ccdeck 1.43.0 → 1.45.0

package/src/server/uv-bootstrap.mjs

@@ -0,0 +1,301 @@
+// Last-resort acquisition of `uv`, so claude-swap can be installed on a machine
+// with no Python tooling at all.
+//
+// The alternative everyone reaches for is `curl -LsSf https://astral.sh/uv/
+// install.sh | sh`, which executes whatever that URL happens to serve, with the
+// user's privileges, and drops files into their global tool path. This does the
+// narrower thing instead: fetch one named release artifact from Astral's own
+// GitHub releases, check it against the SHA-256 that release publishes beside
+// it, and unpack it inside ~/.agents-deck. Nothing is executed until it has
+// been verified, nothing lands outside a directory the deck already owns — the
+// staging directory included, which is what #551 was about — and deleting that
+// directory undoes all of it.
+//
+// It is still a network fetch of an executable, so it only happens when there
+// is no other way: uv, pipx, and python -m pipx have all already been ruled out
+// by the caller. AGENTS_DECK_NO_INSTALL=1 disables it along with everything else.
+import { createHash } from "node:crypto";
+import { mkdir, mkdtemp, writeFile, rm, chmod, readdir, copyFile, open } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { run } from "./exec.mjs";
+// The same rename used to replace settings.json, for the same reason: on
+// Windows a rename over an existing file fails outright while any other process
+// holds the target open, and a virus scanner or the search indexer opens a
+// freshly written executable the instant it appears. Sharing one implementation
+// keeps the retryable-error list from drifting apart between the two callers.
+import { renameWithRetry } from "./installer.mjs";
+
+const TOOL_DIR = join(homedir(), ".agents-deck", "tools");
+const UV_DIR   = join(TOOL_DIR, "uv");
+
+const RELEASE_API = "https://api.github.com/repos/astral-sh/uv/releases/latest";
+const DOWNLOAD_BASE = "https://github.com/astral-sh/uv/releases/download";
+
+// Used when the releases API cannot be reached — rate limiting is per-IP and
+// unauthenticated, so this is a normal outcome rather than an error. Any
+// reasonably recent uv can install claude-swap; it self-updates later.
+const FALLBACK_VERSION = "0.12.3";
+
+const DOWNLOAD_TIMEOUT_MS = 120_000;
+
+/**
+ * Release artifact for this machine, or null if uv does not publish one.
+ *
+ * Rosetta is deliberately not special-cased: an x64 Node on Apple Silicon
+ * reports x64 and gets the x64 build, which runs.
+ */
+export function assetName(platform = process.platform, arch = process.arch) {
+  const a = { x64: "x86_64", arm64: "aarch64", ia32: "i686" }[arch];
+  if (!a) return null;
+  // Apple publishes no i686 build, and never will.
+  if (platform === "darwin") return a === "i686" ? null : `uv-${a}-apple-darwin.tar.gz`;
+  if (platform === "win32")  return `uv-${a}-pc-windows-msvc.zip`;
+  if (platform === "linux")  return `uv-${a}-unknown-linux-gnu.tar.gz`;
+  return null;
+}
+
+/** Path to a uv this function installed earlier, or null. */
+export function existingBootstrappedUv() {
+  const bin = join(UV_DIR, process.platform === "win32" ? "uv.exe" : "uv");
+  return existsSync(bin) ? bin : null;
+}
+
+async function latestVersion() {
+  try {
+    const res = await fetch(RELEASE_API, {
+      headers: { accept: "application/vnd.github+json", "user-agent": "agents-deck" },
+      signal: AbortSignal.timeout(8_000),
+    });
+    if (!res.ok) return FALLBACK_VERSION;
+    const tag = (await res.json())?.tag_name;
+    return typeof tag === "string" && /^\d/.test(tag) ? tag : FALLBACK_VERSION;
+  } catch {
+    return FALLBACK_VERSION;
+  }
+}
+
+async function download(url, { asText = false } = {}) {
+  const res = await fetch(url, {
+    redirect: "follow",
+    headers: { "user-agent": "agents-deck" },
+    signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
+  });
+  if (!res.ok) return null;
+  return asText ? (await res.text()) : Buffer.from(await res.arrayBuffer());
+}
+
+/**
+ * A path as a PowerShell single-quoted string literal.
