@vantran-se/openchamber-web 1.24.4 → 2.0.1

package/server/lib/guests/routes.js

@@ -195,6 +195,7 @@ export const registerGuestRoutes = (app, {
   resolveGitBinaryForSpawn,
   resolveOptionalProjectDirectory,
   getSmallModelService,
+  onGuestDeactivated = async () => false,
 }) => {
   const persistPath = extensionsPersistPath(openchamberDataDir);
   const authPath = guestAuthPersistPath(openchamberDataDir);
@@ -309,6 +310,7 @@ export const registerGuestRoutes = (app, {
       if (!isGuestPanelId(id)) {
         return res.status(404).json({ error: 'not-found' });
       }
+      const removed = await loadGuest(id);
       const result = await uninstallGuest(id, persistPath);
       if (!result.ok) {
         const status = result.code === 'bundled' ? 400 : 404;
@@ -316,6 +318,9 @@ export const registerGuestRoutes = (app, {
       }
       // Remove means forget: tokens, client secret, and settings go with the package.
       await forgetGuestAuth(id, authPath);
+      // A role this package stood in for (the agent's browser) goes back to
+      // the host's own, and the user is told rather than finding out mid-task.
+      await onGuestDeactivated({ guestId: id, guestName: removed?.name ?? id });
       res.status(204).end();
     } catch (error) {
       console.error('Failed to uninstall guest:', error);
@@ -561,7 +566,7 @@ export const registerGuestRoutes = (app, {
       res.json(result);
     } catch (error) {
       if (error instanceof GuestServiceError) {
-        const status = error.code === 'SERVICE_FAILED' ? 502 : 400;
+        const status = error.code === 'SERVICE_FAILED' || error.code === 'REQUEST_FAILED' ? 502 : 400;
         return res.status(status).json({ error: error.code, message: error.message });
       }
       console.error('Failed to proxy guest service request:', error);
@@ -716,6 +721,7 @@ export const registerGuestRoutes = (app, {
       await setCapabilityGrants(guest.id, persistPath, granted, granted.length > 0 ? scope : null);
       if (granted.length === 0) {
         await stopGuestService(guest.id);
+        await onGuestDeactivated({ guestId: guest.id, guestName: guest.name });
       }
       // Credentials were stored for one API origin and one pair of OAuth
       // endpoints. When a newer version points the integration somewhere
@@ -745,6 +751,9 @@ export const registerGuestRoutes = (app, {
         return res.status(400).json({ error: 'invalid-request' });
       }
       await setGuestEnabled(guest.id, persistPath, parsed.data.enabled);
+      if (!parsed.data.enabled) {
+        await onGuestDeactivated({ guestId: guest.id, guestName: guest.name });
+      }
       const next = await loadGuest(guest.id);
       if (!next) {
         return res.status(404).json({ error: 'not-found' });

package/server/lib/guests/service.js

@@ -37,10 +37,39 @@ const runtimes = new Map();
 /** @type {Map<string, Promise<ServiceRuntime>>} */
 const startingByGuest = new Map();
 
+/** @type {Map<string, Promise<void>>} */
+const stoppingByGuest = new Map();
+
+// Requests retain their lifecycle object across awaits. A later host start
+// cannot reopen admission for work that belonged to the previous host.
+let hostLifecycle = { accepting: true };
+
+export const beginGuestServiceHost = () => {
+  if (runtimes.size || startingByGuest.size || stoppingByGuest.size) {
+    throw new Error('Guest services must finish stopping before a new host starts.');
+  }
+  hostLifecycle.accepting = false;
+  hostLifecycle = { accepting: true };
+};
+
+export const beginGuestServiceShutdown = () => {
+  hostLifecycle.accepting = false;
+};
+
+const assertGuestHostActive = (lifecycle) => {
+  if (!lifecycle.accepting) {
+    throw new GuestServiceError('The host is shutting down.', 'NO_SERVICE');
+  }
+};
+
 export class GuestServiceError extends Error {
   /**
    * @param {string} message
-   * @param {'NO_SERVICE' | 'SERVICE_FAILED' | 'BAD_PATH' | 'BAD_METHOD'} code
+   * @param {'NO_SERVICE' | 'SERVICE_FAILED' | 'REQUEST_FAILED' | 'BAD_PATH' | 'BAD_METHOD' | 'DISABLED' | 'CANCELLED'} code
+   * `SERVICE_FAILED` is a service that never became ready: nothing was sent
+   * to it. `REQUEST_FAILED` is a request that was sent and got no usable
+   * answer (timeout, dropped connection, unreadable body): the service may
+   * have acted on it.
    */
   constructor(message, code) {
     super(message);
@@ -175,6 +204,72 @@ const stopEpochs = new Map();
 
 const stopEpochOf = (guestId) => stopEpochs.get(guestId) ?? 0;
 
