@skaile/workspaces 0.33.0 → 0.35.0

package/dist/{chunk-362QBS57.js → chunk-NAMD4AIK.js}

@@ -1,11 +1,11 @@
 import { renderGoogleDriveConfig, renderOneDriveConfig, renderWebDAVConfig } from './chunk-OVRSNIKJ.js';
-import { resolveAuthRef, resolveAuth, resolveMountCredentialString, resolveMountCredential } from './chunk-LRFZNLB2.js';
+import { resolveAuthRef, resolveAuth, resolveMountCredentialString, resolveMountCredential } from './chunk-52HINMW4.js';
 import { PortPool, createFsWatcher, RcloneProcessManager, ensureDirMode } from './chunk-XT6AZWK3.js';
 import { pluginRegistry } from './chunk-6E6PKKAD.js';
 import { computeFlowStateFromSnapshots } from './chunk-X46FY45B.js';
 import { renderStimulusPrompt } from './chunk-DEYYRFQU.js';
 import { computeStimulus } from './chunk-IFGTRL2I.js';
-import { portableSpawn } from './chunk-PKPUVQJP.js';
+import { portableSpawn } from './chunk-2Q6OY3SU.js';
 import { createLogger } from './chunk-JB35MVBN.js';
 import { existsSync, mkdirSync, renameSync, writeFileSync, readFileSync, cpSync, statSync, createReadStream, readdirSync, openSync, writeSync, closeSync, chmodSync } from 'fs';
 import path, { join, dirname, resolve, sep } from 'path';
@@ -14,7 +14,7 @@ import { execFile, execSync, spawn } from 'child_process';
 import { createServer } from 'http';
 import mime from 'mime';
 import { promisify } from 'util';
-import { stat, readdir, mkdir, writeFile, chmod, rm } from 'fs/promises';
+import { stat, readdir, writeFile, chmod, rm, mkdir } from 'fs/promises';
 import { createRequire } from 'module';
 import { pathToFileURL } from 'url';
 
@@ -5273,6 +5273,116 @@ var ConnectorStartupError = class extends Error {
     this.failedReadWrite = failedReadWrite;
   }
 };
+
+// connectors/src/fleet-health-gate.ts
+var FleetHealthGate = class {
+  constructor(target, barrier, log, opts) {
+    this.target = target;
+    this.barrier = barrier;
+    this.log = log;
+    this.unhealthyThreshold = Math.max(1, opts?.unhealthyThreshold ?? 2);
+    this.healthyThreshold = Math.max(1, opts?.healthyThreshold ?? 2);
+  }
+  target;
+  barrier;
+  log;
+  unhealthyThreshold;
+  healthyThreshold;
+  /** True while the read-only barrier is established over the target. */
+  gated = false;
+  /**
+   * The gate state that the most recently *enqueued* transition will settle on.
+   * Hysteresis is measured against this, not `gated`, so that verdicts arriving
+   * while a (slow, async) establish/remove is still in flight are counted toward
+   * the post-transition state rather than the stale pre-transition one. Without
+   * this, fast healthy verdicts arriving during a slow `establish()` could meet
+   * `healthyThreshold` before the gate finished tripping, ungating it on the
+   * first healthy verdict afterwards and defeating the threshold.
+   */
+  pendingGated = false;
+  /** Consecutive same-verdict run length, signed by the *current* run's verdict. */
+  unhealthyRun = 0;
+  healthyRun = 0;
+  /** Serialises establish/remove so overlapping observe() calls can't race. */
+  transition = Promise.resolve();
+  /** True while the read-only barrier is established (test/observability hook). */
+  get isGated() {
+    return this.gated;
+  }
+  /**
+   * Feed one health verdict. Applies hysteresis, then establishes or removes the
+   * barrier on a state change. Resolves once the (possibly no-op) transition is
+   * applied. Never throws — a failed establish is treated as gated (fail-closed).
+   */
+  observe(verdict) {
+    if (verdict === "healthy") {
+      this.healthyRun += 1;
+      this.unhealthyRun = 0;
+      if (this.pendingGated && this.healthyRun >= this.healthyThreshold) {
+        this.pendingGated = false;
+        this.healthyRun = 0;
+        return this.enqueue(() => this.ungate());
+      }
+    } else {
+      this.unhealthyRun += 1;
+      this.healthyRun = 0;
+      if (!this.pendingGated && this.unhealthyRun >= this.unhealthyThreshold) {
+        this.pendingGated = true;
+        this.unhealthyRun = 0;
+        return this.enqueue(() => this.gate());
+      }
+    }
+    return this.transition;
+  }
+  /**
+   * Tear the gate down. If currently gated, removes the barrier so a leftover
+   * read-only tmpfs is not leaked. Call only after the connector above the target
+   * is disconnected (top-down, no leaked mount).
