@venturewild/workspace 0.6.3 → 0.6.5

package/server/src/daemon-supervisor.mjs

@@ -1,285 +1,285 @@
-// Lifecycle owner for the bmo-sync daemon.
-//
-// The daemon is bmo-sync's sync engine running as its own process (a browser
-// app can't embed the Rust library the way wild-terminal's Tauri build did).
-// It does ALL the syncing; wild-workspace only displays its status and tells
-// it what to pair. This module is the one extra responsibility wild-workspace
-// takes on: pressing the daemon's power button.
-//
-// Why wild-workspace owns the lifecycle: on a locked-down (enterprise-managed)
-// machine the daemon cannot register itself as an OS service — logon-triggered
-// scheduled tasks are blocked without admin. So the app the user actually runs
-// starts it instead.
-//
-// The daemon is spawned DETACHED + window-hidden: it keeps running (and so
-// keeps syncing) after wild-workspace — server and browser both — has closed,
-// and it never flashes a console window. It is deliberately NOT stopped when
-// the server stops. The one gap this leaves — sync paused between a reboot and
-// the next `wild-workspace` launch — is covered by bmo-sync's offline-resume.
-
-import { spawn } from 'node:child_process';
-import {
-  openSync,
-  closeSync,
-  mkdirSync,
-  readFileSync,
-  writeFileSync,
-  unlinkSync,
-} from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-import { resolveDaemonBinary } from './daemon-bin.mjs';
-
-const DEFAULT_HTTP_BASE = 'http://127.0.0.1:8320';
-
-export class DaemonSupervisor {
-  /**
-   * @param {object} [opts]
-   * @param {string} [opts.httpBase]   the daemon's local HTTP origin.
-   * @param {string} [opts.globalDir]  where the pid + log files live. A
-   *   machine-global dir (`~/.wild-workspace`) — the daemon is one per machine,
-   *   not one per workspace, so this is deliberately NOT the per-workspace
-   *   `.wild-workspace/` data dir.
-   * @param {Function} [opts.resolveBinary]  daemon-binary resolver (test seam).
-   * @param {Function} [opts.spawnImpl]      child_process.spawn (test seam).
-   * @param {Function} [opts.fetchImpl]      global fetch (test seam).
-   * @param {Function} [opts.killImpl]       process.kill (test seam).
-   * @param {NodeJS.ProcessEnv} [opts.env]
-   */
-  constructor({
-    httpBase = DEFAULT_HTTP_BASE,
-    globalDir = path.join(os.homedir(), '.wild-workspace'),
-    resolveBinary = resolveDaemonBinary,
-    spawnImpl = spawn,
-    fetchImpl = globalThis.fetch,
-    killImpl = (pid, sig) => process.kill(pid, sig),
-    env = process.env,
-    // b-ii: when the install is logged in (account.json present), these are
-    // injected into the daemon's spawn env so it opens the proxy link
-    // (`BMO_DAEMON_ACCOUNT_TOKEN`) against the right relay
-    // (`BMO_DAEMON_SERVER_URL`). Absent → daemon syncs only, no proxy link.
-    accountToken = null,
-    serverUrl = null,
-  } = {}) {
-    this.httpBase = httpBase.replace(/\/+$/, '');
-    this.globalDir = globalDir;
-    this.pidFile = path.join(globalDir, 'daemon.pid');
-    this.logFile = path.join(globalDir, 'daemon.log');
-    // Serializes concurrent ensureRunning() spawns (server + supervisor) so only
-    // one daemon is started — prevents the duplicate-daemon :8320 bind conflict.
