cartethyia 2.4.5 → 2.5.0

package/scripts/cli/command/tray.ts

@@ -0,0 +1,165 @@
+import { isNewerRelease } from "../../../src/console/updates/version-compare";
+import { resolvePackagePath } from "../../../src/config/package-paths";
+import { resolvePort } from "../../../src/config/runtime";
+import { ensureDrainToken } from "../gateway/drain-token";
+import { startGateway } from "../gateway/spawn";
+import { stopGateway } from "../gateway/stop";
+import { readInstalledVersion, readLatestPublishedVersion } from "../support/version";
+import { reportTrayStartup } from "../support/startup-signal";
+import { createTray } from "../tray";
+import { openUrl } from "../ui/background";
+import { exportBackup, resetConsoleAccount } from "./admin";
+import { printUpdateInstructions } from "./update";
+
+/**
+ * Runs the gateway with a tray icon. The tray is platform-specific (`tray/`):
+ * on Windows it is a PowerShell NotifyIcon, because a Node tray library leaves
+ * an empty console tab open for the tray's whole lifetime, and that window is
+ * owned by Windows Terminal — not by this process, so it cannot be found and
+ * hidden from inside.
+ */
+export async function startTray(): Promise<void> {
+  const port = resolvePort();
+  const drainToken = ensureDrainToken();
+  const dashboardUrl = `http://127.0.0.1:${port}/console`;
+  const repositoryUrl = "https://github.com/risunCode/cartethyia";
+  const currentVersion = await readInstalledVersion();
+
+  let gateway: Bun.Subprocess | null = null;
+  let closing = false;
+  let busy = false;
+  let resetArmed = false;
+  let latestVersion: string | null = null;
+  let closePromise: Promise<void> | undefined;
+
+  const tray = createTray({
+    iconPath: resolvePackagePath(
+      "scripts",
+      "cli",
+      "tray",
+      "assets",
+      process.platform === "win32" ? "cartethyia.ico" : "cartethyia.png",
+    ),
+    tooltip: `Cartethyia ${currentVersion}`,
+    items: [
+      { kind: "action", id: "update", title: `Cartethyia ${currentVersion} \u00b7 checking\u2026`, enabled: true },
+      { kind: "separator" },
+      { kind: "action", id: "console", title: `Open Console \u00b7 ${dashboardUrl}` },
+      { kind: "action", id: "reset", title: "Reset console password" },
+      { kind: "action", id: "backup", title: "Backup" },
+      { kind: "separator" },
+      { kind: "action", id: "exit", title: "Exit" },
+    ],
+    onSelect: (id: string) => void handleSelect(id),
+    onExit: () => void close(1),
+  });
+
+  const close = (exitCode = 0): Promise<void> => {
+    if (closePromise) return closePromise;
+    closing = true;
+    closePromise = (async () => {
+      const current: Bun.Subprocess | null = gateway;
+      gateway = null;
+      if (current) await stopGateway(current, port, drainToken);
+      await tray.close();
+      process.exitCode = exitCode;
+    })();
+    return closePromise;
+  };
+
+  const refreshVersion = async (): Promise<void> => {
+    const fetched = await readLatestPublishedVersion();
+    if (closing) return;
+    latestVersion = fetched;
+    if (fetched === null) {
+      tray.update("update", `Cartethyia ${currentVersion} \u00b7 check for updates`, true);
+      return;
+    }
+    const newer = isNewerRelease(currentVersion, fetched);
+    tray.update(
+      "update",
+      newer
+        ? `Cartethyia ${currentVersion} \u00b7 update to ${fetched}`
+        : `Cartethyia ${currentVersion} \u00b7 up to date`,
+      // Always clickable: the row opens the repository, and only offers the
+      // update command when there is something newer.
+      true,
+    );
+  };
+
+  const runUpdate = async (): Promise<void> => {
+    if (busy) return;
+    busy = true;
+    const latest = await readLatestPublishedVersion();
+    await close();
+    printUpdateInstructions(currentVersion, latest);
+    process.exit(0);
+  };
+
+  async function handleSelect(id: string): Promise<void> {
+    if (closing) return;
+    if (id === "exit") return void (await close());
+    if (id === "console") return void (await openUrl(dashboardUrl));
+    if (id === "backup") {
+      const result = await exportBackup(port, drainToken);
+      if (result !== null) {
+        console.log(
+          `Backup written to ${result.path} (${(result.bytes / 1024).toFixed(1)} KiB). Telemetry is not included.`,
+        );
+      }
+      return;
+    }
+    if (id === "reset") {
+      // A tray click cannot ask for the typed confirmation the menu uses, so
+      // the first click arms the action and the second one runs it.
+      if (!resetArmed) {
+        resetArmed = true;
+        tray.update("reset", "Reset console password \u00b7 click again to delete", true);
+        return;
+      }
+      resetArmed = false;
+      tray.update("reset", "Reset console password", true);
+      await resetConsoleAccount(port, drainToken);
+      return;
+    }
+    if (id === "update") {
+      // Nothing to install: the row is the way to the repository instead.
+      if (latestVersion === null || !isNewerRelease(currentVersion, latestVersion)) {
+        await openUrl(repositoryUrl);
+        return;
+      }
+      await runUpdate();
+    }
+  }
+
+  process.once("SIGINT", () => void close());
+  process.once("SIGTERM", () => void close());
+
+  try {
+    await tray.ready();
+    gateway = await startGateway(port, drainToken);
+    // The launcher that spawned this tray is blocked on a signal file: it
+    // cannot read our stdio, because the tray is detached. Without this write
+    // it waits out its 60 s deadline and reports a failure for a tray that is
+    // running fine.
+    reportTrayStartup({ status: "ready", url: dashboardUrl });
+    console.log(`Cartethyia is running at ${dashboardUrl}`);
+    void refreshVersion();
+
+    while (!closing) {
+      const current: Bun.Subprocess | null = gateway;
+      if (!current) {
+        await Bun.sleep(100);
+        continue;
+      }
+      const code = await current.exited;
+      if (gateway !== current || closing) continue;
+      gateway = null;
+      console.error(`Cartethyia exited with code ${code}.`);
+      await close(code ?? 1);
+    }
+  } catch (error) {
+    await close(1);
+    throw error;
+  }
+}

