@stim-cli/server 1.20.0 → 1.20.2

package/README.md

@@ -119,7 +119,9 @@ questions, including without a terminal. Without
 a terminal or `--yes`, setup refuses before installing anything unless every
 chosen capability already has a matching approval. A person on
 the worker still approves; an SSH-driven run is not offered. Build and
-device-host requests are separate grants. Build never includes read or control.
+device-host requests are separate grants. A build grant carries no `read` or
+`control` capability, but it is full access to this account in practice (see
+[Build access](#build-access)).
 A rerun before expiry reports matching approved requests as already approved
 and never grants a second request. After expiry it refuses with exit 2 before
 any change. Requests themselves lapse after 15 minutes.
@@ -310,17 +312,31 @@ connection sees a new grant after it reconnects. Under Stim Host, an approved
 `hello` also carries the same `host` grants as `/health`, which `stim doctor`
 reports for remote Macs.
 
-Every method other than `hello` needs `read`. A device with only `build`
-gets `forbidden` for all of them.
+Every method other than `hello` needs `read`, except the methods with their own
+approval: `build.*` needs `build`, the `device-host.*` methods that run a hosted
+session need `device-host`, and `server.update.*` needs the build or device-host
+approval of the requesting Mac (see [Remote update](#remote-update)). A device
+with only `build` gets `forbidden` for every other method.
 
 ## Build access
 
 `build` lets another Mac on the tailnet run its project's code on this Mac to
 build for it: config plugins, CocoaPods hooks, Xcode script phases and Gradle
-plugins run as the user `stim-server` runs as. It never comes with `read` or
-`control`, and `devices grant` never turns a paired device into a build
-client. Grant it only to Macs you trust with that. A connection from this Mac,
-over loopback, cannot get it: it has no tailnet node to bind the token to.
+plugins run as the user `stim-server` runs as. The offload worker runs with that
+user's real home directory and no sandbox, so a build grant is equivalent to
+full access to the account `stim-server` runs as. In practice it includes
+everything `read` and `control` allow: project code can edit the
+server's `devices.json` (under `~/.stim/server` by default, which the worker's
+real home directory still reaches) to grant itself either, read other build
+clients' checkouts and blobs, and persist through LaunchAgents or shell startup
+files. `devices grant` never turns a paired device into a build client, and the
+protocol does not list `read` or `control` among a build client's capabilities,
+but do not rely on that as a boundary. Grant it only to Macs you trust with
+that. Revoking the grant stops future builds and kills the running job's
+process group. It does not undo anything project code already did. A loopback
+connection from this Mac cannot get it: it has no tailnet node to bind the
+token to. A connection from this Mac to its own tailnet address or `*.ts.net`
+name does carry the Mac's own tailnet identity and can request `build`.
 Because the server trusts `X-Forwarded-For` on loopback (see
 [Pairing](#pairing)), a process on this Mac can still claim a tailnet peer's
 address. Run `stim-server` as a user no one else can run processes as when
@@ -1122,8 +1138,8 @@ A Mac this one approved for builds (`--build`) or device hosting
 (`--device-host`) can update this Mac's `stim-server service` over its tailnet
 connection, so the remote Mac keeps up with the client without ssh. A
 server that offers it lists `server-update` in its `hello` features. A paired
-phone, a `read` or `control` device and a connection from this Mac cannot. The
-methods need that approval, not `read`:
+phone, a `read` or `control` device and a loopback connection from this Mac
+cannot. The methods need that approval, not `read`:
 
 - `server.update.status` returns `server` (`version` and `stimBuild`),
   `service` (the label of the LaunchAgent this server runs under, or `null` when
@@ -1136,7 +1152,9 @@ methods need that approval, not `read`:
 - `server.update.start` takes `{ "release": "<version>" }`, an exact version
   that `stim-server service update --release` installs, or
   `{ "packages": [{ "name", "size", "sha256" }] }`, at most 8 `.tgz` packages
-  of the client's own build. Packages need `server.acceptClientBuilds` set to
+  of the client's own build. A `release` older than the version this server
+  runs is refused with `bad-request`; run `stim-server service update --release`
+  on this Mac to downgrade it. Packages need `server.acceptClientBuilds` set to
   `true` on this Mac (`stim settings set server.acceptClientBuilds true`); a
   release needs no setting. One update runs at a time.
