@superblocksteam/sdk 2.0.157-next.4 → 2.0.157-next.5

package/src/cli-replacement/dev.interception.test.mts

@@ -315,7 +315,7 @@ describe("runFatalExitShutdown", () => {
       removeIntegrationCache: async () => {
         calls.push("cache");
       },
-      shutdownLockService: async () => {
+      relinquishLock: async () => {
         calls.push("lock");
       },
     });
@@ -323,36 +323,36 @@ describe("runFatalExitShutdown", () => {
   });
 
   it("still releases the lock when cache removal rejects", async () => {
-    const shutdownLockService = vi.fn(async () => {});
+    const relinquishLock = vi.fn(async () => {});
     await expect(
       runFatalExitShutdown({
         logger: makeLogger(),
         removeIntegrationCache: async () => {
           throw new Error("ai-service IPC is gone");
         },
-        shutdownLockService,
+        relinquishLock,
       }),
     ).resolves.toBeUndefined();
-    expect(shutdownLockService).toHaveBeenCalledOnce();
+    expect(relinquishLock).toHaveBeenCalledOnce();
   });
 
   it("still releases the lock when cache removal throws synchronously", async () => {
-    const shutdownLockService = vi.fn(async () => {});
+    const relinquishLock = vi.fn(async () => {});
     await runFatalExitShutdown({
       logger: makeLogger(),
       removeIntegrationCache: () => {
         throw new Error("sync boom");
       },
-      shutdownLockService,
+      relinquishLock,
     });
-    expect(shutdownLockService).toHaveBeenCalledOnce();
+    expect(relinquishLock).toHaveBeenCalledOnce();
   });
 
   it("never rejects when the lock release itself rejects", async () => {
     await expect(
       runFatalExitShutdown({
         logger: makeLogger(),
-        shutdownLockService: async () => {
+        relinquishLock: async () => {
           throw new Error("lock server unreachable");
         },
       }),
@@ -370,20 +370,20 @@ describe("runFatalExitShutdown", () => {
   it("abandons a step that never settles and still runs the later steps", async () => {
     vi.useFakeTimers();
     try {
-      const shutdownLockService = vi.fn(async () => {});
+      const relinquishLock = vi.fn(async () => {});
       const settled = vi.fn();
       const done = runFatalExitShutdown({
         logger: makeLogger(),
         removeIntegrationCache: () => new Promise<void>(() => {}),
-        shutdownLockService,
+        relinquishLock,
       }).then(settled);
 
       await vi.advanceTimersByTimeAsync(stepTimeoutMs - 1);
-      expect(shutdownLockService).not.toHaveBeenCalled();
+      expect(relinquishLock).not.toHaveBeenCalled();
 
       await vi.advanceTimersByTimeAsync(2);
       await done;
-      expect(shutdownLockService).toHaveBeenCalledOnce();
+      expect(relinquishLock).toHaveBeenCalledOnce();
       expect(settled).toHaveBeenCalledOnce();
     } finally {
       vi.useRealTimers();

package/src/cli-replacement/dev.mts

@@ -16,10 +16,10 @@ import type {
   DependencyUpgradeError,
   ServerError,
 } from "@superblocksteam/library-shared/types";
+import type { ConflictError } from "@superblocksteam/shared";
 import {
   buildGithubSuperblocksSyncWorkflow,
   buildGithubSuperblocksSyncWorkflowFromBaseUrl,
-  ConflictError,
   DEFAULT_NON_GIT_BRANCH,
   isGitAuthErrorMessage,
   isGitHubRemoteUrl,
@@ -176,6 +176,19 @@ async function handleInactiveLockTakeover(
     throw new Error("Lock takeover prompt shown");
   }
 
