@superblocksteam/vite-plugin-file-sync 2.0.162-next.2 → 2.0.163-next.0

package/dist/socket-manager.js

@@ -13,13 +13,14 @@ import { clearGitAuthFailed, isGitAuthFailed, markGitAuthFailed, } from "./git-a
 import { GIT_LOG_FORMAT, parseGitLog } from "./git-log.js";
 import { GIT_OPERATION_BUSY_MESSAGE, } from "./git-operation-lock.js";
 import { assertIncomingLiveLayout } from "./git-service/app-layout-guard.js";
-import { GitConflictError } from "./git-service/index.js";
+import { GitConflictError, isMissingGitRevisionError, } from "./git-service/index.js";
 import { doesRemoteLiveBranchExist, ensureLiveBranchCheckedOut, pushLiveBranchWithAutoRecreate, rollbackLastCommit, } from "./git-service/live-branch.js";
 import { ensureProviderWorkflowFiles } from "./git-service/provider-workflow-files.js";
 import { getSyncCountsAgainstDefaultBranch } from "./git-service/status-sync.js";
 import { getErrorMeta, getLogger } from "./util/logger.js";
 import { OperationQueue } from "./util/operation-queue.js";
 const SB_WORKTREE_SNAPSHOTS_DIR = join(tmpdir(), "sb-worktree-snapshots");
+const EDITOR_RECONNECT_AUTH_TIMEOUT_MS = 30_000;
 /**
  * Pulls the JWT-derived `userId` out of an `Authorization: Bearer <jwt>`
  * header value. Returns `undefined` for missing / malformed headers or
@@ -299,6 +300,66 @@ class SocketManager extends TracedEventEmitter {
                 return true;
             });
         };
+        // Clark is bound to one editor connection at a time, and which one owns
+        // the pod has to be decided per physical connection rather than per peer
+        // id: the browser reuses its peer id across retry reconnects, so an id
+        // match does not mean the request came from the connection that is still
+        // open. Sockets are keyed by object identity and ordered by the sequence
+        // they connected in, so a request that was already waiting in a
+        // superseded connection's authorization middleware cannot take the pod
+        // back from the connection that replaced it. Only a connection that has
+        // proved its authorization is a candidate, which is why binding happens
+        // here and not on `connect:editor`.
+        let activeEditorSocket;
+        // A failed replacement may have changed AiService's transport. Keep the
+        // owner's ordering, but repair its transport before any further RPC or close.
+        let editorBindingNeedsRepair = false;
+        // Set while the bound editor's socket has closed and a reconnect for the
+        // same peer is open but has not proved its authorization yet. The pod
+        // keeps that peer's conversation until the reconnect binds or gives up.
+        let detachedEditorPeerId;
+        let detachedEditorTimer;
+        let nextEditorConnectionSequence = 0;
+        const authenticatedEditorSockets = new Map();
+        const repairEditorBinding = () => {
+            if (!editorBindingNeedsRepair)
+                return;
+            const owner = activeEditorSocket &&
+                authenticatedEditorSockets.get(activeEditorSocket);
+            if (activeEditorSocket && owner) {
+                aiService?.handleUserConnected(activeEditorSocket, owner.peerId, owner.liveness);
+            }
+            else if (detachedEditorPeerId) {
+                aiService?.detachPeerTransport(detachedEditorPeerId);
+            }
+            else {
+                aiService?.resetEditorConnection();
+            }
+            editorBindingNeedsRepair = false;
+        };
+        const resetFailedEditorTransition = () => {
+            activeEditorSocket = undefined;
+            detachedEditorPeerId = undefined;
+            clearTimeout(detachedEditorTimer);
+            editorBindingNeedsRepair = true;
+            try {
+                repairEditorBinding();
+            }
+            catch (error) {
+                // Keep the repair flag: subsequent RPCs cannot bind until teardown
+                // succeeds. Resetting bookkeeping alone would orphan the conversation.
+                getLogger().error("[socket-manager] Failed to clear editor binding after lifecycle failure", getErrorMeta(error));
+            }
+        };
+        const newestAuthenticatedEditor = () => {
+            let newest;
+            for (const [peer, connection] of authenticatedEditorSockets) {
+                if (!newest || connection.sequence > newest.sequence) {
+                    newest = { peer, ...connection };
+                }
+            }
+            return newest;
+        };
         const releaseHeadlessLock = (peerId, turnId) => headlessLockHandbackQueue.enqueue(() => releaseHeadlessLockNow(peerId, turnId));
         // Provide sync context (branchName, lastCommitId) to the AI service
         // for remote context restore fallback from Bucketeer on fresh pods.
