centralu 0.1.0-beta.27 → 0.1.0-beta.29

package/bin/platform.mjs

@@ -42,6 +42,14 @@ export function targetFor(platform, arch) {
   return TARGETS[`${platform}-${arch}`] ?? null
 }
 
+/**
+ * Whether replacing a file by rename fails while another program has the target open (a reader, a virus scanner):
+ * Windows, which then answers EPERM, EBUSY or EACCES for a moment. Elsewhere a rename over an open file just works.
+ */
+export function renameWaitsForReaders(platform = process.platform) {
+  return platform === 'win32'
+}
+
 /**
  * The file that proves the artifact is there and is what gets started.
  *

package/bin/serve-files.mjs

@@ -7,7 +7,7 @@ import { execFileSync } from 'node:child_process'
 import { randomBytes } from 'node:crypto'
 import { chmodSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, statSync, writeSync, closeSync } from 'node:fs'
 import { join } from 'node:path'
-import { isAlive, replaceFile } from './serve-util.mjs'
+import { isAlive, replaceFile, sleepSync } from './serve-util.mjs'
 
 /**
  * The file in the data folder that holds the token and the port, mode 0600.
@@ -30,14 +30,29 @@ export function serveDataDir(env, home) {
   return env.CC_DATA_DIR || join(home, '.centralu')
 }
 
-/** The state, or null when there is none yet or it cannot be read as one */
-export function readServeState(dataDir) {
-  let raw
-  try {
-    raw = readFileSync(join(dataDir, SERVE_STATE_FILE), 'utf8')
-  } catch {
-    return null
+/**
+ * The state, or null when there is none yet or it cannot be read as one. A file that is refused (Windows, while a
+ * writer or a scanner has it) or does not parse is read again a few times before it counts as unreadable: a
+ * `--detach` waiting for the port reads it while the launcher replaces it (#1041).
+ */
+export function readServeState(dataDir, { tries = 5, sleep = sleepSync } = {}) {
+  const file = join(dataDir, SERVE_STATE_FILE)
+  for (let i = 1; ; i++) {
+    let raw
+    try {
+      raw = readFileSync(file, 'utf8')
+    } catch (e) {
+      if (e?.code === 'ENOENT' || i >= tries) return null
+      sleep(10 * i)
+      continue
+    }
+    const state = parseServeState(raw)
+    if (state || i >= tries) return state
+    sleep(10 * i)
   }
+}
+
+function parseServeState(raw) {
   try {
     const v = JSON.parse(raw)
     if (typeof v?.token !== 'string' || v.token.length < 32) return null

