@rynx-ai/daemon 0.1.9 → 0.1.10-beta.2

package/dist/plugin-package.js

@@ -7,13 +7,22 @@
  */
 import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
-import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { constants as fsConstants, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { lstat as lstatAsync, open as openFile, opendir, readlink as readlinkAsync, realpath as realpathAsync, } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { create as createTar } from "tar";
 import { parsePluginManifest, } from "@rynx-ai/plugin-sdk";
 const MAX_METADATA_BYTES = 1024 * 1024;
+const PACKAGE_HASH_STREAM_BYTES = 256 * 1024;
+const DEFAULT_COMMAND_ABORT_GRACE_MS = 2_000;
+export const DEFAULT_PLUGIN_PACKAGE_INSPECTION_LIMITS = Object.freeze({
+    maxFileBytes: 128 * 1024 * 1024,
+    maxTotalBytes: 512 * 1024 * 1024,
+    maxEntries: 50_000,
+    maxDepth: 64,
+});
 /** Classify provenance without fetching or executing anything. */
 export function detectPluginSource(spec) {
     if (looksLocal(spec))
@@ -85,7 +94,7 @@ async function materializeLocalDirectory(sourceDir, destination, onProgress, sig
         });
         // The rewritten file: specs are a staging-only resolution aid. Keep the
         // installed plugin's own package metadata identical to its source.
-        writeFileSync(join(destination, "package.json"), readFileSync(join(sourceReal, "package.json")));
+        copyBoundedMetadataFile(join(sourceReal, "package.json"), join(destination, "package.json"), "package.json");
         return;
     }
     const localArchiveRoot = join(resolve(destination, ".."), "local-package");
@@ -126,8 +135,8 @@ async function cloneGitPackage(spec, destination, onProgress, signal) {
     const { url, ref } = parseGitSpec(spec);
     rmSync(destination, { recursive: true, force: true });
     const args = ["clone", "--no-checkout", "--filter=blob:none", "--", url, destination];
-    await runCommand("git", args, onProgress, signal);
-    await runCommand("git", ["-C", destination, "checkout", "--detach", ref ?? "HEAD"], onProgress, signal);
+    await runPluginPackageCommand("git", args, onProgress, { signal });
+    await runPluginPackageCommand("git", ["-C", destination, "checkout", "--detach", ref ?? "HEAD"], onProgress, { signal });
 }
 export function parseGitSpec(spec) {
     let value = spec.trim();
@@ -194,9 +203,11 @@ async function materializeWithNpm({ spec, prefix, destination, onProgress, signa
     copyPackageTree(packageReal, destination, false);
 }
 /** Parse and validate static metadata, validate all executable entry paths, and hash the tree. */
-export function inspectPluginPackage(packageDir, options = {}) {
+export async function inspectPluginPackage(packageDir, options = {}) {
+    throwIfInspectionAborted(options.signal);
     const packageRoot = realpathSync(packageDir);
-    validatePackageSymlinkClosure(packageRoot);
+    const integrity = await hashPackageTree(packageRoot, normalizedInspectionLimits(options.limits), options.signal);
+    throwIfInspectionAborted(options.signal);
     const packageJsonPath = requireContainedFile(packageRoot, join(packageRoot, "package.json"), "package.json", "file");
     const packageJson = readJsonObject(packageJsonPath, "package.json");
     if (!isRecord(packageJson.rynx) || typeof packageJson.rynx.manifest !== "string") {
@@ -215,39 +226,9 @@ export function inspectPluginPackage(packageDir, options = {}) {
     return {
         manifest,
         ...(version ? { version } : {}),
-        integrity: hashPackageTree(packageRoot),
+        integrity,
     };
 }
-/**
- * An installed package must be an immutable closure. Internal npm `.bin`
- * links are valid, but a link to mutable content outside the promoted package
- * would make the recorded integrity depend only on the link text.
- */
-function validatePackageSymlinkClosure(root) {
-    visit(root, "");
-    function visit(candidate, rel) {
-        const stat = lstatSync(candidate);
-        const normalized = rel.split(sep).join("/");
-        if (stat.isSymbolicLink()) {
-            let target;
-            try {
-                target = realpathSync(candidate);
