@volter/world-runtime 2.0.15 → 2.0.17

package/src/runtime.ts

@@ -12,7 +12,7 @@ import { createRequire } from 'node:module';
 import { isIP } from 'node:net';
 import { allocatePort } from './tcp-port.ts';
 import { constants as osConstants, hostname as osHostname } from 'node:os';
-import { appendFileSync, chmodSync, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, writeFileSync, writeSync, existsSync } from 'node:fs';
+import { accessSync, appendFileSync, chmodSync, closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync, existsSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { packFacts } from './pack-facts.ts';
 import { describeServiceEnd, readServiceEnd, serviceOutput } from './service-exit.ts';
@@ -832,6 +832,7 @@ async function runExternalUp(
   logPath: string,
   abort?: AbortSignal,
 ): Promise<string> {
+  if (ownInfrastructureUp(command)) return runOwnInfrastructureUp(command, serviceId, env, logPath, abort);
   const [bin, ...args] = ownCommand(command);
   if (!bin) throw new Error(`External service "${serviceId}": up command is empty`);
   if (!commandExists(bin)) {
@@ -867,6 +868,41 @@ async function runExternalUp(
   return chunks.join('');
 }
 
+/** Whether an external `up` is this runtime's own managed-infrastructure tool (`volter-world-infra up`, which `init`
+ *  names), with nothing on PATH answering the name: the phase then runs in this process (infra.ts) instead of in a
+ *  child. The services it starts (the PGlite host, the redis and MongoDB twins) are then children of the process that
+ *  owns the World's lifetime, as every service recorder is, not of a tool that exits once they serve. Where a child
+ *  does not outlive its parent (a browser tab's process layer, measured 2026-09-28: a detached, unref'd listener
+ *  ended with the process that spawned it), the PGlite host ended the moment `volter-world-infra up` returned and
+ *  the readiness probe timed out at "0/1 declared services are ready". status and down still run as the tool.
+ *  The phase gets what the tool's process got: the infrastructure service's environment (`env`, which the hosts it
+ *  starts are spawned with, never this process's own) and the boot's abort; its commands (docker info, compose)
+ *  run without blocking this process's event loop. */
+function ownInfrastructureUp(command: string[]): boolean {
+  return command[0] === 'volter-world-infra' && command[1] === 'up' && ownCommand(command)[0] === process.execPath;
+}
+
+async function runOwnInfrastructureUp(command: string[], serviceId: string, env: NodeJS.ProcessEnv, logPath: string, abort?: AbortSignal): Promise<string> {
+  writeFileSync(logPath, `$ ${command.join(' ')}\n`, { mode: 0o600 });
+  chmodSync(logPath, 0o600);
+  const out = openPrivateLog(logPath, 'a');
+  const chunks: string[] = [];
+  try {
+    abort?.throwIfAborted();
+    const { runInfrastructure } = await import('./infra.ts');
+    const write = (text: string) => { chunks.push(text); writeSync(out, text); };
+    const code = await runInfrastructure(command[1]!, env, { out: write, err: write }, abort);
+    abort?.throwIfAborted();
+    if (code !== 0) {
+      const detail = chunks.join('').trim().split('\n').slice(-40).join('\n');
+      throw new Error(`External service "${serviceId}": up command exited ${code}\n${detail}`);
+    }
+  } finally {
+    closeSync(out);
+  }
+  return chunks.join('');
+}
+
 /** Resolve `${url}`/`${host}`/`${port}` in a readiness probe's httpUrl against an owned loopback
  * service's allocated port (process/twin readiness — the port is auto-assigned, so it can't be a
  * literal in the config). Other probe kinds (command/stdoutMatch) are returned unchanged. */
@@ -2207,7 +2243,15 @@ export function ownCommand(command: string[]): string[] {
   return [process.execPath, siblingScript(import.meta.url, stem), ...args];
 }
 
