@tinvar/renderer 0.0.0-stage → 0.4.1

package/src/pool.js

@@ -0,0 +1,664 @@
+// A pool of renderers: N sandboxed processes, one socket each, in one
+// private directory that PHP reads as the pool.
+//
+// One renderer is one JavaScript thread, and under load that thread is what
+// runs out: on a ten-core machine it sat at 100% of a core while FrankenPHP's
+// ten workers used half of one between them, waiting on its socket (ADR
+// 0028). More renderers is the remedy; how they are run is what this module
+// decides.
+//
+// Each process here is exactly the renderer a single launch starts: its own
+// permission-model sandbox and allowlist, the allowlisted environment, its
+// own socket as the one path it may write, and a tether to this process
+// that this process never reads -- its standard input, a pipe whose end
+// here is held and left alone (spawnSandboxed). They share nothing -- no
+// listening socket, no channel to each other -- so a renderer a dependency
+// has compromised reaches no further than one renderer ever could. Node's
+// cluster module was the other way to get N processes, and was turned down
+// for that reason: its workers inherit the primary's whole environment, and
+// they ask the unsandboxed primary to listen for them, at whatever path they
+// name.
+//
+// PHP finds the renderers by listing the directory, so the set can change
+// under it. A renderer that dies has its socket removed and a new one, under
+// a new name, takes its place; a rolling restart starts each replacement
+// before the renderer it replaces stops taking renders. A name is never
+// reused, so no renderer can remove a successor's socket.
+
+import fs from 'node:fs';
+import net from 'node:net';
+import path from 'node:path';
+import { FrameReader, createCodec, encodeFrame } from './codec.js';
+import { logLine } from './log.js';
+import { FRAME } from './protocol.js';
+import { DEFAULT_DRAIN_MS } from './server.js';
+
+/** Names the supervisor, for renderer:stop and renderer:restart to signal. */
+export const PID_FILE = 'renderer.pid';
+
+export const DEFAULT_TIMINGS = Object.freeze({
+  // A renderer that has not answered a health check by then is not starting.
+  startMs: 20_000,
+  healthEveryMs: 2_000,
+  // Generous: a renderer at full load still answers within a few event-loop
+  // turns. One that misses twice running has a loop that is not turning --
+  // an infinite loop in app code -- and every render sent to it would wait
+  // out the deadline, so it is replaced.
+  healthTimeoutMs: 3_000,
+  unhealthyAfter: 2,
+  // Restarts back off from the first to the second while a renderer keeps
+  // dying young -- a build that throws on import would otherwise be started
+  // in a tight loop -- and start from the first again once one has lasted.
+  restartMinMs: 250,
+  restartMaxMs: 10_000,
+  stableAfterMs: 10_000,
+  drainMs: DEFAULT_DRAIN_MS,
+  // Past the drain, a renderer that has still not exited is killed.
+  killGraceMs: 5_000,
+});
+
+/**
+ * Asks the renderer at `socketPath` how it is, over the renderer protocol.
+ *
+ * @param {string} socketPath
+ * @param {{ codec?: string | object, timeoutMs?: number }} [options]
+ * @returns {Promise<{ pid: number, inFlight: number, served: number }>}
+ */
+export function checkHealth(
+  socketPath,
+  { codec = 'msgpack', timeoutMs = DEFAULT_TIMINGS.healthTimeoutMs } = {},
+) {
+  const wire = typeof codec === 'string' ? createCodec(codec) : codec;
+  // An answer is a few numbers; anything near this size is not one.
+  const maxFrameBytes = 4096;
+
+  return new Promise((resolve, reject) => {
+    const socket = net.createConnection(socketPath);
+    const reader = new FrameReader(maxFrameBytes, wire);
+    let settled = false;
+    const settle = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const timer = setTimeout(() => settle(new Error(`no answer within ${timeoutMs} ms`)), timeoutMs);
+
+    socket.on('connect', () => socket.write(encodeFrame({ t: FRAME.HEALTH }, maxFrameBytes, wire)));
+    socket.on('data', (chunk) => {
+      let frames;
+      try {
+        frames = reader.push(new Uint8Array(chunk));
+      } catch (error) {
+        settle(error);
+        return;
+      }
+      const frame = frames[0];
+      if (frame === undefined) return;
+      // What the renderer says is checked, and nothing it says may throw:
+      // this is a data handler, outside any try, and a throw here takes the
+      // supervisor down. Number() or String() would -- a map whose valueOf
+      // and toString are not functions cannot be made either.