@@ -464,6 +525,7 @@ class SocketManager extends TracedEventEmitter {
         };
         server.on("upgrade", handleUpgrade);
         this._disposer = () => {
+            clearTimeout(detachedEditorTimer);
             server.removeListener("upgrade", handleUpgrade);
             wss.close();
         };
@@ -487,6 +549,9 @@ class SocketManager extends TracedEventEmitter {
                     getLogger().warn(`[socket-manager] post-auth git activation failed: ${err instanceof Error ? err.message : String(err)}`);
                 });
             };
+            const editorConnectionSequence = isEditor
+                ? ++nextEditorConnectionSequence
+                : 0;
             const authMiddleware = async (params, ctx, _peer, next) => {
                 const result = await checkAuthorization(ctx.peerAuthorization);
                 if (!result.success) {
@@ -535,13 +600,66 @@ class SocketManager extends TracedEventEmitter {
                 // user B reconnecting to an AiService running user A's task
                 // would receive A's `taskId` and could then cancel it via
                 // the UI path. See peer-push.ts:resyncActiveTaskStatusesToPeer.
-                if (aiService && isEditor) {
+                // The authorization check above is asynchronous, so this connection
+                // can have closed while it was running, and its close handler has
+                // already run by then. Registering it here would leave a closed
+                // socket owning the pod, with the live connection's primes ignored
+                // as superseded.
+                const isOpenEditor = isEditor && this.editorSockets.has(socket);
+                if (isEditor && !isOpenEditor) {
+                    getLogger().info(`[socket-manager] Ignored an authorization proved by a closed editor connection ${peerId}`, { "editor.connection.sequence": editorConnectionSequence });
+                }
+                if (aiService && isOpenEditor) {
+                    const callerUserId = extractCallerUserId(ctx.peerAuthorization);
                     try {
-                        const callerUserId = extractCallerUserId(ctx.peerAuthorization);
-                        aiService.notifyAuthenticatedRpc(peerId, callerUserId);
+                        repairEditorBinding();
+                        authenticatedEditorSockets.set(socket, {
+                            liveness: connectionLiveness,
+                            peerId,
+                            sequence: editorConnectionSequence,
+                        });
+                        const activeConnection = activeEditorSocket
+                            ? authenticatedEditorSockets.get(activeEditorSocket)
+                            : undefined;
+                        // While the pod waits for a peer's reconnect, nobody else's
+                        // authorization takes it: the pod is unbound but not unowned,
+                        // and a collaborator's next RPC would otherwise walk off with
+                        // the conversation before that reconnect has had its chance.
+                        const waitingForAnotherPeer = detachedEditorPeerId !== undefined &&
+                            detachedEditorPeerId !== peerId;
+                        if (!waitingForAnotherPeer &&
+                            (!activeConnection ||
+                                editorConnectionSequence > activeConnection.sequence)) {
+                            aiService.handleUserConnected(socket, peerId, connectionLiveness);
+                            activeEditorSocket = socket;
+                            editorBindingNeedsRepair = false;
+                            detachedEditorPeerId = undefined;
+                            clearTimeout(detachedEditorTimer);
+                            getLogger().debug("[socket-manager] Bound editor connection", {
+                                "editor.connection.sequence": editorConnectionSequence,
+                                "peer.id": peerId,
+                            });
+                        }
                     }
                     catch (err) {
-                        getLogger().warn("[socket-manager] notifyAuthenticatedRpc threw; continuing", getErrorMeta(err));
+                        if (activeEditorSocket !== socket) {
+                            authenticatedEditorSockets.delete(socket);
+                        }
+                        editorBindingNeedsRepair = true;
+                        getLogger().error(`[socket-manager] Authenticated editor binding failed peer.id=${peerId} editor.connection.sequence=${editorConnectionSequence}`, getErrorMeta(err));
+                        throw err;
+                    }
+                    if (activeEditorSocket === socket) {
+                        try {
+                            aiService.notifyAuthenticatedRpc(peerId, callerUserId);
+                        }
+                        catch (error) {
+                            getLogger().warn("[socket-manager] Authenticated editor resync failed", {
+                                ...getErrorMeta(error),
+                                "editor.connection.sequence": editorConnectionSequence,
+                                "peer.id": peerId,
+                            });
+                        }
                     }
                 }
                 // Everything a gateway peer is trusted with hangs off this proof.
