@volter/supercode-teams 0.3.185 → 0.3.188

package/mail/sqlite-store.mjs

@@ -6,6 +6,7 @@ import { dirname, join, resolve } from 'node:path';
 import { blake3Hex } from './envelope.mjs';
 import { MailDatabase, MailOwner, RETAINED_BODY } from './sqlite.mjs';
 import { migrateMaildir } from './retire-maildir.mjs';
+import { recoveryMailView } from './recovery-view.mjs';
 
 export const MIN_PREFIX_DIGITS = 4;
 export { RETAINED_BODY };
@@ -30,13 +31,15 @@ const validId = (id) => typeof id === 'string' && /^[A-Za-z0-9_-]+$/.test(id);
 const OFFLINE_CEILING_MS = 30 * 24 * 60 * 60_000;
 
 export class SqliteMailStore extends EventEmitter {
-  constructor({ mailRoot, machine = null, log = () => {}, database = null, retention } = {}) {
+  constructor({ mailRoot, machine = null, log = () => {}, database = null, retention, committed = false, startupRecovery = false } = {}) {
     super();
     this.root = resolve(mailRoot);
     this.machine = machine;
     this.log = log;
     this.database = database;
     this.retention = retention;
+    this.committed = committed;
+    this.startupRecovery = startupRecovery;
     this.unread = null;
   }
 
@@ -50,14 +53,21 @@ export class SqliteMailStore extends EventEmitter {
   async start() {
     if (!this.owner) throw new Error('mail cannot open without this daemon\'s writer lease');
     this.database ??= new MailDatabase(join(dirname(this.root), 'mail.sqlite'), { retention: this.retention });
-    this.imported = await migrateMaildir(this.database, this.root, { log: this.log });
-    this.database.retain();
-    this.reconcileDeliverySchedule();
+    try { this.imported = await migrateMaildir(this.database, this.root, { log: this.log, committed: this.committed || (this.startupRecovery && this.database.metadata('maildir_retirement')?.complete === true) }); }
+    catch (error) {
+      if (!this.startupRecovery) throw error;
+      this.log(`startup migration refused: ${error.message}`);
+      this.database.close();
+      this.database = await recoveryMailView(this.root, { log: this.log });
+      this.deferred = true;
+    }
+    if (!this.deferred) this.database.retain();
+    if (!this.deferred) this.reconcileDeliverySchedule();
     this.database.on('message', (address) => this.emit('changed', address));
     this.database.on('wake', ({ address, id }) => this.emit('wake', { address, id }));
     this.database.on('subscriptions', (address) => this.emit('subscriptions', address));
     this.retentionTimer = setInterval(() => {
-      try { this.database.retain(); }
+      try { if (!this.deferred) this.database.retain(); }
       catch (error) { this.log(`mail retention failed: ${error.message}`); }
     }, 3_600_000);
     this.retentionTimer.unref?.();

package/mail/upgrade-admission.mjs

@@ -0,0 +1,44 @@
+// All upgrade entrypoints ask the candidate release, never the old daemon's
+// cached modules. The candidate cannot modify the serving home's state.
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { resolve, join } from 'node:path';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+
+export async function requireUpgradeAdmission({ home, entry = new URL('../bin/teams.mjs', import.meta.url), env = process.env } = {}) {
+  const path = entry instanceof URL ? fileURLToPath(entry) : resolve(entry);
+  const scratch = await mkdtemp(join(tmpdir(), 'supercode-upgrade-'));
+  try { return await new Promise((done, reject) => {
+    const child = spawn(process.execPath, [path, 'mail', 'upgrade-inspect', '--home', resolve(home), '--json'],
+      { env: { ...env, SUPERCODE_UPGRADE_SCRATCH: scratch }, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+    let stdout = '', stderr = '', refused = false;
+    const refuse = (reason) => {
+      if (refused) return;
+      refused = true;
+      // Only the admission child we just started is ended, by its handle.
+      child.kill('SIGKILL');
+      clearTimeout(timer);
+      const error = Object.assign(new Error(`upgrade admission refused: ${reason}; the serving daemon must remain running`), { code: 'upgrade_not_ready' });
+      if (child.exitCode !== null || child.signalCode !== null || !child.pid) reject(error);
+      else child.once('close', () => reject(error));
+    };
+    const timer = setTimeout(() => refuse('candidate did not complete the existing-state check within 8 seconds'), 8000);
+    const collect = (which, bytes) => {
+      if (which === 'out') stdout += bytes; else stderr += bytes;
+      if (stdout.length + stderr.length > 64 * 1024) refuse('candidate returned an oversized admission response');
+    };
+    child.stdout.on('data', bytes => collect('out', bytes));
+    child.stderr.on('data', bytes => collect('err', bytes));
+    child.once('error', error => refuse(error.message));
+    child.once('close', (code, signal) => {
+      clearTimeout(timer);
+      if (refused) return;
+      if (code !== 0 || signal) return refuse(stderr.trim() || `candidate exited ${code ?? signal}`);
+      let receipt;
+      try { receipt = JSON.parse(stdout); } catch { return refuse('candidate returned no admission receipt'); }
+      if (receipt.stage !== 'upgrade_admission' || receipt.admitted !== true || receipt.home !== resolve(home, '..')) return refuse('candidate returned an invalid admission receipt');
+      done(receipt);
+    });
+  }); } finally { await rm(scratch, { recursive: true, force: true }); }
+}

