@vtxmacro/cli 2026.9.69 → 2026.10.2

package/bin/vtx-service-launcher.js

@@ -243,9 +243,9 @@ import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { constants } from "node:fs";
-import { lstat, mkdir, open, readFile, realpath, rename, rm } from "node:fs/promises";
+import { lstat, mkdir, open, readdir, readFile, realpath, rename, rm } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve, win32 as windowsPath } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve, win32 as windowsPath } from "node:path";
 var InferenceHostProcessLockBusyError = class extends Error {
   constructor() {
     super("Another inference host process already owns this local host.");
@@ -785,10 +785,22 @@ var defaultProcessIdentity = async (pid) => {
   if (process.platform === "darwin") return await darwinProcessIdentity(pid);
   return null;
 };
+var cachedCurrentProcessIdentity = null;
 var defaultCurrentProcessIdentity = async () => {
-  const identity = await defaultProcessIdentity(process.pid);
-  if (!identity) throw new Error("Inference host could not establish its process-start identity.");
-  return identity;
+  if (!cachedCurrentProcessIdentity) {
+    cachedCurrentProcessIdentity = (async () => {
+      const identity = await defaultProcessIdentity(process.pid);
+      if (!identity) throw new Error("Inference host could not establish its process-start identity.");
+      return identity;
+    })();
+  }
+  const pending = cachedCurrentProcessIdentity;
+  try {
+    return await pending;
+  } catch (error) {
+    if (cachedCurrentProcessIdentity === pending) cachedCurrentProcessIdentity = null;
+    throw error;
+  }
 };
 var processLockObservationCache = /* @__PURE__ */ new Map();
 var inferenceProcessIdentitiesMatch = (stored, observed) => stored === observed;
@@ -937,150 +949,305 @@ async function writeAtomicInferencePrivateFile(path, contents, dependencies = {}
     throw error;
   }
 }
-async function acquireInferenceHostProcessLock(path, dependencies = {}) {
-  const directory = dirname(path);
-  await ensureInferencePrivateDirectory(directory);
-  const ownerToken = randomBytes(24).toString("base64url");
-  const observeIdentity = dependencies.processIdentity ?? defaultProcessIdentity;
-  const currentBootIdentity = dependencies.currentBootIdentity ?? (() => readInferenceSystemBootIdentity());
-  const isProcessAlive = dependencies.processAlive ?? ((pid) => {
+var PROCESS_LOCK_PUBLICATION_GRACE_MS = 1e4;
+var PROCESS_LOCK_MAX_RECORD_BYTES = 64 * 1024;
+var PROCESS_LOCK_GUARD_ELECTION_LEASE_MS = 5e3;
+var PROCESS_LOCK_GUARD_ELECTION_STALE_MS = 3e4;
+var PROCESS_LOCK_GUARD_ELECTION_ATTEMPTS = 8;
+var PROCESS_LOCK_GUARD_ELECTION_BACKOFF_MS = 10;
+var PROCESS_LOCK_LABEL = "Inference host process lock";
+var PROCESS_LOCK_GUARD_LABEL = "Inference host process lock reclamation guard";
+var sameProcessLockFile = (left, right) => left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+var openExclusiveProcessLockFile = async (path) => {
+  try {
+    return await open(
+      path,
+      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW,
+      384
+    );
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+};
+var inspectProcessLockFile = async (path, label, probes) => {
+  let before;
+  try {
+    before = await lstat(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return { state: "missing" };
+    throw error;
+  }
+  if (before.isSymbolicLink() || !before.isFile() || process.platform !== "win32" && (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+    throw new Error(`${label} is unsafe.`);
+  }
+  let handle;
+  try {
+    await secureExistingWindowsPath(path, "file");
+    handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  } catch (error) {
+    if (error.code === "ENOENT") return { state: "missing" };
+    throw error;
+  }
+  let stale = false;
+  try {
+    const opened = await handle.stat();
+    if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino) {
+      return { state: "busy" };
+    }
+    const raw = opened.size > PROCESS_LOCK_MAX_RECORD_BYTES ? "" : await handle.readFile("utf8");
+    const stat = await handle.stat();
+    if (!sameProcessLockFile(opened, stat)) return { state: "busy" };
+    let record = null;
     try {
-      process.kill(pid, 0);
-      return true;
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object") record = parsed;
+    } catch {
+      record = null;
+    }
+    if (!record || record.schema_version !== 2 || !Number.isSafeInteger(record.pid) || Number(record.pid) < 1 || typeof record.owner_token !== "string" || !record.owner_token || typeof record.process_identity !== "string" || !record.process_identity || typeof record.boot_identity !== "string" || !record.boot_identity) {
+      if (Date.now() - stat.mtimeMs < PROCESS_LOCK_PUBLICATION_GRACE_MS) return { state: "busy" };