+ *
+ * Inside single quotes PowerShell expands nothing, so a doubled quote is both
+ * the only escape it has and the only one needed. Windows filenames cannot
+ * contain `"`, `<`, `>` or `|`, but they can contain an apostrophe — and the
+ * archive lands under the user's own profile either way, which is where an
+ * apostrophe comes from: C:\Users\O'Brien\.agents-deck\tools. Pasted in raw,
+ * that apostrophe ended the string mid-path and Expand-Archive died of a syntax
+ * error, so uv could never be bootstrapped on an account whose owner has that
+ * name.
+ */
+const psQuote = (s) => `'${String(s).replace(/'/g, "''")}'`;
+
+/**
+ * The command that unpacks the artifact, as file + argv.
+ *
+ * `tar` is present on macOS, on Linux, and on Windows 10 1803 and later (as
+ * bsdtar), but Windows ships .zip and older Windows has no tar at all — so zip
+ * goes through PowerShell's Expand-Archive, which is always there.
+ *
+ * Exported, pure, and with the platform as a parameter, because the branch that
+ * needs checking is the one that never runs on the machine running the tests.
+ *
+ * Only the tar branch gets to pass its paths as arguments. `powershell.exe
+ * -Command` has no argument channel to pass them through — everything after
+ * -Command is joined back into the script text — so the paths are part of a
+ * PowerShell program either way, and quoting them for PowerShell is the whole
+ * job. Nothing else is quoting them on the way there: powershell.exe is an .exe,
+ * so exec.mjs spawns it directly with shell:false and the -Command string
+ * arrives as one intact argv entry, never seeing cmd.exe.
+ */
+export function extractCommand(archivePath, destDir, platform = process.platform) {
+  if (platform === "win32" && archivePath.endsWith(".zip")) {
+    return {
+      file: "powershell.exe",
+      args: [
+        "-NoProfile", "-NonInteractive", "-Command",
+        `Expand-Archive -LiteralPath ${psQuote(archivePath)} ` +
+        `-DestinationPath ${psQuote(destDir)} -Force`,
+      ],
+    };
+  }
+  return { file: "tar", args: ["-xzf", archivePath, "-C", destDir] };
+}
+
+/** Unpack the artifact. */
+async function extract(archivePath, destDir) {
+  const { file, args } = extractCommand(archivePath, destDir);
+  const r = await run(file, args, { timeout: 120_000 });
+  return r.ok;
+}
+
+/**
+ * Find the uv executable somewhere under `dir`.
+ *
+ * The archives put it in a versioned subdirectory whose name has changed
+ * between releases, so it is located rather than assumed.
+ */
+async function findUv(dir, depth = 0) {
+  const wanted = process.platform === "win32" ? "uv.exe" : "uv";
+  let entries;
+  try { entries = await readdir(dir, { withFileTypes: true }); } catch { return null; }
+  for (const e of entries) {
+    if (e.isFile() && e.name === wanted) return join(dir, e.name);
+  }
+  if (depth >= 2) return null;
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    const hit = await findUv(join(dir, e.name), depth + 1);
+    if (hit) return hit;
+  }
+  return null;
+}
+
+/**
+ * Download and verify uv into ~/.agents-deck/tools/uv.
+ *
+ * Returns { ok: true, bin, version } or { ok: false, reason }. Never throws:
+ * every caller treats a missing uv as an expected state.
+ */
+export async function bootstrapUv() {
+  // A uv from an earlier run is reused, but only once it has proved it still
+  // runs. Existing-and-therefore-good was a one-way door: the caller has no
+  // other installer left by the time it gets here, and nothing anywhere ever
+  // deletes or re-checks this path, so a uv that had been damaged — by an
+  // interrupted copy from a deck older than this fix, a half-finished disk
+  // restore, a truncating backup tool — made every boot from then on fail with
+  // `install_failed` until the user found and deleted the directory by hand.
+  // One `--version` costs milliseconds and turns that into a re-download.
+  const already = existingBootstrappedUv();
+  if (already && (await run(already, ["--version"], { timeout: 15_000 })).ok) {
+    return { ok: true, bin: already, version: "existing" };
+  }
+  // A broken one is deliberately left where it is rather than deleted: the
+  // download below renames its replacement over it, and if the download cannot
+  // happen the file is harmless — every caller probes `--version` before using
+  // it, so a uv that does not answer is already treated as absent.