 - `server.update.chunk` takes `{ id, name, offset, data }`, at most 32 KiB of
@@ -1173,7 +1191,9 @@ A client with `build` runs its iOS simulator builds and Android emulator
 debug builds and macOS SwiftPM Debug builds here with these methods.
 They need `build`, not `read`; a device without `build` gets `forbidden`.
 The server re-reads the build clients on every call, and revoking a client
-closes its connections and cancels its builds.
+closes its connections and cancels its builds. Once those builds end, it
+deletes the client's directory under the worker root. A client that has not
+connected since stim-server started keeps its directory when revoked.
 
 - `build.offer` takes `repo` (the client's name for its repository: letters,
   digits, `.`, `_` and `-`, at most 80), an optional `lockfile` sha256, and an
@@ -1216,7 +1236,13 @@ closes its connections and cancels its builds.
   the sha256, then the next bytes of that blob, one blob after another. A frame
   for a blob that was not asked for, one that overruns its size, or bytes that
   do not match the digest close the connection with 4400. Blobs are kept per
-  client and shared by all its repositories.
+  client and shared by all its repositories. `build.sync` fails with
+  `build-busy` while the worker root's volume has less than 10 GiB free, and
+  with `limit-exceeded` once the sizes in one manifest add up to more than
+  20 GiB. A blob whose size would leave that volume under 10 GiB free also
+  closes the connection with 4400. When a client's build ends and no other
+  build of that client runs, the server deletes the client's blobs that no
+  repository checkout and no open connection's manifest uses.
 - `build.start` takes `repo`, `project` (the app directory in the repository),
   `platform` (`ios`, `android` or `macos`), `configuration`, `scheme`, `runtime` (a
   simulator runtime identifier, required for `ios`, null for `android`),

package/dist/{stim-server-C5iKxjba.mjs → stim-server-FWcuNpW7.mjs}

@@ -2,11 +2,11 @@ import { n as protocol_exports } from "./protocol-CjUChTWJ.mjs";
 import { createRequire } from "node:module";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { basename, delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { HOSTED_APP_CHUNK_BYTES, HOSTED_MACOS_APP_SLOTS, RECORDING_CAP_BYTES, RECORDING_FOOTAGE_MS, RECORDING_PLATFORMS, archiveDir, assertHostedDeviceLedger, buildWorkerRoot, capDrops, closedSegmentName, compileGrep, createAgentActionReader, createDebugLog, deviceHostArea, deviceHostRoot, deviceViewersDir, footageDrops, getConcurrencyLimits, getParkedMax, hostedAndroidPlacements, hostedAppArea, hostedAppAttempt, hostedAppBlobs, hostedDeviceId, hostedIosPlacements, hostedMacosBundleId, hostedMacosLogsDir, hostedNativeLogsDir, isJournalExpired, isJsonObject, isSetupJournalPrunable, listRecordedDevices, listSegments, loadConfig, machineCapacity, macosAppState, openSegmentName, parseHostedAppOffer, parseHostedLocalDeviceCount, parseHostedLogsCursor, parseHostedNativeOffer, parseHostedOfferRequest, parseHostedPlatformDevice, parseHostedRequest, parseNdjsonLine, pinnedEndpoint, queryJsonLogs, readArchive, readArchiveState, readBuildHistory, readBuildMachines, readDeviceHostMachines, readHostedApp, readHostedAppMetadata, readHostedDevice, readHostedDeviceLedger, readHostedMacosApp, readHostedNativeLogsCheckpoint, readHostedSessions, readJsonObject, readLogTimeline, readLogsSince, readMacosRecord, readSetupJournal, readWorkspaceState, recordingDeviceName, rememberHostedAppBlobRename, saturation, serverSetupDir, settingDefinition, settingValueError, setupJournalFile, sortByTs, stimBuildDigest, tryAcquireBuildSlotClaim, validHostedAppBlob, validRunId, workspaceRecordingsDir } from "@stim-cli/core/state";
