@vibelord/lanes 1.0.0

package/payload/lanes/libexec/view.sh

@@ -0,0 +1,179 @@
+#!/bin/sh
+# Viewport supervisor: shows whichever lane this view's target file names. It never exits on its own:
+# a zellij command pane whose command exits is held ("ENTER to re-run") and can be closed, so the view
+# loops forever and shows a status screen instead of dying.
+# usage: view.sh <device> <workspace> [slot]
+#   switch lane: write the lane id to $STATE/views/<device>/<workspace>.<slot>.target, then `kill -USR1` this pid.
+set -u
+device=${1:?device} ws=${2:?workspace} slot=${3:-main}
+mobile=0; [ "${4:-}" != --mobile ] || mobile=1
+case "$device$ws$slot" in *[!A-Za-z0-9_.-]*) echo 'invalid view name'; exit 64 ;; esac
+state=${LANES_STATE:-$HOME/.local/state/lanes}
+repo=$(cd "$(dirname "$0")/.." && pwd)
+dir=$state/views/$device
+mkdir -p "$dir"
+target_file=$dir/$ws.$slot.target
+err_file=$dir/$ws.$slot.err
+echo $$ > "$dir/$ws.$slot.pid"
+export LANES_STATE="$state" LANES_WS="$ws"
+
+child=
+switching=0
+on_switch() {
+    switching=1
+    if [ -n "$child" ]; then kill -TERM "$child" 2>/dev/null || :; fi
+}
+on_stop() {
+    trap - HUP TERM
+    if [ -n "$child" ]; then kill -TERM "$child" 2>/dev/null || :; fi
+    exit 0
+}
+sizing=0
+on_winch() {
+    # Only while we are waiting for a usable size; never disturb an attached lane client.
+    if [ "$sizing" = 1 ] && [ -n "$child" ]; then kill -TERM "$child" 2>/dev/null || :; fi
+}
+trap on_switch USR1
+trap on_winch WINCH
+trap on_stop HUP TERM
+trap '' INT QUIT   # Ctrl-C on a status screen must not kill the view
+
+# Run a child asynchronously so traps fire immediately. dash redirects stdin of async commands to
+# /dev/null before applying <&0, so keep the terminal on fd 9 first (proven in coder-launch/supervise.sh).
+run() {
+    exec 9<&0
+    "$@" <&9 9<&- 2>"$err_file" &
+    child=$!
+    exec 9<&-
+    rc=0
+    wait "$child" || rc=$?
+    # A trapped signal interrupts wait; make sure the child is really gone before moving on.
+    while kill -0 "$child" 2>/dev/null; do wait "$child" 2>/dev/null || :; done
+    child=
+    return "$rc"
+}
+
+reset_terminal() {
+    # Leave alt screen, mouse modes, bracketed paste, kitty keyboard; reset SGR; clear screen + scrollback.
+    printf '\033[?1049l\033[?1000l\033[?1002l\033[?1003l\033[?1006l\033[?2004l\033[<u\033[0m\033[?25h\033[2J\033[3J\033[H'
+}
+
+# status_screen <title> <text> <dim line> [<lead>]: a lead, when given, is the bold headline above the title.
+status_screen() {
+    reset_terminal
+    if [ -n "${4:-}" ]; then printf '\n  \033[1m%s\033[0m\n\n  %s\n' "$4" "$1"
+    else printf '\n  \033[1m%s\033[0m\n' "$1"; fi
+    printf '\n  %s\n\n  \033[2m%s\033[0m\n' "$2" "$3"
+}
+
+# Is the socket of the lane just shown still there? Then only this VIEWER ended: a lane lives in its holder's server
+# inside the container and never depends on a viewer. File tests and builtins only — no fork, no tmux, no docker:
+# this runs exactly when the host may be too slow for any of them. Unsure = say nothing.
+lane_socket_exists() {
+    case "$holder" in
+        tmux)
+            # statusd's flag: this server's PROCESS runs although its socket file was deleted (emptied /tmp).
+            if grep -q -x -F "$f2/$f3" "$state/flags/sockets-lost" 2>/dev/null; then return 0; fi
+            init=; { IFS= read -r init < "$state/containers/$f2.pid"; } 2>/dev/null || :
+            case "$init" in ''|*[!0-9]*) return 1 ;; esac
+            [ -S "${LANES_PROC_ROOT:-/proc}/$init/root/tmp/tmux-${LANES_CONTAINER_UID:-1000}/$f3" ] ;;
+        zmx) [ -S "$HOME/.lz/$f2/s/$f3" ] ;;
+        *) return 1 ;;
+    esac
+}
+
+# One sentence about the host, or nothing, from statusd's one-line heartbeat $STATE/health
+# ("at=<epoch> level=<ok|busy|critical> …": the key order is part of the format, see lanes_lib.health_line).
+# Its age is judged with OUR clock ($1 = now): a statusd that froze cannot report its own freeze.
+health_hint() {
+    host_hint= health=
+    { IFS= read -r health < "$state/health"; } 2>/dev/null || :   # no file, or no final newline: judged below
+    at=${health#at=}; at=${at%% *}
+    level=${health#* level=}; level=${level%% *}
+    case "$at" in ''|*[!0-9]*) return 0 ;; esac
+    case "$level" in
+        critical) host_hint='The host is under memory pressure: attaching can take a while.' ;;
+        busy) host_hint='The host is busy: attaching can take a while.' ;;
+    esac
+    if [ $(($1 - at)) -gt 30 ]; then host_hint="${host_hint:+$host_hint }The status data is $(($1 - at)) s old."; fi
+}
+
+delay=1
+while :; do
+    # A background-created zellij session has no real size yet: idle until a client has attached once.
+    while [ ! -e "$state/clients/$device.ready" ] || { [ "$mobile" = 1 ] && [ ! -e "$dir/$ws.$slot.shown" ]; }; do
+        status_screen "$ws" 'waiting for the first client…' ''
+        run sleep 2 || :
+    done
+
+    # zellij sizes a tab only once some client has looked at it; until then the pane has a made-up size
+    # (e.g. 14x49). Attaching from such a pane would squeeze the lane, so wait for a sane size first.
+    while :; do
+        size=$(stty size 2>/dev/null || echo '0 0')
+        rows=${size% *} cols=${size#* }
+        min_cols=40 min_rows=8
+        [ "$mobile" != 1 ] || { min_cols=20; min_rows=4; }
+        if [ "${cols:-0}" -ge "$min_cols" ] 2>/dev/null && [ "${rows:-0}" -ge "$min_rows" ] 2>/dev/null; then break; fi
+        status_screen "$ws" 'waiting to be shown…' ''
+        sizing=1; run sleep 3 || :; sizing=0
+    done
+
+    lane=$(head -n 1 "$target_file" 2>/dev/null || :)
+    # Only the first viewport opens the workspace's default lane; extra viewports stay empty until asked.
+    if [ -z "$lane" ] && [ "$slot" = main ]; then lane=$(head -n 1 "$state/defaults/$ws" 2>/dev/null || :); fi
+    case "$lane" in
+        ''|*[!A-Za-z0-9_.-]*)
+            if [ "$slot" = main ]; then hint='Pick one in the sidebar (Ctrl-Alt-/ to find a lane).'