+
+  // Downloading an executable is a bigger step than installing a package with a
+  // tool the user already chose, so it gets its own off switch as well as the
+  // blanket one — someone may want the managed installs and not this.
+  if (process.env.AGENTS_DECK_NO_DOWNLOAD === "1") return { ok: false, reason: "download_disabled" };
+
+  const asset = assetName();
+  if (!asset) return { ok: false, reason: "unsupported_platform" };
+
+  const version = await latestVersion();
+  const base = `${DOWNLOAD_BASE}/${version}/${asset}`;
+
+  // Created inside the try, because it is created rather than merely named:
+  // see the mkdtemp below for why that distinction is the whole fix.
+  let staging = null;
+  // Set while a half-finished binary exists under a name of its own, cleared the
+  // moment it is renamed into place; the finally below removes whatever is left.
+  let partial = null;
+  try {
+    const [archive, sumText] = await Promise.all([
+      download(base),
+      download(`${base}.sha256`, { asText: true }),
+    ]);
+    if (!archive) return { ok: false, reason: "download_failed" };
+
+    // No published checksum means no way to know what was downloaded, and an
+    // unverified binary is not something to run on someone's machine.
+    const expected = sumText?.trim().split(/\s+/)[0]?.toLowerCase();
+    if (!expected || !/^[0-9a-f]{64}$/.test(expected)) {
+      return { ok: false, reason: "no_checksum" };
+    }
+    const actual = createHash("sha256").update(archive).digest("hex");
+    if (actual !== expected) return { ok: false, reason: "checksum_mismatch" };
+
+    // ── where the archive is unpacked, and why it is not the system temp dir ──
+    //
+    // This used to be `join(tmpdir(), `agents-deck-uv-${process.pid}`)`, created
+    // with `mkdir(..., { recursive: true })` — which does not fail on a
+    // directory that is already there.
+    //
+    // On macOS tmpdir() is a per-user `/var/folders/…/T` and on Windows it is
+    // inside the profile, so the header's promise held on both. On Linux it is
+    // `/tmp`, mode 1777, writable by every account on the box. The comment two
+    // hundred lines up reasons carefully about tmpdir() being inside the user's
+    // profile ON WINDOWS and never asks the Linux question.
+    //
+    // Three things then line up. The name is derived from a pid, so it is
+    // cheap to blanket the whole plausible range in advance. `findUv` returns a
+    // depth-0 file before it recurses, while the genuine uv always sits one
+    // level down inside the archive's versioned directory — so a planted
+    // `/tmp/agents-deck-uv-<pid>/uv` wins deterministically rather than by
+    // racing. And the SHA-256 above is computed on the downloaded buffer, never
+    // on the extracted file, so it does not cover the thing that is executed.
+    // What followed was a copy, a chmod 0755, a `--version` run, a rename to
+    // the permanent name and reuse of that name forever.
+    //
+    // `mkdtemp` under TOOL_DIR fixes all three at once: the directory is inside
+    // a tree the user already owns, its name is unpredictable, and mkdtemp
+    // CREATES — it cannot be handed a directory somebody else made. findUv's
+    // ordering is left alone deliberately; it is not wrong on its own, and it
+    // stops being reachable once nobody else can write here.
+    await mkdir(TOOL_DIR, { recursive: true });
+    staging = await mkdtemp(join(TOOL_DIR, "uv-staging-"));
+    const archivePath = join(staging, asset);
+    await writeFile(archivePath, archive);
+    if (!(await extract(archivePath, staging))) return { ok: false, reason: "extract_failed" };
+
+    const found = await findUv(staging);
+    if (!found) return { ok: false, reason: "not_in_archive" };
+
+    await mkdir(UV_DIR, { recursive: true });
+    const dest = join(UV_DIR, process.platform === "win32" ? "uv.exe" : "uv");
+
+    // Copy rather than rename out of staging: the staging dir is in the system
+    // temp directory, which is often a different filesystem, and rename across
+    // one fails. But the copy goes to a name of its own INSIDE UV_DIR — same
+    // filesystem as the destination, so THAT rename is the atomic kind — and
+    // only becomes `uv` once it is whole, flushed, executable and has answered
+    // `--version`. Copying 40MB straight to the final name is many writes long,
+    // and a Ctrl-C in the middle of them (the boot install runs before the
+    // signal handlers are up) left a truncated file under the name every later
+    // run trusts. Interrupt this instead and all that is left is an inert temp
+    // file: `uv` either does not exist or is a binary that ran once already.