-    this.spawnLockFile = path.join(globalDir, 'daemon-spawn.lock');
-    this.resolveBinary = resolveBinary;
-    this.spawnImpl = spawnImpl;
-    this.fetchImpl = fetchImpl;
-    this.killImpl = killImpl;
-    this.env = env;
-    this.accountToken = accountToken;
-    this.serverUrl = serverUrl;
-  }
-
-  /** Probe the daemon's /health endpoint. Never throws. */
-  async health() {
-    try {
-      const res = await this.fetchImpl(`${this.httpBase}/health`, {
-        signal: AbortSignal.timeout(2000),
-      });
-      return { running: !!res.ok };
-    } catch {
-      return { running: false };
-    }
-  }
-
-  /**
-   * Start the daemon unless it is already up. Idempotent and best-effort —
-   * the result is reported, never thrown.
-   *
-   * Concurrency-safe: the daemon is ensured by BOTH the server (its DaemonBridge)
-   * and the always-on supervisor (daemonTick). At boot neither sees the daemon up
-   * yet, so without a guard they'd BOTH spawn → two daemons fighting over :8320
-   * (`Address already in use`) and both opening proxy links → the relay evicts one
-   * → reconnect churn. An atomic cross-process spawn lock serializes the decision:
-   * the winner re-checks health then spawns; the loser waits for the winner's
-   * daemon instead of spawning its own.
-   * @returns {Promise<{started:boolean, alreadyRunning?:boolean, pid?:number,
-   *   error?:string}>}
-   */
-  async ensureRunning() {
-    if ((await this.health()).running) {
-      return { started: false, alreadyRunning: true };
-    }
-    if (!this.acquireSpawnLock()) {
-      // Another process (server bridge / always-on supervisor) is spawning —
-      // wait for ITS daemon rather than racing in a second one.
-      const up = await this.waitForHealthy(4000);
-      return up ? { started: false, alreadyRunning: true } : { started: false, error: 'spawn-in-progress' };
-    }
-    try {
-      // Re-check under the lock: the other caller may have just brought it up.
-      if ((await this.health()).running) {
-        return { started: false, alreadyRunning: true };
-      }
-      return this.spawnDaemon();
-    } finally {
-      this.releaseSpawnLock();
-    }
-  }
-
-  /** Is a pid alive? EPERM ("exists, not ours") still counts as alive. */
-  pidAlive(pid) {
-    try { this.killImpl(pid, 0); return true; } catch (e) { return !!(e && e.code === 'EPERM'); }
-  }
-
-  /**
-   * Atomic, cross-process spawn lock (shared globalDir, so it serializes the
-   * server and the supervisor). Returns true iff we hold it. A stale lock whose
-   * recorded pid is dead is taken over — a crash mid-spawn can't wedge it.
-   */
-  acquireSpawnLock() {
-    try { mkdirSync(this.globalDir, { recursive: true }); } catch { /* surfaced below */ }
-    try {
-      writeFileSync(this.spawnLockFile, String(process.pid), { flag: 'wx' }); // atomic exclusive create
-      return true;
-    } catch {
-      let holder = null;
-      try { holder = Number(readFileSync(this.spawnLockFile, 'utf8').trim()); } catch { /* unreadable */ }
-      if (holder && this.pidAlive(holder)) return false; // a live caller is spawning
-      try { writeFileSync(this.spawnLockFile, String(process.pid)); return true; } catch { return false; }
-    }
-  }
-
-  releaseSpawnLock() {
-    try {
-      if (Number(readFileSync(this.spawnLockFile, 'utf8').trim()) === process.pid) unlinkSync(this.spawnLockFile);
-    } catch { /* already gone */ }
-  }
-
-  /** Spawn the daemon detached + window-hidden, logging to `daemon.log`. */
-  spawnDaemon() {
-    const bin = this.resolveBinary({ env: this.env });
-    // `null` = an explicit override path that doesn't exist; `path` = nothing
-    // concrete found, only the bare name as a PATH last-resort. In neither case
-    // is there a real binary to launch — refuse rather than ENOENT later.