+/** A command answers when it names an executable: a path is checked as a file (what `which` does with a path),
+ *  never by spawning `which`. `ownCommand` hands this the running executable's own path (process.execPath), and a
+ *  process layer without synchronous spawn (a browser tab's, where spawnSync is ENOSYS) answered "not found on PATH"
+ *  for the very node running the World: the managed infrastructure never started there. A bare name is still looked
+ *  up on PATH. */
 function onPath(command: string): boolean {
+  if (command.includes(sep) || command.includes('/')) {
+    try { accessSync(command, fsConstants.X_OK); return statSync(command).isFile(); } catch { return false; }
+  }
   return spawnSync('which', [command], { windowsHide: true, stdio: 'ignore', env: process.env }).status === 0;
 }
 

package/src/served-world.ts

@@ -161,7 +161,8 @@ export async function mountWorld(name: string, opts: { /** the platforms whose p
   const world = new WorldDoors(name, worldRoot, configRef, served, host, held('token') ?? mintToken('tok_'), held('token.read') ?? mintToken('tok_r_'));
   const keep = (): void => { writeSecret(join(worldRoot, stateDirName(), 'token'), world.token); writeSecret(join(worldRoot, stateDirName(), 'token.read'), world.readToken); };
   let timers: ReturnType<typeof setInterval>[] = [];
-  return {
+  let stopping: Promise<void> | null = null;
+  const mounted: MountedWorld = {
     name, served, root: worldRoot,
     get token() { return world.token; }, get readToken() { return world.readToken; },
     twins: () => world.twins(),
@@ -188,13 +189,29 @@ export async function mountWorld(name: string, opts: { /** the platforms whose p
         throw error;
       }
     },
-    async stop() {
-      for (const t of timers) clearInterval(t);
-      try { rmSync(record, { force: true }); } catch { /* already gone */ }
-      const result = await downWorld(name, worldRoot);
-      if (result.externalErrors.length) throw new Error(`World "${name}" shutdown incomplete; instance and reservation retained: ${result.externalErrors.join('; ')}`);
+    stop() {
+      // one stop at a time: a second caller (the view shutting down while a switch stops this World) shares the first's
+      stopping ??= stopOnce().finally(() => { stopping = null; });
+      return stopping;
     },
   };
+  async function stopOnce(): Promise<void> {
+      // refreshes stop first, so none writes into the World while its twins stop; the serve record goes only once they are
+      // down. A stop that fails keeps the record (a checkout under the serve still refuses) and re-arms the refreshes:
+      // refused before anything stopped, the World is served as it was; failed part way, its record names what remains
+      for (const t of timers) clearInterval(t);
+      timers = [];
+      let result: Awaited<ReturnType<typeof downWorld>>;
+      try {
+        result = await downWorld(name, worldRoot);
+        if (result.externalErrors.length) throw new Error(`World "${name}" shutdown incomplete; instance and reservation retained: ${result.externalErrors.join('; ')}`);
+      } catch (error) {
+        if (instance) { try { timers = await scheduleRefreshes(name, worldRoot, instance); } catch { /* the stop's error is the one reported */ } }
+        throw error;
+      }
+      try { rmSync(record, { force: true }); } catch { /* already gone */ }
+  }
+  return mounted;
 }
 
 /** A local World's mirrors: each pack's builders, found once per process, and each client built once. */
@@ -1328,7 +1345,9 @@ export class WorldDoors {
     for (const vendor of Object.keys(this.up().services)) {
       const state = this.stateOf(vendor); const controlRoot = this.controlRoot(vendor);
       const counts = new Map<string, number>();
-      for (const r of readTree(state, controlRoot)) if (r.deleted !== true) counts.set(r.type, (counts.get(r.type) ?? 0) + 1);
+      // what the World holds as the vendor's own resources: the twin's bookkeeping (a `_` type, as a screens sign-in's token)
+      // is never a resource a person reads, as it is in no log or diff
+      for (const r of readTree(state, controlRoot)) if (r.deleted !== true && !r.type.startsWith('_')) counts.set(r.type, (counts.get(r.type) ?? 0) + 1);
       twins.push({
         twin: vendor, position: wholeLog(state, controlRoot).length,
         mirror: Boolean(await this.host.hasMirror?.(vendor)),

package/src/world-view.ts

@@ -55,11 +55,8 @@ export async function serveWorldView(name: string, opts: { root?: string; port?:
     switching = true;
     const from = world.name;
     try {
-      // a stop that fails part way brings this branch back as it was before the error is reported
-      try { await world.stop(); } catch (error) {
-        try { await world.boot(url); } catch { /* the stop's own error is the one reported */ }
-        throw error;
-      }
+      // a stop that is refused or fails leaves this branch served as it was (served-world.ts stop): the switch just fails
+      await world.stop();
       let next: MountedWorld;
       try {
         next = await mountWorld(branch, mountOpts);