 @@ export interface NpmVerbDeps {
   err: (line: string) => void;
   /** `node`: the pinned pi's entry is a script, run by this node. */
   execPath: string;
+  /** Pause auto-review's login refresher of `agentDir` for a login, when one
+   * runs (src/loginrefresh/handover.ts `holdRefresher`). */
+  holdLogin: (agentDir: string) => Promise<RefresherHold>;
 }
 
 export function npmVerbDeps(pkgRoot: string): NpmVerbDeps {
@@ -103,10 +109,20 @@ export function npmVerbDeps(pkgRoot: string): NpmVerbDeps {
     out: (l) => console.log(l),
     err: (l) => console.error(l),
     execPath: process.execPath,
+    holdLogin: async (agentDir) => {
+      const { holdRefresher } = await import("./loginrefresh/handover.js");
+      return holdRefresher(agentDir);
+    },
   };
 }
 
-/** `qcr pi [args]`: the pinned pi with the plugin preloaded; pi's exit code. */
+/** The app's own extensions `qcr pi` loads beside the plugin, as paths under
+ * the CLI package's root: the commands that are the app's, not the plugin's
+ * (ADR 0001). */
+export const APP_PI_EXTENSIONS: readonly string[] = ["extensions/cli/selfimprove.ts"];
+
+/** `qcr pi [args]`: the pinned pi with the plugin and the app's own
+ * extensions preloaded; pi's exit code. */
 export function cmdPi(args: readonly string[], deps: NpmVerbDeps): number {
   let pi: string;
   let plugin: string;
@@ -117,7 +133,8 @@ export function cmdPi(args: readonly string[], deps: NpmVerbDeps): number {
     deps.err(`qcr pi: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
-  const r = deps.run(deps.execPath, [pi, "-e", plugin, ...args], {});
+  const app = APP_PI_EXTENSIONS.flatMap((e) => ["-e", join(deps.pkgRoot, e)]);
+  const r = deps.run(deps.execPath, [pi, "-e", plugin, ...app, ...args], {});
   if (r.error) {
     deps.err(`qcr pi: pi could not start: ${r.error.message}`);
     return 1;
@@ -169,6 +186,27 @@ export async function cmdLogin(args: readonly string[], deps: NpmVerbDeps): Prom
     return 1;
   }
   const agentDir = piAgentDir(deps.env);
+  // The refresher first, when one runs: a refresh that read the old grant and
+  // lands after the login would write it back over the new one.
+  const hold = await deps.holdLogin(agentDir);
+  if (!hold.ok) {
+    deps.err(`qcr login: ${hold.why}; nothing was changed.`);
+    return 1;
+  }
+  if (hold.held) deps.out("qcr login: auto-review's login refresher is paused while you log in.");
+  try {
+    return await runLogin(provider, pi, agentDir, deps);
+  } finally {
+    hold.release();
+  }
+}
+
+async function runLogin(
+  provider: string | undefined,
+  pi: string,
+  agentDir: string,
+  deps: NpmVerbDeps,
+): Promise<number> {
   const before = loggedInProviders(agentDir);
   let status: number | null;
   if (onPath("tmux", deps.env["PATH"])) {
@@ -196,7 +234,9 @@ export async function cmdLogin(args: readonly string[], deps: NpmVerbDeps): Prom
     deps.out(
       `qcr login: opening pi — type /login${provider ? ` ${provider}` : ""} and pick your provider, then quit pi (the login lands in ${agentDir}).`,
     );
-    const r = deps.run(deps.execPath, [pi], {});
+    // --no-approve as on the tmux route (src/pilogin.ts): a login needs
+    // nothing from this folder, so pi neither asks to trust it nor trusts it.
+    const r = deps.run(deps.execPath, [pi, "--no-approve"], {});
     if (r.error) {
       deps.err(`qcr login: pi could not start: ${r.error.message}`);
       return 1;

package/src/onboard/choices.ts

@@ -16,8 +16,7 @@
 //      record each key, and the test proves each named step really does — so a
 //      key that only ever gets read cannot survive review.
 //
-// A key private to one step — the go-live decision, the bring-up timestamp, the
-// vm-deploy record, the model prefix, the memory key-file path — stays a local
+// A key private to one step — the go-live decision, the vm-deploy record, the model prefix, the memory key-file path — stays a local
 // constant in that step. This file is about the handoffs.
 //
 // Nothing here imports a step (the steps import this), so there is no cycle and
@@ -65,6 +64,10 @@ export type MemoryChoice = (typeof MEMORY_CHOICE_IDS)[number];
 export const CHOICE_KEYS = {
   /** The operator's uid, captured by preflight: the containers run as it. */
   uid: "qcr_uid",
+  /** When the bring-up step last brought the stack up (an ISO timestamp).
+   * Written by bringup; read by the login-share step, which recreates a
+   * stack brought up before so the daemon gets its login mount. */
+  broughtUpAt: "stack_brought_up_at",
 
   /** `Topology`. Written by the topology step; read by everything that has to
    * know where the stack runs (transport selection, the VM-only steps). */
@@ -164,6 +167,7 @@ export type ChoiceKey = (typeof CHOICE_KEYS)[ChoiceName];
  */
 export const CHOICE_WRITERS: Record<ChoiceName, readonly string[]> = {
   uid: ["preflight"],
+  broughtUpAt: ["bringup"],
   githubAuth: ["github_account"],
   accountLogin: ["github_account"],
   accountRepo: ["github_account"],
@@ -210,7 +214,6 @@ export const CHOICE_WRITERS: Record<ChoiceName, readonly string[]> = {
 export const PRIVATE_CHOICE_KEYS: Readonly<Record<string, string>> = {
   llm_model_prefix: "llm_auth",
   openviking_keys_file: "memory",
-  stack_brought_up_at: "bringup",
   go_live_decision: "go_live",
 };