+      stale = true;
+      return { state: "stale", handle, stat };
+    }
+    const ownerPid = Number(record.pid);
+    const storedIdentity = record.process_identity;
+    const cacheKey = resolve(path);
+    if (await probes.currentBootIdentity() === record.boot_identity && probes.isProcessAlive(ownerPid)) {
+      const cached = processLockObservationCache.get(cacheKey);
+      const observedIdentity = cached && cached.dev === stat.dev && cached.ino === stat.ino && cached.pid === ownerPid && cached.storedIdentity === storedIdentity && Date.now() - cached.observedAtMs < 5e3 ? cached.observedIdentity : await probes.observeIdentity(ownerPid);
+      if (!observedIdentity) {
+        throw new Error("Inference host could not verify the existing lock owner identity.");
+      }
+      processLockObservationCache.set(cacheKey, {
+        dev: stat.dev,
+        ino: stat.ino,
+        pid: ownerPid,
+        storedIdentity,
+        observedIdentity,
+        observedAtMs: Date.now()
+      });
+      if (inferenceProcessIdentitiesMatch(storedIdentity, observedIdentity)) {
+        return { state: "busy" };
+      }
+    }
+    stale = true;
+    return { state: "stale", handle, stat };
+  } finally {
+    if (!stale) await handle.close().catch(() => void 0);
+  }
+};
+var removeVerifiedStaleProcessLockFile = async (path, inspection, assertExclusive) => {
+  try {
+    await assertExclusive();
+    let current;
+    try {
+      current = await lstat(path);
     } catch (error) {
-      if (error.code === "ESRCH") return false;
+      if (error.code === "ENOENT") return;
       throw error;
     }
-  });
-  let handle;
-  for (let acquisition = 0; acquisition < 2; acquisition += 1) {
+    const opened = await inspection.handle.stat();
+    if (current.isSymbolicLink() || !sameProcessLockFile(current, opened) || !sameProcessLockFile(opened, inspection.stat)) {
+      throw new InferenceHostProcessLockBusyError();
+    }
+    if (process.platform === "win32") await inspection.handle.close();
     try {
-      handle = await open(
-        path,
-        constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW,
-        384
-      );
-      break;
+      await rm(path);
     } catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      if (acquisition > 0) {
-        throw new InferenceHostProcessLockBusyError();
+      if (error.code !== "ENOENT") throw error;
+    }
+  } finally {
+    await inspection.handle.close().catch(() => void 0);
+  }
+  processLockObservationCache.delete(resolve(path));
+  invalidateWindowsAclCache(path);
+  await syncInferenceDirectory(dirname(path));
+};
+var removeStaleProcessLockReclaimGuard = async (lockPath, guardPath, inspection) => {
+  const directory = dirname(lockPath);
+  const prefix = `${basename(lockPath)}.reclaim-ballot.`;
+  try {
+    for (let attempt = 0; attempt < PROCESS_LOCK_GUARD_ELECTION_ATTEMPTS; attempt += 1) {
+      if (attempt > 0) {
+        await new Promise((resolvePromise) => setTimeout(
+          resolvePromise,
+          Math.floor(Math.random() * PROCESS_LOCK_GUARD_ELECTION_BACKOFF_MS * 2 ** Math.min(attempt, 4))
+        ));
+        let current;
+        try {
+          current = await lstat(guardPath);
+        } catch (error) {
+          if (error.code === "ENOENT") return;
+          throw error;
+        }
+        if (!sameProcessLockFile(current, inspection.stat)) return;
       }
-      let before;
+      const ballotName = `${prefix}${randomBytes(16).toString("hex")}`;
+      const ballotPath = join(directory, ballotName);
+      const ballot = await openExclusiveProcessLockFile(ballotPath);
+      if (!ballot) continue;
+      await ballot.close();
+      const electedAt = performance.now();
       try {
-        before = await lstat(path);
-      } catch (error2) {
-        if (error2.code === "ENOENT") continue;
-        throw error2;
+        let contested = false;
+        for (const name of await readdir(directory)) {
+          if (!name.startsWith(prefix) || name === ballotName) continue;
+          const otherPath = join(directory, name);
+          let other;
+          try {
+            other = await lstat(otherPath);
+          } catch (error) {
+            if (error.code === "ENOENT") continue;
+            throw error;
+          }
+          if (!other.isDirectory() && Date.now() - other.mtimeMs > PROCESS_LOCK_GUARD_ELECTION_STALE_MS) {
+            await rm(otherPath, { force: true });
+            continue;
+          }
+          contested = true;
+        }
+        if (contested) continue;
+        await removeVerifiedStaleProcessLockFile(guardPath, inspection, async () => {
+          if (performance.now() - electedAt > PROCESS_LOCK_GUARD_ELECTION_LEASE_MS) {
+            throw new InferenceHostProcessLockBusyError();
+          }
+        });