+  // Only ask if somebody can answer. `promptUser` reads stdin, which on a
+  // sandbox nothing is attached to — it would wait forever for a keystroke
+  // that cannot come. Reachable now that conflicts surface when a client
+  // attaches rather than only during a CLI startup.
+  if (!process.stdin.isTTY) {
+    logger.warn(`${warningMessage} Run with --force-takeover to take it.`);
+    span.setStatus({
+      code: SpanStatusCode.ERROR,
+      message: "Lock held by an inactive user, nobody available to prompt",
+    });
+    throw new Error(warningMessage);
+  }
+
   // Prompt user to force takeover (CLI only)
   logger.warn(warningMessage);
   const shouldTakeover = await getBooleanUserResponse(prompt);
@@ -1019,12 +1032,12 @@ export async function flushTelemetryWithTimeout(): Promise<boolean> {
  * MUST BE CALLED LAST in any shutdown sequence. This does not merely flush: it
  * awaits `shutdownTelemetry()`, which tears the provider down, so every signal
  * emitted after it goes into a dead pipeline. It can also block for up to
- * `TELEMETRY_FLUSH_TIMEOUT_MS`, and delaying `lockService.shutdown()` by that
- * much delays the lock release that lets a replacement sandbox take over —
+ * `TELEMETRY_FLUSH_TIMEOUT_MS`, and delaying `lockService.relinquishLock()` by
+ * that much delays the lock release that lets a replacement sandbox take over —
  * which is the entire recovery story this exit path exists to enable.
  *
  * "Last" is only reachable because the callers drive the lock service with
- * `shutdown()` rather than `shutdownAndExit()`. The latter ends in an
+ * `relinquishLock()` rather than `shutdownAndExit()`. The latter ends in an
  * unconditional `finally { process.exit(1) }`, and `process.exit` is
  * synchronous, so anything sequenced after it never runs at all. See the two
  * fatal-exit blocks in `dev()`.
@@ -1075,8 +1088,8 @@ const FATAL_EXIT_STEP_TIMEOUT_MS = 5000;
 
 /**
  * One teardown step. Returning `undefined` is allowed so callers can pass the
- * optional-chained call directly (`() => lockService?.shutdown(...)`) without
- * having to re-narrow a mutable binding at the call site.
+ * optional-chained call directly (`() => lockService?.relinquishLock()`)
+ * without having to re-narrow a mutable binding at the call site.
  */
 type FatalExitStep = () => Promise<unknown> | undefined;
 
@@ -1130,7 +1143,7 @@ async function runFatalExitStep(
  *
  * Order is load-bearing:
  *   1. `removeIntegrationCache` — ai-service state that must not outlive us.
- *   2. `shutdownLockService` — releases the AppBranchLock. Recovery-critical:
+ *   2. `relinquishLock` — hands the AppBranchLock back. Recovery-critical:
  *      the heartbeat dies with the process, so skipping this makes the
  *      replacement sandbox's `acquireLock()` fail with a ConflictError until
  *      the server-side TTL expires, and the replacement is the entire point of
@@ -1145,15 +1158,15 @@ async function runFatalExitStep(
  *
  * This does NOT exit. The caller owns `process.exit(1)` from a `finally`, so
  * the exit still happens even if this function is somehow bypassed. That is
- * also why callers must drive the lock service through `shutdown()` and not
- * `shutdownAndExit()`: the latter ends in its own unconditional
+ * also why callers must drive the lock service through `relinquishLock()` and
+ * not `shutdownAndExit()`: the latter ends in its own unconditional
  * `finally { process.exit(1) }`, and `process.exit` is synchronous, so
  * everything sequenced after it — including the flush — silently never ran.
  */
 export async function runFatalExitShutdown(steps: {
   logger: Logger;
   removeIntegrationCache?: FatalExitStep;
-  shutdownLockService?: FatalExitStep;
+  relinquishLock?: FatalExitStep;
 }): Promise<void> {
   const { logger } = steps;
   await runFatalExitStep(
@@ -1161,11 +1174,7 @@ export async function runFatalExitShutdown(steps: {
     "ai-service integration cache removal",
     steps.removeIntegrationCache,
   );
-  await runFatalExitStep(
-    logger,
-    "lock service shutdown",
-    steps.shutdownLockService,
-  );
+  await runFatalExitStep(logger, "lock hand-back", steps.relinquishLock);
   await flushTelemetryBeforeExit(logger);
 }
 