+            else hint='In the sidebar, move to a lane and press 2 (or 3) to show it here.'; fi
+            status_screen "$ws" 'No lane selected.' "$hint"
+            switching=0; run sleep 5 || :; continue ;;
+    esac
+    resolve=$state/resolve/$lane
+    if [ ! -r "$resolve" ]; then resolve=$state/resolve.dynamic/$lane; fi
+    if [ ! -r "$resolve" ]; then
+        status_screen "$lane" 'This lane is no longer in the registry.' 'Pick another lane in the sidebar.'
+        switching=0; run sleep 5 || :; continue
+    fi
+    { IFS= read -r holder; IFS= read -r f2; IFS= read -r f3; IFS= read -r f4; IFS= read -r title; } < "$resolve"
+
+    reset_terminal
+    switching=0
+    started=$(date +%s)
+    case "$holder" in
+        tmux) run "$repo/holders/tmux.sh" "$f2" "$f3" "$f4" || : ;;
+        zmx)  run "$repo/holders/zmx.sh" "$f2" "$f3" "$f4" || : ;;
+        exec) run "$repo/holders/exec.sh" "$f2" "$f3" "$f4" || : ;;
+        *)    rc=64 ;;
+    esac
+    if [ "$switching" = 1 ]; then delay=1; continue; fi
+
+    # The holder's client has just left its own last word on the screen (tmux: "[terminated]", "[lost server]"), which
+    # reads like the death of the lane. Replace it AT ONCE — before date / tail below, which are forks and can take
+    # seconds on a thrashing host. Not after 64 / 66 / 69: there the holder itself found no such lane or server.
+    #
+    # The headline says only what `lane_socket_exists` proves — the lane's SERVER answered — because that is
+    # all a fork-free check can know. It used to say "THE LANE IS STILL RUNNING", and a lane KILLED on a
+    # server that holds other lanes produces exactly this shape: MEASURED (tmux 3.4, default config) the
+    # client of a killed session exits 0 with `[exited]` while the server stays up, so a Throttle Studio
+    # `Stop` of a lane this viewport was showing headlined that the lane still ran, one second before the
+    # holder answered 66 "no such tmux session" (DEF-965). The retry below is what learns the session's fate.
+    lead=
+    untouched=' — the lane itself is untouched'
+    case "$rc" in
+        # The holder itself found no such lane or server: nothing may claim the lane is untouched.
+        64|66|69) untouched= ;;
+        *) if lane_socket_exists; then
+               lead="THIS VIEWER DISCONNECTED — the lane's tmux server is still running"
+               status_screen "${title:-$lane}" 'reconnecting…' "$holder · $f2 · $f3 · $f4" "$lead"
+           fi ;;
+    esac
+    ended=$(date +%s)
+    if [ $((ended - started)) -ge 30 ]; then delay=1; fi
+    reason=$(tail -n 1 "$err_file" 2>/dev/null || :)
+    health_hint "$ended"
+    status_screen "${title:-$lane}" "${reason:-viewer detached (exit $rc)}${untouched}; retrying in ${delay}s.${host_hint:+
+  $host_hint}" "$holder · $f2 · $f3 · $f4" "$lead"
+    run sleep "$delay" || :
+    delay=$((delay * 2))
+    if [ "$delay" -gt 15 ]; then delay=15; fi
+done

