centralu 0.1.0-beta.25 → 0.1.0-beta.26

package/bin/serve.mjs

@@ -15,8 +15,8 @@
  * import time and cannot be imported by a test. package.json "files" lists the whole bin/
  * directory, so this ships automatically.
  */
-import { spawn } from 'node:child_process'
-import { createHash, randomBytes } from 'node:crypto'
+import { execFileSync, spawn } from 'node:child_process'
+import { createHash, createHmac, randomBytes } from 'node:crypto'
 import { chmodSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, writeSync, closeSync } from 'node:fs'
 import { connect, createServer } from 'node:net'
 import { userInfo } from 'node:os'
@@ -295,7 +295,29 @@ export function rotateServeToken(dataDir, platform = process.platform) {
  */
 export function launcherScript(platform, execPath, cliPath) {
   if (platform === 'win32') {
-    return `@echo off\r\nrem Written by \`centralu serve\`: reaches this install without npm's folder on PATH.\r\n"${execPath}" "${cliPath}" %*\r\n`
+    // A batch file reads every % as the start of a variable (`100% cli.mjs" %*` came out as `100*`); %% is a literal one
+    const lit = (v) => String(v).replaceAll('%', '%%')
+    /*
+     * The file is UTF-8, and cmd.exe reads each line of a batch file in the console's code page as it reaches it: 949
+     * on a Korean Windows, where a profile folder named in Korean came out as other characters and node found no
+     * centralu.mjs there (#849). So the lines before the paths, all ASCII, switch the console to UTF-8 (65001), and the
+     * code page it had is put back on the line with the paths, ahead of node: cmd.exe reads and decodes a whole line
+     * before it runs any of it, so the paths are already read as UTF-8 by then. The console is the shell's that ran
+     * this, and node runs on the page it had; a Ctrl+C answered at "Terminate batch job (Y/N)?" ends this file
+     * before any later line, and a restore there was skipped. chcp is named by its full path: the shell's PATH may
+     * not have System32 on it.
+     */
+    return [
+      '@echo off',
+      "rem Written by `centralu serve`: reaches this install without npm's folder on PATH.",
+      'setlocal',
+      'set "CENTRALU_CP="',
+      `for /f "tokens=2 delims=:." %%c in ('%SystemRoot%\\System32\\chcp.com') do set /a "CENTRALU_CP=%%c" >nul 2>&1`,
+      '%SystemRoot%\\System32\\chcp.com 65001 >nul 2>&1',
+      `(if defined CENTRALU_CP %SystemRoot%\\System32\\chcp.com %CENTRALU_CP% >nul 2>&1) & "${lit(execPath)}" "${lit(cliPath)}" %*`,
+      'exit /b %ERRORLEVEL%',
+      '',
+    ].join('\r\n')
   }
   const q = (v) => `'${String(v).replaceAll("'", "'\\''")}'`
   return (
@@ -398,7 +420,7 @@ export function protocolVersionOf(entry) {
  * `install` (additive, the line stays `v: 1`) says what runs this command (`installInfo`); `detach`
  * is added by `--detach` only.
  */
-export function connectionLine({ port, token, version, protocolVersion, dataDir, hostRunning, install, autostart, detach }) {
+export function connectionLine({ port, token, version, protocolVersion, dataDir, hostRunning, install, autostart, detach, proof }) {
   return JSON.stringify({
     v: 1,
     port,
@@ -410,6 +432,8 @@ export function connectionLine({ port, token, version, protocolVersion, dataDir,
     ...(install ? { install } : {}),
     ...(autostart ? { autostart } : {}),
     ...(detach ? { detach } : {}),
+    // The running host proves it holds the token before the hub sends it (#838); absent: the hub sends hello as before
+    ...(proof ? { proof: true } : {}),
   })
 }
 
@@ -584,16 +608,73 @@ export function mismatchServerVersion(message) {
   return m ? Number(m[1] ?? m[2]) : null
 }
 