-            }
-            catch {
-                throw new Error(`plugin package contains a broken symlink: ${normalized}`);
-            }
-            if (!isWithin(root, target)) {
-                throw new Error(`plugin package symlink resolves outside the package: ${normalized}`);
-            }
-            return;
-        }
-        if (!stat.isDirectory())
-            return;
-        for (const name of readdirSync(candidate)) {
-            visit(join(candidate, name), join(rel, name));
-        }
-    }
-}
 /** Run package/dependency build scripts only after explicit user approval. */
 export async function rebuildPluginPackage(packageDir, onProgress, signal) {
     await runNpm([
@@ -474,58 +455,241 @@ function readJsonObject(path, label) {
         throw new Error(`invalid ${label}: ${messageOf(error)}`);
     }
 }
-function hashPackageTree(root) {
+function copyBoundedMetadataFile(source, destination, label) {
+    try {
+        const stat = statSync(source);
+        if (!stat.isFile())
+            throw new Error("not a file");
+        if (stat.size > MAX_METADATA_BYTES)
+            throw new Error("metadata is too large");
+        copyFileSync(source, destination);
+    }
+    catch (error) {
+        throw new Error(`cannot copy ${label}: ${messageOf(error)}`);
+    }
+}
+async function hashPackageTree(root, limits, signal) {
     const hash = createHash("sha256");
     hash.update("rynx-plugin-package-v1\0");
-    visit(root, "");
+    let entryCount = 0;
+    let totalBytes = 0;
+    await visit(root, "", 0);
     return `sha256-${hash.digest("base64")}`;
-    function visit(path, rel) {
-        const stat = lstatSync(path);
+    async function visit(path, rel, depth) {
+        throwIfInspectionAborted(signal);
+        entryCount += 1;
+        if (entryCount > limits.maxEntries) {
+            throw new Error(`plugin package exceeds ${limits.maxEntries} entries`);
+        }
+        if (depth > limits.maxDepth) {
+            throw new Error(`plugin package exceeds maximum depth ${limits.maxDepth}`);
+        }
+        const stat = await lstatAsync(path);
         const normalized = rel.split(sep).join("/");
         if (stat.isDirectory()) {
             hash.update(`d\0${normalized}\0`);
-            for (const name of readdirSync(path).sort())
-                visit(join(path, name), join(rel, name));
+            const names = [];
+            const directory = await opendir(path);
+            for await (const entry of directory) {
+                throwIfInspectionAborted(signal);
+                names.push(entry.name);
+                if (entryCount + names.length > limits.maxEntries) {
+                    throw new Error(`plugin package exceeds ${limits.maxEntries} entries`);
+                }
+            }
+            for (const name of names.sort()) {
+                await visit(join(path, name), join(rel, name), depth + 1);
+            }
             return;
         }
         if (stat.isFile()) {
+            if (stat.size > limits.maxFileBytes) {
+                throw new Error(`plugin package file exceeds ${limits.maxFileBytes} bytes: ${normalized}`);
+            }
+            if (totalBytes + stat.size > limits.maxTotalBytes) {
+                throw new Error(`plugin package exceeds ${limits.maxTotalBytes} total bytes`);
+            }
+            totalBytes += stat.size;
             hash.update(`f\0${normalized}\0${stat.size}\0`);
-            hash.update(readFileSync(path));
+            const noFollow = process.platform === "win32" ? 0 : fsConstants.O_NOFOLLOW;
+            const file = await openFile(path, fsConstants.O_RDONLY | noFollow);
+            try {
+                const before = await file.stat();
+                if (!before.isFile() || before.size !== stat.size) {
+                    throw new Error(`plugin package file changed during inspection: ${normalized}`);
+                }
+                let streamedBytes = 0;
+                const stream = file.createReadStream({
+                    autoClose: false,
+                    highWaterMark: PACKAGE_HASH_STREAM_BYTES,