+      if (frame?.t !== FRAME.HEALTHY) {
+        const type = typeof frame?.t === 'string' ? frame.t : typeof frame?.t;
+        settle(new Error(`answered a health check with a '${type}' frame`));
+        return;
+      }
+      const whole = (value) => Number.isSafeInteger(value) && value >= 0;
+      if (!whole(frame.pid) || !whole(frame.inFlight) || !whole(frame.served)) {
+        settle(
+          new Error(
+            "answered a health check without a whole number in each of 'pid', 'inFlight' and 'served'",
+          ),
+        );
+        return;
+      }
+      settle(null, { pid: frame.pid, inFlight: frame.inFlight, served: frame.served });
+    });
+    socket.on('error', (error) => settle(error));
+    socket.on('close', () => settle(new Error('closed without answering')));
+  });
+}
+
+export class RendererPool {
+  #directory;
+  #size;
+  #spawn;
+  #codec;
+  #timings;
+  #log;
+  #socketGroup;
+  #slots = [];
+  /**
+   * Every renderer started and not yet exited: each slot's, those a rolling
+   * restart replaced that are still finishing their renders, and those
+   * still starting. A stop reaches all of them; tracked through the slots
+   * alone, one starting as a replacement was missed.
+   */
+  #live = new Set();
+  #sequence = 0;
+  #started = false;
+  #stopping = null;
+  #restarting = null;
+  #again = false;
+  #monitor = null;
+
+  /**
+   * @param {{
+   *   directory: string,
+   *   processes: number,
+   *   spawn: (socketPath: string) => import('node:child_process').ChildProcess,
+   *   codec?: string,
+   *   timings?: Partial<Record<keyof typeof DEFAULT_TIMINGS, number>>,
+   *   log?: { info: (line: string) => void, error: (line: string) => void },
+   *   socketGroup?: number | null,
+   * }} options `spawn` starts one renderer listening on the path it is given;
+   *        `socketGroup` is the group the directory is shared with, as each
+   *        renderer shares its socket (src/socket-group.js)
+   */
+  constructor({ directory, processes, spawn, codec = 'msgpack', timings = {}, log, socketGroup = null }) {
+    this.#directory = directory;
+    this.#socketGroup = socketGroup;
+    this.#size = processes;
+    this.#spawn = spawn;
+    this.#codec = codec;
+    this.#timings = { ...DEFAULT_TIMINGS, ...timings };
+    // JSON lines, as a render's are, redacted and with the supervisor's pid
+    // (ADR 0112): one shipper reads every line the renderer writes.
+    this.#log = log ?? {
+      info: (line) => logLine('info', line, { component: 'pool' }),
+      error: (line) => logLine('error', line, { component: 'pool' }),
+    };
+  }
+
+  /** The sockets of the renderers taking renders now. */
+  get sockets() {
+    return this.#slots.map((slot) => slot.current?.socketPath).filter(Boolean);
+  }
+
+  /** The pids of the renderers taking renders now, by slot. */
+  get pids() {
+    return this.#slots.map((slot) => slot.current?.child.pid ?? null);
+  }
+
+  /**
+   * Starts every renderer and resolves once each has answered a health
+   * check. If any fails to start, the rest are stopped and this rejects:
+   * a pool that could not start whole is a build or a setup that is wrong.
+   * Stopped before it is up, it resolves once the renderers are ready or gone.
+   */
+  async start() {
+    prepareDirectory(this.#directory, { socketGroup: this.#socketGroup });
+
+    this.#slots = Array.from({ length: this.#size }, (_, index) => ({
+      index,
+      current: null,
+      delay: 0,
+      timer: null,
+    }));
+    for (const slot of this.#slots) slot.current = this.#launch(slot);
+
+    const ready = await Promise.all(this.#slots.map((slot) => this.#ready(slot.current)));
+    // Stopped while starting: the renderers left because they were asked
+    // to, and the stop under way is the one that ends them.