-    if (!bin || bin.source === 'path') {
-      return { started: false, error: 'daemon-binary-not-found' };
-    }
-
-    try {
-      mkdirSync(this.globalDir, { recursive: true });
-    } catch {
-      /* fall through — openSync below will surface a real problem */
-    }
-
-    // A real fd (not 'ignore') so the daemon's stdout/stderr land in a log the
-    // user can read — and so its eprintln writes hit a valid handle.
-    let logFd = 'ignore';
-    try {
-      logFd = openSync(this.logFile, 'a');
-    } catch {
-      /* can't open the log — run anyway with output discarded */
-    }
-
-    let child;
-    try {
-      child = this.spawnImpl(bin.path, [], {
-        detached: true, //      outlive the wild-workspace server
-        windowsHide: true, //   no console window — the whole point
-        stdio: ['ignore', logFd, logFd],
-        // b-ii proxy link: inject the account token + relay URL when the
-        // install is logged in. Object-spreading a falsy value is a no-op,
-        // so an unauthenticated install spawns with a clean inherited env.
-        env: {
-          ...this.env,
-          ...(this.accountToken && { BMO_DAEMON_ACCOUNT_TOKEN: this.accountToken }),
-          ...(this.serverUrl && { BMO_DAEMON_SERVER_URL: this.serverUrl }),
-        },
-      });
-    } catch (err) {
-      if (typeof logFd === 'number') {
-        try { closeSync(logFd); } catch {}
-      }
-      return { started: false, error: String(err?.message || err) };
-    }
-
-    // The parent must drop its own copy of the log fd + its handle on the
-    // child, or the server process can't exit cleanly.
-    if (typeof logFd === 'number') {
-      try { closeSync(logFd); } catch {}
-    }
-    child.unref();
-
-    try {
-      writeFileSync(this.pidFile, String(child.pid));
-    } catch {
-      /* pid file is best-effort — `stop` falls back to a health probe */
-    }
-    return { started: true, pid: child.pid, binary: bin.path, source: bin.source };
-  }
-
-  /** The pid recorded by the last spawn, or null. */
-  readPid() {
-    try {
-      const pid = Number(readFileSync(this.pidFile, 'utf8').trim());
-      return Number.isInteger(pid) && pid > 0 ? pid : null;
-    } catch {
-      return null;
-    }
-  }
-
-  /** Stop the daemon (best-effort) by signalling the recorded pid. */
-  async stop() {
-    const pid = this.readPid();
-    if (!pid) {
-      const running = (await this.health()).running;
-      return { stopped: false, reason: running ? 'no-pid-file' : 'not-running' };
-    }
-    try {
-      this.killImpl(pid, 'SIGTERM');
-    } catch (err) {
-      if (err?.code === 'ESRCH') {
-        // already gone — tidy the stale pid file
-        try { unlinkSync(this.pidFile); } catch {}
-        return { stopped: false, reason: 'not-running' };
-      }
-      return { stopped: false, reason: String(err?.message || err) };
-    }
-    try { unlinkSync(this.pidFile); } catch {}
-    return { stopped: true, pid };
-  }
-
-  /**
-   * Recycle the daemon so it loads a freshly-resolved binary (after an
-   * auto-update). Stop the running process, wait for it to release its API port,
-   * then spawn again. Returns the `spawnDaemon` result.
-   */
-  async recycle() {
-    await this.stop();
-    // Wait for the old process to exit + free :PORT, else the new one can't bind.
-    const deadline = Date.now() + 5000;
-    while (Date.now() < deadline && (await this.health()).running) {
-      await new Promise((r) => setTimeout(r, 200));
-    }
-    return this.spawnDaemon();
-  }
-
-  /** Combined status for `wild-workspace daemon status`. */
-  async status() {
-    const { running } = await this.health();
-    return {
-      running,
-      pid: this.readPid(),
-      httpBase: this.httpBase,
-      pidFile: this.pidFile,
-      logFile: this.logFile,
-    };
-  }
-
-  /** Poll /health until the daemon answers or the deadline passes. */
-  async waitForHealthy(timeoutMs = 4000) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      if ((await this.health()).running) return true;
-      await new Promise((r) => setTimeout(r, 250));
-    }
-    return false;
-  }
-}
+// Lifecycle owner for the bmo-sync daemon.