+/**
+ * Services the host starts on its own (a provider role) have no panel whose
+ * closing would end them, so they end themselves: a request arms a timer, the
+ * next request re-arms it, and when it fires with nothing in flight the
+ * process goes away. The next request starts it again. A panel-driven service
+ * passes no `idleStopMs` and keeps today's lifetime.
+ * @type {Map<string, { timer: ReturnType<typeof setTimeout>, inflight: number, idleMs: number }>}
+ */
+const idleStops = new Map();
+
+const clearIdleStop = (guestId) => {
+  const entry = idleStops.get(guestId);
+  if (!entry) return;
+  clearTimeout(entry.timer);
+  idleStops.delete(guestId);
+};
+
+/** Long-lived consumers (a surface viewer) that keep an idle-stopping service up. */
+const holds = new Map();
+
+const armIdleStop = (guestId, idleMs) => {
+  const previous = idleStops.get(guestId);
+  const inflight = previous?.inflight ?? 0;
+  if (previous) clearTimeout(previous.timer);
+  const timer = setTimeout(() => {
+    const current = idleStops.get(guestId);
+    if (!current || current.inflight > 0 || (holds.get(guestId) ?? 0) > 0) {
+      // A request is running or a viewer is attached; whichever ends last
+      // re-arms the timer.
+      return;
+    }
+    idleStops.delete(guestId);
+    void discardRuntime(guestId);
+  }, idleMs);
+  timer.unref?.();
+  idleStops.set(guestId, { timer, inflight, idleMs });
+};
+
+/**
+ * Keeps an idle-stopping service alive while the returned release function
+ * has not been called. Releasing the last hold restarts the idle window.
+ * @param {string} guestId
+ */
+export const holdGuestService = (guestId) => {
+  holds.set(guestId, (holds.get(guestId) ?? 0) + 1);
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    const remaining = (holds.get(guestId) ?? 1) - 1;
+    if (remaining > 0) {
+      holds.set(guestId, remaining);
+      return;
+    }
+    holds.delete(guestId);
+    const entry = idleStops.get(guestId);
+    if (entry && runtimes.get(guestId)) armIdleStop(guestId, entry.idleMs);
+  };
+};
+
+const trackInflight = (guestId, delta) => {
+  const entry = idleStops.get(guestId);
+  if (!entry) return;
+  entry.inflight = Math.max(0, entry.inflight + delta);
+};
+
 /**
  * A user-facing stop (Pause, Remove, withdrawn approval, socket change,
  * host quit): ends the process and cancels any request or start in flight.
@@ -182,6 +277,7 @@ const stopEpochOf = (guestId) => stopEpochs.get(guestId) ?? 0;
  */
 export const stopGuestService = async (guestId) => {
   stopEpochs.set(guestId, stopEpochOf(guestId) + 1);
+  clearIdleStop(guestId);
   await discardRuntime(guestId);
 };
 
@@ -192,6 +288,8 @@ export const stopGuestService = async (guestId) => {
  * @param {string} guestId
  */
 const discardRuntime = async (guestId) => {
+  const stopping = stoppingByGuest.get(guestId);
+  if (stopping) return stopping;
   const runtime = runtimes.get(guestId);
   if (!runtime) {
     return;
@@ -202,7 +300,7 @@ const discardRuntime = async (guestId) => {
   if (child.exitCode !== null || child.signalCode) {
     return;
   }
-  await new Promise((resolve) => {
+  const stopped = new Promise((resolve) => {
     const timer = setTimeout(() => {
       child.kill('SIGKILL');
       resolve(undefined);
@@ -213,14 +311,24 @@ const discardRuntime = async (guestId) => {
     });
     child.kill('SIGTERM');
   });
+  stoppingByGuest.set(guestId, stopped);
+  try {
+    await stopped;
+  } finally {
+    stoppingByGuest.delete(guestId);
+  }
 };
 
