@rynx-ai/daemon 0.1.11-beta.2 → 0.1.11-beta.3

package/dist/daemon-server.js

@@ -11,7 +11,7 @@ import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import WebSocket from "ws";
-import { loadConfig, resolveExecutionSnapshot, rynxHome, sessionWorkspaceSnapshotSchema, } from "@rynx-ai/core";
+import { CloseableAdmissionGate, loadConfig, resolveExecutionSnapshot, rynxHome, sessionWorkspaceSnapshotSchema, } from "@rynx-ai/core";
 import { LOCAL_MANAGEMENT_PROTOCOL, } from "@rynx-ai/protocol/control";
 import { REMOTE_RUNTIME_CORE_PROTOCOL } from "@rynx-ai/protocol/remote-runtime";
 import { RUNTIME_BROWSER_INSPECT_MAX_MESSAGE_BYTES, RUNTIME_BROWSER_INSPECT_SEMANTIC_CAPABILITY, } from "@rynx-ai/protocol/runtime-browser-inspect";
@@ -22,8 +22,10 @@ import { APP_BROWSER_HOST_BOOTSTRAP_TYPE, AppBrowserHostSupervisor, parseAppBrow
 import { buildControlDeps } from "./control-deps.js";
 import { createBrowserArtifactManagementService } from "./browser-artifact-management.js";
 import { createDaemonBuildStatus } from "./daemon-build-status.js";
+import { MaintenanceLeaseStore } from "./maintenance-lease.js";
 import { BrowserRunnerSessionContextProvider } from "./browser-runner-session-context.js";
 import { removeLegacyPluginSkillSnapshot, snapshotEnabledPluginSkillSources, } from "./plugin-skill-context.js";
+import { installedDaemonVersion } from "./entry-path.js";
 import { isChromeForTestingHostSupported } from "./chrome-for-testing-store.js";
 import { ChromeInspectionManager, } from "./chrome-inspection-manager.js";
 import { createHeadlessBrowserHost } from "./headless-browser-host.js";
@@ -76,7 +78,10 @@ async function resolveSessionExecutionSnapshot(input) {
         pluginSkills: snapshotEnabledPluginSkillSources(),
     };
 }
-async function resolveSessionWorkspace(projects, projectId, managedCwd) {
+async function resolveSessionWorkspace(projects, projectId, managedCwd, workspace) {
+    if (workspace) {
+        return sessionWorkspaceSnapshotSchema.parse(workspace);
+    }
     if (projectId) {
         const project = await projects.get(projectId);
         if (!project) {
@@ -131,7 +136,8 @@ function toMarketplaceItem(record) {
     };
 }
 export function daemonActivityBlocksShutdown(activity) {
-    return activity.runningTurns > 0 || activity.pendingInteractions > 0;
+    return activity.runningTurns > 0
+        || activity.pendingInteractions > 0;
 }
 function defaultWarn(message) {
     console.warn(JSON.stringify({ level: "warn", type: "channel-registry", msg: message }));
@@ -250,12 +256,24 @@ async function removeControlEndpointForCurrentProcess() {
         // Best effort only; stale endpoint files are ignored by the client fallback.
     }
 }
-export async function startRynxDaemonServer({ config, warn = defaultWarn, writeEndpoint = writeControlEndpoint, acquireOwner = acquireDaemonOwner, preparePlugins, loadDirectConfig = loadDirectRuntimeConfig, startDirectServer = startDirectRuntimeServer, createChromeInspectionManager = (options) => ChromeInspectionManager.create(options), createBrowserHostSupervisor = (options) => new AppBrowserHostSupervisor(options), } = {}) {
+export async function startRynxDaemonServer({ config, warn = defaultWarn, onShutdownComplete, writeEndpoint = writeControlEndpoint, acquireOwner = acquireDaemonOwner, preparePlugins, loadDirectConfig = loadDirectRuntimeConfig, startDirectServer = startDirectRuntimeServer, createChromeInspectionManager = (options) => ChromeInspectionManager.create(options), createBrowserHostSupervisor = (options) => new AppBrowserHostSupervisor(options), } = {}) {
     const owner = await acquireOwner();
     let ownerManagedByServer = false;
     try {
         await preparePlugins?.();
         const appConfig = config ?? loadConfig();
+        const admissionGate = new CloseableAdmissionGate();
+        let shutdownAccepted = false;
+        const maintenanceLease = new MaintenanceLeaseStore({
+            // Expiry restores the gate primitive for a process that outlives its
+            // upgrader. The independent accepted-shutdown fence below still prevents
+            // new work after an irreversible server shutdown has begun.