package/scripts/cli/command/update.ts

@@ -0,0 +1,23 @@
+/**
+ * The update path, which prints a command rather than running one.
+ *
+ * npm cannot replace this package's directory while a process is executing out
+ * of it: on Windows the rename fails with EBUSY and npm exits 14. Stopping the
+ * gateway is not enough either, because the CLI or tray itself is the process
+ * holding the directory. So every caller stops, prints the command, and exits —
+ * the same shape 9router uses.
+ */
+export function updateCommand(): string {
+  return "npm install -g cartethyia@latest --prefer-online";
+}
+
+/** Prints the "run this now" block after Cartethyia has stopped. */
+export function printUpdateInstructions(from: string, to: string | null): void {
+  console.log("");
+  console.log(`Update available: ${from} \u2192 ${to ?? "latest"}`);
+  console.log("");
+  console.log("Run this now that Cartethyia has stopped:");
+  console.log("");
+  console.log(`   ${updateCommand()}`);
+  console.log("");
+}

package/scripts/cli/{runtime-state.ts → gateway/drain-token.ts}

@@ -1,78 +1,78 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-/**
- * The install's drain token, persisted in the config directory.
- *
- * Why it persists instead of being generated per run: `cartethyia stop` runs in
- * a different process, possibly minutes later, and the token is the only way it
- * can authenticate to a gateway it did not start. A token regenerated on each
- * start could never match the gateway that is actually running, which is why
- * `stop` reported "no gateway found" or a 401 on a live gateway.
- *
- * It is kept out of `.env` on purpose: it authorises a shutdown, so it belongs
- * in a machine-written file the operator never hand-edits and never commits.
- * Mode 0600 where the platform honours it.
- */
-const RUNTIME_STATE_FILE = "runtime.json";
-
-interface RuntimeState {
-  readonly drainToken: string;
-}
-
-function statePath(): string | null {
-  const configDir = process.env.CARTETHYIA_CONFIG_DIR;
-  return configDir ? join(configDir, RUNTIME_STATE_FILE) : null;
-}
-
-function readState(): RuntimeState | null {
-  const path = statePath();
-  if (path === null || !existsSync(path)) return null;
-  try {
-    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
-    if (
-      parsed !== null &&
-      typeof parsed === "object" &&
-      "drainToken" in parsed &&
-      typeof parsed.drainToken === "string" &&
-      parsed.drainToken.length > 0
-    ) {
-      return { drainToken: parsed.drainToken };
-    }
-  } catch {
-    // A corrupt or stale state file reads as "no token".
-  }
-  return null;
-}
-
-/**
- * Returns the install's drain token, creating and persisting one on first use.
- *
- * Every start calls this, so a gateway started from the menu, from `tray`, or
- * from `cartethyia start` all authenticate with the same token and `stop`
- * always has the one that works.
- */
-export function ensureDrainToken(): string {
-  const existing = readState();
-  if (existing !== null) return existing.drainToken;
-
-  const token = crypto.randomUUID().replace(/-/g, "") + crypto.randomUUID().replace(/-/g, "");
-  const path = statePath();
-  if (path !== null) {
-    try {
-      writeFileSync(path, JSON.stringify({ drainToken: token }), {
-        encoding: "utf8",
-        mode: 0o600,
-      });
-    } catch {
-      // A read-only config directory still yields a usable in-process token;
-      // only `stop` from another process is lost.
-    }
-  }
-  return token;
-}
-
-/** The persisted token, or null when this install has never started. */
-export function readPersistedDrainToken(): string | null {
-  return readState()?.drainToken ?? null;
-}
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * The install's drain token, persisted in the config directory.
+ *
+ * Why it persists instead of being generated per run: the tray that "Hide to
+ * tray" starts runs in a different process and drains the gateway through the
+ * loopback endpoint, so the token has to match across processes. A token
+ * regenerated on each start could never authenticate against a gateway another
+ * process had started.
+ *
+ * It is kept out of `.env` on purpose: it authorises a shutdown, so it belongs
+ * in a machine-written file the operator never hand-edits and never commits.
+ * Mode 0600 where the platform honours it.
+ */
+const RUNTIME_STATE_FILE = "runtime.json";
+
+interface RuntimeState {
+  readonly drainToken: string;
+}
+
+function statePath(): string | null {
+  const configDir = process.env.CARTETHYIA_CONFIG_DIR;
+  return configDir ? join(configDir, RUNTIME_STATE_FILE) : null;
+}
+
+function readState(): RuntimeState | null {
+  const path = statePath();
+  if (path === null || !existsSync(path)) return null;
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
+    if (
+      parsed !== null &&
+      typeof parsed === "object" &&
+      "drainToken" in parsed &&
+      typeof parsed.drainToken === "string" &&
+      parsed.drainToken.length > 0
+    ) {
+      return { drainToken: parsed.drainToken };
+    }
+  } catch {
+    // A corrupt or stale state file reads as "no token".
+  }
+  return null;
+}
+
+/**
+ * Returns the install's drain token, creating and persisting one on first use.
+ *
+ * Every start calls this, so a gateway started from the menu, from `tray`, or
+ * from `cartethyia start` all authenticate with the same token and `stop`
+ * always has the one that works.
+ */
+export function ensureDrainToken(): string {
+  const existing = readState();
+  if (existing !== null) return existing.drainToken;
+
+  const token = crypto.randomUUID().replace(/-/g, "") + crypto.randomUUID().replace(/-/g, "");
+  const path = statePath();
+  if (path !== null) {
+    try {
+      writeFileSync(path, JSON.stringify({ drainToken: token }), {
+        encoding: "utf8",
+        mode: 0o600,
+      });
+    } catch {
+      // A read-only config directory still yields a usable in-process token;
+      // only `stop` from another process is lost.
+    }
+  }
+  return token;
+}
+
+/** The persisted token, or null when this install has never started. */
+export function readPersistedDrainToken(): string | null {
+  return readState()?.drainToken ?? null;
+}