package/bin/serve-host.mjs

@@ -54,9 +54,12 @@ export function connectionLine({ port, token, version, protocolVersion, dataDir,
 /**
  * The host's environment.
  *
- * - The token travels in `CC_HOST_TOKEN`, not `--token`: arguments are readable by every user on
- *   the machine (`ps`), a process's environment only by its owner. The host deletes it after
- *   reading, so nothing it spawns inherits it.
+ * - The token is in neither: arguments are readable by every user on the machine (`ps`), and a
+ *   process's start environment by every process of its user for as long as it runs (`ps eww`,
+ *   #502). `CC_HOST_TOKEN_ON_STDIN=1` tells the host it comes as the first line on its stdin
+ *   (`tokenLine`, #538), which is a pipe to this launcher anyway (`--watch-parent`). A host bundle
+ *   from before #538 reads only `CC_HOST_TOKEN`: given `legacyToken` (`takesTokenOnStdin` said no),
+ *   it gets the token there, as before.
  * - `CC_HOST_SOURCE` is the record `hello_ok.build` is made from (keeper-link.ts); without it a
  *   client could not see which version the host it reached is.
  * - Headless: no `DISPLAY` / `WAYLAND_DISPLAY`. Nothing the host or an agent starts gets a screen
@@ -66,17 +69,37 @@ export function connectionLine({ port, token, version, protocolVersion, dataDir,
  *   `CENTRALU_MANAGED`, which is the launcher's business and would otherwise reach every agent.
  * - `CC_SERVE=1` lets the host take `host.stop` (`--stop`); a host the app runs refuses it.
  */
-export function hostEnv(env, { token, dataDir, version, hostDir }) {
+export function hostEnv(env, { dataDir, version, hostDir, legacyToken }) {
   const out = { ...env }
-  for (const k of ['DISPLAY', 'WAYLAND_DISPLAY', 'CC_KEEPER', 'CC_FRONT_DOOR', 'CC_DEV', 'CC_HOST_TOKEN', 'CC_HOST_SOURCE', 'CENTRALU_MANAGED']) delete out[k]
+  for (const k of ['DISPLAY', 'WAYLAND_DISPLAY', 'CC_KEEPER', 'CC_FRONT_DOOR', 'CC_DEV', 'CC_HOST_TOKEN', 'CC_HOST_TOKEN_ON_STDIN', 'CC_HOST_SOURCE', 'CENTRALU_MANAGED']) delete out[k]
   out.CC_DATA_DIR = dataDir
   // The host `host.stop` may end (`centralu serve --stop`): nothing else stops it in order on Windows
   out.CC_SERVE = '1'
-  out.CC_HOST_TOKEN = token
+  if (legacyToken === undefined) out.CC_HOST_TOKEN_ON_STDIN = '1'
+  else out.CC_HOST_TOKEN = legacyToken
   out.CC_HOST_SOURCE = JSON.stringify({ version, bundlePath: hostDir })
   return out
 }
 
+/**
+ * Whether the host at `entry` reads its token from stdin (#538): a bundle says so in `bundle-info.json`
+ * (`tokenOnStdin`), as the keeper reads it; a host run from source always does. `CENTRALU_HOST_ENTRY` can point at an
+ * older bundle, which would otherwise get no token and refuse every hello.
+ */
+export function takesTokenOnStdin(entry) {
+  try {
+    return JSON.parse(readFileSync(join(dirname(entry), 'bundle-info.json'), 'utf8')).tokenOnStdin === 1
+  } catch {
+    // not a bundle: the source, which reads it
+  }
+  return !existsSync(join(dirname(entry), 'bundle-info.json'))
+}
+
+/** The first line on the host's stdin: the token (#538, the host's `readHandedToken`) */
+export function tokenLine(token) {
+  return `${JSON.stringify({ token })}\n`
+}
+
 /**
  * How to start the host.
  *

package/bin/serve-install.mjs

@@ -114,6 +114,21 @@ export function parsePointer(text) {
   return { version: m[1], node: m[2] }
 }
 
+/**
+ * Where a managed version came from, from its `install.json`: `{ kind: 'dev', commit, dirty }` for a dev build put
+ * there from a git commit (`pnpm remote-dev`, #1036), null for a release (or anything unreadable). The hub shows it
+ * on the machine's row, so a build no release produced is never mistaken for one.
+ */
+export function installSource(versionDir) {
+  try {
+    const s = JSON.parse(readFileSync(join(versionDir, 'install.json'), 'utf8')).source
+    if (s?.kind === 'dev' && typeof s.commit === 'string' && /^[0-9a-f]{7,64}$/.test(s.commit)) return { kind: 'dev', commit: s.commit, dirty: s.dirty === true }
+  } catch {
+    // no install.json, or not one this reads
+  }
+  return null
+}
+
 /**
  * The connection line's `install` field (docs/plans/remote-hub.md §10.5): whether this command was
  * started by the managed launcher, the managed install's `current` and `previous`, and the Node
@@ -122,11 +137,14 @@ export function parsePointer(text) {
 export function installInfo(dataDir, env, nodeVersion = process.versions.node) {
   const l = remoteLayout(dataDir)
   const read = (file) => {
+    let p
     try {
-      return parsePointer(readFileSync(file, 'utf8'))
+      p = parsePointer(readFileSync(file, 'utf8'))
     } catch {
       return null
     }
+    const source = p && installSource(join(l.versions, p.version))
+    return p && source ? { ...p, source } : p
   }
   return { managed: env.CENTRALU_MANAGED === '1', current: read(l.current), previous: read(l.previous), node: nodeVersion }
 }