package/payload/lanes/scripts/adopt-sharing-candidate.py

@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+"""Offline adoption of PR #352's deployed schema-37 candidate.
+
+Stop the platform first. Connection comes from libpq's PG* environment/service.
+Normal platform startup continues to reject mismatched migration journals.
+"""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+
+ROOT = Path(__file__).resolve().parents[2]
+MIGRATIONS = ROOT / "crates/throttle-platform/migrations"
+LOCK_KEY = 0x5448524F5F4D4752
+CANDIDATE_DIGEST = "625d4c9c7807116fe5cf5aca2c52bb6efacfc4755b55b24836cebaf60267865c"
+
+
+def sha256(path):
+    digest = hashlib.sha256()
+    with path.open("rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            digest.update(block)
+    return digest.hexdigest()
+
+
+def chain():
+    files = sorted(MIGRATIONS.glob("[0-9][0-9][0-9][0-9]_*.sql"))
+    files = [p for p in files if int(p.name[:4]) <= 39]
+    if [int(p.name[:4]) for p in files] != list(range(1, 40)):
+        raise RuntimeError("expected the canonical migration chain 1..39")
+    if sha256(files[38]) != CANDIDATE_DIGEST:
+        raise RuntimeError("sharing SQL differs from the deployed candidate; refusing adoption")
+    return files
+
+
+def adoption_sql():
+    files = chain()
+    rows = ",\n".join(f"({i}, decode('{sha256(p)}', 'hex'))" for i, p in enumerate(files, 1))
+    return f"""BEGIN;
+SET LOCAL lock_timeout = '5s';
+SET LOCAL statement_timeout = '120s';
+DO $guard$ BEGIN
+  IF NOT pg_try_advisory_xact_lock({LOCK_KEY}) THEN
+    RAISE EXCEPTION 'platform migration lock is held; stop the platform first';
+  END IF;
+END $guard$;
+LOCK public.schema_migrations IN ACCESS EXCLUSIVE MODE;
+CREATE TEMP TABLE expected_chain(version integer PRIMARY KEY, sha256 bytea) ON COMMIT DROP;
+INSERT INTO expected_chain VALUES {rows};
+DO $guard$ BEGIN
+  IF (SELECT count(*) FROM public.schema_migrations) <> 37 OR
+     EXISTS (SELECT 1 FROM public.schema_migrations j
+             FULL JOIN expected_chain e ON e.version = j.version AND e.version <= 36
+             WHERE (e.version <= 36 OR j.version <= 36) AND
+                   (j.version IS NULL OR e.version IS NULL OR j.sha256 <> e.sha256)) OR
+     NOT EXISTS (SELECT 1 FROM public.schema_migrations
+                 WHERE version = 37 AND sha256 = decode('{CANDIDATE_DIGEST}', 'hex')) THEN
+    RAISE EXCEPTION 'not the exact PR 352 candidate journal; no changes made';
+  END IF;
+  IF to_regclass('studio.lane_shares') IS NULL OR
+     to_regclass('studio.lane_sharing_policy') IS NULL OR
+     to_regclass('studio.hosts') IS NOT NULL THEN
+    RAISE EXCEPTION 'candidate catalog differs; no changes made';
+  END IF;
+END $guard$;
+-- Keep sharing data, exact SQL digest and original applied_at.
+UPDATE public.schema_migrations SET version = 39 WHERE version = 37;
+{files[36].read_text()}
+{files[37].read_text()}
+INSERT INTO public.schema_migrations(version, sha256)
+  SELECT version, sha256 FROM expected_chain WHERE version IN (37,38);
+DO $guard$ BEGIN
+  IF EXISTS (SELECT 1 FROM expected_chain e FULL JOIN public.schema_migrations j USING (version)
+             WHERE e.version IS NULL OR j.version IS NULL OR e.sha256 <> j.sha256) THEN
+    RAISE EXCEPTION 'canonical journal verification failed';
+  END IF;
+END $guard$;
+COMMIT;
+"""
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--apply", action="store_true", required=True)
+    parser.add_argument("--platform-stopped", action="store_true", required=True)
+    parser.add_argument("--backup-dir", type=Path, required=True)
+    args = parser.parse_args()
+    sql = adoption_sql()
+    os.umask(0o077)
+    args.backup_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
+    work = Path(tempfile.mkdtemp(prefix="sharing-candidate-", dir=args.backup_dir))
+    backup = work / "before.dump"
+    subprocess.run(["pg_dump", "--no-password", "--format=custom", "--file", str(backup)], check=True)
+    subprocess.run(["pg_restore", "--list", str(backup)], check=True, stdout=subprocess.DEVNULL)
+    receipt = {"backup": str(backup.resolve()), "backup_sha256": sha256(backup), "status": "backed_up"}
+    receipt_path = work / "receipt.json"
+    receipt_path.write_text(json.dumps(receipt, indent=2) + "\n")
+    result = subprocess.run(["psql", "-X", "--no-password", "-q", "-v", "ON_ERROR_STOP=1"], input=sql, text=True)
+    receipt["status"] = "canonical_schema_39" if result.returncode == 0 else "refused_or_rolled_back"
+    receipt_path.write_text(json.dumps(receipt, indent=2) + "\n")
+    print(json.dumps({"receipt": str(receipt_path.resolve()), "status": receipt["status"]}))
+    raise SystemExit(result.returncode)
+
+
+if __name__ == "__main__":
+    main()