@@ -1635,35 +1644,84 @@ export async function dev(options: {
 
         logger.info("Checking if local files are synced with the server");
 
+        const lockSvc = lockService;
+
+        // Nobody takes the lock to boot: nothing startup does is gated on
+        // holding one, and a lock taken before any client exists is held on
+        // behalf of nobody. `LockService` takes it when the first client
+        // attaches, and tells us here if somebody else already has it —
+        // this is the `ConflictError` catch that used to wrap the boot-time
+        // acquire, moved to where acquisition actually happens (ENG-6090).
+        lockSvc.setOnLockConflict(async (error) => {
+          let stopForExtension = false;
+          await tracer.startActiveSpan("handlingLockConflict", async (span) => {
+            try {
+              await handleLockConflict(error, lockSvc, span, logger);
+            } catch (conflictError) {
+              // Reporting is all this owes the caller. The holder is someone
+              // else's live session and the pod is still serving preview, so
+              // there is nothing to tear down — the lock does not decide how
+              // long this process lives (ENG-6032).
+              logger.warn(
+                `Could not take the live-edit lock: ${conflictError instanceof Error ? conflictError.message : String(conflictError)}`,
+              );
+              // Except under the VS Code extension, which reads the `cliprompt`
+              // above, asks the user, and answers by restarting this command
+              // with `--force-takeover`. That hand-off has always ended with
+              // this process gone: it used to abort startup before anything
+              // bound a port. Staying up now would leave the replacement
+              // fighting us for :5173.
+              if (process.env.SUPERBLOCKS_VSCODE === "true") {
+                logger.info(
+                  "Stopping so the extension can restart with --force-takeover",
+                );
+                stopForExtension = true;
+              }
+            } finally {
+              span.end();
+            }
+          });
+          if (!stopForExtension) {
+            return;
+          }
+          // Outside the span, so `span.end()` above has already run and the
+          // flush below can carry it. This is the same teardown the two
+          // fatal-exit blocks in `dev()` use, and for the same reason: the
+          // `shutdownAndExit()` that used to be inside the `catch` exits
+          // synchronously from its own `finally`, which made both the
+          // `span.end()` and the telemetry flush unreachable — the trace for
+          // the one event this handler exists to record never left the process.
+          try {
+            await runFatalExitShutdown({
+              logger,
+              removeIntegrationCache: () => aiService?.removeIntegrationCache(),
+              relinquishLock: () => lockSvc.relinquishLock(),
+            });
+          } finally {
+            process.exit(1);
+          }
+        });
+
         try {
           await maskUnixSignals(async () => {
-            if (lockService) {
-              const lockSvc = lockService;
+            // `--force-takeover` is the one thing that still acquires at boot:
+            // it is an explicit "take it from them now" rather than a pod
+            // helping itself to a lock nobody asked it to hold.
+            if (options.forceTakeover) {
               await tracer.startActiveSpan(
-                "acquiringInitialLock",
+                "forcingInitialLockTakeover",
                 async (span) => {
                   try {
-                    // If --force-takeover flag is set, immediately force takeover instead of acquiring
-                    if (options.forceTakeover) {
-                      logger.info(
-                        "Force takeover requested, taking over lock...",
-                      );
-                      await lockSvc.forceTakeover();
-                      logger.info(
-                        "Lock acquired successfully via force takeover.",
-                      );
-                    } else {
-                      await lockSvc.acquireLock();
-                    }
+                    logger.info(
+                      "Force takeover requested, taking over lock...",
+                    );
+                    await lockSvc.forceTakeover();
+                    logger.info(
+                      "Lock acquired successfully via force takeover.",
+                    );
                   } catch (error) {
-                    // If we got a conflict error (409), inspect the lock for more information
-                    if (error instanceof ConflictError) {
-                      await handleLockConflict(error, lockSvc, span, logger);
-                      return;
-                    }
-
                     logger.error(
-                      "Failed to acquire lock on application",
+                      "Failed to force takeover of lock on application",
                       getErrorMeta(error),
                     );
                     span.setStatus({
@@ -2337,7 +2395,7 @@ export async function dev(options: {
               try {
                 logger.info("Releasing lock before restarting the dev server");
                 await aiService?.removeIntegrationCache();
-                await lockService?.shutdown({ serverInitiated: false });
+                await lockService?.relinquishLock();
               } catch (e) {
                 logger.error(
                   "Error releasing lock before restarting the dev server",
@@ -2414,13 +2472,13 @@ export async function dev(options: {
               }),
             );
             try {
-              // `shutdown()`, NOT `shutdownAndExit()`. The latter ends in an
-              // unconditional `finally { process.exit(1) }`; `process.exit` is
-              // synchronous, so every statement below it would be dead code
+              // `relinquishLock()`, NOT `shutdownAndExit()`. The latter ends in
+              // an unconditional `finally { process.exit(1) }`; `process.exit`
+              // is synchronous, so every statement below it would be dead code
               // whenever `lockService` is set — which is the normal state in a
               // SABS pod, exactly the population this exit path targets. The
-              // telemetry flush was silently never running. `shutdown()` does
-              // the same teardown without owning the exit, matching how
+              // telemetry flush was silently never running. `relinquishLock()`
+              // does the same teardown without owning the exit, matching how
               // `runGracefulShutdown` in dev-server.mts drives it; the
               // `finally` below performs the exit instead.
               //
@@ -2431,8 +2489,7 @@ export async function dev(options: {
                 logger,
                 removeIntegrationCache: () =>
                   aiService?.removeIntegrationCache(),
-                shutdownLockService: () =>
-                  lockService?.shutdown({ serverInitiated: false }),
+                relinquishLock: () => lockService?.relinquishLock(),
               });
             } finally {
               // The only exit on this path now that the lock service no longer
@@ -2489,15 +2546,14 @@ export async function dev(options: {
             }),
           );
           try {
-            // `shutdown()`, NOT `shutdownAndExit()` — same reason as the
+            // `relinquishLock()`, NOT `shutdownAndExit()` — same reason as the
             // sync/lock catch above: `shutdownAndExit()` exits the process
             // synchronously in its own `finally`, which made everything
             // sequenced after it unreachable.
             await runFatalExitShutdown({
               logger,
               removeIntegrationCache: () => aiService?.removeIntegrationCache(),
-              shutdownLockService: () =>
-                lockService?.shutdown({ serverInitiated: false }),
+              relinquishLock: () => lockService?.relinquishLock(),
             });
           } finally {
             // The only exit on this path; here so a thrown shutdown path can't
@@ -2695,7 +2751,8 @@ export async function dev(options: {
           logger.warn(`Error removing integration cache: ${error}`);
         });
         lockService?.shutdownAndExit().catch(() => {
-          // this is redundant, but it's here to make sure the lock service is shutdown and the process exits
+          // Redundant — `shutdownAndExit` exits from its own `finally` — but
+          // kept so the process still goes away if that ever stops being true.
           process.exit(1);
         });
       });
@@ -3094,7 +3151,7 @@ async function ensureRuntimeDbfsBranchConsistency({
   currentBranchName: string;
 }): Promise<string> {
   interface BranchSwitchingLockService {
-    isLocked: boolean;
+    isLockedWhenSettled(): Promise<boolean>;
     switchBranch(
       nextBranchName: string,
       options?: { reacquireLock?: boolean },
@@ -3124,7 +3181,8 @@ async function ensureRuntimeDbfsBranchConsistency({
 