+//
+// The daemon is bmo-sync's sync engine running as its own process (a browser
+// app can't embed the Rust library the way wild-terminal's Tauri build did).
+// It does ALL the syncing; wild-workspace only displays its status and tells
+// it what to pair. This module is the one extra responsibility wild-workspace
+// takes on: pressing the daemon's power button.
+//
+// Why wild-workspace owns the lifecycle: on a locked-down (enterprise-managed)
+// machine the daemon cannot register itself as an OS service — logon-triggered
+// scheduled tasks are blocked without admin. So the app the user actually runs
+// starts it instead.
+//
+// The daemon is spawned DETACHED + window-hidden: it keeps running (and so
+// keeps syncing) after wild-workspace — server and browser both — has closed,
+// and it never flashes a console window. It is deliberately NOT stopped when
+// the server stops. The one gap this leaves — sync paused between a reboot and
+// the next `wild-workspace` launch — is covered by bmo-sync's offline-resume.
+
+import { spawn } from 'node:child_process';
+import {
+  openSync,
+  closeSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  unlinkSync,
+} from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { resolveDaemonBinary } from './daemon-bin.mjs';
+
+const DEFAULT_HTTP_BASE = 'http://127.0.0.1:8320';
+
+export class DaemonSupervisor {
+  /**
+   * @param {object} [opts]
+   * @param {string} [opts.httpBase]   the daemon's local HTTP origin.
+   * @param {string} [opts.globalDir]  where the pid + log files live. A
+   *   machine-global dir (`~/.wild-workspace`) — the daemon is one per machine,
+   *   not one per workspace, so this is deliberately NOT the per-workspace
+   *   `.wild-workspace/` data dir.
+   * @param {Function} [opts.resolveBinary]  daemon-binary resolver (test seam).
+   * @param {Function} [opts.spawnImpl]      child_process.spawn (test seam).
+   * @param {Function} [opts.fetchImpl]      global fetch (test seam).
+   * @param {Function} [opts.killImpl]       process.kill (test seam).
+   * @param {NodeJS.ProcessEnv} [opts.env]
+   */
+  constructor({
+    httpBase = DEFAULT_HTTP_BASE,
+    globalDir = path.join(os.homedir(), '.wild-workspace'),
+    resolveBinary = resolveDaemonBinary,
+    spawnImpl = spawn,
+    fetchImpl = globalThis.fetch,
+    killImpl = (pid, sig) => process.kill(pid, sig),
+    env = process.env,
+    // b-ii: when the install is logged in (account.json present), these are
+    // injected into the daemon's spawn env so it opens the proxy link
+    // (`BMO_DAEMON_ACCOUNT_TOKEN`) against the right relay
+    // (`BMO_DAEMON_SERVER_URL`). Absent → daemon syncs only, no proxy link.
+    accountToken = null,
+    serverUrl = null,
+  } = {}) {
+    this.httpBase = httpBase.replace(/\/+$/, '');
+    this.globalDir = globalDir;
+    this.pidFile = path.join(globalDir, 'daemon.pid');
+    this.logFile = path.join(globalDir, 'daemon.log');
+    // Serializes concurrent ensureRunning() spawns (server + supervisor) so only
+    // one daemon is started — prevents the duplicate-daemon :8320 bind conflict.
+    this.spawnLockFile = path.join(globalDir, 'daemon-spawn.lock');
+    this.resolveBinary = resolveBinary;
+    this.spawnImpl = spawnImpl;
+    this.fetchImpl = fetchImpl;
+    this.killImpl = killImpl;
+    this.env = env;
+    this.accountToken = accountToken;
+    this.serverUrl = serverUrl;
+  }
+
+  /** Probe the daemon's /health endpoint. Never throws. */
+  async health() {
+    try {
+      const res = await this.fetchImpl(`${this.httpBase}/health`, {
+        signal: AbortSignal.timeout(2000),
+      });
+      return { running: !!res.ok };
+    } catch {
+      return { running: false };
+    }
+  }
+
+  /**
+   * Start the daemon unless it is already up. Idempotent and best-effort —
+   * the result is reported, never thrown.