+import { DEVICE_HOST_LIMITS, HOSTED_APP_CHUNK_BYTES, HOSTED_MACOS_APP_SLOTS, RECORDING_CAP_BYTES, RECORDING_FOOTAGE_MS, RECORDING_PLATFORMS, archiveDir, assertHostedDeviceLedger, buildWorkerRoot, capDrops, closedSegmentName, compileGrep, createAgentActionReader, createDebugLog, deviceHostArea, deviceHostRoot, deviceViewersDir, footageDrops, getConcurrencyLimits, getParkedMax, hostedAndroidPlacements, hostedAppArea, hostedAppAttempt, hostedAppBlobs, hostedDeviceId, hostedIosPlacements, hostedMacosBundleId, hostedMacosLogsDir, hostedNativeLogsDir, hostedWorkerSettleMs, isJournalExpired, isJsonObject, isSetupJournalPrunable, listRecordedDevices, listSegments, loadConfig, machineCapacity, macosAppState, openSegmentName, parseHostedAppOffer, parseHostedLocalDeviceCount, parseHostedLogsCursor, parseHostedNativeOffer, parseHostedOfferRequest, parseHostedPlatformDevice, parseHostedRequest, parseNdjsonLine, pinnedEndpoint, queryJsonLogs, readArchive, readArchiveState, readBuildHistory, readBuildMachines, readDeviceHostMachines, readHostedApp, readHostedAppMetadata, readHostedDevice, readHostedDeviceLedger, readHostedMacosApp, readHostedNativeLogsCheckpoint, readHostedSessions, readJsonObject, readLogTimeline, readLogsSince, readMacosRecord, readSetupJournal, readWorkspaceState, recordingDeviceName, rememberHostedAppBlobRename, saturation, serverSetupDir, settingDefinition, settingValueError, setupJournalFile, sortByTs, stimBuildDigest, tryAcquireBuildSlotClaim, validHostedAppBlob, validRunId, workspaceRecordingsDir } from "@stim-cli/core/state";
 import { accessSync, appendFileSync, chmodSync, closeSync, constants, copyFileSync, cpSync, createReadStream, existsSync, futimesSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, statfsSync, watch, writeFileSync, writeSync } from "node:fs";
 import { availableParallelism, cpus, freemem, homedir, hostname, loadavg, tmpdir, totalmem } from "node:os";
 import { parseArgs } from "node:util";
-import { copyFile, lstat, open, readFile, realpath } from "node:fs/promises";
+import { copyFile, lstat, open, readFile, realpath, rm } from "node:fs/promises";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { compiledHelper, configDir, createMetroBridge, validMacosResourceDestination, withDirLock, workspaceStateDir } from "@stim-cli/core";
 import { DEFAULT_STUCK_MINUTES, OVERSIGHT_CATEGORIES, inQuietHours, oversee, oversightTitle } from "@stim-cli/core/oversight";
@@ -130,7 +130,7 @@ function validTimeZone(timeZone) {
 		return false;
 	}
 }
-const minuteOfDay$1 = (value) => Number.isInteger(value) && value >= 0 && value < 1440;
+const minuteOfDay$1 = (value) => typeof value === "number" && Number.isInteger(value) && value >= 0 && value < 1440;
 /** Quiet hours as `push.register` takes them, or null when `value` is not valid. */
 function parseQuietHours(value) {
 	if (!isJsonObject(value)) return null;
@@ -144,7 +144,7 @@ function parseQuietHours(value) {
 }
 /** Whether `value` is a stuck threshold `push.register` takes: whole minutes from 1 to 240. */
 function validStuckMinutes(value) {
-	return Number.isInteger(value) && value >= 1 && value <= 240;
+	return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 240;
 }
 function serverDir() {
 	return join(configDir(), "server");
@@ -260,6 +260,10 @@ function lapsed(client, now) {
 function readBuildClients(now = Date.now()) {
 	return readRecords(clientsFile("build")).filter((client) => !lapsed(client, now));
 }
+/** Whether the build client registry parses, so an empty `readBuildClients` means no client rather than a read failure. */
+function buildClientsReadable() {