+            onExpired: () => admissionGate.reopen(),
+        });
+        const admissionOpen = () => !shutdownAccepted && !maintenanceLease.isActive();
+        const reserveAdmission = () => !admissionOpen()
+            ? undefined
+            : admissionGate.tryReserve();
         const appBrowserHostLaunch = parseAppBrowserHostLaunchConfig();
         const directHostingSupported = isDaemonDirectRuntimeHostingSupported();
         const runtimeBrowserSupported = appBrowserHostLaunch !== undefined || isChromeForTestingHostSupported();
@@ -335,6 +353,9 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
         }
         const pluginSupervisor = new PluginSupervisor(listPlugins(), {
             daemonInstanceId,
+            productVersion: controlEndpointDistributionMetadata().productVersion,
+            cliVersion: boundedEnvironmentMetadata(process.env.RYNX_CLI_VERSION, 128)
+                ?? installedDaemonVersion(),
             log: (entry) => {
                 const output = entry.level === "error"
                     ? console.error
@@ -379,7 +400,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
                 },
                 sessionLaunch: {
                     resolve: async (selection) => {
-                        const workspace = await resolveSessionWorkspace(runtimeProjects, selection.projectId, selection.managedCwd);
+                        const workspace = await resolveSessionWorkspace(runtimeProjects, selection.projectId, selection.managedCwd, selection.workspace);
                         return {
                             workspace,
                             execution: await resolveSessionExecutionSnapshot({
@@ -387,7 +408,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
                                 ...(selection.agent ? { agentName: selection.agent } : {}),
                                 ...(selection.config ? { spec: selection.config } : {}),
                                 ...((selection.provider || (!selection.agent && !selection.config))
-                                    ? { provider: selection.provider ?? appConfig.AGENT_RUNTIME }
+                                    ? { provider: selection.provider ?? appConfig.DEFAULT_RUNTIME }
                                     : {}),
                                 ...(selection.model ? { model: selection.model } : {}),
                                 ...(selection.reasoningEffort
@@ -399,6 +420,8 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
                     },
                 },
                 sessionFork: (input) => machineSessions.fork(input),
+                admissionOpen,
+                admissionReserve: reserveAdmission,
             }),
             startPluginRuntimes: pluginSupervisor.startPluginRuntimes.bind(pluginSupervisor),
             statusSnapshot: pluginSupervisor.statusSnapshot.bind(pluginSupervisor),
@@ -421,6 +444,8 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
             config: appConfig,
             sessionLog,
             sessionContextProvider: browserRunnerSessionContexts,
+            admissionOpen,
+            admissionReserve: reserveAdmission,
             onMirrorError: (error, sessionId) => warn(`Session mirror failed for ${sessionId}: ${error instanceof Error ? error.message : String(error)}`),
         });
         const sessionBrowserHost = appBrowserHostSupervisor
@@ -432,6 +457,8 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
                 exists: async (sessionId) => Boolean(sessionRegistry.get(sessionId) ??
                     await sessionRuntimeServices.sessionStore.get(sessionId)),
             },
+        }, {
+            admissionReserve: reserveAdmission,
         });
         const sessionEmulators = control.emulator
             ? new SessionEmulatorService({
@@ -543,10 +570,14 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
                 resolve: (projectId) => resolveSessionWorkspace(runtimeProjects, projectId),
                 discardUnbound: discardSessionFallbackWorkspace,
             },
+        }, {
+            admissionOpen,
+            admissionReserve: reserveAdmission,
         });