+   */
+  dispose() {
+    if (!this.gated && !this.pendingGated) return this.transition;
+    this.pendingGated = false;
+    return this.enqueue(() => this.ungate());
+  }
+  enqueue(step) {
+    this.transition = this.transition.then(step, step);
+    return this.transition;
+  }
+  async gate() {
+    if (this.gated) {
+      this.pendingGated = true;
+      return;
+    }
+    try {
+      await this.barrier.establish(this.target, this.log);
+      this.gated = true;
+      this.log?.warn("fleet mount unhealthy \u2014 gated read-only", { target: this.target });
+    } catch (err) {
+      this.gated = true;
+      this.log?.error(
+        "fleet read-only gate establish threw \u2014 treating as gated (fail-closed)",
+        err,
+        {
+          target: this.target
+        }
+      );
+    }
+  }
+  async ungate() {
+    if (!this.gated) return;
+    try {
+      await this.barrier.remove(this.target, this.log);
+    } catch (err) {
+      this.pendingGated = true;
+      this.log?.error("fleet read-only gate remove failed \u2014 staying gated", err, {
+        target: this.target
+      });
+      return;
+    }
+    this.gated = false;
+    this.log?.info("fleet mount recovered \u2014 gate lifted, writable again", { target: this.target });
+  }
+};
 function isFleetManaged(connectorId) {
   const raw = process.env.SKAILE_FLEET_MANAGED_MOUNTS ?? "";
   if (raw.length === 0) return false;
@@ -5301,7 +5411,21 @@ async function ensureFleetMounted(dir, log, options) {
     `fleet mount ${dir} not ready after ${timeoutMs}ms \u2014 check SKAILE_FLEET_MANAGED_MOUNTS env var and host bind: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
   );
 }
+async function probeFleetHealth(dir) {
+  try {
+    const st = await stat(dir);
+    if (!st.isDirectory()) return "error";
+    await readdir(dir);
+    return "healthy";
+  } catch {
+    return "error";
+  }
+}
 var NOT_READY_SENTINEL = ".skaile-workspace-not-ready";
+var TARGET_ALREADY_PRESENT_CODES = /* @__PURE__ */ new Set(["EEXIST", "ENOTCONN", "EBUSY", "ENOTDIR"]);
+function errnoCode(err) {
+  return typeof err === "object" && err !== null && "code" in err ? String(err.code) : void 0;
+}
 var SENTINEL_BODY = [
   "This workspace is backed by a remote mount that is not live yet.",
   "It is mounted read-only on purpose: writing here would create a phantom",
@@ -5309,6 +5433,9 @@ var SENTINEL_BODY = [
   "Wait for the mount to finish syncing (watch connector_status) before writing.",
   ""
 ].join("\n");
+var defaultMkdir = async (target) => {
+  await mkdir(target, { recursive: true });
+};
 var defaultRunner = (cmd, args) => new Promise((resolve5, reject) => {
   const proc = spawn(cmd, args, { stdio: "ignore" });
   proc.once("error", reject);
@@ -5319,13 +5446,27 @@ var defaultRunner = (cmd, args) => new Promise((resolve5, reject) => {
 });
 var RoMountPlaceholderBarrier = class {
   run;
+  mkdirFn;
   modes = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.run = opts?.run ?? defaultRunner;
+    this.mkdirFn = opts?.mkdirFn ?? defaultMkdir;
   }
   async establish(target, log) {
     if (this.modes.has(target)) return;
-    await mkdir(target, { recursive: true });
+    try {
+      await this.mkdirFn(target);
+    } catch (err) {
+      const code = errnoCode(err);
+      if (!code || !TARGET_ALREADY_PRESENT_CODES.has(code)) {
+        await this.chmodFallback(target, err, log);
+        return;
+      }
+      log?.debug("barrier target already present (live/broken mount) \u2014 protecting in place", {
+        target,
+        code
+      });
+    }
     let tmpfsMounted = false;
     try {
       await this.run("mount", [
@@ -5427,6 +5568,12 @@ var defaultMountPlaceholderBarrier = new RoMountPlaceholderBarrier();
 
 // connectors/src/connector-manager.ts
 var KNOWN_PREFIXES = ["env:", "forge:", "op:", "kp:", "oauth:"];
+var DEFAULT_FLEET_HEALTH_POLL_MS = 5e3;
+function parseFleetHealthPollMs(raw = process.env.SKAILE_FLEET_HEALTH_POLL_MS) {