+	return Array.isArray(readJsonObject(clientsFile("build"))?.devices);
+}
 /** Device-host approvals live apart from read/control pairings and build clients. */
 function readDeviceHostClients(now = Date.now()) {
 	return readRecords(clientsFile("device-host")).filter((client) => !lapsed(client, now));
@@ -871,6 +875,26 @@ function planServe(route, target, previous) {
 		create: true
 	};
 }
+const parseVersion = (v) => /^(\d+)\.(\d+)\.(\d+)(?:-([^+]+))?(?:\+.*)?$/.exec(v);
+function compareVersions(a, b) {
+	const aa = parseVersion(a), bb = parseVersion(b);
+	if (!aa || !bb) throw new ServiceError(`Cannot compare stim-server versions ${a} and ${b}.`);
+	for (let i = 1; i <= 3; i++) {
+		const diff = Number(aa[i]) - Number(bb[i]);
+		if (diff) return diff;
+	}
+	if (!aa[4] || !bb[4]) return aa[4] ? -1 : bb[4] ? 1 : 0;
+	const ap = aa[4].split("."), bp = bb[4].split(".");
+	for (let i = 0; i < Math.max(ap.length, bp.length); i++) {
+		const x = ap[i], y = bp[i];
+		if (x === y) continue;
+		if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
+		if (/^\d+$/.test(x) && /^\d+$/.test(y)) return Number(x) - Number(y);
+		if (/^\d+$/.test(x) !== /^\d+$/.test(y)) return /^\d+$/.test(x) ? -1 : 1;
+		return x < y ? -1 : 1;
+	}
+	return 0;
+}
 const RELEASE_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 function validateRelease(value) {
 	return RELEASE_PATTERN.test(value) ? null : `--release takes an exact stim-server version such as 1.15.0, not a range or tag; got "${value}".`;
@@ -2532,6 +2556,7 @@ function listProcesses(columns = "pid=,command=") {
 const DEFAULT_BUILD_LIMITS = {
 	maxJobs: 1,
 	minFreeBytes: 10 * 1024 ** 3,
+	maxManifestBytes: 20 * 1024 ** 3,
 	timeoutMs: 36e5,
 	killGraceMs: 5e3,
 	detachGraceMs: 3e5,
@@ -2637,6 +2662,8 @@ var BuildHost = class {
 	limits;
 	jobs = /* @__PURE__ */ new Set();
 	owned = /* @__PURE__ */ new Map();
+	sessions = /* @__PURE__ */ new Map();
+	served = /* @__PURE__ */ new Set();
 	retained = /* @__PURE__ */ new Map();
 	closed = false;
 	draining = null;
@@ -2775,12 +2802,17 @@ var BuildHost = class {
 	drain(reason) {
 		this.draining = reason;
 	}
+	/** Why the worker root's volume cannot take `bytes` more, or null when it can. */
+	lowDisk(bytes = 0) {
+		const free = freeBytes(this.root());
+		return free !== null && free - bytes < this.limits.minFreeBytes ? `${gb(free)} GB free, builds need ${gb(this.limits.minFreeBytes)} GB` : null;
+	}
 	capacity() {
 		const machine = machineCapacity();
 		const running = this.jobs.size;
 		const diskFreeBytes = freeBytes(this.root());
 		const builds = machine.builds + [...this.jobs].filter((job) => !job.slotted).length;
-		const declined = this.draining ?? (running >= this.limits.maxJobs ? `already running ${running} offloaded build(s), its limit` : diskFreeBytes !== null && diskFreeBytes < this.limits.minFreeBytes ? `${gb(diskFreeBytes)} GB free, builds need ${gb(this.limits.minFreeBytes)} GB` : saturation({
+		const declined = this.draining ?? (running >= this.limits.maxJobs ? `already running ${running} offloaded build(s), its limit` : this.lowDisk() ?? saturation({
 			...machine,
 			builds
 		}));
@@ -2798,7 +2830,57 @@ var BuildHost = class {
 		};
 	}
 	session(client, socket, send) {
-		return new BuildSession(this, client, socket, send);
+		const session = new BuildSession(this, client, socket, send);
+		this.sessions.set(session, client);
+		this.served.add(client);
+		return session;
+	}
+	ended(session) {
+		this.sessions.delete(session);
+	}
+	/**
+	* Deletes the blobs of `client` that no `mirror.json` of its repositories and no open connection's manifest
+	* references, unless a build of that client runs.