 /** Test seam: the pid of a guest's running service, or `null`. */
 export const readServicePid = (guestId) => runtimes.get(guestId)?.child.pid ?? null;
 
 export const stopAllGuestServices = async () => {
-  const ids = [...runtimes.keys()];
-  await Promise.all(ids.map((id) => stopGuestService(id)));
+  const starts = [...startingByGuest.values()];
+  const ids = new Set([...runtimes.keys(), ...startingByGuest.keys(), ...stoppingByGuest.keys()]);
+  const stops = [...ids].map((id) => stopGuestService(id));
+  // Cancelled starts reject normally. Await their cleanup as well as children
+  // already registered when shutdown began.
+  await Promise.allSettled([...starts, ...stops]);
 };
 
 /**
@@ -266,7 +374,14 @@ const startGuestService = async ({
   socketBindings = [],
   socketOverrides = {},
   epoch,
+  lifecycle,
 }) => {
+  assertGuestHostActive(lifecycle);
+  // A replacement must not occupy the same guest slot while its previous
+  // child is still stopping; host shutdown must be able to drain both.
+  const previousStop = stoppingByGuest.get(guestId);
+  if (previousStop) await previousStop;
+  assertGuestHostActive(lifecycle);
   const existing = runtimes.get(guestId);
   if (existing?.status === 'ready' && existing.child.exitCode === null && !existing.child.signalCode) {
     return existing;
@@ -276,7 +391,7 @@ const startGuestService = async ({
   }
   // The request's epoch, read before its first store access: a Pause that
   // finished anywhere since then is a cancellation, spawn included.
-  const cancelled = () => stopEpochOf(guestId) !== epoch;
+  const cancelled = () => !lifecycle.accepting || stopEpochOf(guestId) !== epoch;
   const stoppedError = () => new GuestServiceError('The service was stopped before it became ready.', 'NO_SERVICE');
 
   const absoluteEntry = path.resolve(packageRoot, entry);
@@ -294,6 +409,7 @@ const startGuestService = async ({
     throw stoppedError();
   }
   const port = await reserveLoopbackPort();
+  if (cancelled()) throw stoppedError();
   const token = crypto.randomBytes(24).toString('hex');
   const socketEnv = socketBindings.length > 0
     ? await resolveServiceSocketEnv(socketBindings, socketOverrides)
@@ -418,8 +534,15 @@ const ensureGuestService = async (params) => {
 };
 
 /**
+ * Starts the guest's service if needed and sends it one HTTP request, giving
+ * back the raw `Response`. This is the one place a host-driven caller (a
+ * provider role, a shared surface) or a panel proxy talks to the loopback:
+ * the enabled check, the grant, the spawn, the epoch, and the bearer live
+ * here. The caller reads the body as it needs it (text, JSON, image bytes).
+ *
  * @param {{
  *   guestId: string,
+ *   guestName?: string,
  *   packageRoot: string,
  *   service: { entry: string, permissions?: { sockets?: Array<{ id: string, candidatesByPlatform?: Partial<Record<'linux' | 'darwin' | 'win32', string[]>> }>, exec?: string[] } },
  *   granted: string[],
@@ -428,9 +551,16 @@ const ensureGuestService = async (params) => {
  *   path: string,
  *   query?: Record<string, string>,
  *   body?: string,
- * }} params
+ *   accept?: string,
+ *   timeoutMs?: number,
+ *   idleStopMs?: number,
+ *   signal?: AbortSignal,
+ * }} params `timeoutMs` and `idleStopMs` are for host-driven calls; a
+ * panel's `serviceRequest` keeps the SDK limits. With `idleStopMs` the
+ * service stops itself after that long without a request; `holdGuestService`
+ * suspends that while a long-lived consumer (a surface viewer) is attached.
  */
-export const proxyGuestServiceRequest = async ({
+export const openGuestServiceRequest = async ({
   guestId,
   guestName,
   packageRoot,
@@ -441,7 +571,13 @@ export const proxyGuestServiceRequest = async ({
   path: requestPath,
   query,
   body,
+  accept = 'application/json',
+  timeoutMs = GUEST_REQUEST_TIMEOUT_MS,
+  idleStopMs,
+  signal,
 }) => {
+  const lifecycle = hostLifecycle;
+  assertGuestHostActive(lifecycle);
   if (!METHODS.has(method)) {
     throw new GuestServiceError('Unsupported request method.', 'BAD_METHOD');
   }
@@ -453,6 +589,7 @@ export const proxyGuestServiceRequest = async ({
   // enabled flag it read before the pause.
   const epoch = stopEpochOf(guestId);
   const store = await readExtensionStore(persistPath);
+  assertGuestHostActive(lifecycle);
   if (store.disabledGuests?.[guestId]) {
     const label = typeof guestName === 'string' && guestName.trim() ? guestName.trim() : 'This extension';
     throw new GuestServiceError(
@@ -481,9 +618,10 @@ export const proxyGuestServiceRequest = async ({
       socketBindings,
       socketOverrides,
       epoch,
+      lifecycle,
     });
   }
-  if (stopEpochOf(guestId) !== epoch) {
+  if (!lifecycle.accepting || stopEpochOf(guestId) !== epoch) {
     if (runtimes.get(guestId) === runtime) {
       await discardRuntime(guestId);
     }
@@ -507,13 +645,24 @@ export const proxyGuestServiceRequest = async ({
 