package/bin/serve-run.mjs

@@ -7,7 +7,7 @@ import { isAlive, say } from './serve-util.mjs'
 import { SERVE_STATE_FILE, SERVE_PID_FILE, serveDataDir, ensureServeState, recordServePort, rotateServeToken, heldHere, lockHolderPid, removeServePid } from './serve-files.mjs'
 import { DEFAULT_SERVE_PORT, SERVE_PORT_TRIES, chooseServePort, listensHere, windowsListening } from './serve-port.mjs'
 import { keepLauncher, installInfo } from './serve-install.mjs'
-import { protocolVersionOf, connectionLine, hostEnv, hostCommand, readyPort, hostProvesOf, probeHost } from './serve-host.mjs'
+import { protocolVersionOf, connectionLine, hostEnv, hostCommand, readyPort, hostProvesOf, probeHost, takesTokenOnStdin, tokenLine } from './serve-host.mjs'
 import { autostartInfo } from './serve-autostart.mjs'
 
 /**
@@ -97,12 +97,15 @@ export async function runServe({ env, home, entry, version, cliPath, port: asked
   }
 
   const plan = hostCommand(execPath, entry, { port, dataDir, platform })
+  const onStdin = takesTokenOnStdin(entry)
   const child = spawn(plan.command, plan.args, {
     stdio: ['pipe', 'pipe', logFd === null ? 'inherit' : 'pipe'],
-    env: hostEnv(env, { token: state.token, dataDir, version, hostDir: dirname(entry) }),
+    env: hostEnv(env, { dataDir, version, hostDir: dirname(entry), ...(onStdin ? {} : { legacyToken: state.token }) }),
     detached: plan.detached,
     windowsHide: true,
   })
+  // The token, before anything else on the pipe the host watches (#538); stdin stays open for --watch-parent
+  if (onStdin) child.stdin.write(tokenLine(state.token))
 
   let ready = false
   if (logFd !== null) {

package/bin/serve-util.mjs

@@ -3,7 +3,8 @@
  * output, a process check, and waiting.
  */
 import { spawn } from 'node:child_process'
-import { closeSync, openSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { closeSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { renameWaitsForReaders } from './platform.mjs'
 
 /**
  * Where `say` writes: stderr, except in a detached launcher, which nobody reads the stderr of and
@@ -31,12 +32,39 @@ export function sayTo(write) {
   sink = write
 }
 