+	*/
+	pruneBlobs(client) {
+		if ([...this.jobs].some((job) => job.client === client)) return;
+		const keep = /* @__PURE__ */ new Set();
+		for (const [session, owner] of this.sessions) if (owner === client) for (const sha256 of session.digests()) keep.add(sha256);
+		try {
+			const repos = join(this.clientDir(client), "repos");
+			const blobs = join(this.clientDir(client), "blobs");
+			for (const repo of readdirSync(repos)) {
+				const mirror = join(repos, repo, "mirror.json");
+				if (!existsSync(mirror)) continue;
+				const record = JSON.parse(readFileSync(mirror, "utf8"));
+				if (typeof record !== "object" || record === null) throw new Error("unreadable mirror record");
+				for (const entry of Object.values(record)) {
+					if (typeof entry?.sha256 !== "string") throw new Error("unreadable mirror record");
+					keep.add(entry.sha256);
+				}
+			}
+			for (const prefix of readdirSync(blobs, { withFileTypes: true })) {
+				if (!prefix.isDirectory() || !/^[0-9a-f]{2}$/.test(prefix.name)) continue;
+				for (const blob of readdirSync(join(blobs, prefix.name), { withFileTypes: true })) if (blob.isFile() && /^[0-9a-f]{64}$/.test(blob.name) && !keep.has(blob.name)) rmSync(join(blobs, prefix.name, blob.name), { force: true });
+			}
+		} catch {}
+	}
+	/** Cancels the builds of `client`, a client that lost `build`, and deletes its area once they end. */
+	async remove(client) {
+		if (!client || client === "." || client === ".." || basename(client) !== client) return;
+		for (const [token, entry] of this.retained) if (entry.client === client) this.drop(token);
+		const jobs = [...this.jobs].filter((job) => job.client === client);
+		for (const job of jobs) job.cancel();
+		await Promise.all(jobs.map((job) => job.done));
+		try {
+			await rm(this.clientDir(client), {
+				recursive: true,
+				force: true,
+				maxRetries: 3
+			});
+		} catch (error) {
+			console.error(`stim-server: could not delete the build area of ${client}: ${String(error)}`);
+		}
 	}
 	/** Starts the build of one synced manifest; the job belongs to the caller's connection. */
 	launch({ client, repo, job, session, send }) {
@@ -3010,6 +3092,7 @@ var BuildHost = class {
 						durationMs: Date.now() - started
 					});
 					resolve();
+					this.pruneBlobs(client);
 				};
 				settle();
 			});
@@ -3108,11 +3191,17 @@ var BuildHost = class {
 	}
 	/**
 	* Cancels the jobs no connection holds, and deletes the retained bundles, of clients `allowed` no longer accepts,
-	* such as a revoked one.
+	* such as a revoked one. With `deleteAreas`, the area of each such client this server process served is deleted
+	* once its builds end.
 	*/
-	abandonDetached(allowed) {
+	abandonDetached(allowed, deleteAreas = false) {
 		for (const job of this.owned.values()) if (!job.session && !allowed(job.client)) this.abandon(job);
 		for (const [token, entry] of this.retained) if (!allowed(entry.client)) this.drop(token);
+		for (const client of this.served) {
+			if (!deleteAreas || allowed(client)) continue;
+			this.served.delete(client);
+			this.remove(client);
+		}
 	}
 	async close() {
 		this.closed = true;
@@ -3155,6 +3244,7 @@ function workerOutcome(value, native) {
 var BuildSession = class {
 	repo = null;
 	files = /* @__PURE__ */ new Map();
+	bytes = 0;
 	done = false;
 	expected = /* @__PURE__ */ new Map();
 	incoming = null;
@@ -3179,15 +3269,20 @@ var BuildSession = class {
 	sync(params) {
 		if (!isJsonObject(params) || !validRepo(params.repo) || !Array.isArray(params.files)) return refusal("bad-request", "build.sync needs params.repo, params.files and params.done.");
 		if (typeof params.done !== "boolean") return refusal("bad-request", "build.sync needs params.done.");
+		const low = this.host.lowDisk();
+		if (low) return refusal("build-busy", `This Mac declines the upload: ${low}.`);
 		if (this.done || this.repo !== params.repo) {
 			this.repo = params.repo;
 			this.files = /* @__PURE__ */ new Map();
+			this.bytes = 0;
 			this.done = false;
 		}