   /** @type {Record<string, string>} */
   const headers = {
-    Accept: 'application/json',
+    Accept: accept,
     [OPENCHAMBER_SERVICE_AUTH_HEADER]: `Bearer ${runtime.token}`,
   };
   if (body !== undefined && method !== 'GET') {
     headers['Content-Type'] = 'application/json';
   }
 
+  if (idleStopMs) {
+    armIdleStop(guestId, idleStopMs);
+    trackInflight(guestId, 1);
+  }
+  const settleIdle = () => {
+    if (!idleStopMs) return;
+    trackInflight(guestId, -1);
+    // Measured from the end of the last request, not its start: a long
+    // action must not be cut short by a timer armed before it began.
+    if (runtimes.get(guestId) === runtime) armIdleStop(guestId, idleStopMs);
+  };
   let response;
   try {
     response = await fetch(url, {
@@ -521,18 +670,47 @@ export const proxyGuestServiceRequest = async ({
       headers,
       body: method === 'GET' || body === undefined ? undefined : body,
       redirect: 'manual',
-      signal: AbortSignal.timeout(GUEST_REQUEST_TIMEOUT_MS),
+      signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs),
     });
   } catch {
+    settleIdle();
+    if (signal?.aborted) {
+      throw new GuestServiceError('The request was cancelled.', 'CANCELLED');
+    }
     runtime.status = 'failed';
-    throw new GuestServiceError('Guest service request failed.', 'SERVICE_FAILED');
+    throw new GuestServiceError('Guest service request failed.', 'REQUEST_FAILED');
   }
+  // The body is still streaming when we return; the idle window starts once
+  // the caller has read it (or dropped it), which is what `finished` marks.
+  return {
+    response,
+    finished: settleIdle,
+  };
+};
 
-  const text = await response.text();
+/**
+ * Panel-shaped proxy: text answer, capped. Same params as
+ * `openGuestServiceRequest` plus `responseMax`.
+ */
+export const proxyGuestServiceRequest = async ({ responseMax = GUEST_REQUEST_RESPONSE_MAX, ...params }) => {
+  const { response, finished } = await openGuestServiceRequest(params);
+  let text;
+  try {
+    text = await response.text();
+  } catch {
+    finished();
+    if (params.signal?.aborted) {
+      throw new GuestServiceError('The request was cancelled.', 'CANCELLED');
+    }
+    const runtime = runtimes.get(params.guestId);
+    if (runtime) runtime.status = 'failed';
+    throw new GuestServiceError('Guest service request failed.', 'REQUEST_FAILED');
+  }
+  finished();
   return {
     status: response.status,
-    body: text.length <= GUEST_REQUEST_RESPONSE_MAX
+    body: text.length <= responseMax
       ? text
-      : text.slice(0, GUEST_REQUEST_RESPONSE_MAX),
+      : text.slice(0, responseMax),
   };
 };

package/server/lib/guests/service.test.js

@@ -1,10 +1,12 @@
-import { afterEach, describe, expect, test } from 'bun:test';
+import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
 import {
   getServiceStatus,
+  beginGuestServiceHost,
+  beginGuestServiceShutdown,
   proxyGuestServiceRequest,
   readServicePid,
   stopAllGuestServices,
@@ -45,6 +47,8 @@ http.createServer((req, res) => {
   return { dir, persistPath, packageRoot };
 };
 