+    // The pid keeps two decks starting at once off each other's copy, and the
+    // .exe keeps the file executable on Windows, where the version check below
+    // would otherwise have nothing to spawn.
+    const suffix = process.platform === "win32" ? ".exe" : "";
+    partial = join(UV_DIR, `.uv-${process.pid}-${Date.now().toString(36)}${suffix}`);
+    await copyFile(found, partial);
+    // Flushed before the rename, so a crash or power cut just after a
+    // successful bootstrap cannot leave the name pointing at blocks that were
+    // never written — the same guarantee writeFileAtomic gives settings.json.
+    const handle = await open(partial, "r+");
+    try { await handle.sync(); } finally { await handle.close(); }
+    if (process.platform !== "win32") await chmod(partial, 0o755);
+
+    const check = await run(partial, ["--version"], { timeout: 15_000 });
+    if (!check.ok) return { ok: false, reason: "does_not_run" };
+
+    await renameWithRetry(partial, dest);
+    partial = null;
+
+    return { ok: true, bin: dest, version };
+  } catch (err) {
+    return { ok: false, reason: "error", detail: String(err?.message ?? err).slice(0, 200) };
+  } finally {
+    // maxRetries for the reason the ccusage repair gives: the archive was just
+    // unpacked here and `partial` was just run out of it, and on Windows a file
+    // a handle has not finished releasing cannot be deleted — the directory
+    // then refuses to go with ENOTEMPTY. Litter rather than a failure, since
+    // this is swallowed, but litter in the user's home that nothing else sweeps.
+    if (staging) await rm(staging, { recursive: true, force: true, maxRetries: 10, retryDelay: 25 }).catch(() => {});
+    if (partial) await rm(partial, { force: true }).catch(() => {});
+  }
+}

package/bin/ccdeck.js

@@ -1,194 +0,0 @@
-#!/usr/bin/env node
-import { spawn } from 'child_process';
-import { existsSync } from 'fs';
-import { createRequire } from 'module';
-import { fileURLToPath, pathToFileURL } from 'url';
-import { dirname, resolve } from 'path';
-
-const __dir = dirname(fileURLToPath(import.meta.url));
-// This package ships nothing but bin/, so both halves of the deck come out of
-// the agents-deck installed beside us — the binary to hand off to, and the rule
-// for reporting a worker that was killed. Reached by path rather than as the
-// bare specifier `agents-deck/src/server/supervisor.mjs` so the two can never
-// resolve to different copies, and so an `exports` map added to agents-deck
-// later cannot turn this into a startup crash. The dependency is pinned to the
-// exact version at publish time, so the file is always there.
-//
-// TWO LAYOUTS, because npm has two and only one of them was ever handled. Under
-// `npx ccdeck` the dependency is a sibling — `_npx/<hash>/node_modules/{ccdeck,
-// agents-deck}` — and `../../agents-deck` finds it. Under `npm i -g ccdeck` it
-// is NOT: npm stopped hoisting a global package's dependencies in v7, so it
-// lands at `lib/node_modules/ccdeck/node_modules/agents-deck` while
-// `../../agents-deck` points at `lib/node_modules/agents-deck`, which does not
-// exist. That is not a hypothetical — installing the published 1.33.142 this
-// way and running it gives ERR_MODULE_NOT_FOUND before the deck prints
-// anything, so the one command every surface tells people to run has been dead
-// on arrival for every global install. npx was the only shape anybody tested.
-//
-// So: try the nested layout first (it is the one that was broken), then the
-// sibling, then let node resolve it — which covers a workspace, a pnpm store
-// and any future layout none of us predicted. Path-first, resolution last,
-// keeps the guarantee in the paragraph above wherever a path does answer.
-const nested = resolve(__dir, '../node_modules/agents-deck');
-const sibling = resolve(__dir, '../../agents-deck');
-
-// The three codes that mean "there is no deck here", as opposed to "the deck is
-// broken". Both of the steps below can fail either way and they deserve opposite
-// answers, so the distinction is made once, by code, and nothing else is caught.
