@zgeoff/atc 2.28.0 → 2.29.0

package/src/daemon/{make-non-blocking-log.ts → create-non-blocking-log.ts}

@@ -9,7 +9,17 @@ const MAX_QUEUED_BYTES = 64 * 1024;
 const writeAsync = promisify(write);
 
 /**
- * Makes a log that writes each line to a file descriptor without ever
+ * A log that never blocks the event loop. `log` queues one line, and
+ * `drain` resolves once every queued line is written or the given number of
+ * milliseconds has passed, whichever comes first.
+ */
+export interface NonBlockingLog {
+  readonly log: (line: string) => void;
+  readonly drain: (timeoutMs: number) => Promise<void>;
+}
+
+/**
+ * Creates a log that writes each line to a file descriptor without ever
  * blocking the event loop, so a reader that stops reading stalls nothing
  * but the log. Each write goes through the asynchronous node:fs write,
  * which Bun runs on its thread pool, one write at a time. Lines that
@@ -17,13 +27,22 @@ const writeAsync = promisify(write);
  * next write after the drops starts with one `atc log dropped=N` line. A
  * failed write drops its lines and counts them the same way, and the next
  * line logged writes again.
+ *
+ * A write to a full pipe that nobody reads never returns, and it keeps the
+ * process alive until the process calls exit. A process that shuts down
+ * drains the log with a timeout and then exits: every queued line reaches a
+ * reader that keeps reading, and an unread pipe holds the exit back no
+ * longer than the timeout.
  */
-export function makeNonBlockingLog(fd: number): (line: string) => void {
+export function createNonBlockingLog(fd: number): NonBlockingLog {
   let queue: string[] = [];
   let queuedBytes = 0;
   let dropped = 0;
   let writing = false;
 
+  // The drains that wait for the log to have nothing left to write.
+  let idleWaiters: (() => void)[] = [];
+
   const recordLine = (line: string): boolean => {
     const text = `${line}\n`;
     const bytes = Buffer.byteLength(text);
@@ -43,6 +62,8 @@ export function makeNonBlockingLog(fd: number): (line: string) => void {
     if (queue.length === 0 && dropped === 0) {
       writing = false;
 
+      releaseIdleWaiters();
+
       return;
     }
 
@@ -70,22 +91,59 @@ export function makeNonBlockingLog(fd: number): (line: string) => void {
         rest = rest.subarray(result.bytesWritten);
       }
     } catch {
+      // A drain stops waiting here too: the next write would most likely
+      // fail the same way, and the lines it would carry stay counted.
       dropped += lineCount;
       writing = false;
 
+      releaseIdleWaiters();
+
       return;
     }
 
     writeNext();
   };
 
-  return (line) => {
-    if (!recordLine(line)) {
-      dropped++;
-    }
+  const releaseIdleWaiters = (): void => {
+    const waiters = idleWaiters;
+
+    idleWaiters = [];
 
-    if (!writing) {
-      writeNext();
+    for (const resolve of waiters) {
+      resolve();
     }
   };
+
+  return {
+    log: (line) => {
+      if (!recordLine(line)) {
+        dropped++;
+      }
+
+      if (!writing) {
+        writeNext();
+      }
+    },
+    drain: async (timeoutMs) => {
+      // Lines left behind by a failed write wait for the next line logged,
+      // so a drain writes them itself.
+      if (!writing) {
+        writeNext();
+      }
+
+      if (!writing) {
+        return;
+      }
+
+      const idle = Promise.withResolvers<void>();
+
+      idleWaiters.push(idle.resolve);
+
+      const timer = setTimeout(idle.resolve, timeoutMs);
+
+      await idle.promise;
+
+      clearTimeout(timer);
+    },
+  };
 }

package/src/daemon/daemon-connection.ts

@@ -7,6 +7,7 @@ import { LineDecoder } from '../protocol/line-decoder';
 import { OutboundQueue } from '../protocol/outbound-queue';
 import type { SocketWriter } from '../protocol/outbound-queue';
 import { parseRequestParams } from '../protocol/parse-request-params';
+import type { RequestMethod } from '../protocol/parse-request-params';
 import {
   MAX_CHUNK,
   MAX_LINE,
@@ -26,6 +27,7 @@ import { buildTargetForbiddenError } from './build-target-forbidden-error';
 import type { DaemonContext, SpawnParams } from './daemon-context';
 import type { TranscriptPosition } from './load-transcript-page';
 import { parseSpawnOverrides } from './parse-spawn-overrides';
+import { REQUEST_ACCESS_CLASSES } from './request-access-classes';
 import { TargetAccess } from './target-access';
 