+    if (this.#stopping) return;
+    if (ready.includes(false)) {
+      await this.stop({ graceful: false });
+      const index = ready.indexOf(false);
+      throw new Error(`renderer ${index} did not start; its output is above.`);
+    }
+
+    this.#started = true;
+    this.#monitor = setInterval(() => this.#checkAll(), this.#timings.healthEveryMs);
+    this.#log.info(`a pool of ${this.#size} listening in ${this.#directory}`);
+  }
+
+  /**
+   * Replaces every renderer, one at a time, without refusing a render: each
+   * replacement is started and answering before the renderer it replaces
+   * stops taking renders and finishes the ones it has. For a deploy -- the
+   * replacements load the build as it is now.
+   *
+   * Stops at the first replacement that does not start, leaving the pool on
+   * the renderers it had: a broken build is not rolled out over a working one.
+   *
+   * @returns {Promise<boolean>} whether every renderer was replaced
+   */
+  restart() {
+    if (this.#stopping || !this.#started) return Promise.resolve(false);
+    if (this.#restarting) {
+      // Asked again mid-way: the build may have changed since this one
+      // began, so the whole pool goes round once more when it ends.
+      this.#again = true;
+      return this.#restarting;
+    }
+
+    this.#restarting = (async () => {
+      do {
+        this.#again = false;
+        for (const slot of this.#slots) {
+          if (this.#stopping) return false;
+          const replaced = await this.#replace(slot);
+          // Stopped meanwhile: the replacement was stopped with the rest.
+          if (this.#stopping) return false;
+          if (!replaced) {
+            this.#log.error(
+              `rolling restart stopped: the new renderer ${slot.index} did not start, so the pool keeps the renderers it had.`,
+            );
+            return false;
+          }
+        }
+      } while (this.#again && !this.#stopping);
+      this.#log.info(`rolling restart done: ${this.#size} renderers replaced`);
+      return true;
+    })().finally(() => {
+      this.#restarting = null;
+    });
+
+    return this.#restarting;
+  }
+
+  /**
+   * Stops the pool. Graceful: every renderer stops taking renders and
+   * finishes those it has, within the drain time. Otherwise at once: the
+   * renders in flight are cut off, and PHP reports each as incomplete.
+   *
+   * A graceful stop already under way is made immediate by asking for one
+   * that is not; asked for again as graceful, it is the same stop.
+   */
+  stop({ graceful = true } = {}) {
+    if (this.#stopping && graceful) return this.#stopping.done;
+    if (this.#stopping?.graceful === false) return this.#stopping.done;
+
+    clearInterval(this.#monitor);
+    for (const slot of this.#slots) clearTimeout(slot.timer);
+
+    const running = [...this.#live].filter((p) => !p.gone);
+    const signal = graceful ? 'SIGTERM' : 'SIGKILL';
+    for (const proc of running) proc.child.kill(signal);
+
+    const limit = graceful ? this.#timings.drainMs + this.#timings.killGraceMs : this.#timings.killGraceMs;
+    const done = Promise.all(running.map((proc) => this.#gone(proc, limit))).then(() => {
+      for (const proc of running) removeSocket(proc.socketPath);
+      removePidFile(this.#directory);
+      if (this.#started) this.#log.info(graceful ? 'pool drained and stopped' : 'pool stopped');
+    });
+
+    this.#stopping = { graceful, done };
+    return done;
+  }
+
+  /** Starts a renderer for `slot` on a socket no renderer has used. */
+  #launch(slot) {
+    const socketPath = path.join(this.#directory, `renderer-${slot.index}-${++this.#sequence}.sock`);
+    const proc = {
+      socketPath,
+      child: null,
+      startedAt: Date.now(),
+      failures: 0,
+      checking: false,
+      ready: false,
+      gone: false,
+    };
+    proc.exited = new Promise((resolve) => {
+      proc.markGone = resolve;
+    });
+
+    try {
+      proc.child = this.#spawn(socketPath);
+    } catch (error) {
+      this.#log.error(`could not start renderer ${slot.index}: ${error.message}`);
+      proc.gone = true;
+      proc.markGone();
+      queueMicrotask(() => this.#exited(slot, proc, null, null));
+      return proc;
+    }
+
+    this.#live.add(proc);
+
+    // An 'error' with no 'exit' after it is a process that never started.