-//
-// MODULE_NOT_FOUND is what the last resort above threw in the shape people
-// actually hit it: a half-removed install, a linked workspace, Yarn PnP without
-// agents-deck in scope. Unguarded it reached the user as an eight-frame stack
-// out of node's CJS loader before a single line of the deck — the same failure
-// shape 0075d57 was written to eliminate, arriving through a different API. A
-// launcher that cannot find its own deck knows exactly what is wrong and can say
-// it in a sentence.
-//
-// ERR_PACKAGE_PATH_NOT_EXPORTED is the case the header above worries about:
-// `./package.json` is not exported by default, so an `exports` map added to
-// agents-deck later would make that resolve throw rather than answer. Resolving
-// `agents-deck/bin/agent-dag.js` instead, as #359 suggests, does not avoid it —
-// every subpath is gated by an exports map, and that one resolves to the bin
-// directory rather than to the package root. The path probes are what actually
-// keep the header's promise; listing the code here only makes the failure legible
-// if it ever arrives.
-//
-// ERR_MODULE_NOT_FOUND is the import below: a pkg that was found but has no
-// supervisor.mjs under it — a truncated or half-written install — is just as
-// much "there is no deck here", and it used to throw its own stack too.
-const NO_DECK = new Set(['MODULE_NOT_FOUND', 'ERR_MODULE_NOT_FOUND', 'ERR_PACKAGE_PATH_NOT_EXPORTED']);
-
-let pkg, dieOfSignal;
-try {
-  pkg = existsSync(resolve(nested, 'package.json')) ? nested
-    : existsSync(resolve(sibling, 'package.json')) ? sibling
-    : dirname(createRequire(import.meta.url).resolve('agents-deck/package.json'));
-  ({ dieOfSignal } = await import(pathToFileURL(resolve(pkg, 'src/server/supervisor.mjs')).href));
-} catch (err) {
-  // A supervisor.mjs that throws while it evaluates is a bug in the deck, not a
-  // missing install, and it keeps its stack — that stack is the only thing that
-  // would explain it.
-  if (!NO_DECK.has(err?.code)) throw err;
-  console.error([
-    'ccdeck: could not find the agents-deck install it runs.',
-    '',
-    `  looked in ${nested}`,
-    `       and ${sibling}`,
-    '',
-    '  ccdeck ships only this launcher — the deck itself is the agents-deck package',
-    '  npm installs alongside it. Reinstall with `npm i -g ccdeck`, or skip the',
-    '  launcher and run the deck directly with `npx agents-deck`.',
-  ].join('\n'));
-  process.exit(1);
-}
-
-const bin = resolve(pkg, 'bin/agent-dag.js');
-const child = spawn(process.execPath, [bin, ...process.argv.slice(2)], { stdio: 'inherit' });
-// The supervisor answers a killed worker by dying of the same signal rather
-// than exiting 128+n, which reaches us as (null, 'SIGTERM'). Exiting with
-// `code ?? 0` turned that into 0: a `kill` or an OOM kill of a deck started as
-// `npx ccdeck` was reported to systemd — or to whatever script started it — as
-// a clean stop, while the same build under `npx agents-deck` reported 143.
-// Ctrl+C hid it: that signals the whole group, so the stub died of SIGINT
-// before this line could run — and a deck that shut itself down cleanly comes
-// back through here as a plain 0 anyway. The handlers below are what stop the
-// stub from dying first, which is what makes this line reachable on that path
-// too; they change nothing about the verdict it reports.
-child.on('exit', (code, signal) => (signal ? dieOfSignal(signal) : process.exit(code ?? 0)));
-
-// ── a signal aimed at this process has to reach the deck, and must not reach it
-//    twice ─────────────────────────────────────────────────────────────────────
-//
-// Nothing here trapped a signal, so `kill <pid>` against the stub — a systemd
-// unit without KillMode=control-group, any supervisor that signals only the main
-// pid, a hand-typed kill — ended the launcher in about six milliseconds and left
-// agent-dag.js and deck.js running: still serving on 4317, still advertising a
-// live pid in the discovery file. Hooks keep posting to a deck the user believes
-// is stopped, and the next `npx ccdeck` finds the port taken and quietly binds
-// another one.