+/**
+ * Whether the installed host answers a `prove` (#838): a bundle says so in `bundle-info.json` (`hostProof`), a host run
+ * from source has `transport/host-proof.ts`. The connection line's `proof` is this, not a live answer: a program another
+ * account put on the port could otherwise answer the probe so as to make the line say no, and the hub send the token.
+ */
+export function hostProvesOf(entry) {
+  try {
+    return JSON.parse(readFileSync(join(dirname(entry), 'bundle-info.json'), 'utf8')).hostProof === 1
+  } catch {
+    // not a bundle; try the source below
+  }
+  return existsSync(join(dirname(entry), 'transport', 'host-proof.ts'))
+}
+
+/** The answer a host holding `token` gives to a `prove` of `nonce` (the host's `hostProof`) */
+function proofOf(token, nonce) {
+  return createHmac('sha256', token).update(`centralu host proof v1\0${nonce}`).digest('base64url')
+}
+
+/**
+ * Opens a socket to the host and says hello with the token, the way `probeHost` and `askHostToStop` do. With `prove`
+ * (the installed host can, `hostProvesOf`), the host first proves it holds the token (#838), and the token goes out only
+ * then: whatever else listens on the port (another account's program, while the host is down) never sees it.
+ * `on.hello(ws)` runs after the hello is sent; `on.unproven()` when the proof did not come.
+ */
+function helloSocket({ port, token, protocolVersion, prove, WebSocketImpl, on }) {
+  const ws = new WebSocketImpl(`ws://127.0.0.1:${port}`)
+  const nonce = prove ? randomBytes(24).toString('base64url') : null
+  // Proving only once the socket is open: a port where nothing listens is gone, not unproven
+  let proving = false
+  const hello = () => ws.send(JSON.stringify({ kind: 'hello', token, protocolVersion: protocolVersion ?? 0 }))
+  ws.onopen = () => {
+    if (!prove) return hello()
+    proving = true
+    ws.send(JSON.stringify({ kind: 'prove', nonce }))
+  }
+  ws.onmessage = (ev) => {
+    let m
+    try {
+      m = JSON.parse(String(ev.data))
+    } catch {
+      m = null
+    }
+    if (proving) {
+      proving = false
+      if (m?.kind === 'proof' && m.nonce === nonce && m.mac === proofOf(token, nonce)) return hello()
+      return on.unproven()
+    }
+    if (m) on.message(m)
+  }
+  ws.onerror = () => (proving ? on.unproven() : on.gone())
+  ws.onclose = () => (proving ? on.unproven() : on.gone())
+  return ws
+}
+
 /**
  * Whether a host that holds this token answers on the port: a real hello, not a TCP connect, so a
  * stranger's program on the same port does not count, and the answer carries the running host's
  * own protocol and version (which differ from the installed package's after an `npm i -g` the
- * host was not restarted for).
+ * host was not restarted for). With `prove` the host proves it holds the token first (#838).
  *
- * `{ running, protocolVersion?, version? }`. Node 22.4+ has a global WebSocket; on an older 22
- * this falls back to a TCP connect and reports only `running`.
+ * `{ running, protocolVersion?, version?, unproven? }`. `unproven`: something answered on the port but did not prove
+ * it holds the token, so it was not sent: another program, or a host from before #838 still running after an update
+ * (`heldHere` tells those apart by the data folder's lock). Node 22.4+ has a global WebSocket; on an older 22 this falls
+ * back to a TCP connect and reports only `running`.
  */
-export function probeHost({ port, token, protocolVersion, timeoutMs = 2000, WebSocketImpl = globalThis.WebSocket }) {
+export function probeHost({ port, token, protocolVersion, prove = false, timeoutMs = 2000, WebSocketImpl = globalThis.WebSocket }) {
   if (typeof WebSocketImpl !== 'function') return tcpProbe(port, timeoutMs)
   return new Promise((resolve) => {
     let ws = null
@@ -611,35 +692,84 @@ export function probeHost({ port, token, protocolVersion, timeoutMs = 2000, WebS
     }
     const timer = setTimeout(() => done({ running: false }), timeoutMs)
     try {
-      ws = new WebSocketImpl(`ws://127.0.0.1:${port}`)
+      ws = helloSocket({
+        port, token, protocolVersion, prove, WebSocketImpl,
+        on: {
+          unproven: () => done({ running: false, unproven: true }),
+          gone: () => done({ running: false }),
+          message: (m) => {
+            if (m.kind === 'hello_ok') {
+              done({
+                running: true,
+                protocolVersion: Number.isInteger(m.protocolVersion) ? m.protocolVersion : undefined,
+                version: typeof m.build?.version === 'string' ? m.build.version : undefined,
+              })
+            } else if (m.kind === 'res' && m.ok === false && m.error?.code === 'version_mismatch') {
+              // The token was right (it is checked first), so this is our host, on another protocol
+              done({ running: true, protocolVersion: mismatchServerVersion(m.error.message) ?? undefined })
+            }
+          },
+        },
+      })
     } catch {
       done({ running: false })
-      return
     }
-    ws.onopen = () => ws.send(JSON.stringify({ kind: 'hello', token, protocolVersion: protocolVersion ?? 0 }))
-    ws.onmessage = (ev) => {
-      let m
-      try {
-        m = JSON.parse(String(ev.data))
-      } catch {
-        return
-      }
-      if (m?.kind === 'hello_ok') {
-        done({
-          running: true,
-          protocolVersion: Number.isInteger(m.protocolVersion) ? m.protocolVersion : undefined,
-          version: typeof m.build?.version === 'string' ? m.build.version : undefined,
-        })
-      } else if (m?.kind === 'res' && m.ok === false && m.error?.code === 'version_mismatch') {
-        // The token was right (it is checked first), so this is our host, on another protocol
-        done({ running: true, protocolVersion: mismatchServerVersion(m.error.message) ?? undefined })
-      }
-    }
-    ws.onerror = () => done({ running: false })
-    ws.onclose = () => done({ running: false })
   })
 }
 