         const directAuthenticator = new DaemonDirectRuntimeAuthenticator(installationIdentity, remoteRuntime, remoteRuntimeAccess);
         const sessionTerminals = createRunnerSessionTerminalHost({
             runnerManager: sessionRuntimeServices.runnerManager,
+            admissionReserve: reserveAdmission,
             resolveLiveSession: async (sessionId) => {
                 const registered = sessionRegistry.get(sessionId);
                 if (!registered ||
@@ -556,8 +587,95 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
                 return { cwd: registered.workspace.cwd };
             },
         });
-        let shutdownAccepted = false;
         let requestServerShutdown;
+        let shutdownAttempt;
+        let shutdownAttemptLeaseToken;
+        const shutdownIfIdle = (maintenanceLeaseToken) => {
+            if (maintenanceLease.isActive()) {
+                if (!maintenanceLeaseToken || !maintenanceLease.isHeldBy(maintenanceLeaseToken)) {
+                    return Promise.reject(new Error("a different maintenance lease is already active"));
+                }
+                // The previous daemon may have persisted the lease and exited after
+                // its 202 response was lost. A replacement process holding the same
+                // token must perform its own close/drain/shutdown; returning accepted
+                // without scheduling this PID would strand the updater waiting for a
+                // process that can never exit.
+            }
+            if (shutdownAccepted) {
+                if (maintenanceLeaseToken) {
+                    maintenanceLease.acquire(maintenanceLeaseToken);
+                    return Promise.resolve({
+                        outcome: "accepted",
+                        maintenanceLease: "active",
+                    });
+                }
+                return Promise.resolve({ outcome: "accepted" });
+            }
+            if (shutdownAttempt) {
+                if (maintenanceLeaseToken === shutdownAttemptLeaseToken) {
+                    return shutdownAttempt;
+                }
+                return Promise.reject(new Error("another idle shutdown check is already in progress"));
+            }
+            shutdownAttemptLeaseToken = maintenanceLeaseToken;
+            const attempt = (async () => {
+                await admissionGate.closeAndDrain();
+                const runtimeActivity = sessionRuntimeServices.sessionRuntimeIndex.activitySnapshot();
+                const activity = {
+                    ...runtimeActivity,
+                    // A terminal submission keeps its own admission reservation until the
+                    // first response or native rotation is visible. Failed process-tree
+                    // cleanup releases the reservation but remains pinned here, so an
+                    // idle check returns busy instead of hanging or killing hidden work.
+                    runningTurns: runtimeActivity.runningTurns
+                        + sessionRuntimeServices.runnerManager.pendingTerminalInputCount(),
+                    activeTerminals: sessionTerminals.activeTerminalCount(),
+                    activeBrowsers: sessionBrowsers.activeBrowserCount(),
+                };
+                if (daemonActivityBlocksShutdown(activity)) {
+                    admissionGate.reopen();
+                    return { outcome: "busy", activity };
+                }
+                const shutdown = requestServerShutdown;
+                if (!shutdown) {
+                    admissionGate.reopen();
+                    throw new Error("idle daemon shutdown was requested before server lifecycle was ready");
+                }
+                const acquiredLease = maintenanceLeaseToken
+                    ? maintenanceLease.acquire(maintenanceLeaseToken)
+                    : false;
+                shutdownAccepted = true;
+                try {
+                    void shutdown().catch((error) => {
+                        shutdownAccepted = false;
+                        if (acquiredLease && maintenanceLeaseToken) {
+                            maintenanceLease.release(maintenanceLeaseToken);