+                    ...(signal ? { signal } : {}),
+                });
+                for await (const chunk of stream) {
+                    throwIfInspectionAborted(signal);
+                    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                    streamedBytes += bytes.byteLength;
+                    if (streamedBytes > limits.maxFileBytes ||
+                        totalBytes - stat.size + streamedBytes > limits.maxTotalBytes) {
+                        throw new Error(`plugin package file changed during inspection: ${normalized}`);
+                    }
+                    hash.update(bytes);
+                }
+                const after = await file.stat();
+                if (streamedBytes !== before.size ||
+                    after.size !== before.size ||
+                    after.mtimeMs !== before.mtimeMs) {
+                    throw new Error(`plugin package file changed during inspection: ${normalized}`);
+                }
+            }
+            finally {
+                await file.close();
+            }
             return;
         }
         if (stat.isSymbolicLink()) {
-            hash.update(`l\0${normalized}\0${readlinkSync(path)}\0`);
+            let target;
+            try {
+                target = await realpathAsync(path);
+            }
+            catch {
+                throw new Error(`plugin package contains a broken symlink: ${normalized}`);
+            }
+            if (!isWithin(root, target)) {
+                throw new Error(`plugin package symlink resolves outside the package: ${normalized}`);
+            }
+            const link = await readlinkAsync(path);
+            hash.update(`l\0${normalized}\0${link}\0`);
             return;
         }
         throw new Error(`unsupported package entry: ${normalized}`);
     }
 }
+function normalizedInspectionLimits(overrides) {
+    const limits = {
+        ...DEFAULT_PLUGIN_PACKAGE_INSPECTION_LIMITS,
+        ...overrides,
+    };
+    for (const [name, value] of Object.entries(limits)) {
+        if (!Number.isSafeInteger(value) || value <= 0) {
+            throw new Error(`plugin package inspection ${name} must be a positive safe integer`);
+        }
+    }
+    return limits;
+}
+function throwIfInspectionAborted(signal) {
+    if (signal?.aborted) {
+        throw new Error("plugin package inspection aborted", { cause: signal.reason });
+    }
+}
 function isSafeNpmPackageName(name) {
     return /^(?:@[A-Za-z0-9][A-Za-z0-9._-]*\/)?[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name);
 }
 function runNpm(args, onProgress, signal) {
-    return runCommand("npm", args, onProgress, signal);
+    return runPluginPackageCommand("npm", args, onProgress, { signal });
 }
-function runCommand(command, args, onProgress, signal, cwd) {
+/**
+ * Run one package tool without a shell and tear down its full POSIX process
+ * group on cancellation. Windows cannot signal process groups through Node,
+ * so it safely degrades to TERM→KILL on the direct child.
+ */
+export function runPluginPackageCommand(command, args, onProgress, options = {}) {
     return new Promise((resolveDone, reject) => {
+        const { signal, cwd } = options;
+        const abortGraceMs = options.abortGraceMs ?? DEFAULT_COMMAND_ABORT_GRACE_MS;
+        if (!Number.isSafeInteger(abortGraceMs) || abortGraceMs <= 0 || abortGraceMs > 60_000) {
+            reject(new Error("plugin command abort grace must be 1-60000ms"));
+            return;
+        }
         if (signal?.aborted) {
             reject(new Error("plugin installation aborted"));
             return;
         }
+        const useProcessGroup = process.platform !== "win32";
         const child = spawn(command, args, {
             cwd,
             stdio: ["ignore", "pipe", "pipe"],
+            detached: useProcessGroup,
         });
         let settled = false;
+        let aborting = false;
+        let childClosed = false;
+        let escalationTimer;
+        let hardStopTimer;
+        let groupPollTimer;
         const settle = (callback) => {
             if (settled)
                 return;
             settled = true;