+/**
+ * A probe that did not prove the token, while this data folder's host is alive (`host.lock`): a host from before #838
+ * still running after an update. It is running, and is not sent the token; a hub asking it for a proof is refused
+ * until it restarts. Without a live lock holder, what answered is not ours.
+ */
+export function heldHere(probe, dataDir, startOf = processStartTime) {
+  if (probe.running) return true
+  if (!probe.unproven) return false
+  return lockHolderIsAlive(dataDir, startOf)
+}
+
+/**
+ * Whether the process `host.lock` names is the one that wrote it (#838 review): alive, and started when the lock says
+ * (`ps -o lstart`, as the host writes it, `instance-lock.ts`). A lock left by a host that died, whose pid another
+ * process of the same user now has, names a stranger: counted as running, `--stop` would signal it. A lock without a
+ * start time (a host from before #184) or a system without `ps` (Windows) cannot be told apart, so it does not count.
+ */
+export function lockHolderIsAlive(dataDir, startOf = processStartTime) {
+  let holder
+  try {
+    holder = parseLockHolder(readFileSync(join(dataDir, 'host.lock'), 'utf8'))
+  } catch {
+    return false
+  }
+  if (!holder || !holder.started || !isAlive(holder.pid)) return false
+  return startOf(holder.pid) === holder.started
+}
+
+/** host.lock's `{ pid, started }`; a bare pid (an older host) has no start time */
+function parseLockHolder(text) {
+  const t = text.trim()
+  if (/^\d+$/.test(t)) return { pid: Number(t), started: null }
+  try {
+    const v = JSON.parse(t)
+    return Number.isInteger(v?.pid) && v.pid > 0 ? { pid: v.pid, started: typeof v.started === 'string' ? v.started : null } : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * A pid's start time, as `instance-lock.ts`'s `processStartTime` reads it: `ps -o lstart=` with the C locale, so the
+ * host that wrote the lock and this launcher read the same text. null without `ps` (Windows) or when it fails.
+ */
+export function processStartTime(pid) {
+  if (process.platform === 'win32') return null
+  try {
+    return execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 2000, env: { ...process.env, LC_ALL: 'C' }, stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null
+  } catch {
+    return null
+  }
+}
+
 function tcpProbe(port, timeoutMs) {
   return new Promise((resolve) => {
     const s = connect({ host: '127.0.0.1', port })
@@ -688,16 +818,19 @@ function say(line) {
 async function describe({ env, dataDir, state, entry, version }) {
   const port = state.port ?? DEFAULT_SERVE_PORT
   const installed = protocolVersionOf(entry)
-  const probe = await probeHost({ port, token: state.token, protocolVersion: installed })
+  // Whether the installed host proves it holds the token (#838): asked of the running one before its hello, and said in the line
+  const proof = hostProvesOf(entry)
+  const probe = await probeHost({ port, token: state.token, protocolVersion: installed, prove: proof })
   const protocolVersion = (probe.running ? probe.protocolVersion : undefined) ?? installed
   if (protocolVersion === null) return null
   return {
+    proof,
     port,
     token: state.token,
     version: (probe.running ? probe.version : undefined) ?? version,
     protocolVersion,
     dataDir,
-    hostRunning: probe.running,
+    hostRunning: heldHere(probe, dataDir),
     install: installInfo(dataDir, env),
     autostart: autostartInfo(dataDir, process.platform, env),
   }
@@ -760,8 +893,8 @@ export async function runServe({ env, home, entry, version, cliPath, port: asked
   // A serve that is already up answers on the port it recorded; say so before starting a host that
   // would only fail on the data folder's lock with a less specific message.
   const recorded = state.port ?? DEFAULT_SERVE_PORT
-  const existing = await probeHost({ port: recorded, token: state.token, protocolVersion })
-  if (existing.running) {
+  const existing = await probeHost({ port: recorded, token: state.token, protocolVersion, prove: hostProvesOf(entry) })
+  if (heldHere(existing, dataDir)) {
     const pid = lockHolderPid(dataDir)
     say(`centralu serve is already running for ${dataDir} on 127.0.0.1:${recorded}${pid ? ` (pid ${pid})` : ''}. Not starting a second one.`)
     return 1
@@ -934,11 +1067,21 @@ export function windowsArg(arg) {
   return `"${s.replace(/(\\+)$/, '$1$1')}"`
 }
 