+beforeEach(() => beginGuestServiceHost());
+
 afterEach(async () => {
   await stopAllGuestServices();
 });
@@ -194,6 +198,86 @@ describe('guest service proxy', () => {
   });
 });
 
+describe('host-driven services', () => {
+  const request = (extra) => ({
+    guestId: 'docker',
+    packageRoot: extra.packageRoot,
+    service: { entry: 'service/main.js' },
+    granted: ['service'],
+    persistPath: extra.persistPath,
+    method: 'GET',
+    path: '/ping',
+    ...extra,
+  });
+
+  test('stops itself after the idle window and restarts on the next request', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      const first = await proxyGuestServiceRequest(request({ packageRoot, persistPath, idleStopMs: 150 }));
+      expect(first.status).toBe(200);
+      const pid = readServicePid('docker');
+      expect(pid).not.toBeNull();
+      await new Promise((resolve) => setTimeout(resolve, 400));
+      expect(getServiceStatus('docker')).toBe('stopped');
+      expect(readServicePid('docker')).toBeNull();
+
+      const second = await proxyGuestServiceRequest(request({ packageRoot, persistPath, idleStopMs: 150 }));
+      expect(second.status).toBe(200);
+      expect(readServicePid('docker')).not.toBe(pid);
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('a request keeps re-arming the window, and a panel request never arms one', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      await proxyGuestServiceRequest(request({ packageRoot, persistPath, idleStopMs: 200 }));
+      const pid = readServicePid('docker');
+      for (let i = 0; i < 3; i += 1) {
+        await new Promise((resolve) => setTimeout(resolve, 120));
+        await proxyGuestServiceRequest(request({ packageRoot, persistPath, idleStopMs: 200 }));
+      }
+      expect(readServicePid('docker')).toBe(pid);
+
+      await stopGuestService('docker');
+      await proxyGuestServiceRequest(request({ packageRoot, persistPath }));
+      await new Promise((resolve) => setTimeout(resolve, 350));
+      expect(getServiceStatus('docker')).toBe('ready');
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('a longer timeout and a bigger response cap are honoured', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      const result = await proxyGuestServiceRequest(request({ packageRoot, persistPath, timeoutMs: 45_000, responseMax: 5 }));
+      expect(result).toEqual({ status: 200, body: '{"pon' });
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('an aborted request reports cancellation, not a failed service', async () => {
+    const { dir, persistPath, packageRoot } = await writeFixture();
+    try {
+      await setCapabilityGrants('docker', persistPath, ['service']);
+      await proxyGuestServiceRequest(request({ packageRoot, persistPath }));
+      const controller = new AbortController();
+      controller.abort();
+      await expect(proxyGuestServiceRequest(request({ packageRoot, persistPath, signal: controller.signal })))
+        .rejects.toMatchObject({ code: 'CANCELLED' });
+      expect(getServiceStatus('docker')).toBe('ready');
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+});
+
 describe('pause during startup', () => {
   test('a stop that lands while the service is coming up wins', async () => {
     const { dir, persistPath, packageRoot } = await writeFixture();
@@ -275,3 +359,119 @@ describe('restart after the process died', () => {
     }
   });
 });
+
+describe('host shutdown', () => {
+  const request = (fixture) => ({
+    guestId: 'docker', packageRoot: fixture.packageRoot,
+    service: { entry: 'service/main.js' }, granted: ['service'],
+    persistPath: fixture.persistPath, method: 'GET', path: '/ping',
+  });
+
+  test('a replacement waits for the previous child and cannot escape host shutdown', async () => {
+    const fixture = await writeFixture();
+    await fs.appendFile(path.join(fixture.packageRoot, 'service/main.js'), '\nprocess.on("SIGTERM", () => {});\n');
+    let pid;
+    let reading;
+    let accessing;
+    try {
+      await proxyGuestServiceRequest(request(fixture));
+      pid = readServicePid('docker');
+      const previousStop = stopGuestService('docker');
+      accessing = spyOn(fs, 'access');