package/mail/upgrade-readiness.mjs

@@ -0,0 +1,59 @@
+// Upgrade admission is a candidate command, before the serving daemon exits.
+// It opens live state read-only and applies this release's import/schema work
+// only to a private database. A refusal leaves the current service serving.
+import { DatabaseSync } from 'node:sqlite';
+import { lstat } from 'node:fs/promises';
+import { join, dirname, resolve } from 'node:path';
+import { MailDatabase } from './sqlite.mjs';
+import { importMaildir } from './import-maildir.mjs';
+import { requireLegacyMaildirReady } from './migration-readiness.mjs';
+import { verifyImportedMaildir } from './retire-maildir.mjs';
+import { requireSessionIndexRuntime } from '../session-index-owner.mjs';
+
+const exists = async (path) => {
+  try { return await lstat(path); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+};
+
+export async function inspectUpgradeReadiness(teamsHome, directory) {
+  requireSessionIndexRuntime();
+  // Resolve all daemon modules before admission, without starting its carrier,
+  // binding a socket or executing any retained delivery against a real session.
+  await import('../machine.mjs');
+  const home = dirname(teamsHome), root = join(home, 'mail');
+  const guard = await requireLegacyMaildirReady(root);
+  if (!directory) throw new Error('upgrade inspection requires its private admission directory');
+  let database;
+  try {
+    const live = join(home, 'mail.sqlite'), candidate = join(directory, 'mail.sqlite');
+    if (await exists(live)) {
+      const reader = new DatabaseSync(live, { readOnly: true });
+      try {
+        // SQLite creates a coherent snapshot, including committed WAL pages;
+        // copying the db/WAL files independently cannot establish that.
+        reader.prepare('VACUUM INTO ?').run(candidate);
+      } finally { reader.close(); }
+    }
+    database = new MailDatabase(candidate);
+    const retirement = database.metadata('maildir_retirement');
+    const source = await exists(root);
+    let input = root;
+    if (retirement?.source && retirement.source !== root) throw new Error('mail migration source differs from its stored receipt');
+    if (retirement?.archive && dirname(resolve(retirement.archive)) !== resolve(home, 'mail-retired')) throw new Error('migration snapshot is outside this home');
+    if (retirement?.archive && await exists(retirement.archive)) {
+      if (source) throw new Error('both the original migration snapshot and a recreated Maildir exist; explicit recovery is required before activation');
+      input = retirement.archive;
+    } else if (retirement?.complete && source) {
+      throw new Error('a retired Maildir was recreated; explicit recovery is required before activation');
+    } else if (retirement?.archive && !source && !retirement.complete) {
+      throw new Error('the incomplete mail migration source is missing');
+    }
+    const imported = await importMaildir(database, input, { legacyRoot: root });
+    if (!retirement?.complete && await exists(input)) await verifyImportedMaildir(database, input);
+    return { version: 1, stage: 'upgrade_admission', admitted: true, home,
+      messages: imported.messages, records: imported.records, retained_diagnostics: imported.skipped,
+      legacy_wrappers: guard.live.length, schema: database.metadata('schema_version') };
+  } finally {
+    database?.close();
+  }
+}