 // The targets a request may use and the namespace of its idempotency keys.
@@ -34,15 +36,6 @@ interface RequestScope {
   readonly keyNamespace: string;
 }
 
-// The requests that act on the whole daemon, or on the credentials a
-// session's host may use, which only its owner may make.
-const OWNER_METHODS: ReadonlySet<string> = new Set([
-  'daemon.quit',
-  'fleet.restore',
-  'session.auth.revoke',
-  'session.auth.rebind',
-]);
-
 // What a limited connection is sent for one event, and the sessions that
 // event moved out of its view.
 interface ViewUpdate {
@@ -316,7 +309,7 @@ export class DaemonConnection {
 
     const scope = this.findRequestScope(req);
 
-    if (scope !== null && OWNER_METHODS.has(req.m)) {
+    if (scope !== null && isOwnerOnlyMethod(req.m)) {
       this.sendErr(req.id, 'unauthorized', `${req.m} is open to the daemon's owner only`);
 
       return true;
@@ -379,7 +372,7 @@ export class DaemonConnection {
       return;
     }
 
-    if (OWNER_METHODS.has(req.m)) {
+    if (isOwnerOnlyMethod(req.m)) {
       this.sendErr(req.id, 'unauthorized', `${req.m} is open to the daemon's owner only`);
 
       return;
@@ -548,6 +541,12 @@ export class DaemonConnection {
   private async applyRequest(req: RequestMsg, ctx: DaemonContext): Promise<void> {
     await this.helloAnswered;
 
+    if (!isRequestMethod(req.m)) {
+      this.sendErr(req.id, 'unknown_method', `unknown method '${req.m}'`);
+
+      return;
+    }
+
     switch (req.m) {
       case 'daemon.ping': {
         this.sendOk(req.id, {});
@@ -908,7 +907,10 @@ export class DaemonConnection {
 
         return;
       }
-      default: {
+
+      // The handshake is answered before a request is admitted, so it never
+      // runs as one.
+      case 'daemon.hello': {
         this.sendErr(req.id, 'unknown_method', `unknown method '${req.m}'`);
       }
     }
@@ -1779,6 +1781,17 @@ export class DaemonConnection {
   }
 }
 
+// Whether a request method is open to the daemon's owner alone. A method
+// the protocol does not define is not: it runs as no request and is
+// answered as unknown.
+function isOwnerOnlyMethod(method: string): boolean {
+  return isRequestMethod(method) && REQUEST_ACCESS_CLASSES[method] === 'owner';
+}
+
+function isRequestMethod(method: string): method is RequestMethod {
+  return Object.hasOwn(REQUEST_ACCESS_CLASSES, method);
+}
+
 // The token of a handshake's `auth: { scheme: "bearer", token }`, or null
 // when its params hold none.
 function findBearerToken(p: Readonly<Record<string, unknown>> | undefined): string | null {

package/src/daemon/daemon.ts

@@ -48,6 +48,8 @@ import { buildTargetAccess } from './build-target-access';
 import { buildTargetForbiddenError } from './build-target-forbidden-error';
 import { buildTargetList } from './build-target-list';
 import { claimDaemonLock } from './claim-daemon-lock';
+import { createNonBlockingLog } from './create-non-blocking-log';
+import type { NonBlockingLog } from './create-non-blocking-log';
 import { DaemonConnection } from './daemon-connection';
 import type {
   DaemonContext,
@@ -69,7 +71,6 @@ import { loadListenerTokens } from './load-listener-tokens';
 import { loadTranscriptPage } from './load-transcript-page';
 import { makeHookRunner } from './make-hook-runner';
 import type { HookScope } from './make-hook-runner';
-import { makeNonBlockingLog } from './make-non-blocking-log';
 import { materializeWorkspace } from './materialize-workspace';
 import { mintMessageID } from './mint-message-id';
 import { mintSessionID } from './mint-session-id';
@@ -253,6 +254,10 @@ const MAX_REFUSAL_WINDOWS = 1024;
 // Where the TCP listener logs when the daemon is given no log.
 const STDERR_FD = 2;
 