+  if (raw === void 0) return DEFAULT_FLEET_HEALTH_POLL_MS;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_FLEET_HEALTH_POLL_MS;
+}
 function hasKnownPrefix(ref) {
   return KNOWN_PREFIXES.some((p) => ref.startsWith(p));
 }
@@ -5527,6 +5674,7 @@ var ConnectorManager = class {
     this.tokenMediator = opts.tokenMediator;
     this.preMintedSecrets = opts.preMintedSecrets;
     this.placeholderBarrier = opts.placeholderBarrier ?? defaultMountPlaceholderBarrier;
+    this.fleetHealthPollMs = opts.fleetHealthPollMs ?? parseFleetHealthPollMs();
     const secrets = opts.secrets;
     if (secrets && typeof secrets === "object" && "prepareRef" in secrets) {
       this.chain = secrets;
@@ -5555,6 +5703,10 @@ var ConnectorManager = class {
   disposeController = new AbortController();
   /** Tracks the background task driving deferred (rclone-backed) mounts. */
   deferredConnect;
+  /** Periodic local fleet-health probe; runs only while a fleet gate is active. */
+  fleetHealthTimer;
+  /** Local fleet-health poll interval (ms). 0 disables the local probe. */
+  fleetHealthPollMs;
   // ── Private helpers ──────────────────────────────────────────────────────────
   /**
    * Wrap the user-supplied `TokenMediator` so `reason: 'initial'` calls for an
@@ -5826,7 +5978,9 @@ var ConnectorManager = class {
         connector,
         handle,
         declaration: decl,
-        placeholderTarget: previous?.placeholderTarget
+        placeholderTarget: previous?.placeholderTarget,
+        fleetHealthGate: previous?.fleetHealthGate,
+        fleetHealthTarget: previous?.fleetHealthTarget
       });
       this.opts.onStatusChange?.({
         type: "connector_status",
@@ -5862,16 +6016,25 @@ var ConnectorManager = class {
    * prompt before the background mount completes.
    *
    * Before exposing the target, a read-only barrier is established so the agent
-   * cannot write a phantom workspace into a not-yet-mounted remote. Fleet-managed
-   * mounts are skipped: the host already bound the live share at the target, so a
-   * barrier on top would shadow real content.
+   * cannot write a phantom workspace into a not-yet-mounted remote.
+   *
+   * Fleet-managed mounts skip the *static* boot-time barrier (the host already
+   * bound the live share at the target — a static barrier would shadow real
+   * content) but instead get a *dynamic* health gate: while the host fleet rclone
+   * is healthy the target stays writable exactly as before; when it wedges, the
+   * gate establishes the same read-only barrier until the mount recovers.
    */
   async preRegisterDeferred(decl, connector) {
     const mountTarget = this.resolveMountTarget(decl);
     if (!existsSync(mountTarget)) mkdirSync(mountTarget, { recursive: true });
     const fleetManaged = isFleetManaged(decl.id);
     let placeholderTarget;
-    if (!fleetManaged) {
+    let fleetHealthGate;
+    let fleetHealthTarget;
+    if (fleetManaged) {
+      fleetHealthGate = new FleetHealthGate(mountTarget, this.placeholderBarrier, this.mgrLog);
+      fleetHealthTarget = mountTarget;
+    } else {
       try {
         await this.placeholderBarrier.establish(mountTarget, this.mgrLog);
         placeholderTarget = mountTarget;
@@ -5890,7 +6053,58 @@ var ConnectorManager = class {
       // returns cleanly instead of dereferencing null state.
       state: {}
     };
-    this.active.set(decl.id, { connector, handle, declaration: decl, placeholderTarget });
+    this.active.set(decl.id, {
+      connector,
+      handle,
+      declaration: decl,
+      placeholderTarget,
+      fleetHealthGate,
+      fleetHealthTarget
+    });
+    if (fleetHealthGate) this.ensureFleetHealthPoll();
+  }
+  /**
+   * Start the periodic local fleet-health probe if it is not already running and
+   * the poll interval is enabled. Each tick `stat`+`readdir`s every fleet target
+   * and feeds the verdict to its gate (hysteresis lives in the gate). The probe
+   * only catches directly-detectable failures (EIO / dead bind); silent
+   * degradation is covered by the platform signal via `reportFleetHealth`.