package/scripts/cli/gateway/instance-lock.ts

@@ -0,0 +1,105 @@
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * A marker that one gateway owns this install's port.
+ *
+ * The port probe alone cannot tell a healthy gateway from a stranger's process:
+ * something answering on 12800 is not necessarily ours, so a start that found
+ * the port busy either failed outright or — worse — would have to guess before
+ * stopping anything. The lock names the PID and the token it was written with,
+ * which is what makes "is this our gateway?" answerable without guessing.
+ *
+ * It is advisory, not an OS lock: a stale file from a crashed process is the
+ * normal case this exists to recover from, so presence alone never blocks a
+ * start. Liveness is decided by probing the port, and identity by the token.
+ */
+export interface InstanceLock {
+  readonly pid: number;
+  readonly port: number;
+  /** Fingerprint of the drain token, never the token itself. */
+  readonly tokenFingerprint: string;
+  readonly startedAt: string;
+}
+
+const LOCK_FILE = "instance.json";
+
+function lockPath(): string | null {
+  const configDir = process.env.CARTETHYIA_CONFIG_DIR;
+  return configDir ? join(configDir, LOCK_FILE) : null;
+}
+
+/** A short, non-reversible fingerprint so the token itself is never written. */
+export function fingerprint(token: string): string {
+  let hash = 0;
+  for (let i = 0; i < token.length; i += 1) {
+    hash = (hash * 31 + token.charCodeAt(i)) | 0;
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+
+export function writeInstanceLock(port: number, pid: number, token: string): void {
+  const path = lockPath();
+  if (path === null) return;
+  const lock: InstanceLock = {
+    pid,
+    port,
+    tokenFingerprint: fingerprint(token),
+    startedAt: new Date().toISOString(),
+  };
+  try {
+    writeFileSync(path, JSON.stringify(lock), { encoding: "utf8", mode: 0o600 });
+  } catch {
+    // A read-only config directory costs the marker, not the run.
+  }
+}
+
+export function readInstanceLock(): InstanceLock | null {
+  const path = lockPath();
+  if (path === null || !existsSync(path)) return null;
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
+    if (
+      parsed !== null &&
+      typeof parsed === "object" &&
+      "pid" in parsed &&
+      typeof parsed.pid === "number" &&
+      "port" in parsed &&
+      typeof parsed.port === "number" &&
+      "tokenFingerprint" in parsed &&
+      typeof parsed.tokenFingerprint === "string"
+    ) {
+      const startedAt = "startedAt" in parsed && typeof parsed.startedAt === "string" ? parsed.startedAt : "";
+      return {
+        pid: parsed.pid,
+        port: parsed.port,
+        tokenFingerprint: parsed.tokenFingerprint,
+        startedAt,
+      };
+    }
+  } catch {
+    // A corrupt marker reads as none.
+  }
+  return null;
+}
+
+export function clearInstanceLock(): void {
+  const path = lockPath();
+  if (path === null) return;
+  try {
+    unlinkSync(path);
+  } catch {
+    // Already gone, or the directory is read-only.
+  }
+}
+
+/** Whether a process id is alive. `0` is never a real pid. */
+export function pidAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}