+/** Blocks this thread for `ms`, for the synchronous callers that cannot await (a rename that is retried) */
+export function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+}
+
+/** What a rename over a file says on Windows while another handle has the target open (a reader, a virus scanner) */
+const BUSY_CODES = new Set(['EPERM', 'EBUSY', 'EACCES'])
+
+/**
+ * `rename`, tried again for up to `budgetMs` while the system refuses it because someone has the target open (#1041;
+ * `retry`: Windows only, `renameWaitsForReaders`). With `retry` off, and for any other error, it is one try. Backs off 10, 20, 40 ... 200 ms between tries; the last
+ * error is thrown when the budget is spent.
+ */
+export function renameRetrying(from, to, { retry = renameWaitsForReaders(), rename = renameSync, sleep = sleepSync, budgetMs = 5_000, now = Date.now } = {}) {
+  const t0 = now()
+  for (let delay = 10; ; delay = Math.min(delay * 2, 200)) {
+    try {
+      return rename(from, to)
+    } catch (e) {
+      if (!retry || !BUSY_CODES.has(e?.code) || now() - t0 + delay > budgetMs) throw e
+    }
+    sleep(delay)
+  }
+}
+
 /**
  * Replaces `file` with `text` at once: written to a temporary file beside it, then renamed over it, so a reader finds
  * the old file or the new one and never half of one. `mode` and `flag` are the temporary file's: a private file is
  * created with its mode from the first byte, and with `wx`, never written into a file that is already there.
+ * On Windows a rename fails while a reader has the target open, so it is retried (`renameRetrying`); when it still
+ * fails, the temporary file is removed and the error thrown, the old file untouched.
  */
-export function replaceFile(file, text, { mode = 0o666, flag = 'w' } = {}) {
+export function replaceFile(file, text, { mode = 0o666, flag = 'w', ...rename } = {}) {
   const tmp = `${file}.${process.pid}.tmp`
   const fd = openSync(tmp, flag, mode)
   try {
@@ -44,7 +72,12 @@ export function replaceFile(file, text, { mode = 0o666, flag = 'w' } = {}) {
   } finally {
     closeSync(fd)
   }
-  renameSync(tmp, file)
+  try {
+    renameRetrying(tmp, file, rename)
+  } catch (e) {
+    rmSync(tmp, { force: true })
+    throw e
+  }
 }
 
 export function runCaptured(command, args, env) {

package/bin/serve.mjs

@@ -29,7 +29,7 @@ export { detachHow, windowsArg, wmiScript, parseWmiAnswer, wmiBlockedMessage, wi
 export { DEFAULT_SERVE_PORT, SERVE_PORT_TRIES, chooseServePort, listensHere, parseNetstatListening } from './serve-port.mjs'
 export { SERVE_HELP, AUTOSTART_ACTIONS, parseServeArgs } from './serve-args.mjs'
 export { launcherScript, ensureLauncher, remoteLayout, parsePointer, installInfo, managedLauncherScript } from './serve-install.mjs'
-export { protocolVersionOf, connectionLine, hostEnv, hostCommand, readyPort, mismatchServerVersion, hostProvesOf, probeHost, askHostToStop } from './serve-host.mjs'
+export { protocolVersionOf, connectionLine, hostEnv, hostCommand, readyPort, mismatchServerVersion, hostProvesOf, probeHost, askHostToStop, takesTokenOnStdin, tokenLine } from './serve-host.mjs'
 export { AUTOSTART_FILE, AUTOSTART_ENV, autostartHow, autostartUnsupported, pathKey, autostartName, autostartLauncher, systemdUnit, taskActionScript, taskScript, parseTaskAnswer, readAutostartMark, autostartInfo, lingerMessage, runAutostart } from './serve-autostart.mjs'
 export { printConnection, runServe, rotateToken } from './serve-run.mjs'
 export { CARRIED_ENV, encodeChildSpec, decodeChildSpec, startDetached, runDetach, runDetachedChild, runStop } from './serve-detach.mjs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "centralu",
-  "version": "0.1.0-beta.27",
+  "version": "0.1.0-beta.29",
   "description": "Run, watch and steer several Claude Code and Codex CLI sessions from one window",
   "license": "MIT",
   "author": "ijun17",
@@ -38,9 +38,9 @@
     "win32"
   ],
   "optionalDependencies": {
-    "@centralu/darwin-arm64": "0.1.0-beta.27",
-    "@centralu/linux-arm64": "0.1.0-beta.27",
-    "@centralu/linux-x64": "0.1.0-beta.27",
-    "@centralu/win32-x64": "0.1.0-beta.27"
+    "@centralu/darwin-arm64": "0.1.0-beta.29",
+    "@centralu/linux-arm64": "0.1.0-beta.29",
+    "@centralu/linux-x64": "0.1.0-beta.29",
+    "@centralu/win32-x64": "0.1.0-beta.29"
   }
 }