 		if (this.files.size + params.files.length > MAX_MANIFEST_FILES) return refusal("limit-exceeded", `A manifest holds at most ${MAX_MANIFEST_FILES} files.`);
 		const missing = [];
 		for (const file of params.files) {
 			if (!validFile(file)) return refusal("bad-request", `Invalid manifest entry ${JSON.stringify(file).slice(0, 200)}.`);
+			if (this.bytes + file.size > this.host.limits.maxManifestBytes) return refusal("limit-exceeded", `A manifest holds at most ${gb(this.host.limits.maxManifestBytes)} GB.`);
+			this.bytes += file.size;
 			this.files.set(file.path, file);
 			if (this.expected.has(file.sha256) || existsSync(this.blobPath(file.sha256))) continue;
 			this.expected.set(file.sha256, file.size);
@@ -3196,6 +3291,9 @@ var BuildSession = class {
 		this.done = params.done;
 		return { result: { missing } };
 	}
+	digests() {
+		return [...this.files.values()].map((file) => file.sha256);
+	}
 	/** One binary frame: a 32-byte sha256, then the next bytes of that blob. Returns why the frame is refused. */
 	blob(frame) {
 		if (frame.length < DIGEST_BYTES) return "a blob frame starts with its 32-byte sha256";
@@ -3205,6 +3303,8 @@ var BuildSession = class {
 		if (!this.incoming) {
 			const size = this.expected.get(sha256);
 			if (size === void 0) return `blob ${sha256} was not asked for`;
+			const low = this.host.lowDisk(size);
+			if (low) return `this Mac declines the upload: ${low}`;
 			const tmp = join(this.blobs(), `.incoming-${randomUUID()}`);
 			mkdirSync(this.blobs(), {
 				recursive: true,
@@ -3369,6 +3469,7 @@ var BuildSession = class {
 	}
 	close(dropped) {
 		this.closed = true;
+		this.host.ended(this);
 		for (const job of this.jobs.values()) if (dropped) this.host.detach(job);
 		else this.host.abandon(job);
 		this.jobs.clear();
@@ -3590,26 +3691,6 @@ function selectGrants(records, match) {
 		}] : [];
 	});
 }
-const parseVersion = (v) => /^(\d+)\.(\d+)\.(\d+)(?:-([^+]+))?(?:\+.*)?$/.exec(v);
-function compareVersions(a, b) {
-	const aa = parseVersion(a), bb = parseVersion(b);
-	if (!aa || !bb) throw new SetupRefusal(`Cannot compare stim-server versions ${a} and ${b}.`);
-	for (let i = 1; i <= 3; i++) {
-		const diff = Number(aa[i]) - Number(bb[i]);
-		if (diff) return diff;
-	}
-	if (!aa[4] || !bb[4]) return aa[4] ? -1 : bb[4] ? 1 : 0;
-	const ap = aa[4].split("."), bp = bb[4].split(".");
-	for (let i = 0; i < Math.max(ap.length, bp.length); i++) {
-		const x = ap[i], y = bp[i];
-		if (x === y) continue;
-		if (x === void 0 || y === void 0) return x === void 0 ? -1 : 1;
-		if (/^\d+$/.test(x) && /^\d+$/.test(y)) return Number(x) - Number(y);
-		if (/^\d+$/.test(x) !== /^\d+$/.test(y)) return /^\d+$/.test(x) ? -1 : 1;
-		return x < y ? -1 : 1;
-	}
-	return 0;
-}
 function setupVersionDecision(current, desired, managed) {
 	if (current === null) return "install";
 	if (managed && compareVersions(current, desired) < 0) return "update";
@@ -6612,11 +6693,7 @@ var DeviceHost = class {
 		this.options = options;
 		this.debug = createDebugLog("server", { env: options.env });
 		this.limits = {
-			prepareMs: 3e5,
-			offerMs: 3e4,
-			stopMs: 9e4,
-			logsMs: 15e3,
-			killGraceMs: 5e3,
+			...DEVICE_HOST_LIMITS,
 			...options.limits
 		};
 	}
@@ -7384,7 +7461,7 @@ var DeviceHost = class {
 			const value = outcome.value;
 			const installed = !owned.stopping && this.options.allowed(record.client) && !outcome.notice && outcome.settled && isJsonObject(value) && value.state === "installed" && parseHostedPlatformDevice(value.device, record.platform) !== null && record.device !== null && hostedDeviceId(parseHostedPlatformDevice(value.device, record.platform)) === hostedDeviceId(record.device) && (value.launched === true || value.launched === "unverified");
 			if (installed) owned.installedAttempt = attempt;
-			if (installed && (record.platform !== "macos" || Number.isSafeInteger(value.pid) && value.pid > 0)) await this.startAgent(record, attempt, value.pid);
+			if (installed && (record.platform !== "macos" || typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0)) await this.startAgent(record, attempt, value.pid);