package/payload/lanes/site/README.md

@@ -0,0 +1,28 @@
+# Choose a deployment
+
+The software has no default server. A profile is plain `KEY=VALUE` data and the server's public host key;
+it contains no client private key or login token.
+
+For your own host, copy `site.example.conf` to `site.conf`, fill in its address/account/host-key alias, and
+put a verified `known_hosts` file beside it. These two local files are Git-ignored. Then run `./install.sh`
+from `lanes/`. You can keep the pair elsewhere and use `./install.sh --site /path/to/site.conf` instead.
+
+A known_hosts record has the form:
+
+```text
+workspace-server ssh-ed25519 AAAA...verified-public-host-key...
+```
+
+Use the alias from `LANES_SERVER_ALIAS`. Get the key from the administrator or an already trusted server
+session (`/etc/ssh/ssh_host_ed25519_key.pub`); a network key scan alone does not authenticate it.
+
+For the existing Beyond Work server, select `./install.sh --site site/beyondwork/site.conf` explicitly.
+That directory preserves the existing deployment address and pinned public key as one named profile.
+
+The installer saves a client-owned copy of the profile and key in `~/.config/lanes/client-site.conf` and
+`client-known-hosts`. Updates and `--check` reuse them. To switch deployments, pass `--site` again.
+SSH refuses changed host keys until the administrator's new fingerprint has been verified.
+
+Server-side board catalogs belong in `~/.config/lanes/workspaces/`; real workspaces, credentials and generated
+state are not part of the software package. Optional server facts such as a public SSH fallback are served from
+`~/.config/lanes/site.conf` by `lanes client-config`. See [installation](../docs/INSTALL.md).

package/payload/lanes/site/beyondwork/known_hosts

@@ -0,0 +1 @@
+ceobox ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEq1SYj7AHFMLna0FIaIluqXDOAjJKg5RTXcd9OzqfHw

package/payload/lanes/site/beyondwork/site.conf

@@ -0,0 +1,11 @@
+# Site file: the workspace server this package connects to. Plain KEY=VALUE (read, never executed).
+# Only what a client needs BEFORE its first connection lives here. Everything else (for example the public
+# fallback address) is fetched from the server once the client is authorized:  lanes client-config
+LANES_SITE_SCHEMA=1
+LANES_SITE=beyondwork
+# known_hosts alias the server's host key is pinned under (site/known_hosts)
+LANES_SERVER_ALIAS=ceobox
+# Tailscale address of the server (the address is only meaningful inside the tailnet) and its MagicDNS name
+LANES_SERVER_HOST=100.91.241.52
+LANES_SERVER_NAME=ceobox.tail70a9fd.ts.net
+LANES_SERVER_USER=dev

package/payload/lanes/site/site.example.conf

@@ -0,0 +1,10 @@
+# Copy to site/site.conf, edit, then run ./install.sh.
+# Plain data, not a shell script. Put the matching public host key in site/known_hosts.
+LANES_SITE_SCHEMA=1
+LANES_SITE=my-team
+LANES_SERVER_ALIAS=workspace-server
+LANES_SERVER_HOST=workspace-server.example.ts.net
+LANES_SERVER_NAME=workspace-server.example.ts.net
+LANES_SERVER_USER=workspace
+# Optional public SSH fallback (use only if your server exposes SSH there):
+# LANES_SERVER_PUBLIC=ssh.example.com