+// How long a stopping daemon waits for the TCP listener's log to write the
+// lines it still holds, so an unread stderr delays the exit no longer.
+const LOG_DRAIN_TIMEOUT_MS = 1000;
+
 // How long startup waits for a daemon that is shutting down to release the
 // state lock before refusing to start.
 const LOCK_WAIT_MS = 2000;
@@ -2082,8 +2087,15 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
   // refuses the start before any client can connect, and releases what the
   // daemon holds, the lock included.
   let tcpListener: TCPListener | null = null;
+  let listenerLog: NonBlockingLog | null = null;
 
   if (opts.listen !== undefined && listenTokens !== null) {
+    // A given log writes as it is called, so it has nothing to drain.
+    listenerLog =
+      opts.log === undefined
+        ? createNonBlockingLog(STDERR_FD)
+        : { log: opts.log, drain: () => Promise.resolve() };
+
     try {
       tcpListener = startTCPListener({
         host: opts.listen.host,
@@ -2099,7 +2111,7 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
           return connection;
         },
         closeConnection: detachConnection,
-        log: opts.log ?? makeNonBlockingLog(STDERR_FD),
+        log: listenerLog.log,
         now: opts.listen.now ?? Date.now,
         refusalLogIntervalMs: opts.listen.refusalLogIntervalMs ?? REFUSAL_LOG_INTERVAL_MS,
         maxRefusalWindows: opts.listen.maxRefusalWindows ?? MAX_REFUSAL_WINDOWS,
@@ -2167,6 +2179,11 @@ export async function startDaemon(opts: DaemonOptions): Promise<DaemonHandle> {
     server.stop(true);
 
     await releaseResources();
+
+    // The stopped listener logs no more lines, so this writes the ones the
+    // log still holds, waiting no longer than the timeout when nothing reads
+    // stderr.
+    await listenerLog?.drain(LOG_DRAIN_TIMEOUT_MS);
   };
 
   writeDaemonRecord(recordPath, {

package/src/daemon/request-access-classes.ts

@@ -0,0 +1,54 @@
+import type { RequestMethod } from '../protocol/parse-request-params';
+
+/**
+ * Who may make a request: `owner` is the daemon's owner alone, and
+ * `principal` is also open to a principal, which runs it through the
+ * context scoped to that principal.
+ */
+export type RequestAccessClass = 'owner' | 'principal';
+
+/**
+ * The access class of every request method, checked when a request is
+ * admitted and before it runs. The type takes every method the protocol
+ * defines, so a method without a class fails typecheck. Owner-class
+ * methods act on the whole daemon, or on the credentials a session's host
+ * may use.
+ */
+export const REQUEST_ACCESS_CLASSES: Readonly<Record<RequestMethod, RequestAccessClass>> = {
+  'daemon.hello': 'principal',
+  'daemon.ping': 'principal',
+  'daemon.quit': 'owner',
+  'session.list': 'principal',
+  'dirs.list': 'principal',
+  'agents.list': 'principal',
+  'sources.list': 'principal',
+  'sources.interpret': 'principal',
+  'git.probe': 'principal',
+  'fleet.list': 'principal',
+  'fleet.restore': 'owner',
+  'session.spawn': 'principal',
+  'session.kill': 'principal',
+  'session.ack': 'principal',
+  'session.forget': 'principal',
+  'session.resumeCommand': 'principal',
+  'session.auth.revoke': 'owner',
+  'session.auth.rebind': 'owner',
+  'session.update': 'principal',
+  'session.attach': 'principal',
+  'session.detach': 'principal',
+  'session.input': 'principal',
+  'session.submit': 'principal',
+  'session.resize': 'principal',
+  'session.screen': 'principal',
+  'session.eject': 'principal',
+  'session.adopt': 'principal',
+  'permission.respond': 'principal',
+  'session.get': 'principal',
+  'session.read': 'principal',
+  'events.read': 'principal',
+  'session.message': 'principal',
+  'session.tap': 'principal',
+  'message.get': 'principal',
+  'report.get': 'principal',
+  'message.ack': 'principal',
+};