package/scripts/cli/gateway/spawn.ts

@@ -0,0 +1,173 @@
+import { openSync } from "node:fs";
+import {
+  clearInstanceLock,
+  fingerprint,
+  pidAlive,
+  readInstanceLock,
+  writeInstanceLock,
+} from "./instance-lock";
+import { join } from "node:path";
+import { PACKAGE_ROOT, resolvePackagePath } from "../../../src/config/package-paths";
+
+/**
+ * Frees the port when what holds it is this install's own gateway.
+ *
+ * Returns `null` when the port is free (or was successfully taken), and a
+ * message to fail with otherwise. It never kills a process it cannot identify:
+ * a stranger's service on this port is reported, not drained.
+ *
+ * The probe is two-step on purpose. `/health` alone is answered by anything, so
+ * it only says "something is there"; the drain request is what distinguishes
+ * ours from someone else's, because it is token-gated — and a 401 means another
+ * Cartethyia install, which this one must not stop.
+ */
+async function claimPort(port: number, drainToken: string): Promise<string | null> {
+  // A lock naming this install's own gateway is the strongest evidence
+  // available, so prefer it over the network probe when it is live.
+  const lock = readInstanceLock();
+  const ours = lock !== null && lock.port === port && lock.tokenFingerprint === fingerprint(drainToken);
+
+  const response = await fetch(`http://127.0.0.1:${port}/admin/drain`, {
+    method: "POST",
+    headers: { "x-drain-token": drainToken },
+    signal: AbortSignal.timeout(3_000),
+  }).catch(() => null);
+
+  if (response === null) {
+    // Nothing answered a drain request. If our own lock names a dead pid, the
+    // marker is stale and nothing is holding the port — clear it and continue.
+    if (ours && !pidAlive(lock.pid)) {
+      clearInstanceLock();
+      return null;
+    }
+    return `Port ${port} is busy and nothing there answers a drain request. Stop whatever holds it, or set a different PORT.`;
+  }
+  if (response.status === 401) {
+    return `Another Cartethyia gateway is already running on port ${port} under a different install. Stop it from its own terminal or tray — this install will not stop a gateway it does not own.`;
+  }
+  if (response.status === 403) {
+    return `Port ${port} refused a drain from loopback. Stop what holds it, then start again.`;
+  }
+  if (response.status !== 202) {
+    return `Port ${port} is busy and refused to drain (HTTP ${response.status}). Stop it manually, then start again.`;
+  }
+  // Drain accepted. Wait for the port to actually free: the gateway flushes its
+  // 202 before closing sockets, so acceptance is not release.
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    const stillUp = await fetch(`http://127.0.0.1:${port}/health`, {
+      signal: AbortSignal.timeout(500),
+    }).catch(() => null);
+    if (stillUp === null) {
+      clearInstanceLock();
+      return null;
+    }
+    await Bun.sleep(200);
+  }
+  return `The gateway on port ${port} accepted a drain but did not release the port within 30 seconds. Stop it manually, then start again.`;
+}
+
+/**
+ * Starts the gateway and resolves once it answers its own health probe.
+ *
+ * The child is attached by default. A detached child cannot be killed from an
+ * `exit` handler on Windows (measured: `kill()` runs, the gateway keeps
+ * serving), and a terminal's Ctrl-C only reaches children in the same process
+ * group. Staying attached means Ctrl-C and the `exit` backstop both stop the
+ * gateway. "Hide to tray" passes `detached: true` because that gateway must
+ * outlive this process.
+ */
+export async function startGateway(
+  port: number,
+  drainToken: string,
+  options: { readonly detached?: boolean } = {},
+): Promise<Bun.Subprocess> {
+  // Starting a second gateway on the same port used to fail with "stopped