package/mail/upgrade-state.mjs

@@ -0,0 +1,78 @@
+import { connect } from 'node:net';
+import { copyFile, lstat, mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+const json = async path => { try { return JSON.parse(await readFile(path, 'utf8')); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } };
+const present = async path => { try { return await lstat(path); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } };
+const answers = socket => new Promise(done => {
+  if (typeof socket !== 'string') return done(false);
+  const probe = connect(socket), timer = setTimeout(() => { probe.destroy(); done(false); }, 200);
+  probe.once('connect', () => { clearTimeout(timer); probe.destroy(); done(true); });
+  probe.once('error', () => { clearTimeout(timer); done(false); });
+});
+
+export async function checkpoint(home, directory) {
+  const path = join(home, 'mail.sqlite');
+  let database = false;
+  if (await present(path)) {
+    const { DatabaseSync } = await import('node:sqlite');
+    const reader = new DatabaseSync(path, { readOnly: true });
+    try { reader.prepare('VACUUM INTO ?').run(join(directory, 'mail.sqlite')); database = true; }
+    finally { reader.close(); }
+  }
+  const legacy = await present(join(home, 'mail'));
+  if (legacy && !legacy.isDirectory()) throw new Error('startup checkpoint requires a regular original Maildir');
+  const before = { database, legacy: legacy ? { device: legacy.dev, inode: legacy.ino } : null };
+  await writeFile(join(directory, 'before.json'), JSON.stringify(before) + '\n', { mode: 0o600 });
+  return before;
+}
+
+async function mergeLegacy(source, target) {
+  // Older writers can recreate the path during startup. Merge only records
+  // that do not conflict; keep both complete trees if a choice is required.
+  for (const item of await readdir(source, { withFileTypes: true })) {
+    const from = join(source, item.name), to = join(target, item.name), saved = await present(to);
+    if (item.isDirectory()) {
+      if (saved && !saved.isDirectory()) throw new Error('startup recovery found conflicting legacy record types');
+      if (!saved) await mkdir(to, { mode: 0o700 });
+      await mergeLegacy(from, to);
+    } else if (item.isFile()) {
+      if (!saved) await copyFile(from, to);
+      else if (!saved.isFile() || !(await readFile(from)).equals(await readFile(to))) throw new Error('startup recovery found conflicting legacy record bytes; both originals are retained');
+    } else throw new Error('startup recovery found a non-regular legacy record');
+  }
+}
+
+export async function restore(home, directory, before, teamsHome) {
+  const serving = await json(join(teamsHome, 'machine.json'));
+  if (serving && await answers(serving.socket)) throw new Error('startup recovery refused: another daemon is serving this home');
+  const path = join(home, 'mail.sqlite');
+  if (before.legacy) {
+    const root = join(home, 'mail'), current = await present(root);
+    const original = item => item?.isDirectory() && item.dev === before.legacy.device && item.ino === before.legacy.inode;
+    if (!original(current)) {
+      const archives = join(home, 'mail-retired');
+      let matches = [];
+      if (await present(archives)) for (const name of await readdir(archives)) {
+        const path = join(archives, name);
+        if (original(await present(path))) matches.push(path);
+      }
+      // Locate the pre-start inode even if a failed candidate's database cannot
+      // be opened or its metadata transaction never committed.
+      if (matches.length !== 1) throw new Error('startup recovery cannot locate its retained original Maildir');
+      if (current) {
+        if (!current.isDirectory()) throw new Error('startup recovery found a replaced Maildir path');
+        await mergeLegacy(root, matches[0]);
+        await rename(root, join(directory, 'recreated-mail'));
+      }
+      await rename(matches[0], root);
+    }
+  }
+  // Startup failure never served a caller. Preserve the failed candidate's
+  // database bytes for diagnosis before restoring the previous schema snapshot.
+  for (const suffix of ['', '-wal', '-shm']) {
+    if (await present(path + suffix)) await rename(path + suffix, join(directory, 'failed-mail.sqlite' + suffix));
+  }
+  if (before.database) await copyFile(join(directory, 'mail.sqlite'), path);
+}
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.3.185",
+  "version": "0.3.188",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/session-index-owner.mjs

@@ -273,7 +273,8 @@ export class SessionIndexOwner extends EventEmitter {
     // Lifecycle parents cover replacement of the selected root, not every
     // sibling below that parent. Only selected physical directory bindings
     // extend file-source admission beyond its logical aliases.
-    const parents = new Set([dirname(source.root), ...[...source.aliases].map(dirname)]);
+    const parents = new Set([dirname(source.root), ...[...source.aliases].map(dirname),
+      ...(source.registryPath ? [dirname(source.registryPath)] : [])]);
     const selectedTargets = source.kind === 'stores' ? targets : targets.filter((target) => !parents.has(target));
     if (path != null && !pathUnder(source.root, path) && !pathUnder(path, source.root)
       && ![...selectedTargets, ...source.aliases].some((target) => pathUnder(path, target) || pathUnder(target, path))
@@ -349,6 +350,12 @@ export class SessionIndexOwner extends EventEmitter {
     });
     if (this.closed) return;
     for (const part of source.parts.values()) if (part.kind === 'file' && (folder === source.root || pathUnder(folder, part.path)) && !listing.parts.has(part.path)) this.#remove(source, part.path);
+    // A previous watcher may have admitted a sibling of an aliased registry.
+    // Only a completed full listing proves which transcript paths belong here;
+    // malformed files still selected retain their failure and retry evidence.
+    if (folder === source.root) for (const failure of this.store.failures([source.id])) {
+      if (failure.kind === 'file' && !listing.parts.has(failure.path)) this.store.clearFailure(source.id, failure.path, failure.kind);
+    }
     for (const path of listing.parts) { if (this.closed) return; await this.#file(source, path); }
     if (this.closed) return;
     this.store.clearFailure(source.id, folder, 'folder');