+   *
+   * Concurrency-safe: the daemon is ensured by BOTH the server (its DaemonBridge)
+   * and the always-on supervisor (daemonTick). At boot neither sees the daemon up
+   * yet, so without a guard they'd BOTH spawn → two daemons fighting over :8320
+   * (`Address already in use`) and both opening proxy links → the relay evicts one
+   * → reconnect churn. An atomic cross-process spawn lock serializes the decision:
+   * the winner re-checks health then spawns; the loser waits for the winner's
+   * daemon instead of spawning its own.
+   * @returns {Promise<{started:boolean, alreadyRunning?:boolean, pid?:number,
+   *   error?:string}>}
+   */
+  async ensureRunning() {
+    if ((await this.health()).running) {
+      return { started: false, alreadyRunning: true };
+    }
+    if (!this.acquireSpawnLock()) {
+      // Another process (server bridge / always-on supervisor) is spawning —
+      // wait for ITS daemon rather than racing in a second one.
+      const up = await this.waitForHealthy(4000);
+      return up ? { started: false, alreadyRunning: true } : { started: false, error: 'spawn-in-progress' };
+    }
+    try {
+      // Re-check under the lock: the other caller may have just brought it up.
+      if ((await this.health()).running) {
+        return { started: false, alreadyRunning: true };
+      }
+      return this.spawnDaemon();
+    } finally {
+      this.releaseSpawnLock();
+    }
+  }
+
+  /** Is a pid alive? EPERM ("exists, not ours") still counts as alive. */
+  pidAlive(pid) {
+    try { this.killImpl(pid, 0); return true; } catch (e) { return !!(e && e.code === 'EPERM'); }
+  }
+
+  /**
+   * Atomic, cross-process spawn lock (shared globalDir, so it serializes the
+   * server and the supervisor). Returns true iff we hold it. A stale lock whose
+   * recorded pid is dead is taken over — a crash mid-spawn can't wedge it.
+   */
+  acquireSpawnLock() {
+    try { mkdirSync(this.globalDir, { recursive: true }); } catch { /* surfaced below */ }
+    try {
+      writeFileSync(this.spawnLockFile, String(process.pid), { flag: 'wx' }); // atomic exclusive create
+      return true;
+    } catch {
+      let holder = null;
+      try { holder = Number(readFileSync(this.spawnLockFile, 'utf8').trim()); } catch { /* unreadable */ }
+      if (holder && this.pidAlive(holder)) return false; // a live caller is spawning
+      try { writeFileSync(this.spawnLockFile, String(process.pid)); return true; } catch { return false; }
+    }
+  }
+
+  releaseSpawnLock() {
+    try {
+      if (Number(readFileSync(this.spawnLockFile, 'utf8').trim()) === process.pid) unlinkSync(this.spawnLockFile);
+    } catch { /* already gone */ }
+  }
+
+  /** Spawn the daemon detached + window-hidden, logging to `daemon.log`. */
+  spawnDaemon() {
+    const bin = this.resolveBinary({ env: this.env });
+    // `null` = an explicit override path that doesn't exist; `path` = nothing
+    // concrete found, only the bare name as a PATH last-resort. In neither case
+    // is there a real binary to launch — refuse rather than ENOENT later.
+    if (!bin || bin.source === 'path') {
+      return { started: false, error: 'daemon-binary-not-found' };
+    }
+
+    try {
+      mkdirSync(this.globalDir, { recursive: true });
+    } catch {
+      /* fall through — openSync below will surface a real problem */
+    }
+
+    // A real fd (not 'ignore') so the daemon's stdout/stderr land in a log the
+    // user can read — and so its eprintln writes hit a valid handle.