+  // before becoming ready (exit code 1)", which says nothing about the real
+  // cause. Probe the port first and say what is actually there.
+  const existing = await fetch(`http://127.0.0.1:${port}/health`, {
+    signal: AbortSignal.timeout(1_000),
+  }).catch(() => null);
+  if (existing !== null) {
+    // Something already owns the port. Replace it only when it proves to be our
+    // own gateway — otherwise stop and say what is there. A gateway left behind
+    // by a closed terminal used to make every later start fail until the
+    // operator found and killed it by hand.
+    const claimed = await claimPort(port, drainToken);
+    if (claimed !== null) throw new Error(claimed);
+  }
+  // The gateway logs a startup phase line per stage. In menu mode those lines
+  // would scroll through the same terminal the menu is drawing on, so they go
+  // to a file instead and the operator sees only the menu.
+  const configDir = process.env.CARTETHYIA_CONFIG_DIR;
+  let logFd: number | null = null;
+  if (configDir) {
+    try {
+      logFd = openSync(join(configDir, "gateway.log"), "a");
+    } catch {
+      // A read-only config directory costs only the log, not startup.
+    }
+  }
+  const child = Bun.spawn(
+    [process.execPath, "run", resolvePackagePath("src", "main.ts")],
+    {
+      cwd: PACKAGE_ROOT,
+      env: { ...process.env, CARTETHYIA_DRAIN_TOKEN: drainToken },
+      // "ignore", not "inherit": the gateway does not read stdin, and in menu
+      // mode the menu is the only stdin consumer. With "inherit" the gateway
+      // held the fd and swallowed every keypress after the first, so the menu
+      // rendered but never received Enter.
+      stdin: "ignore",
+      stdout: logFd ?? "ignore",
+      // stderr goes to the same file: "inherit" ties the gateway to the
+      // terminal, so closing that terminal took the gateway down with it and
+      // "Hide to tray" left nothing running.
+      stderr: logFd ?? "ignore",
+      detached: options.detached === true,
+    },
+  );
+  const startupController = new AbortController();
+  const ready = (async (): Promise<void> => {
+    const deadline = Date.now() + 30_000;
+    while (!startupController.signal.aborted && Date.now() < deadline) {
+      try {
+        const response = await fetch(`http://127.0.0.1:${port}/health`, {
+          signal: AbortSignal.timeout(500),
+        });
+        if (response.ok) {
+          const body: unknown = await response.json();
+          if (body !== null && typeof body === "object" && "status" in body && body.status === "ok") return;
+        }
+      } catch {
+        // The gateway is not accepting health requests yet.
+      }
+      await Bun.sleep(250);
+    }
+    if (startupController.signal.aborted) throw new Error("Cartethyia exited before becoming ready");
+    throw new Error("Cartethyia did not open its configured port within 30 seconds");
+  })();
+  const exitedEarly = child.exited.then((code) => {
+    startupController.abort();
+    return { status: "exit" as const, code };
+  });
+  const readyResult = ready.then(
+    () => ({ status: "ready" as const }),
+    (error: unknown) => ({ status: "failure" as const, error }),
+  );
+  try {
+    const result = await Promise.race([readyResult, exitedEarly]);
+    if (result.status === "exit") {
+      throw new Error(`Cartethyia stopped before becoming ready (exit code ${result.code})`);
+    }
+    if (result.status === "failure") throw result.error;
+    // Recorded only once the child is actually serving: a marker written before
+    // readiness would name a gateway that never came up, and the next start
+    // would treat a live port as ours when it is not.
+    writeInstanceLock(port, child.pid, drainToken);
+    return child;
+  } catch (error) {
+    child.kill();
+    await child.exited;
+    throw error;
+  }
+}