+      const storeRead = Promise.withResolvers();
+      const readFile = fs.readFile.bind(fs);
+      reading = spyOn(fs, 'readFile').mockImplementation(async (...args) => {
+        const result = await readFile(...args);
+        if (args[0] === fixture.persistPath) storeRead.resolve();
+        return result;
+      });
+      const replacement = proxyGuestServiceRequest(request(fixture)).catch((error) => error);
+      await storeRead.promise;
+      await new Promise((resolve) => setImmediate(resolve));
+      expect(accessing).not.toHaveBeenCalledWith(path.join(fixture.packageRoot, 'service/main.js'));
+      expect(readServicePid('docker')).toBeNull();
+      beginGuestServiceShutdown();
+      const stopping = stopAllGuestServices();
+      process.kill(pid, 'SIGKILL');
+      await Promise.all([previousStop, stopping]);
+      expect(await replacement).toMatchObject({ code: 'NO_SERVICE' });
+      expect(readServicePid('docker')).toBeNull();
+      expect(() => process.kill(pid, 0)).toThrow();
+    } finally {
+      reading?.mockRestore();
+      accessing?.mockRestore();
+      if (pid) { try { process.kill(pid, 'SIGKILL'); } catch {} }
+      await stopAllGuestServices();
+      await fs.rm(fixture.dir, { recursive: true, force: true });
+    }
+  });
+
+  test('rejects new requests, drains a live child, and only reopens on a new host lifecycle', async () => {
+    const fixture = await writeFixture();
+    try {
+      expect((await proxyGuestServiceRequest(request(fixture))).status).toBe(200);
+      const pid = readServicePid('docker');
+      beginGuestServiceShutdown();
+      const stopping = stopAllGuestServices();
+      await expect(proxyGuestServiceRequest(request(fixture))).rejects.toMatchObject({ code: 'NO_SERVICE' });
+      await stopping;
+      expect(readServicePid('docker')).toBeNull();
+      expect(() => process.kill(pid, 0)).toThrow();
+      await expect(proxyGuestServiceRequest(request(fixture))).rejects.toMatchObject({ code: 'NO_SERVICE' });
+      beginGuestServiceHost();
+      expect((await proxyGuestServiceRequest(request(fixture))).status).toBe(200);
+    } finally {
+      await stopAllGuestServices();
+      await fs.rm(fixture.dir, { recursive: true, force: true });
+    }
+  });
+
+  test('drains a first start paused before spawn and prevents it from surviving shutdown', async () => {
+    const fixture = await writeFixture();
+    const entered = Promise.withResolvers();
+    const release = Promise.withResolvers();
+    const access = fs.access.bind(fs);
+    const pausedAccess = spyOn(fs, 'access').mockImplementation(async (...args) => {
+      if (args[0] === path.join(fixture.packageRoot, 'service/main.js')) {
+        entered.resolve();
+        await release.promise;
+      }
+      return access(...args);
+    });
+    try {
+      const pending = proxyGuestServiceRequest(request(fixture)).catch((error) => error);
+      await entered.promise;
+      expect(readServicePid('docker')).toBeNull();
+      beginGuestServiceShutdown();
+      let drained = false;
+      const stopping = stopAllGuestServices().then(() => { drained = true; });
+      await Promise.resolve();
+      expect(drained).toBe(false);
+      expect(() => beginGuestServiceHost()).toThrow();
+      release.resolve();
+      expect(await pending).toMatchObject({ code: 'NO_SERVICE' });
+      await stopping;
+      expect(readServicePid('docker')).toBeNull();
+      expect(getServiceStatus('docker')).toBe('stopped');
+    } finally {
+      release.resolve();
+      pausedAccess.mockRestore();
+      await stopAllGuestServices();
+      await fs.rm(fixture.dir, { recursive: true, force: true });
+    }
+  });
+
+  test('a request still reading the store cannot enter a later host lifecycle', async () => {
+    const fixture = await writeFixture();
+    try {
+      const pending = proxyGuestServiceRequest(request(fixture));
+      beginGuestServiceShutdown();
+      await stopAllGuestServices();
+      beginGuestServiceHost();
+      await expect(pending).rejects.toMatchObject({ code: 'NO_SERVICE' });
+      expect(readServicePid('docker')).toBeNull();
+    } finally {
+      await fs.rm(fixture.dir, { recursive: true, force: true });
+    }
+  });
+});