+    let logFd = 'ignore';
+    try {
+      logFd = openSync(this.logFile, 'a');
+    } catch {
+      /* can't open the log — run anyway with output discarded */
+    }
+
+    let child;
+    try {
+      child = this.spawnImpl(bin.path, [], {
+        detached: true, //      outlive the wild-workspace server
+        windowsHide: true, //   no console window — the whole point
+        stdio: ['ignore', logFd, logFd],
+        // b-ii proxy link: inject the account token + relay URL when the
+        // install is logged in. Object-spreading a falsy value is a no-op,
+        // so an unauthenticated install spawns with a clean inherited env.
+        env: {
+          ...this.env,
+          ...(this.accountToken && { BMO_DAEMON_ACCOUNT_TOKEN: this.accountToken }),
+          ...(this.serverUrl && { BMO_DAEMON_SERVER_URL: this.serverUrl }),
+        },
+      });
+    } catch (err) {
+      if (typeof logFd === 'number') {
+        try { closeSync(logFd); } catch {}
+      }
+      return { started: false, error: String(err?.message || err) };
+    }
+
+    // The parent must drop its own copy of the log fd + its handle on the
+    // child, or the server process can't exit cleanly.
+    if (typeof logFd === 'number') {
+      try { closeSync(logFd); } catch {}
+    }
+    child.unref();
+
+    try {
+      writeFileSync(this.pidFile, String(child.pid));
+    } catch {
+      /* pid file is best-effort — `stop` falls back to a health probe */
+    }
+    return { started: true, pid: child.pid, binary: bin.path, source: bin.source };
+  }
+
+  /** The pid recorded by the last spawn, or null. */
+  readPid() {
+    try {
+      const pid = Number(readFileSync(this.pidFile, 'utf8').trim());
+      return Number.isInteger(pid) && pid > 0 ? pid : null;
+    } catch {
+      return null;
+    }
+  }
+
+  /** Stop the daemon (best-effort) by signalling the recorded pid. */
+  async stop() {
+    const pid = this.readPid();
+    if (!pid) {
+      const running = (await this.health()).running;
+      return { stopped: false, reason: running ? 'no-pid-file' : 'not-running' };
+    }
+    try {
+      this.killImpl(pid, 'SIGTERM');
+    } catch (err) {
+      if (err?.code === 'ESRCH') {
+        // already gone — tidy the stale pid file
+        try { unlinkSync(this.pidFile); } catch {}
+        return { stopped: false, reason: 'not-running' };
+      }
+      return { stopped: false, reason: String(err?.message || err) };
+    }
+    try { unlinkSync(this.pidFile); } catch {}
+    return { stopped: true, pid };
+  }
+
+  /**
+   * Recycle the daemon so it loads a freshly-resolved binary (after an
+   * auto-update). Stop the running process, wait for it to release its API port,
+   * then spawn again. Returns the `spawnDaemon` result.
+   */
+  async recycle() {
+    await this.stop();
+    // Wait for the old process to exit + free :PORT, else the new one can't bind.
+    const deadline = Date.now() + 5000;
+    while (Date.now() < deadline && (await this.health()).running) {
+      await new Promise((r) => setTimeout(r, 200));
+    }
+    return this.spawnDaemon();
+  }
+
+  /** Combined status for `wild-workspace daemon status`. */
+  async status() {
+    const { running } = await this.health();
+    return {
+      running,
+      pid: this.readPid(),
+      httpBase: this.httpBase,
+      pidFile: this.pidFile,
+      logFile: this.logFile,
+    };
+  }
+
+  /** Poll /health until the daemon answers or the deadline passes. */
+  async waitForHealthy(timeoutMs = 4000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if ((await this.health()).running) return true;
+      await new Promise((r) => setTimeout(r, 250));
+    }
+    return false;
+  }
+}