@@ -580,7 +698,6 @@ class SocketManager extends TracedEventEmitter {
                     // Renames
                     renameElement: [fileSyncManager.handleRenameElement],
                     renameApi: [fileSyncManager.handleRenameApi],
-                    // Update APIs
                     apiUpdate: [fileSyncManager.handleUpdateApi],
                     apiDelete: [fileSyncManager.handleDeleteApi],
                     // Ensure files are synced
@@ -846,6 +963,11 @@ class SocketManager extends TracedEventEmitter {
                             await aiService?.handleAiSummarizeApiUsage(request);
                         },
                     ],
+                    aiSummarizeDestructiveMigration: [
+                        async (request) => {
+                            await aiService?.handleAiSummarizeDestructiveMigration(request);
+                        },
+                    ],
                     aiSummarizeError: [
                         async (request) => {
                             await aiService?.handleAiSummarizeError(request);
@@ -936,6 +1058,15 @@ class SocketManager extends TracedEventEmitter {
                     ],
                     aiRestoreToCommit: [
                         async (request, _context) => {
+                            if (!isEditor) {
+                                throw new Error("This RPC requires an editor connection");
+                            }
+                            if (!activeEditorSocket) {
+                                throw new Error("The editor connection is still reconnecting");
+                            }
+                            if (activeEditorSocket !== socket) {
+                                throw new Error("Only the active editor connection can restore a commit");
+                            }
                             // Update clark.context.jwt from socket if missing (for restore operations)
                             if (aiService && _context.peerAuthorization) {
                                 const jwt = _context.peerAuthorization.replace("Bearer ", "");
@@ -1003,6 +1134,27 @@ class SocketManager extends TracedEventEmitter {
                             if (!aiService) {
                                 throw new Error("Cannot prime the Clark inference JWT: the AI service is not running");
                             }
+                            if (!isEditor) {
+                                throw new Error("This RPC requires an editor connection");
+                            }
+                            if (!activeEditorSocket) {
+                                throw new Error("The editor connection is still reconnecting");
+                            }
+                            // A prime can still be waiting in a closed socket's
+                            // authorization middleware when a newer connection has
+                            // already taken over the pod, and closing a socket does
+                            // not retract a request it already sent. Reported as
+                            // taken: the pod holds the newer connection's token, so
+                            // the browser has no failure to retry.
+                            if (activeEditorSocket !== socket) {
+                                getLogger().info(`[socket-manager] Ignored a Clark inference JWT prime from superseded editor connection ${peerId}`, {
+                                    "editor.connection.sequence": editorConnectionSequence,
+                                    "editor.active_connection.sequence": activeEditorSocket
+                                        ? authenticatedEditorSockets.get(activeEditorSocket)?.sequence
+                                        : undefined,
+                                });
+                                return;
+                            }
                             if (!aiService.updateClarkJwt(request.jwt)) {
                                 throw new Error("The dev server rejected the Clark inference JWT");
                             }
@@ -1449,16 +1601,36 @@ class SocketManager extends TracedEventEmitter {
                                         remote: "origin",
                                         ...getErrorMeta(fetchErr),
                                     });
+                                    if (isMissingGitRevisionError(fetchErr)) {
+                                        return [];
+                                    }
                                 }
                             }
-                            const raw = await readyGitService.raw([
-                                "log",
-                                logRef,
-                                `--format=${GIT_LOG_FORMAT}`,
-                                `-n`,
-                                String(limit),
-                            ]);
-                            return parseGitLog(raw);
+                            try {
+                                const raw = await readyGitService.raw([
+                                    "log",
+                                    logRef,
+                                    `--format=${GIT_LOG_FORMAT}`,
+                                    `-n`,
+                                    String(limit),
+                                ]);
+                                return parseGitLog(raw);
+                            }
+                            catch (logErr) {
+                                if (isMissingGitRevisionError(logErr)) {
+                                    getLogger().warn("[git] gitBranchLog skipped missing ref", {
+                                        gitCategory: "branch",
+                                        gitOperation: "branch-log",
+                                        gitOutcome: "fallback",
+                                        gitErrorKind: "missing_revision",
+                                        branch,
+                                        logRef,
+                                        ...getErrorMeta(logErr),
+                                    });
+                                    return [];
+                                }
+                                throw logErr;
+                            }
                         },
                     ],
                     gitPrepareMainCommit: [
@@ -1618,7 +1790,10 @@ class SocketManager extends TracedEventEmitter {
                     // new arrival and activates git again.
                     this.gitActivatedPeerIds.delete(peerId);
                 }
-                getLogger().info(`Socket from ${kind} closed code: ${code} reason: ${reason}`);
+                getLogger().info(`Socket from ${kind} closed code: ${code} reason: ${reason}`, {
+                    "editor.connection.sequence": editorConnectionSequence,
+                    "peer.id": peerId,
+                });
                 if (kind === "gateway") {
                     this.gatewaySockets.delete(socket);
                     lockService?.markGatewayDetached(peerId);
@@ -1631,7 +1806,93 @@ class SocketManager extends TracedEventEmitter {
                 }
                 else if (isEditor) {
                     this.editorSockets.delete(socket);
+                    const wasActiveEditor = activeEditorSocket === socket;
+                    // Keep the closing owner's binding available for repair below.