+    proc.child.on('error', (error) => {
+      this.#log.error(`renderer ${slot.index}: ${error.message}`);
+      if (proc.child.pid === undefined) this.#exited(slot, proc, null, null);
+    });
+    proc.child.once('exit', (code, signal) => this.#exited(slot, proc, code, signal));
+
+    return proc;
+  }
+
+  /** Whether `proc` is listening and answering, within the start time. */
+  async #ready(proc) {
+    const deadline = Date.now() + this.#timings.startMs;
+    while (!proc.gone && Date.now() < deadline) {
+      if (fs.existsSync(proc.socketPath)) {
+        try {
+          const answer = await checkHealth(proc.socketPath, {
+            codec: this.#codec,
+            timeoutMs: this.#timings.healthTimeoutMs,
+          });
+          // Only the renderer started here counts. Anything of this user's
+          // can listen at a path in the directory -- a compromised sibling
+          // at the next socket's name, before the renderer is up -- and an
+          // answer from it would pass a replacement that never started.
+          if (answer.pid === proc.child.pid) {
+            proc.ready = true;
+            return true;
+          }
+        } catch {
+          // Listening but not answering yet: asked again below.
+        }
+      }
+      await sleep(50);
+    }
+    if (!proc.gone) proc.child?.kill('SIGKILL');
+
+    return false;
+  }
+
+  /** One slot of a rolling restart. */
+  async #replace(slot) {
+    const old = slot.current;
+    const next = this.#launch(slot);
+    if (!(await this.#ready(next)) || this.#stopping) return false;
+
+    // A restart scheduled for the old renderer, had it just died, is
+    // answered by this one. One that already ran -- the old renderer died
+    // while this one was starting -- made a renderer of its own the slot's;
+    // left there, it was overwritten below and ran on outside the pool,
+    // its socket still listed. It makes way too.
+    clearTimeout(slot.timer);
+    const displaced = slot.current;
+    slot.current = next;
+    const retiring = [...new Set([old, displaced])].filter((proc) => proc && !proc.gone);
+    for (const proc of retiring) {
+      proc.retired = true;
+      // It stops taking renders now and removes its socket; PHP has the
+      // replacement's already, so nothing waits on the gap.
+      proc.child.kill('SIGTERM');
+    }
+    await Promise.all(
+      retiring.map((proc) => this.#gone(proc, this.#timings.drainMs + this.#timings.killGraceMs)),
+    );
+    this.#log.info(`renderer ${slot.index} replaced (pid ${old?.child?.pid ?? '-'} -> ${next.child.pid})`);
+
+    return true;
+  }
+
+  #exited(slot, proc, code, signal) {
+    if (proc.reported) return;
+    proc.reported = true;
+    proc.gone = true;
+    proc.markGone();
+    this.#live.delete(proc);
+
+    // Its socket now leads nowhere: removed, PHP stops choosing it at once,
+    // rather than after a refused connection each.
+    removeSocket(proc.socketPath);
+
+    // Replaced, stopped on purpose, or a replacement that never became the
+    // slot's renderer: nothing to start in its place.
+    if (proc.retired || this.#stopping || !this.#started || slot.current !== proc) return;
+
+    const lived = Date.now() - proc.startedAt;
+    slot.delay =
+      lived >= this.#timings.stableAfterMs || slot.delay === 0
+        ? this.#timings.restartMinMs
+        : Math.min(this.#timings.restartMaxMs, slot.delay * 2);
+
+    this.#log.error(
+      `renderer ${slot.index} (pid ${proc.child?.pid ?? '-'}) exited with ${signal ?? `status ${code}`}; ` +
+        `starting another in ${slot.delay} ms`,
+    );
+
+    // Never at once, even the first time: a Ctrl-C reaches a whole process
+    // group, and a renderer may exit on it a moment before this process
+    // hears of it. Restarting then would start a renderer on the way down.