+                        }
+                        admissionGate.reopen();
+                        warn(`idle daemon shutdown failed: ${error instanceof Error ? error.message : String(error)}`);
+                    });
+                }
+                catch (error) {
+                    shutdownAccepted = false;
+                    if (acquiredLease && maintenanceLeaseToken) {
+                        maintenanceLease.release(maintenanceLeaseToken);
+                    }
+                    admissionGate.reopen();
+                    throw error;
+                }
+                return maintenanceLeaseToken
+                    ? { outcome: "accepted", maintenanceLease: "active" }
+                    : { outcome: "accepted" };
+            })();
+            shutdownAttempt = attempt;
+            void attempt.finally(() => {
+                if (shutdownAttempt === attempt) {
+                    shutdownAttempt = undefined;
+                    shutdownAttemptLeaseToken = undefined;
+                }
+            }).catch(() => undefined);
+            return attempt;
+        };
         const daemonManagement = {
             managementToken,
             identity: () => ({
@@ -566,6 +684,14 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
                 publicKey: installationIdentity.publicKey,
             }),
             buildStatus: daemonBuildStatus,
+            releaseMaintenanceLease: (token) => ({
+                outcome: (() => {
+                    const outcome = maintenanceLease.release(token);
+                    if (outcome === "released")
+                        admissionGate.reopen();
+                    return outcome;
+                })(),
+            }),
             pluginManagement: {
                 listPlugins: () => pluginManagement.list(),
                 setPluginEnabled: (pluginId, enabled) => pluginManagement.setEnabled(pluginId, enabled),
@@ -591,30 +717,7 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
             },
             browserArtifacts: browserArtifactManagement,
             maintenance: maintenanceManagement,
-            shutdownIfIdle: () => {
-                if (shutdownAccepted)
-                    return { outcome: "accepted" };
-                const activity = {
-                    ...sessionRuntimeServices.sessionRuntimeIndex.activitySnapshot(),
-                    activeTerminals: sessionTerminals.activeTerminalCount(),
-                    activeBrowsers: sessionBrowsers.activeBrowserCount(),
-                };
-                if (daemonActivityBlocksShutdown(activity)) {
-                    return { outcome: "busy", activity };
-                }
-                shutdownAccepted = true;
-                const shutdown = requestServerShutdown;
-                if (!shutdown) {
-                    shutdownAccepted = false;
-                    throw new Error("idle daemon shutdown was requested before server lifecycle was ready");
-                }
-                // Start admission fences in this event-loop turn, before another
-                // request or Direct dispatch can be accepted.
-                void shutdown().catch((error) => {
-                    warn(`idle daemon shutdown failed: ${error instanceof Error ? error.message : String(error)}`);
-                });
-                return { outcome: "accepted" };
-            },
+            shutdownIfIdle,
             invokePluginCli,
         };
         const remoteRuntimeDispatcher = new RemoteRuntimeDispatcher({
@@ -853,8 +956,10 @@ export async function startRynxDaemonServer({ config, warn = defaultWarn, writeE
                     // A failed resource shutdown may leave plugin transports alive. Keep
                     // the process-scoped owner lease in that fail-closed state; it will be
                     // released by the OS when the process exits.
-                    if (shutdownComplete)
+                    if (shutdownComplete) {
                         await owner.release();
+                        onShutdownComplete?.();
+                    }
                 }
             })();
             return shutdownPromise;