             signal?.removeEventListener("abort", abort);
+            if (escalationTimer)
+                clearTimeout(escalationTimer);
+            if (hardStopTimer)
+                clearTimeout(hardStopTimer);
+            if (groupPollTimer)
+                clearInterval(groupPollTimer);
             callback();
         };
-        const abort = () => child.kill();
+        const rejectAborted = () => settle(() => reject(new Error("plugin installation aborted", {
+            cause: signal?.reason,
+        })));
+        const processGroupAlive = () => {
+            if (!useProcessGroup || child.pid === undefined)
+                return !childClosed;
+            try {
+                process.kill(-child.pid, 0);
+                return true;
+            }
+            catch (error) {
+                return error.code !== "ESRCH";
+            }
+        };
+        const signalProcessTree = (processSignal) => {
+            if (useProcessGroup && child.pid !== undefined) {
+                try {
+                    process.kill(-child.pid, processSignal);
+                    return;
+                }
+                catch (error) {
+                    if (error.code !== "ESRCH") {
+                        try {
+                            child.kill(processSignal);
+                        }
+                        catch {
+                            // The bounded hard-stop path below still resolves cancellation.
+                        }
+                    }
+                    return;
+                }
+            }
+            try {
+                child.kill(processSignal);
+            }
+            catch {
+                // A concurrently exited child is already stopped.
+            }
+        };
+        const finishWhenStopped = () => {
+            if (!aborting || settled)
+                return;
+            if (childClosed && !processGroupAlive())
+                rejectAborted();
+        };
+        const abort = () => {
+            if (aborting || settled)
+                return;
+            aborting = true;
+            signalProcessTree("SIGTERM");
+            groupPollTimer = setInterval(finishWhenStopped, 25);
+            escalationTimer = setTimeout(() => {
+                signalProcessTree("SIGKILL");
+                finishWhenStopped();
+            }, abortGraceMs);
+            hardStopTimer = setTimeout(rejectAborted, abortGraceMs * 2);
+            finishWhenStopped();
+        };
         signal?.addEventListener("abort", abort, { once: true });
+        if (signal?.aborted)
+            abort();
         const onData = (buffer) => {
             for (const line of buffer.toString().split(/\r?\n/)) {
                 if (line.trim())
@@ -534,15 +698,30 @@ function runCommand(command, args, onProgress, signal, cwd) {
         };
         child.stdout?.on("data", onData);
         child.stderr?.on("data", onData);
-        child.on("error", (error) => settle(() => reject(error)));
-        child.on("close", (code) => settle(() => {
-            if (signal?.aborted)
-                reject(new Error("plugin installation aborted"));
-            else if (code === 0)
-                resolveDone();
+        child.on("error", (error) => {
+            if (aborting)
+                rejectAborted();
             else
-                reject(new Error(`${command} exited with code ${code ?? "null"}`));
-        }));
+                settle(() => reject(error));
+        });
+        child.on("close", (code) => {
+            childClosed = true;
+            if (aborting || signal?.aborted) {
+                if (!aborting)
+                    abort();
+                if (!useProcessGroup)
+                    rejectAborted();
+                else
+                    finishWhenStopped();
+                return;
+            }
+            settle(() => {
+                if (code === 0)
+                    resolveDone();
+                else
+                    reject(new Error(`${command} exited with code ${code ?? "null"}`));
+            });
+        });
     });
 }
 function isRecord(value) {