+    slot.timer = setTimeout(() => this.#respawn(slot, proc), slot.delay);
+  }
+
+  async #respawn(slot, dead) {
+    if (this.#stopping || slot.current !== dead) return;
+
+    const proc = this.#launch(slot);
+    slot.current = proc;
+    if (await this.#ready(proc)) {
+      this.#log.info(`renderer ${slot.index} restarted (pid ${proc.child.pid})`);
+    }
+    // Not ready: it was killed or died, and its exit schedules the next try.
+  }
+
+  #checkAll() {
+    for (const slot of this.#slots) {
+      const proc = slot.current;
+      if (!proc || !proc.ready || proc.gone || proc.checking) continue;
+
+      proc.checking = true;
+      checkHealth(proc.socketPath, { codec: this.#codec, timeoutMs: this.#timings.healthTimeoutMs })
+        .then((answer) => {
+          if (answer.pid !== proc.child.pid) throw new Error(`pid ${answer.pid} answered on its socket`);
+        })
+        .then(
+          () => {
+            proc.failures = 0;
+          },
+          (error) => {
+            if (proc.gone || this.#stopping) return;
+            proc.failures++;
+            if (proc.failures >= this.#timings.unhealthyAfter) {
+              this.#log.error(
+                `renderer ${slot.index} (pid ${proc.child.pid}) failed ${proc.failures} health checks running ` +
+                  `(${error.message}); replacing it`,
+              );
+              proc.child.kill('SIGKILL');
+            }
+          },
+        )
+        .finally(() => {
+          proc.checking = false;
+        });
+    }
+  }
+
+  /** Resolves once `proc` has exited, killing it if it is still there after `limitMs`. */
+  async #gone(proc, limitMs) {
+    if (proc.gone) return;
+    let timer;
+    const late = new Promise((resolve) => {
+      timer = setTimeout(() => resolve('late'), limitMs);
+    });
+    if ((await Promise.race([proc.exited, late])) === 'late') {
+      proc.child.kill('SIGKILL');
+      await proc.exited;
+    }
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Runs a pool until it is told to stop, and resolves with the exit status.
+ *
+ *   SIGTERM, SIGINT, SIGHUP  graceful stop
+ *   SIGQUIT                  immediate stop, even during a graceful one
+ *   SIGUSR2                  rolling restart, for a deploy
+ *
+ * A second SIGTERM or SIGINT does not hurry a drain. Under `tinvar serve` a
+ * terminal's Ctrl-C reaches this process and serve together, and serve then
+ * sends a SIGTERM of its own: one stop, asked for twice, while FrankenPHP
+ * finishes the requests whose renders are draining here.
+ *
+ * SIGUSR1 is not used: a listener for it is how the launcher keeps the
+ * debugger shut, and it must stay that and nothing else.
+ *
+ * @param {ConstructorParameters<typeof RendererPool>[0]} options
+ */
+export async function runPool(options) {
+  const pool = new RendererPool(options);
+
+  let resolveStopped;
+  const stopped = new Promise((resolve) => {
+    resolveStopped = resolve;
+  });
+  const stop = (graceful) => pool.stop({ graceful }).then(() => resolveStopped(0));
+
+  for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, () => stop(true));
+  process.on('SIGQUIT', () => stop(false));
+  process.on('SIGUSR2', () => {
+    pool.restart();
+  });
+
+  try {
+    await pool.start();
+  } catch (error) {
+    logLine('error', 'the pool did not start', { component: 'pool' }, error);
+    return 1;
+  }
+
+  return stopped;
+}
+
+/**
+ * The pool's directory: made if missing, and refused if anyone but this user
+ * could write it. PHP lists it to find renderers, so whoever could add a
+ * socket to it would be sent renders.
+ *
+ * With a socket group -- the renderers run as a user of their own, and PHP
+ * as another in the group -- it is given to the group and made 0750: PHP
+ * may list it, and only this user may write it. A directory a service
+ * manager made for the pool (systemd's RuntimeDirectory=) is taken as it is
+ * and set the same way.