+        return;
+      } finally {
+        await rm(ballotPath, { force: true }).catch(() => void 0);
       }
-      if (before.isSymbolicLink() || !before.isFile() || process.platform !== "win32" && (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
-        throw new Error("Inference host process lock is unsafe.");
+    }
+    throw new InferenceHostProcessLockBusyError();
+  } finally {
+    await inspection.handle.close().catch(() => void 0);
+  }
+};
+var acquireProcessLockReclaimGuard = async (lockPath, ownerRecord, probes) => {
+  const guardPath = `${lockPath}.reclaim`;
+  const guardToken = randomBytes(24).toString("base64url");
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const handle = await openExclusiveProcessLockFile(guardPath);
+    if (handle) {
+      try {
+        await handle.writeFile(ownerRecord(guardToken), "utf8");
+      } catch (error) {
+        await handle.close().catch(() => void 0);
+        await rm(guardPath, { force: true }).catch(() => void 0);
+        throw error;
       }
-      const reclaimPublicationResidue = async () => {
-        let current2;
+      await handle.close();
+      await secureWindowsPrivatePath(guardPath, "file", "harden");
+      const isHeld = async () => {
+        let reader;
         try {
-          current2 = await lstat(path);
-        } catch (error2) {
-          if (error2.code === "ENOENT") return false;
-          throw error2;
-        }
-        if (current2.isSymbolicLink() || !current2.isFile() || current2.dev !== before.dev || current2.ino !== before.ino || process.platform !== "win32" && (current2.mode & 63) !== 0 || typeof process.getuid === "function" && current2.uid !== process.getuid()) {
-          throw new Error("Inference host process lock publication residue changed or is unsafe.");
+          reader = await open(guardPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        } catch (error) {
+          if (error.code === "ENOENT") return false;
+          throw error;
         }
         try {
-          await rm(path);
-        } catch (error2) {
-          if (error2.code === "ENOENT") return false;
-          throw error2;
+          const [opened, current] = await Promise.all([reader.stat(), lstat(guardPath)]);
+          if (current.isSymbolicLink() || current.dev !== opened.dev || current.ino !== opened.ino) {
+            return false;
+          }
+          const parsed = JSON.parse(await reader.readFile("utf8"));
+          return parsed.owner_token === guardToken;
+        } catch {
+          return false;
+        } finally {
+          await reader.close().catch(() => void 0);
+        }
+      };
+      return {
+        assertHeld: async () => {
+          if (!await isHeld()) throw new InferenceHostProcessLockBusyError();
+        },
+        // Best effort: a guard left behind carries this live process identity
+        // and becomes reclaimable once this process exits.
+        release: async () => {
+          try {
+            if (!await isHeld()) return;
+            await rm(guardPath);
+            processLockObservationCache.delete(resolve(guardPath));
+            invalidateWindowsAclCache(guardPath);
+          } catch {
+          }
         }
-        processLockObservationCache.delete(resolve(path));
-        await syncInferenceDirectory(directory);
-        return true;
       };
+    }
+    if (attempt > 0) break;
+    const inspection = await inspectProcessLockFile(guardPath, PROCESS_LOCK_GUARD_LABEL, probes);
+    if (inspection.state === "busy") break;
+    if (inspection.state === "stale") {
+      await removeStaleProcessLockReclaimGuard(lockPath, guardPath, inspection);
+    }
+  }
+  throw new InferenceHostProcessLockBusyError();
+};
+async function acquireInferenceHostProcessLock(path, dependencies = {}) {
+  const directory = dirname(path);
+  await ensureInferencePrivateDirectory(directory);
+  const ownerToken = randomBytes(24).toString("base64url");
+  const probes = {
+    currentBootIdentity: dependencies.currentBootIdentity ?? (() => readInferenceSystemBootIdentity()),
+    observeIdentity: dependencies.processIdentity ?? defaultProcessIdentity,
+    isProcessAlive: dependencies.processAlive ?? ((pid) => {
       try {
-        await secureExistingWindowsPath(path, "file");
-      } catch (error2) {
-        if (error2.code === "ENOENT") continue;
-        throw error2;
+        process.kill(pid, 0);
+        return true;
+      } catch (error) {
+        if (error.code === "ESRCH") return false;
+        throw error;
       }
-      let staleOwner;
+    })
+  };
+  const [ownerIdentity, bootIdentity] = await Promise.all([
+    (dependencies.currentProcessIdentity ?? defaultCurrentProcessIdentity)(),
+    probes.currentBootIdentity()
+  ]);
+  const ownerRecord = (token) => `${JSON.stringify({