package/dist/pm2.js

@@ -8,16 +8,18 @@
  * shipped `ecosystem.cjs` to keep in sync.
  */
 import { spawn, spawnSync } from "node:child_process";
-import { mkdirSync } from "node:fs";
+import { mkdirSync, realpathSync } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadConfig } from "@rynx-ai/core";
+import { daemonEntryRestartRequired } from "./daemon-build-status.js";
 const require = createRequire(import.meta.url);
 /** pm2 app name — single resident daemon per machine. */
 const APP_NAME = "rynx";
 const PM2_COMMAND_TIMEOUT_MS = 5_000;
+const DAEMON_PACKAGE_VERSION = require("../package.json").version;
 /**
  * Build a dialable control-console URL from the daemon's bind host/port. Bind-all
  * addresses (`0.0.0.0`, `::`) aren't dialable, so show a loopback host instead.
@@ -120,13 +122,18 @@ export function startDaemon({ force, quiet = false }) {
             console.error(error instanceof Error ? error.message : String(error));
         return 1;
     }
-    if (!force && existing?.pm2_env?.status === "online") {
+    const staleBuild = existing?.pm2_env?.status === "online" &&
+        residentBuildRestartRequired(existing);
+    if (!force && existing?.pm2_env?.status === "online" && !staleBuild) {
         if (!quiet) {
             console.log(`rynx is already running (pid ${existing.pid ?? "?"}). Use \`rynx restart\` to reload.`);
             console.log(`Control console: ${styleUrl(controlConsoleUrl())}`);
         }
         return 0;
     }
+    if (staleBuild && !quiet) {
+        console.log("A newer daemon build is present on disk; restarting Rynx.");
+    }
     const dir = logsDir();
     if (existing) {
         const removed = runPm2(["delete", APP_NAME], quiet);
@@ -182,8 +189,10 @@ export function statusDaemon() {
     const state = app.pm2_env?.status ?? "unknown";
     const pid = app.pid ? ` pid=${app.pid}` : "";
     const restarts = app.pm2_env?.restart_time != null ? ` restarts=${app.pm2_env.restart_time}` : "";
-    console.log(`rynx: ${state}${pid}${restarts}`);
-    return state === "online" ? 0 : 1;
+    const staleBuild = state === "online" && residentBuildRestartRequired(app);
+    console.log(`rynx: ${state}${pid}${restarts}` +
+        (staleBuild ? " restart-required (run `rynx restart`)" : ""));
+    return state === "online" && !staleBuild ? 0 : 1;
 }
 /** Stream the daemon's pm2 logs until the user detaches (Ctrl-C). */
 export function streamLogs() {
@@ -193,3 +202,26 @@ export function streamLogs() {
     });
     child.on("exit", (code) => process.exit(code ?? 0));
 }
+function residentBuildRestartRequired(app) {
+    const runningEntry = app.pm2_env?.pm_exec_path;
+    if (runningEntry && !sameEntryPath(runningEntry, daemonEntryPath()))
+        return true;
+    const runningVersion = app.pm2_env?.version;
+    if (runningVersion &&
+        typeof DAEMON_PACKAGE_VERSION === "string" &&
+        runningVersion !== DAEMON_PACKAGE_VERSION) {
+        return true;
+    }
+    const startedAt = app.pm2_env?.pm_uptime;
+    return typeof startedAt === "number" &&
+        Number.isFinite(startedAt) &&
+        daemonEntryRestartRequired(daemonEntryPath(), startedAt);
+}
+function sameEntryPath(left, right) {
+    try {
+        return realpathSync(left) === realpathSync(right);
+    }
+    catch {
+        return resolve(left) === resolve(right);
+    }
+}

package/dist/remote-runtime-access-store.d.ts

@@ -54,6 +54,7 @@ export declare class RemoteRuntimeAccessStore {
     /** Recheck an already authenticated peer before each dispatched operation. */
     isClientGrantActive(grantIdInput: string, clientIdInput: string): boolean;
     revokeClientGrant(grantIdInput: string): boolean;
+    deleteRevokedClientGrant(grantIdInput: string): boolean;
     private replayConsumedClaim;
     private deleteRetainedExpiredClaims;
     private now;

package/dist/remote-runtime-access-store.js

@@ -197,6 +197,13 @@ export class RemoteRuntimeAccessStore {
         });
         return revoke.immediate();
     }
+    deleteRevokedClientGrant(grantIdInput) {
+        const grantId = validId(grantIdInput, "grantId", "grant_not_found");
+        return this.connection
+            .prepare(`DELETE FROM runtime_client_grants
+         WHERE grant_id = ? AND revoked_at IS NOT NULL`)
+            .run(grantId).changes === 1;
+    }
     replayConsumedClaim(claim, clientId, clientPublicKey) {
         if (claim.consumed_client_id === null ||
             claim.consumed_client_public_key === null ||