package/scripts/cli/gateway/stop.ts

@@ -0,0 +1,51 @@
+/**
+ * Stops a gateway this process started, gracefully where possible.
+ *
+ * The drain endpoint is the only graceful path: it lets in-flight responses
+ * finish. The OS-level kill is the fallback, and it is reached whenever the
+ * endpoint is unreachable — which is also what happens when the gateway is
+ * already on its way out, so a failure here is not necessarily an error the
+ * operator needs to act on.
+ */
+export async function stopGateway(
+  current: Bun.Subprocess,
+  port: number,
+  drainToken: string,
+): Promise<void> {
+  let drainAccepted = false;
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/admin/drain`, {
+      method: "POST",
+      headers: { "x-drain-token": drainToken },
+      signal: AbortSignal.timeout(2_000),
+    });
+    drainAccepted = response.status === 202;
+  } catch {
+    // The process may already be exiting; fall back to its OS-level termination.
+  }
+  if (!drainAccepted) {
+    console.error("Could not request a graceful gateway drain; terminating the gateway process.");
+    current.kill();
+    await current.exited;
+    return;
+  }
+
+  // The drain is bounded: a gateway that accepted the request but never exits
+  // would otherwise hang the CLI. 30 s is the drain budget `src/main.ts` uses.
+  // The timer is cleared unconditionally afterwards — leaving it pending keeps
+  // the event loop alive for its full 30 s after the gateway is already gone,
+  // which made every `carte` exit take half a minute.
+  let timer: Timer | undefined;
+  const drained = await Promise.race([
+    current.exited,
+    new Promise<null>((resolveExit) => {
+      timer = setTimeout(() => resolveExit(null), 30_000);
+    }),
+  ]);
+  clearTimeout(timer);
+  if (drained === null) {
+    console.error("Graceful drain timed out; terminating the gateway process.");
+    current.kill();
+    await current.exited;
+  }
+}