 			const app = changeHostedApp(record.id, attempt, (current) => {
 				current.state = installed ? "installed" : "unknown";
 				current.launched = installed ? value.launched : null;
@@ -7834,7 +7911,7 @@ var DeviceHost = class {
 			notice ??= "Hosted worker was cancelled or exceeded its deadline.";
 			signal("SIGTERM");
 			killTimer = setTimeout(() => signal("SIGKILL"), this.limits.killGraceMs);
-			finishTimer = setTimeout(finish, this.limits.killGraceMs * 2);
+			finishTimer = setTimeout(finish, hostedWorkerSettleMs(this.limits));
 		};
 		const finishGroup = () => {
 			if (finished) return;
@@ -7936,11 +8013,13 @@ function connect$1(url, timeoutMs) {
 			} catch {
 				return;
 			}
-			const waiter = typeof message.id === "number" ? pending.get(message.id) : void 0;
+			if (!isJsonObject(message) || typeof message.id !== "number") return;
+			const waiter = pending.get(message.id);
 			if (!waiter) return;
 			pending.delete(message.id);
-			if (message.error) waiter.reject(new Error(message.error.message ?? "DevTools command failed."));
-			else waiter.resolve(message.result ?? {});
+			const { error, result } = message;
+			if (error) waiter.reject(new Error(isJsonObject(error) && typeof error.message === "string" ? error.message : "DevTools command failed."));
+			else waiter.resolve(isJsonObject(result) ? result : {});
 		});
 		socket.on("close", () => {
 			for (const waiter of pending.values()) waiter.reject(/* @__PURE__ */ new Error("The DevTools connection closed."));
@@ -9896,7 +9975,7 @@ function parseInput(method, params, targetOf) {
 			code: "bad-request",
 			message: "input.touch needs phase (down, move or up), and x and y from 0 to 1."
 		};
-		if (display !== void 0 && (!Number.isInteger(display) || display < 0 || display > 3)) return {
+		if (display !== void 0 && (typeof display !== "number" || !Number.isInteger(display) || display < 0 || display > 3)) return {
 			code: "bad-request",
 			message: "display must be a display index from 0 to 3."
 		};
@@ -11328,7 +11407,7 @@ function parseLogFilter(params) {
 	if (slot !== void 0 && (typeof slot !== "string" || !SLOT_NAME.test(slot))) return { error: "slot must be 1-64 letters, digits, underscores or hyphens." };
 	if (grep !== void 0 && (typeof grep !== "string" || grep.includes("\0") || compileGrep(grep).error)) return { error: "grep must be a valid regular expression without NUL characters." };
 	if (errors !== void 0 && typeof errors !== "boolean") return { error: "errors must be true or false." };
-	if (tail !== void 0 && (!Number.isInteger(tail) || tail < 1 || tail > protocol_exports.MAX_LOG_TAIL)) return { error: `tail must be an integer from 1 to ${protocol_exports.MAX_LOG_TAIL}.` };
+	if (tail !== void 0 && (typeof tail !== "number" || !Number.isInteger(tail) || tail < 1 || tail > protocol_exports.MAX_LOG_TAIL)) return { error: `tail must be an integer from 1 to ${protocol_exports.MAX_LOG_TAIL}.` };
 	return { filter: {
 		...typeof params.archive === "string" ? { archive: params.archive } : { workspace: params.workspace },
 		...sources ? { sources } : {},
@@ -12618,6 +12697,7 @@ var ServerUpdates = class {
 	async start(by, params) {
 		const parsed = parseUpdateStart(params);
 		if (typeof parsed === "string") return refused("bad-request", parsed);
+		if ("release" in parsed && compareVersions(parsed.release, this.options.build.version) < 0) return refused("bad-request", `This server runs ${this.options.build.version}; it does not install the older release ${parsed.release} on a client's request. To downgrade it, run \`stim-server service update --release ${parsed.release}\` on the Mac it runs on.`);
 		const label = this.options.label;
 		if (!label || !await (this.options.runsAsService ?? runsAsService)(label, this.options.port)) return refused("forbidden", "This stim-server does not run as a `stim-server service` LaunchAgent, so it cannot update itself. Update it where it runs.");
