@ran-sh/dsh-crew 1.5.0 → 1.5.1

package/src/install/npx-lifecycle.mjs

@@ -42,6 +42,7 @@ import { homedir } from 'node:os';
 import * as realInstaller from './install.mjs';
 import { samePayloadContent, capturePayloadContent } from './payload-content.mjs';
 import { crewDshHome, crewProfileDir } from './install.mjs';
+import { liveReleaseClaims } from '../release-in-use.mjs';
 import { ensureCrewDshRuntime, ensureCrewPluginRegistration, removeCrewPluginRegistration, migrateCrewDshRuntime, installDshInto, restoreRetainedRuntime, crewDshRuntimeRoot, payloadDshVersion, TARGET_DSH_VERSION } from '../dsh-cli-runtime.mjs';
 import {
   ensureOfficialWebIntegration,
@@ -1085,9 +1086,15 @@ function gcOldReleases({ home, keep = KEEP_RELEASES, protect = null }) {
   const releasesDir = crewReleasesDir({ home });
   if (!existsSync(releasesDir)) return;
   const removed = [];
+  // A running Hub keeps executing the release it started from and re-reads
+  // several modules from disk on every request, so removing that release breaks
+  // those routes with no recovery but a restart. Protect what live processes
+  // claim, not just what the pointer names.
+  const claimed = liveReleaseClaims({ home }).map((dir) => resolve(dir));
+  const live = new Set([...(protect ? [resolve(protect)] : []), ...claimed]);
   const dirs = readdirSync(releasesDir)
     .map((name) => join(releasesDir, name))
-    .filter((dir) => (!pointer || dir !== pointer.path) && (!protect || dir !== protect));
+    .filter((dir) => (!pointer || dir !== pointer.path) && !live.has(resolve(dir)));
   const incomplete = [];
   const complete = [];
   for (const dir of dirs) {
@@ -3434,7 +3441,14 @@ export async function runNpxCli({
     else if (command === 'releases') result = await actions.releases({ args, log });
     else if (command === 'rollback') result = await actions.rollback({ version: args?.[0], args, log });
     else result = await actions[command]({ log });
-    return result?.ok === false ? 1 : 0;
+    // Surface why the command failed. Actions return a structured failure rather
+    // than throwing, so without this the CLI exits 1 having printed nothing —
+    // `dsh-crew rollback` with no version was a silent failure.
+    if (result?.ok === false) {
+      error(`dsh-crew ${command} failed: ${result.error ?? result.code ?? 'unknown error'}`);
+      return 1;
+    }
+    return 0;
   } catch (err) {
     error(`dsh-crew ${command} failed: ${err?.message ?? err}`);
     return 1;

package/src/release-in-use.mjs

@@ -0,0 +1,110 @@
+// Release liveness claims.
+//
+// A running Hub keeps executing the release it was started from, but it loads
+// several modules lazily with a cache-busting query (`import('...?t=' + Date.now())`)
+// so that a config edit is visible without a restart. Those lazy reads go to
+// disk every time, which means deleting the release under a live process breaks
+// it permanently: the routes that were already loaded keep working while
+// everything behind a lazy import answers 500.
+//
+// Release retention keeps only the newest few, and it protected the *current*
+// pointer — not the one a running process is actually executing. So a machine
+// could be left with a Hub whose config routes were dead, and an update would
+// not repair it because the damage is to the process, not the files.
+//
+// A process therefore records that it is using a release. Retention skips any
+// release with a live claim. Liveness is decided by the pid, not by the file, so
+// a process that dies without cleaning up cannot pin a release forever.
+
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const IN_USE_DIRNAME = 'in-use';
+
+export function releaseInUseDir({ home = homedir() } = {}) {
+  return join(home, '.config', 'dsh-crew', 'app', IN_USE_DIRNAME);
+}
+
+/** The release root that owns `moduleUrl`, or null when it is outside one. */
+export function releaseRootFor(moduleUrl) {
+  let path;
+  try { path = fileURLToPath(moduleUrl); } catch { return null; }
+  // <release>/src/<...> or <release>/src/hub/entry.mjs → walk up to the release root.
+  let dir = dirname(path);
+  for (let depth = 0; depth < 6; depth++) {
+    if (existsSync(join(dir, 'package.json'))) {
+      try {
+        const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+        if (pkg?.name === '@ran-sh/dsh-crew') return resolve(dir);
+      } catch { /* not the payload manifest; keep walking */ }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+
+function isAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error?.code === 'EPERM'; }
+}
+
+/**
+ * Record that this process is running `releasePath`. Best effort: failing to
+ * claim must never stop the Hub from starting, because the cost of a missed
+ * claim is a possible retention of one extra release.
+ */
+export function claimReleaseInUse({ moduleUrl = import.meta.url, releasePath, home = homedir(), pid = process.pid, now = Date.now() } = {}) {
+  try {
+    const target = releasePath ?? releaseRootFor(moduleUrl);
+    if (!target) return null;
+    const dir = releaseInUseDir({ home });
+    mkdirSync(dir, { recursive: true });
+    const file = join(dir, `${pid}.json`);
+    writeFileSync(file, JSON.stringify({ pid, release: resolve(target), claimed_at: now }) + '\n');
+    return file;
+  } catch { return null; }
+}
+
+export function releaseClaimFile({ home = homedir(), pid = process.pid } = {}) {
+  return join(releaseInUseDir({ home }), `${pid}.json`);
+}
+
+export function releaseClaimInUse({ home = homedir(), pid = process.pid } = {}) {
+  const file = releaseClaimFile({ home, pid });
+  return existsSync(file) || false;
+}
+
+export function clearReleaseClaim({ home = homedir(), pid = process.pid } = {}) {
+  try { rmSync(releaseClaimFile({ home, pid }), { force: true }); return true; } catch { return false; }
+}
+
+/**
+ * Releases currently held by a live process. Dead claims are removed as they are
+ * encountered, so the directory cannot accumulate stale files.
+ */
+export function liveReleaseClaims({ home = homedir(), alive = isAlive } = {}) {
+  const dir = releaseInUseDir({ home });
+  let names;
+  // A state directory that is unreadable — or replaced by a file — must read as
+  // "no claims" rather than throwing: this runs inside install, and failing it
+  // would block an update over a problem that only affects pruning.
+  try { names = readdirSync(dir); } catch { return []; }
+  const live = [];
+  for (const name of names) {
+    if (!name.endsWith('.json')) continue;
+    const file = join(dir, name);
+    let record;
+    try { record = JSON.parse(readFileSync(file, 'utf8')); } catch { record = null; }
+    if (record && Number.isInteger(record.pid) && typeof record.release === 'string' && alive(record.pid)) {
+      live.push(resolve(record.release));
+      continue;
+    }
+    try { rmSync(file, { force: true }); } catch { /* best effort */ }
+  }
+  return [...new Set(live)];
+}

package/src/runtime-identity.mjs

@@ -36,7 +36,7 @@ export {
 // included in the identity contract.
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '1.5.0';
+export const RUNTIME_VERSION = '1.5.1';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([