-//
-// Ctrl+C is why that survived: the terminal signals the whole foreground process
-// group, and the child is in it — nothing here spawns detached — so the deck
-// gets its own copy and tears itself down without us. Measured rather than
-// assumed, by group-signalling a real stub over a real child: under a group-wide
-// SIGINT the child receives exactly one signal and shuts down; under a targeted
-// one it receives none and is still alive seconds later.
-//
-// Which is exactly why forwarding cannot be unconditional. Under Ctrl+C the
-// child has already had the signal, and a forwarded copy lands about a
-// millisecond behind it as a SECOND one — measured the same way, three runs out
-// of three. agent-dag.js reads a second signal as an impatient user pressing
-// Ctrl+C again and answers it by SIGKILLing deck.js, and a SIGKILLed deck is a
-// deck denied its own shutdown: the discovery file it was partway through
-// removing stays behind, naming a pid that is gone. That is this very bug
-// arriving from the other direction, so the obvious one-liner trades an orphaned
-// deck for a stale one.
-//
-// So the forward is delayed, and the child's own exit cancels it. If the child
-// got the signal too it is gone long before the timer and nothing is sent; if it
-// did not, the timer fires and the deck comes down. A second signal means
-// somebody is waiting, so it goes straight through. Deciding this by clock
-// rather than by asking agent-dag to tolerate a duplicate keeps the answer true
-// against a deck this stub did not ship with — a workspace, a pnpm store, an
-// older global agents-deck found by the resolution above — which is the whole
-// reason those layouts are supported at all.
-//
-// Staying alive is the other half of the fix, and it is what the delay is built
-// on. The default action for all three signals is to die, so the stub used to
-// vanish while the deck was still shutting down, handing the shell a prompt and
-// a status of its own before the deck had one. Now the child's status is what
-// the caller gets, the way `npx agents-deck` has always answered — including the
-// 0 deck.js chooses for a Ctrl+C, where the stub used to report 130. That is the
-// parity the exit handler above exists for, extended to the signals that arrive
-// here rather than there. dieOfSignal drops our handler before it re-raises, so
-// a deck that really did die of a signal still comes back as 128+n instead of
-// being swallowed by the handlers below.
-//
-// WINDOWS GETS THE OPPOSITE ANSWER, because it has no signals to forward. The
-// only thing that runs these handlers there is a console event — Ctrl+C,
-// Ctrl+Break, the window closing — and the console delivers those to every
-// process attached to it, so the child always has its own copy already. A
-// targeted kill there is TerminateProcess: no handler runs at all, and there is
-// nothing this file can do about that. Meanwhile `child.kill()` on Windows IS
-// TerminateProcess, so forwarding would take agent-dag.js out mid-shutdown and
-// orphan deck.js underneath it — the failure we are here to fix, caused by the
-// fix. So on Windows the handlers only keep us alive for the child's exit
-// status, and never forward.
-//
-// The delay itself is chosen against what it has to outlast and what it makes
-// wait: longer than a healthy teardown, since deck.js caps its entire shutdown
-// at 1500ms, and shorter than every stop timeout that would be sitting on the
-// other end of a `kill` — docker's 10s is the tightest, systemd's 90s the most
-// common. Ctrl+C never waits it out, because the deck is long gone by then.
-const FORWARD_AFTER_MS = 2000;
-
-let pending = null;   // a forward waiting to see whether the child needs one
-let forwarded = false; // whether one has already gone out
-
-const forward = (sig) => {
-  pending = null;
-  forwarded = true;
-  try { child.kill(sig); } catch { /* already gone */ }
-};
-
-for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
-  process.on(sig, () => {
-    // Node sets both of these in the same breath as it emits 'exit', so this is
-    // the child's real state and not a guess: there is nothing left to signal,
-    // and the exit handler above is already on its way to ending us.
-    if (child.exitCode !== null || child.signalCode !== null) return;
-    if (process.platform === 'win32') return;
-    if (!pending && !forwarded) {
-      // unref'd because the child's own handle is what keeps this process alive;
-      // a forward that is still waiting should never be the reason the stub
-      // outlives the deck.
-      pending = setTimeout(() => forward(sig), FORWARD_AFTER_MS).unref();
-      return;
-    }
-    // Anything after the first goes straight out, and `forwarded` keeps it that
-    // way: once somebody has asked twice, a later ask must not be slower than
-    // the one before it. The clear is a no-op when the delay has already run.
-    clearTimeout(pending);
-    forward(sig);
-  });
-}