package/dist/db.js

@@ -195,6 +195,7 @@ function migrate(conn) {
       scope_id       TEXT NOT NULL,
       operation_id   TEXT NOT NULL,
       request_hash   TEXT NOT NULL,
+      raw_request_hash TEXT,
       session_id     TEXT NOT NULL,
       state          TEXT NOT NULL DEFAULT 'active' CHECK(state IN ('active', 'deleted')),
       created_at     TEXT NOT NULL,
@@ -316,6 +317,7 @@ function migrate(conn) {
   `);
     addColumnIfMissing(conn, "plugin_marketplaces", "built_in", "INTEGER NOT NULL DEFAULT 0");
     addColumnIfMissing(conn, "sessions", "forked_from_session_id", "TEXT");
+    addColumnIfMissing(conn, "plugin_session_launch_operations", "raw_request_hash", "TEXT");
 }
 /**
  * Breaking Session cutover: the previous rows contain mutable Agent/Provider

package/dist/entry-path.d.ts

@@ -0,0 +1,3 @@
+/** Resolve the executable daemon module without importing its side-effectful entry. */
+export declare function resolveDaemonEntry(moduleUrl?: string): string;
+export declare function installedDaemonVersion(): string;

package/dist/entry-path.js

@@ -0,0 +1,12 @@
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const require = createRequire(import.meta.url);
+/** Resolve the executable daemon module without importing its side-effectful entry. */
+export function resolveDaemonEntry(moduleUrl = import.meta.url) {
+    return join(dirname(fileURLToPath(moduleUrl)), "index-daemon.js");
+}
+export function installedDaemonVersion() {
+    const manifest = require("../package.json");
+    return typeof manifest.version === "string" ? manifest.version : "0.0.0";
+}

package/dist/index-daemon.js

@@ -1,91 +1,7 @@
 #!/usr/bin/env node
-/**
- * The resident daemon entry — this is what pm2 keeps alive.
- *
- * Boot order matters: install the EPIPE guard first (we're a pm2 child).
- * The composition root reads static plugin manifests and supervises one runtime
- * process for each enabled runtime plugin. Installed plugin code is loaded only
- * in child processes; plugin-owned channel instances stay inside that process.
- */
-import { startRynxDaemonServer } from "./daemon-server.js";
-import { ensureBundledOfficialPlugins } from "./bundled-plugins.js";
-import { installStdioEpipeGuard } from "./stdio-epipe-guard.js";
-installStdioEpipeGuard();
-async function main() {
-    const followsApp = process.env.RYNX_DAEMON_LIFECYCLE === "follow-app";
-    let parentDisconnected = followsApp && !process.connected;
-    const recordParentDisconnect = () => {
-        parentDisconnected = true;
-    };
-    if (followsApp)
-        process.once("disconnect", recordParentDisconnect);
-    const preparePlugins = async () => {
-        try {
-            const bundled = await ensureBundledOfficialPlugins({ reclaimHostLeases: true });
-            if (bundled.status === "ready") {
-                console.log(JSON.stringify({
-                    level: "info",
-                    type: "bundled_plugins_ready",
-                    installed: bundled.installed,
-                    updated: bundled.updated,
-                }));
-            }
-        }
-        catch (error) {
-            console.error(JSON.stringify({
-                level: "error",
-                type: "bundled_plugins_failed",
-                error: error instanceof Error ? error.message : String(error),
-            }));
-        }
-    };
-    let server;
-    try {
-        server = await startRynxDaemonServer({ preparePlugins });
-    }
-    catch (error) {
-        process.off("disconnect", recordParentDisconnect);
-        throw error;
-    }
-    let shutdownPromise;
-    const shutdown = (signal) => {
-        if (shutdownPromise)
-            return shutdownPromise;
-        process.off("SIGINT", onSigint);
-        process.off("SIGTERM", onSigterm);
-        process.off("disconnect", onDisconnect);
-        shutdownPromise = (async () => {
-            console.log(JSON.stringify({ level: "info", type: "shutdown", signal }));
-            await server.shutdown();
-        })();
-        shutdownPromise.catch((error) => {
-            process.exitCode = 1;
-            console.error(`Shutdown failed: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
-        });
-        return shutdownPromise;
-    };
-    const onSigint = () => {
-        void shutdown("SIGINT");
-    };
-    const onSigterm = () => {
-        void shutdown("SIGTERM");
-    };
-    const onDisconnect = () => {
-        if (process.env.RYNX_DAEMON_LIFECYCLE === "follow-app") {
-            void shutdown("APP_DISCONNECT");
-        }
-    };
-    process.once("SIGINT", onSigint);
-    process.once("SIGTERM", onSigterm);
-    if (followsApp) {
-        process.once("disconnect", onDisconnect);
-        process.off("disconnect", recordParentDisconnect);
-        if (parentDisconnected || !process.connected) {
-            void shutdown("APP_DISCONNECT");
-        }
-    }
-}
-main().catch((err) => {
+/** Direct daemon executable retained only for standalone PM2 supervision. */
+import { runDaemonProcess } from "./process.js";
+runDaemonProcess().catch((err) => {
     console.error(`Fatal error: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
     process.exit(1);
 });