+   */
+  ensureFleetHealthPoll() {
+    if (this.fleetHealthTimer || this.fleetHealthPollMs <= 0 || this.disposed) return;
+    this.fleetHealthTimer = setInterval(() => {
+      void this.runFleetHealthProbe();
+    }, this.fleetHealthPollMs);
+    this.fleetHealthTimer.unref?.();
+  }
+  async runFleetHealthProbe() {
+    if (this.disposed) return;
+    const gates = [...this.active.values()].filter(
+      (e) => e.fleetHealthGate != null && e.fleetHealthTarget != null
+    );
+    await Promise.all(
+      gates.map(async (e) => {
+        if (e.fleetHealthGate.isGated) return;
+        const verdict = await probeFleetHealth(e.fleetHealthTarget);
+        await e.fleetHealthGate.observe(verdict).catch(() => {
+        });
+      })
+    );
+  }
+  /**
+   * Feed an externally-derived fleet-health verdict for a connector into its gate.
+   *
+   * This is the consume side of the platform fleet-health signal: the host fleet
+   * health poll knows `core/stats.errors` and can detect a *silently-empty-but-
+   * writable* degraded mount that the local probe cannot. The runner watches the
+   * `<workspace>/.skaile/fleet-health/<connectorId>` flag and forwards its verdict
+   * here. Unknown / non-fleet ids are ignored.
+   */
+  async reportFleetHealth(connectorId, verdict) {
+    const entry = this.active.get(connectorId);
+    if (!entry?.fleetHealthGate) return;
+    await entry.fleetHealthGate.observe(verdict).catch(() => {
+    });
   }
   /** Drive all deferred mounts concurrently; resolves when every one settles. */
   async connectDeferred(deferred) {
@@ -5937,6 +6151,10 @@ var ConnectorManager = class {
     this.mgrLog.info("disconnectAll start", { count: this.active.size });
     this.disposed = true;
     this.disposeController.abort();
+    if (this.fleetHealthTimer) {
+      clearInterval(this.fleetHealthTimer);
+      this.fleetHealthTimer = void 0;
+    }
     if (this.deferredConnect) {
       try {
         await this.deferredConnect;
@@ -5954,6 +6172,8 @@ var ConnectorManager = class {
         await this.placeholderBarrier.remove(entry.placeholderTarget, this.mgrLog).catch(() => {
         });
       }
+      if (entry.fleetHealthGate) await entry.fleetHealthGate.dispose().catch(() => {
+      });
       this.opts.onStatusChange?.({
         type: "connector_status",
         connectorId: id,
@@ -6044,6 +6264,8 @@ var ConnectorManager = class {
             await this.placeholderBarrier.remove(entry.placeholderTarget, this.mgrLog).catch(() => {
             });
           }
+          if (entry.fleetHealthGate) await entry.fleetHealthGate.dispose().catch(() => {
+          });
           this.active.delete(id);
           this.opts.onStatusChange?.({
             type: "connector_status",
@@ -8164,6 +8386,6 @@ function createConnector() {
   return new FlowAdapter();
 }
 
-export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DEFAULT_REACTIVE_COOLDOWN_MS, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PROACTIVE_RCLONE_REFRESH_MARGIN_MS, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createRcloneTokenRefresh, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
-//# sourceMappingURL=chunk-362QBS57.js.map
-//# sourceMappingURL=chunk-362QBS57.js.map
+export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, ConnectorFieldMissingError, ConnectorManager, ConnectorStartupError, DEFAULT_REACTIVE_COOLDOWN_MS, DeployConnector, DevServerConnector, FleetHealthGate, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NOT_READY_SENTINEL, PROACTIVE_RCLONE_REFRESH_MARGIN_MS, PostgresConnector, RoMountPlaceholderBarrier, S3Connector, SQLiteConnector, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildSdkConnectorTools, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createRcloneTokenRefresh, createWorktree, defaultMountPlaceholderBarrier, defaultSpawn, ensureFleetMounted, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, probeFleetHealth, registerBuiltinConnectors, removeMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock };
+//# sourceMappingURL=chunk-NAMD4AIK.js.map
+//# sourceMappingURL=chunk-NAMD4AIK.js.map