+ *
+ * @param {string} directory
+ * @param {{ socketGroup?: number | null }} [options]
+ */
+export function prepareDirectory(directory, { socketGroup = null } = {}) {
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+
+  const stat = fs.lstatSync(directory);
+  if (!stat.isDirectory()) {
+    throw new Error(`${directory} is not a directory, so it cannot hold a renderer pool.`);
+  }
+  if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+    throw new Error(
+      `${directory} belongs to another user; a renderer pool's directory must be this user's own.`,
+    );
+  }
+  if ((stat.mode & 0o022) !== 0) {
+    throw new Error(
+      `${directory} is writable by other users, who could add a renderer of their own to the pool; ` +
+        'use a directory only this user can write (mode 700 or 755).',
+    );
+  }
+
+  if (socketGroup !== null) {
+    // Given to the group before it is opened to it.
+    fs.chownSync(directory, -1, socketGroup);
+    fs.chmodSync(directory, 0o750);
+    const shared = fs.lstatSync(directory);
+    if (shared.gid !== socketGroup || (shared.mode & 0o777) !== 0o750) {
+      throw new Error(
+        `${directory} could not be shared with group ${socketGroup} as 0750; it is ` +
+          `${(shared.mode & 0o777).toString(8)} in group ${shared.gid}.`,
+      );
+    }
+  }
+
+  // Readable by the group too, when there is one, so renderer:check run as
+  // PHP's user can name the supervisor; it can still signal none of it.
+  claimPidFile(directory, socketGroup === null ? 0o600 : 0o640);
+
+  // Sockets a pool that was killed outright left behind: nothing answers on
+  // them, and PHP would try each before finding the live ones. Only once
+  // the directory is this pool's, or a pool starting beside it would lose
+  // its sockets as stale.
+  for (const name of fs.readdirSync(directory)) {
+    const entry = path.join(directory, name);
+    if (name.endsWith('.sock') && fs.lstatSync(entry).isSocket()) fs.rmSync(entry);
+  }
+}
+
+/**
+ * Makes the directory this process's pool's, or throws if a live pool has
+ * it. The pid file is written whole and linked into place, so a reader
+ * never sees half a pid -- and linked rather than renamed, since a link
+ * refuses a file already there: checked first and written after, two pools
+ * started at the same moment both found none and both ran. One left by a
+ * pool killed outright is removed and the claim made again. (Two pools that
+ * both find such a file can still race in the moment between reading it
+ * and removing it.)
+ */
+function claimPidFile(directory, mode) {
+  const pidFile = path.join(directory, PID_FILE);
+  const temporary = `${pidFile}.${process.pid}`;
+  fs.writeFileSync(temporary, `${process.pid}\n`, { mode });
+  fs.chmodSync(temporary, mode);
+  try {
+    for (;;) {
+      try {
+        fs.linkSync(temporary, pidFile);
+        return;
+      } catch (error) {
+        if (error.code !== 'EEXIST') throw error;
+      }
+      const other = readPid(pidFile);
+      if (other !== null && other !== process.pid && running(other)) {
+        throw new Error(`a renderer pool (pid ${other}) is already running in ${directory}.`);
+      }
+      fs.rmSync(pidFile, { force: true });
+    }
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+}
+
+/**
+ * Removes what a renderer leaves at its socket path, and never throws: it
+ * runs in exit handlers, where a throw takes this process down, and every
+ * renderer with it.
+ *
+ * A renderer may write that one path, so it may leave a directory there
+ * instead of a socket -- an empty one: the sandbox refuses it anything
+ * beneath. rm() without `recursive` refuses a directory; it goes as one.
+ */
+function removeSocket(socketPath) {
+  try {
+    fs.rmSync(socketPath, { force: true });
+  } catch {
+    try {
+      fs.rmdirSync(socketPath);
+    } catch {
+      // Not empty, or not ours to remove: left where it is. PHP is refused
+      // by it, and passes over it.
+    }
+  }
+}
+
+/** The pid in `file`, or null if there is none to read. */
+export function readPid(file) {
+  try {
+    const text = fs.readFileSync(file, 'utf8').trim();
+    return /^[1-9][0-9]{0,9}$/.test(text) ? Number(text) : null;
+  } catch {
+    return null;
+  }
+}
+
+function removePidFile(directory) {
+  const pidFile = path.join(directory, PID_FILE);
+  if (readPid(pidFile) === process.pid) fs.rmSync(pidFile, { force: true });
+}
+
+/** Signal 0 asks without sending; EPERM is a process that exists under another user. */
+function running(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === 'EPERM';
+  }
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}