+                    // Otherwise a partial replacement makes its disconnect look stale.
+                    if (!wasActiveEditor)
+                        authenticatedEditorSockets.delete(socket);
                     const hasOtherEditorSocket = Array.from(peerSockets ?? []).some((peerSocket) => this.editorSockets.has(peerSocket));
+                    // The user really left. Tear the conversation down and hand the
+                    // pod to the newest other editor that proved its authorization.
+                    const releaseEditorBinding = (liveness) => {
+                        clearTimeout(detachedEditorTimer);
+                        detachedEditorPeerId = undefined;
+                        const replacement = newestAuthenticatedEditor();
+                        activeEditorSocket = undefined;
+                        try {
+                            aiService?.handleUserDisconnected(peerId, replacement, liveness);
+                            activeEditorSocket = replacement?.peer;
+                            getLogger().debug("[socket-manager] Released editor connection", {
+                                "editor.connection.sequence": editorConnectionSequence,
+                                "editor.active_connection.sequence": replacement?.sequence,
+                                "peer.id": peerId,
+                            });
+                            // Task pushes wait for the survivor's next authenticated RPC.
+                        }
+                        catch (error) {
+                            resetFailedEditorTransition();
+                            getLogger().error(`[socket-manager] Failed to release editor binding peer.id=${peerId} editor.connection.sequence=${editorConnectionSequence}`, getErrorMeta(error));
+                        }
+                    };
+                    try {
+                        if (wasActiveEditor) {
+                            repairEditorBinding();
+                            authenticatedEditorSockets.delete(socket);
+                            const replacement = newestAuthenticatedEditor();
+                            if (replacement?.peerId === peerId) {
+                                aiService?.handleUserConnected(replacement.peer, peerId, replacement.liveness);
+                                activeEditorSocket = replacement.peer;
+                                getLogger().debug("[socket-manager] Rebound surviving editor connection", {
+                                    "editor.connection.sequence": editorConnectionSequence,
+                                    "editor.active_connection.sequence": replacement.sequence,
+                                    "peer.id": peerId,
+                                });
+                            }
+                            else if (hasOtherEditorSocket ||
+                                connectionLiveness?.reconnectRequested) {
+                                // Wait for a pending same-peer authorization or a locally
+                                // requested reconnect that has not opened yet. Neither is a
+                                // binding candidate, but clearing context here would destroy
+                                // the conversation it is about to resume. Drop only the
+                                // transport and reserve ownership until bind or timeout.
+                                // A bare network drop without either signal deliberately
+                                // retains the ordinary last-socket teardown policy.
+                                activeEditorSocket = undefined;
+                                detachedEditorPeerId = peerId;
+                                aiService?.detachPeerTransport(peerId);
+                                getLogger().debug("[socket-manager] Waiting for editor reconnect authorization", {
+                                    "editor.connection.sequence": editorConnectionSequence,
+                                    "peer.id": peerId,
+                                });
+                                clearTimeout(detachedEditorTimer);
+                                detachedEditorTimer = setTimeout(() => {
+                                    getLogger().warn("[socket-manager] Editor reconnect authorization timed out", {
+                                        "editor.connection.sequence": editorConnectionSequence,
+                                        "peer.id": peerId,
+                                    });
+                                    releaseEditorBinding(undefined);
+                                }, EDITOR_RECONNECT_AUTH_TIMEOUT_MS);
+                                detachedEditorTimer.unref();
+                            }
+                            else {
+                                releaseEditorBinding(connectionLiveness);
+                            }
+                        }
+                        else if (detachedEditorPeerId === peerId &&
+                            !hasOtherEditorSocket) {
+                            // The reconnect the pod was waiting for gave up before it proved
+                            // its authorization. This socket was never bound, so there is no
+                            // connection generation for the AI service to check the teardown
+                            // against.
+                            detachedEditorPeerId = undefined;
+                            releaseEditorBinding(undefined);
+                        }
+                    }
+                    catch (error) {
+                        authenticatedEditorSockets.delete(socket);
+                        resetFailedEditorTransition();
+                        getLogger().error(`[socket-manager] Editor disconnect transition failed peer.id=${peerId} editor.connection.sequence=${editorConnectionSequence}`, getErrorMeta(error));
+                    }
                     if (!hasOtherEditorSocket) {
                         // Keyed by peer, so whichever of the peer's sockets is last out
                         // takes the presence down — including one that never authenticated