package/dist/remote-runtime-admin.d.ts

@@ -29,4 +29,7 @@ export declare class DaemonRemoteRuntimeAdmin implements RemoteRuntimeAdminHost
         revoked: boolean;
         closedConnections: number;
     };
+    deleteRevokedClientGrant(grantId: string): {
+        deleted: boolean;
+    };
 }

package/dist/remote-runtime-admin.js

@@ -47,6 +47,9 @@ export class DaemonRemoteRuntimeAdmin {
         const closedConnections = revoked ? this.connections.revokeGrant(grantId) : 0;
         return { revoked, closedConnections };
     }
+    deleteRevokedClientGrant(grantId) {
+        return { deleted: this.access.deleteRevokedClientGrant(grantId) };
+    }
 }
 function advertisedEndpoint(address, listenerPort) {
     const input = address?.trim() || "127.0.0.1";

package/dist/remote-runtime-connection-manager.d.ts

@@ -1,5 +1,6 @@
+import { type RuntimeBrowserInspectTarget } from "@rynx-ai/protocol/runtime-browser-inspect";
 import { type RuntimeBrowserSurfaceOpenFrame } from "@rynx-ai/protocol/runtime-browser-surface";
-import { type DirectRuntimeConnection, type DirectRuntimeBrowserSurfaceConnection, type DirectRuntimeCredential } from "@rynx-ai/remote-runtime-client";
+import { type DirectRuntimeConnection, type DirectRuntimeBrowserInspectConnection, type DirectRuntimeBrowserSurfaceConnection, type DirectRuntimeCredential } from "@rynx-ai/remote-runtime-client";
 import type { DirectRuntimeBrowserSurfaceHost, DirectRuntimeEmulatorSurfaceHost, RemoteRuntimeDispatcher, RuntimeConnectionLease, RuntimeConnectionResolverHost } from "@rynx-ai/server";
 import { type FileRemoteRuntimeCredentialStore, type RemoteRuntimeClientCredential } from "./remote-runtime-credential-store.js";
 import { type RemoteRuntimeTarget, type RemoteRuntimeTargetStore } from "./remote-runtime-target-store.js";
@@ -19,6 +20,10 @@ interface RuntimeCredentialReader {
 }
 interface RuntimeClientAdapter {
     connect(credential: DirectRuntimeCredential): Promise<DirectRuntimeConnection>;
+    openBrowserInspect?(credential: DirectRuntimeCredential, target: RuntimeBrowserInspectTarget, options?: {
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    }): Promise<DirectRuntimeBrowserInspectConnection>;
     openBrowserSurface?(credential: DirectRuntimeCredential, frame: RuntimeBrowserSurfaceOpenFrame, options?: {
         timeoutMs?: number;
         signal?: AbortSignal;
@@ -49,6 +54,8 @@ export declare class DaemonRuntimeConnectionManager implements RuntimeConnection
     private readonly maxIdleConnections;
     private readonly slots;
     private readonly generations;
+    /** Independent inspect sockets must outlive shared control-channel eviction. */
+    private readonly browserInspectClosers;
     private localStatusSnapshot?;
     private closed;
     private managerClosePromise?;
@@ -71,6 +78,7 @@ export declare class DaemonRuntimeConnectionManager implements RuntimeConnection
     private wrapDirectSessionSubscription;
     private openDedicatedDirectTerminal;
     private openDedicatedDirectBrowserSurface;
+    private openDedicatedDirectBrowserInspect;
     private openDedicatedDirectEmulatorSurface;
     private slotFor;
     private openDirectConnection;
@@ -78,6 +86,9 @@ export declare class DaemonRuntimeConnectionManager implements RuntimeConnection
     private closeSlot;
     private trackDedicatedTerminal;
     private trackDedicatedBrowserSurface;
+    private trackDedicatedBrowserInspect;
+    private registerBrowserInspectCloser;
+    private closeBrowserInspects;
     private trackDedicatedEmulatorSurface;
     private registerDedicatedCloser;
     private scheduleIdleClose;