+/**
+ * The first line of a script run by Windows PowerShell 5.1: its own module path. Started from
+ * PowerShell 7 (pwsh, a `DefaultShell` of it, a CI runner), 5.1 inherits pwsh's `PSModulePath`, whose
+ * first folder holds 7.x copies of the built-in modules that 5.1 cannot load: `Invoke-CimMethod` and
+ * `Get-ScheduledTask` are then "found in the module … but the module could not be loaded". Same line as
+ * the hub's (links/tunnel.ts, `PS_PREAMBLE`)
+ */
+const PS_MODULE_PATH = "if ($env:PSModulePath -match '\\x5cPowerShell\\x5c') { $env:PSModulePath = \"$env:ProgramFiles\\WindowsPowerShell\\Modules;$PSHOME\\Modules\" }"
+
 /** The PowerShell that asks WMI to create `commandLine`. Values cross as base64, so no quoting can break */
 export function wmiScript({ commandLine, cwd = null }) {
   const text = (s) => `[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${Buffer.from(s, 'utf8').toString('base64')}'))`
   return [
     "$ErrorActionPreference = 'Stop'",
+    PS_MODULE_PATH,
     '[Console]::OutputEncoding = [Text.Encoding]::UTF8',
     `$a = @{ CommandLine = ${text(commandLine)} }`,
     ...(cwd ? [`$a.CurrentDirectory = ${text(cwd)}`] : []),
@@ -1205,7 +1348,7 @@ export async function runDetachedChild({ spec, ...opts }) {
  * `{ ok: true }` once the host took it, `{ ok: false, message, protocolVersion? }` otherwise; the
  * last names the host's protocol when the hello was refused for it, so the caller can ask again.
  */
-export function askHostToStop({ port, token, protocolVersion, timeoutMs = 5000, WebSocketImpl = globalThis.WebSocket }) {
+export function askHostToStop({ port, token, protocolVersion, prove = false, timeoutMs = 5000, WebSocketImpl = globalThis.WebSocket }) {
   if (typeof WebSocketImpl !== 'function') return Promise.resolve({ ok: false, message: `Node ${process.version} has no WebSocket to ask with` })
   return new Promise((resolve) => {
     let ws = null
@@ -1223,28 +1366,25 @@ export function askHostToStop({ port, token, protocolVersion, timeoutMs = 5000,
     }
     const timer = setTimeout(() => done({ ok: false, message: 'no answer in time' }), timeoutMs)
     try {
-      ws = new WebSocketImpl(`ws://127.0.0.1:${port}`)
+      // With `prove`, the token goes out only to a host that proved it holds it (#838)
+      ws = helloSocket({
+        port, token, protocolVersion, prove, WebSocketImpl,
+        on: {
+          unproven: () => done({ ok: false, message: 'what answers on the port did not prove it holds the token' }),
+          gone: () => done({ ok: false, message: 'the connection closed' }),
+          message: (m) => {
+            if (m.kind === 'hello_ok') ws.send(JSON.stringify({ kind: 'rpc', id: 'stop', method: 'host.stop', params: {} }))
+            else if (m.kind === 'res' && m.id === 'stop') done(m.ok ? { ok: true } : { ok: false, message: m.error?.message ?? 'refused' })
+            else if (m.kind === 'res' && m.ok === false) {
+              const pv = m.error?.code === 'version_mismatch' ? (m.error?.data?.protocolVersion ?? mismatchServerVersion(m.error.message)) : null
+              done({ ok: false, message: m.error?.message ?? 'refused', ...(Number.isInteger(pv) ? { protocolVersion: pv } : {}) })
+            }
+          },
+        },
+      })
     } catch (e) {
       done({ ok: false, message: e.message })
-      return
-    }
-    ws.onopen = () => ws.send(JSON.stringify({ kind: 'hello', token, protocolVersion: protocolVersion ?? 0 }))
-    ws.onmessage = (ev) => {
-      let m
-      try {
-        m = JSON.parse(String(ev.data))
-      } catch {
-        return
-      }
-      if (m?.kind === 'hello_ok') ws.send(JSON.stringify({ kind: 'rpc', id: 'stop', method: 'host.stop', params: {} }))
-      else if (m?.kind === 'res' && m.id === 'stop') done(m.ok ? { ok: true } : { ok: false, message: m.error?.message ?? 'refused' })
-      else if (m?.kind === 'res' && m.ok === false) {
-        const pv = m.error?.code === 'version_mismatch' ? (m.error?.data?.protocolVersion ?? mismatchServerVersion(m.error.message)) : null
-        done({ ok: false, message: m.error?.message ?? 'refused', ...(Number.isInteger(pv) ? { protocolVersion: pv } : {}) })
-      }
     }
-    ws.onerror = () => done({ ok: false, message: 'could not connect' })
-    ws.onclose = () => done({ ok: false, message: 'the connection closed' })
   })
 }
 