   const lockSvc = lockService as unknown as BranchSwitchingLockService;
   const syncSvc = syncService as unknown as BranchSwitchingSyncService;
-  const wasLocked = lockSvc.isLocked;
+  // Retain the pre-switch state for explicit fallback and rollback paths.
+  const wasLocked = await lockSvc.isLockedWhenSettled();
   logger.info(
     `Switching runtime DBFS branch context from '${currentBranchName}' to '${targetBranchName}'`,
   );
@@ -3132,14 +3190,12 @@ async function ensureRuntimeDbfsBranchConsistency({
   try {
     syncSvc.setBranchName(targetBranchName);
     try {
-      await lockSvc.switchBranch(targetBranchName, {
-        reacquireLock: wasLocked,
-      });
+      await lockSvc.switchBranch(targetBranchName);
     } catch (switchError) {
       // Disconnecting native git can invalidate the previous live branch
       // context. Fall back to explicit release/reacquire on the target branch.
       logger.warn(
-        `Lock branch transfer failed for '${currentBranchName}' -> '${targetBranchName}', performing shutdown-style lock reset: ${switchError instanceof Error ? switchError.message : String(switchError)}`,
+        `Lock branch transfer failed for '${currentBranchName}' -> '${targetBranchName}', performing an explicit release and reacquire: ${switchError instanceof Error ? switchError.message : String(switchError)}`,
       );
       await lockSvc.switchBranch(targetBranchName, { reacquireLock: false });
       if (wasLocked) {
@@ -3156,7 +3212,7 @@ async function ensureRuntimeDbfsBranchConsistency({
     syncSvc.setBranchName(currentBranchName);
     try {
       await lockSvc.switchBranch(currentBranchName, {
-        reacquireLock: lockSvc.isLocked || wasLocked,
+        reacquireLock: (await lockSvc.isLockedWhenSettled()) || wasLocked,
       });
     } catch (rollbackError) {
       logger.warn(