+    schema_version: 2,
+    pid: process.pid,
+    owner_token: token,
+    process_identity: ownerIdentity,
+    boot_identity: bootIdentity
+  })}
+`;
+  let handle = await openExclusiveProcessLockFile(path);
+  if (!handle) {
+    const inspection = await inspectProcessLockFile(path, PROCESS_LOCK_LABEL, probes);
+    if (inspection.state === "busy") throw new InferenceHostProcessLockBusyError();
+    if (inspection.state === "stale") {
+      await inspection.handle.close();
+      const guard = await acquireProcessLockReclaimGuard(path, ownerRecord, probes);
       try {
-        staleOwner = JSON.parse(await readFile(path, "utf8"));
-      } catch (error2) {
-        if (error2.code === "ENOENT") continue;
-        if (Date.now() - before.mtimeMs < 1e4) {
-          throw new InferenceHostProcessLockBusyError();
-        }
-        await reclaimPublicationResidue();
-        continue;
-      }
-      if (staleOwner.schema_version !== 2 || !Number.isSafeInteger(staleOwner.pid) || Number(staleOwner.pid) < 1 || typeof staleOwner.owner_token !== "string" || !staleOwner.owner_token || typeof staleOwner.process_identity !== "string" || !staleOwner.process_identity || typeof staleOwner.boot_identity !== "string" || !staleOwner.boot_identity) {
-        if (Date.now() - before.mtimeMs < 1e4) {
-          throw new InferenceHostProcessLockBusyError();
-        }
-        await reclaimPublicationResidue();
-        continue;
-      }
-      const stalePid = Number(staleOwner.pid);
-      const bootIdentity2 = await currentBootIdentity();
-      if (bootIdentity2 === staleOwner.boot_identity && isProcessAlive(stalePid)) {
-        const cached = processLockObservationCache.get(resolve(path));
-        const observedIdentity = cached && cached.dev === before.dev && cached.ino === before.ino && cached.pid === stalePid && cached.storedIdentity === staleOwner.process_identity && Date.now() - cached.observedAtMs < 5e3 ? cached.observedIdentity : await observeIdentity(stalePid);
-        if (!observedIdentity) {
-          throw new Error("Inference host could not verify the existing lock owner identity.");
-        }
-        processLockObservationCache.set(resolve(path), {
-          dev: before.dev,
-          ino: before.ino,
-          pid: stalePid,
-          storedIdentity: staleOwner.process_identity,
-          observedIdentity,
-          observedAtMs: Date.now()
-        });
-        if (inferenceProcessIdentitiesMatch(staleOwner.process_identity, observedIdentity)) {
-          throw new InferenceHostProcessLockBusyError();
+        const guarded = await inspectProcessLockFile(path, PROCESS_LOCK_LABEL, probes);
+        if (guarded.state === "busy") throw new InferenceHostProcessLockBusyError();
+        if (guarded.state === "stale") {
+          await removeVerifiedStaleProcessLockFile(path, guarded, guard.assertHeld);
         }
+        handle = await openExclusiveProcessLockFile(path);
+      } finally {
+        await guard.release();
       }
-      let current;
-      try {
-        current = await lstat(path);
-      } catch (error2) {
-        if (error2.code === "ENOENT") continue;
-        throw error2;
-      }
-      if (current.dev !== before.dev || current.ino !== before.ino) {
-        throw new Error("Inference host process lock ownership changed.");
-      }
-      await rm(path);
-      processLockObservationCache.delete(resolve(path));
-      await syncInferenceDirectory(directory);
+    } else {
+      handle = await openExclusiveProcessLockFile(path);
     }
+    if (!handle) throw new InferenceHostProcessLockBusyError();
   }
-  if (!handle) throw new Error("Inference host process lock could not be acquired.");
-  let ownerIdentity;
-  let bootIdentity;
   try {
-    [ownerIdentity, bootIdentity] = await Promise.all([
-      (dependencies.currentProcessIdentity ?? defaultCurrentProcessIdentity)(),
-      currentBootIdentity()
-    ]);
+    await handle.writeFile(ownerRecord(ownerToken), "utf8");
+    await handle.sync();
   } catch (error) {
+    const created = await handle.stat().catch(() => null);
     await handle.close().catch(() => void 0);
-    await rm(path, { force: true }).catch(() => void 0);
+    const current = await lstat(path).catch(() => null);
+    if (created && current && current.dev === created.dev && current.ino === created.ino) {
+      await rm(path, { force: true }).catch(() => void 0);
+    }
     throw error;
   }
-  await handle.writeFile(
-    `${JSON.stringify({
-      schema_version: 2,
-      pid: process.pid,
-      owner_token: ownerToken,
-      process_identity: ownerIdentity,
-      boot_identity: bootIdentity
-    })}
-`,
-    "utf8"
-  );
-  await handle.sync();
   await handle.close();
   await secureWindowsPrivatePath(path, "file", "harden");
   await syncInferenceDirectory(directory);