@@ -1293,9 +1433,10 @@ export async function runStop({
   if (!state) return report({ ok: true, wasRunning: false, message: `no centralu serve has run for ${dataDir}` })
   const port = state.port ?? DEFAULT_SERVE_PORT
   const installed = protocolVersionOf(entry) ?? 0
-  const probe = () => probeHost({ port, token: state.token, protocolVersion: installed })
+  const prove = hostProvesOf(entry)
+  const probe = () => probeHost({ port, token: state.token, protocolVersion: installed, prove })
   const first = await probe()
-  if (!first.running) return report({ ok: true, wasRunning: false, message: `centralu serve is not running for ${dataDir}` })
+  if (!heldHere(first, dataDir)) return report({ ok: true, wasRunning: false, message: `centralu serve is not running for ${dataDir}` })
 
   const hostPid = lockHolderPid(dataDir)
   const launcher = readServePid(dataDir)
@@ -1303,8 +1444,8 @@ export async function runStop({
   const launcherPid = launcher && hostPid && launcher.hostPid === hostPid ? launcher.pid : null
   const down = async () => !(await probe()).running && !(hostPid && isAlive(hostPid))
 
-  let asked = await askHostToStop({ port, token: state.token, protocolVersion: first.protocolVersion ?? installed })
-  if (!asked.ok && asked.protocolVersion !== undefined) asked = await askHostToStop({ port, token: state.token, protocolVersion: asked.protocolVersion })
+  let asked = await askHostToStop({ port, token: state.token, protocolVersion: first.protocolVersion ?? installed, prove })
+  if (!asked.ok && asked.protocolVersion !== undefined) asked = await askHostToStop({ port, token: state.token, protocolVersion: asked.protocolVersion, prove })
   let how = 'asked'
   let stopped = asked.ok && (await waitUntil(down, timeoutMs))
   let note = asked.ok ? null : `the host did not take the request to stop (${asked.message})`
@@ -1499,7 +1640,7 @@ const TASK_WORD = 'CENTRALU-AUTOSTART'
  * on battery too, and with no time limit (the default ends a task after 72 hours).
  */
 export function taskScript(action, { name, run = '' }) {
-  const head = ["$ErrorActionPreference = 'Stop'", '[Console]::OutputEncoding = [Text.Encoding]::UTF8', `$name = ${psText(name)}`]
+  const head = ["$ErrorActionPreference = 'Stop'", PS_MODULE_PATH, '[Console]::OutputEncoding = [Text.Encoding]::UTF8', `$name = ${psText(name)}`]
   const fail = `} catch { "${TASK_WORD}-ERROR $($_.Exception.Message -replace '\\s+', ' ')" }`
   const find = "$t = Get-ScheduledTask -TaskName $name -TaskPath '\\' -ErrorAction SilentlyContinue"
   if (action === 'status') return [...head, 'try {', `  ${find}`, `  if ($t) { "${TASK_WORD} state $($t.State)" } else { '${TASK_WORD} state none' }`, fail].join('\n')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "centralu",
-  "version": "0.1.0-beta.25",
+  "version": "0.1.0-beta.26",
   "description": "Run, watch and steer several Claude Code and Codex CLI sessions from one window",
   "license": "MIT",
   "author": "ijun17",
@@ -38,9 +38,9 @@
     "win32"
   ],
   "optionalDependencies": {
-    "@centralu/darwin-arm64": "0.1.0-beta.25",
-    "@centralu/linux-arm64": "0.1.0-beta.25",
-    "@centralu/linux-x64": "0.1.0-beta.25",
-    "@centralu/win32-x64": "0.1.0-beta.25"
+    "@centralu/darwin-arm64": "0.1.0-beta.26",
+    "@centralu/linux-arm64": "0.1.0-beta.26",
+    "@centralu/linux-x64": "0.1.0-beta.26",
+    "@centralu/win32-x64": "0.1.0-beta.26"
   }
 }