package/dist/lifecycle.d.ts

@@ -0,0 +1,12 @@
+export { formatControlUrl, isPm2DaemonOnline, statusDaemon, stopDaemon, streamLogs, } from "./pm2.js";
+export { resolveDaemonEntry } from "./entry-path.js";
+export interface StandaloneDaemonLaunchContext {
+    builtinSkillsDir: string;
+    cliVersion: string;
+    productVersion: string;
+}
+export declare function startDaemon(options: {
+    force: boolean;
+    quiet?: boolean;
+    context: StandaloneDaemonLaunchContext;
+}): number;

package/dist/lifecycle.js

@@ -0,0 +1,16 @@
+import { startDaemon as startPm2Daemon, } from "./pm2.js";
+export { formatControlUrl, isPm2DaemonOnline, statusDaemon, stopDaemon, streamLogs, } from "./pm2.js";
+export { resolveDaemonEntry } from "./entry-path.js";
+export function startDaemon(options) {
+    return startPm2Daemon({
+        force: options.force,
+        quiet: options.quiet,
+        launchEnvironment: {
+            RYNX_BUILTIN_SKILLS_DIR: options.context.builtinSkillsDir,
+            RYNX_CLI_VERSION: options.context.cliVersion,
+            RYNX_DISTRIBUTION: "standalone",
+            RYNX_PRODUCT_VERSION: options.context.productVersion,
+            RYNX_DAEMON_LIFECYCLE: "standalone",
+        },
+    });
+}

package/dist/maintenance-lease.d.ts

@@ -0,0 +1,39 @@
+export type MaintenanceLeaseReleaseOutcome = "released" | "not_active" | "denied";
+export interface MaintenanceLeaseStoreOptions {
+    filePath?: string;
+    now?: () => number;
+    ttlMs?: number;
+    /** Test seam; production fsyncs the lease directory after rename/remove. */
+    syncDirectory?: (directory: string) => void;
+    /** Process-local recovery hook, invoked once when a live lease is observed expired. */
+    onExpired?: () => void;
+}
+export declare function maintenanceLeaseFile(env?: NodeJS.ProcessEnv): string;
+/**
+ * Cross-process admission fence used only during daemon replacement.
+ *
+ * The raw bearer token is never persisted. The bounded expiry means a crashed
+ * upgrader cannot leave the daemon permanently unavailable, while atomic rename
+ * ensures a replacement daemon sees either the complete lease or no lease.
+ */
+export declare class MaintenanceLeaseStore {
+    private readonly filePath;
+    private readonly now;
+    private readonly ttlMs;
+    private readonly syncDirectory;
+    private readonly onExpired;
+    private lease;
+    private expiryTimer;
+    constructor(options?: MaintenanceLeaseStoreOptions);
+    isActive(): boolean;
+    isHeldBy(token: string): boolean;
+    acquire(token: string): boolean;
+    release(token: string): MaintenanceLeaseReleaseOutcome;
+    private readPersistedLease;
+    private writePersistedLease;
+    private clear;
+    private clearFile;
+    private expire;
+    private scheduleExpiry;
+    private cancelExpiry;
+}