package/src/dev-utils/dev-server-json-parser.test.mts

@@ -0,0 +1,89 @@
+import { createServer, type Server } from "node:http";
+
+import express from "express";
+import { afterEach, describe, expect, it } from "vitest";
+
+import { mountDevServerJsonParsers } from "./dev-server.mjs";
+
+describe("dev server JSON parser", () => {
+  let server: Server | undefined;
+
+  afterEach(
+    () =>
+      new Promise<void>((resolve, reject) => {
+        if (!server) {
+          resolve();
+          return;
+        }
+        server.close((error) => (error ? reject(error) : resolve()));
+      }),
+  );
+
+  async function listenWithParsers(
+    registerRoute: (app: express.Express) => void,
+  ): Promise<number> {
+    const app = express();
+    mountDevServerJsonParsers(app);
+    registerRoute(app);
+
+    server = createServer(app);
+    await new Promise<void>((resolve) => server?.listen(0, resolve));
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      throw new Error("Expected a TCP listener");
+    }
+    return address.port;
+  }
+
+  it("accepts policy gate assignment bodies larger than 100 KiB", async () => {
+    const port = await listenWithParsers((app) => {
+      app.post("/_sb_policy_gates/v1/execute", (_req, res) =>
+        res.status(204).end(),
+      );
+    });
+
+    const response = await fetch(
+      `http://127.0.0.1:${port}/_sb_policy_gates/v1/execute`,
+      {
+        body: JSON.stringify({ scanScopeJson: "x".repeat(256 * 1024) }),
+        headers: { "Content-Type": "application/json" },
+        method: "POST",
+      },
+    );
+
+    expect(response.status).toBe(204);
+  });
+
+  it("rejects policy gate JSON bodies larger than 1 MiB", async () => {
+    const port = await listenWithParsers((app) => {
+      app.post("/_sb_policy_gates/v1/execute", (_req, res) =>
+        res.status(204).end(),
+      );
+    });
+
+    const response = await fetch(
+      `http://127.0.0.1:${port}/_sb_policy_gates/v1/execute`,
+      {
+        body: JSON.stringify({ scanScopeJson: "x".repeat(1024 * 1024) }),
+        headers: { "Content-Type": "application/json" },
+        method: "POST",
+      },
+    );
+
+    expect(response.status).toBe(413);
+  });
+
+  it("keeps the 100 KiB default limit on non-policy-gate JSON posts", async () => {
+    const port = await listenWithParsers((app) => {
+      app.post("/_sb_ai/v1/chat", (_req, res) => res.status(204).end());
+    });
+
+    const response = await fetch(`http://127.0.0.1:${port}/_sb_ai/v1/chat`, {
+      body: JSON.stringify({ prompt: "x".repeat(256 * 1024) }),
+      headers: { "Content-Type": "application/json" },
+      method: "POST",
+    });
+
+    expect(response.status).toBe(413);
+  });
+});