 		if ("packages" in parsed && !this.options.acceptsClientBuilds()) return refused("forbidden", "This Mac installs only stim-server releases from npm. To take this build, run `stim settings set server.acceptClientBuilds true` on it.");
@@ -13783,7 +13863,7 @@ async function startServer(options) {
 		push.refresh();
 		for (const [socket, device] of sessions) if (!paired.has(device.id)) socket.close(CLOSE_UNAUTHORIZED, "device revoked");
 		hostedDevices.revoke();
-		builds.abandonDetached((client) => paired.get(client)?.capabilities.includes("build") ?? false);
+		builds.abandonDetached((client) => paired.get(client)?.capabilities.includes("build") ?? false, buildClientsReadable());
 		builds.sweepDaemons();
 		for (const [socket, controller] of controllers) {
 			const capabilities = paired.get(controller.device.id)?.capabilities;
@@ -14211,8 +14291,8 @@ async function startServer(options) {
 			if (video !== void 0 && (!Array.isArray(video) || !video.every((codec) => typeof codec === "string"))) return error(id, "bad-request", "video must be a list of codec names.");
 			const wantsVideo = video?.includes("h264") === true;
 			const maxFps = wantsVideo ? protocol_exports.FRAME_FPS.video : protocol_exports.FRAME_FPS.max;
-			if (fps !== void 0 && (!Number.isInteger(fps) || fps < 1 || fps > maxFps)) return error(id, "bad-request", `fps must be a whole number from 1 to ${maxFps}.`);
-			if (maxEdge !== void 0 && (!Number.isInteger(maxEdge) || maxEdge < protocol_exports.FRAME_EDGE.min || maxEdge > protocol_exports.FRAME_EDGE.max)) return error(id, "bad-request", `maxEdge must be a whole number of pixels from ${protocol_exports.FRAME_EDGE.min} to ${protocol_exports.FRAME_EDGE.max}.`);
+			if (fps !== void 0 && (typeof fps !== "number" || !Number.isInteger(fps) || fps < 1 || fps > maxFps)) return error(id, "bad-request", `fps must be a whole number from 1 to ${maxFps}.`);
+			if (maxEdge !== void 0 && (typeof maxEdge !== "number" || !Number.isInteger(maxEdge) || maxEdge < protocol_exports.FRAME_EDGE.min || maxEdge > protocol_exports.FRAME_EDGE.max)) return error(id, "bad-request", `maxEdge must be a whole number of pixels from ${protocol_exports.FRAME_EDGE.min} to ${protocol_exports.FRAME_EDGE.max}.`);
 			const resolvedDir = hosted ? null : readDir(id, {
 				workspace,
 				archive
@@ -15224,7 +15304,7 @@ async function startServer(options) {
 			if (message.method === "notifications.list") {
 				const params = message.params ?? {};
 				const since = isJsonObject(params) ? params.since : void 0;
-				if (!isJsonObject(params) || since !== void 0 && !(Number.isInteger(since) && since >= 0)) return error(id, "bad-request", "notifications.list takes an optional since, a cursor of 0 or more.");
+				if (!isJsonObject(params) || since !== void 0 && !(typeof since === "number" && Number.isInteger(since) && since >= 0)) return error(id, "bad-request", "notifications.list takes an optional since, a cursor of 0 or more.");
 				listeners.add(socket);
 				return send(socket, {
 					id,

package/dist/stim-server.mjs

@@ -4,6 +4,6 @@ const encode = (version) => version.split(".", 3).reduce((sum, part) => sum * 1e
 if (encode(process.versions.node) < encode("22.12.0")) {
 	process.stderr.write(`STIM_NODE_UNSUPPORTED: stim-server needs Node 22.12.0 or later; this is Node ${process.versions.node} at ${process.execPath}. To run stim-server where a project pins an older Node, see https://stim.appandflow.com/docs/requirements#older-node-pins\n`);
 	process.exitCode = 1;
-} else import("./stim-server-C5iKxjba.mjs");
+} else import("./stim-server-FWcuNpW7.mjs");
 //#endregion
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stim-cli/server",
-  "version": "1.20.0",
+  "version": "1.20.2",
   "description": "Serves Stim status to paired clients over Tailscale, and runs reload and stop for clients granted control.",
   "license": "MIT",
   "repository": {
@@ -28,8 +28,8 @@
     "./protocol.schema.json": "./dist/protocol.schema.json"
   },
   "dependencies": {
-    "@stim-cli/core": "^1.20.0",
-    "stim": "1.20.0",
+    "@stim-cli/core": "^1.20.2",
+    "stim": "1.20.2",
     "ws": "^8.21.3"
   },
   "devDependencies": {