codedeck 0.1.7 → 0.1.8

package/dist/daemon/daemon.js

@@ -1,6 +1,7 @@
-#!/usr/bin/env node
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
+import { spawn } from "node:child_process";
 import { Database } from "../store/database.js";
 import { SessionStore } from "../store/sessions.js";
 import { EventStore } from "../store/events.js";
@@ -12,10 +13,22 @@ import { generateSessionId } from "../core/session.js";
 import { getGitInfo } from "../git/repository.js";
 import { createWorktree } from "../git/worktree.js";
 import { getDiff } from "../git/diff.js";
-import { processAlive, processStartTime } from "../utils/process.js";
+import { killTree, processAlive, processStartTime, resolveInhibitBin, sleep } from "../utils/process.js";
 import { readSessionProcessMetadata } from "../drivers/session-runtime.js";
 import { loadConfig } from "../config/config.js";
 import { classifyFailure } from "../core/errors.js";
+import { getCachedOrDiscoverModels } from "../core/models.js";
+// Daemon's view of power readiness for the doctor IPC result (field names
+// fixed by cross-worker contract; the CLI falls back to local detection
+// when the daemon is unreachable).
+function powerServiceInstalled() {
+    try {
+        return fs.existsSync(path.join(os.homedir(), ".config", "systemd", "user", "codedeck.service"));
+    }
+    catch {
+        return false;
+    }
+}
 class Daemon {
     db;
     sessions;
@@ -25,6 +38,27 @@ class Daemon {
     subscribers = new Map(); // sessionId -> sockets
     startTime = Date.now();
     sessionLocks = new Set();
+    // Power-shutdown state. `shuttingDown` is set synchronously by the signal
+    // handler so concurrent handleRequest calls are refused during the drain.
+    shuttingDown = false;
+    // Exactly-once drain: concurrent handleShutdown callers share one promise.
+    shutdownPromise = null;
+    // Best-effort delay-lock child (systemd-inhibit), alive for the daemon's
+    // whole life when the binary exists; killed after TRUNCATE in the drain.
+    inhibitChild = null;
+    inhibitExitHookInstalled = false;
+    inFlightModels = new Map();
+    async fetchModels(agent, refresh) {
+        const key = `${agent || "all"}:${Boolean(refresh)}`;
+        const existing = this.inFlightModels.get(key);
+        if (existing)
+            return existing;
+        const promise = getCachedOrDiscoverModels(this.registry, { agent, refresh }).finally(() => {
+            this.inFlightModels.delete(key);
+        });
+        this.inFlightModels.set(key, promise);
+        return promise;
+    }
     constructor() {
         ensureDirs();
         this.db = new Database();
@@ -57,10 +91,15 @@ class Daemon {
             fs.writeFileSync(paths.daemonPid, String(process.pid), "utf-8");
         }
         catch { }
-        // Handle shutdown
-        process.on("SIGTERM", () => this.shutdown());
-        process.on("SIGINT", () => this.shutdown());
-        process.on("exit", () => this.shutdown());
+        // Graceful power shutdown: exactly-once drain on power signals. SIGHUP
+        // covers lid-close/logout via logind. Keep listeners installed so a
+        // repeated signal reaches the synchronous shuttingDown guard.
+        process.on("SIGTERM", () => this.onSignal("SIGTERM"));
+        process.on("SIGINT", () => this.onSignal("SIGINT"));
+        process.on("SIGHUP", () => this.onSignal("SIGHUP"));
+        // Best-effort delay lock so the system waits for the drain. Silent
+        // no-op when systemd-inhibit is absent (containers, macOS, CI).
+        this.maybeSpawnInhibit();
         console.log(`[daemon] listening on ${paths.daemonSock} pid=${process.pid}`);
         // Keep alive
         // Write log
@@ -77,6 +116,12 @@ class Daemon {
         const paths = getPaths();
         const actives = this.sessions.listActive();
         for (const s of actives) {
+            // Power-shutdown rows are terminal: never reattach, never flip. A
+            // harness that survived the kill stays an untracked orphan by design
+            // (no hunt). Defensive: listActive() already returns only
+            // starting|working|needs_input|idle.
+            if (s.status === "interrupted")
+                continue;
             const driver = this.registry.get(s.agent);
             const metadata = readSessionProcessMetadata(s.id);
             const pid = metadata?.pid ?? s.pid;
@@ -171,6 +216,13 @@ class Daemon {
             }
             catch { }
         };
+        // Power-shutdown guard: while draining, refuse new work so a send/stop
+        // cannot race the interrupted persist. daemon.stop is the shutdown
+        // trigger itself, so it stays admitted (idempotent via handleShutdown).
+        if (this.shuttingDown && method !== "daemon.stop") {
+            send({ error: { code: "SERVICE_UNAVAILABLE", message: "daemon is shutting down" } });
+            return;
+        }
         switch (method) {
             case "session.create": {
                 const p = params;
@@ -193,6 +245,10 @@ class Daemon {
                 let repository;
                 let baseCommit;
                 const gitInfo = await getGitInfo(cwd);
+                if (this.shuttingDown) {
+                    send({ error: { code: "SERVICE_UNAVAILABLE", message: "daemon is shutting down" } });
+                    return;
+                }
                 if (gitInfo)
                     repository = gitInfo.root;
                 const wantsWorktree = p.worktree === true || (p.worktree === undefined && cfg.worktree === true);
@@ -200,6 +256,10 @@ class Daemon {
                 if (wantsWorktree && gitInfo) {
                     try {
                         const wt = await createWorktree({ repoRoot: gitInfo.root, sessionId, prompt, name: p.name });
+                        if (this.shuttingDown) {
+                            send({ error: { code: "SERVICE_UNAVAILABLE", message: "daemon is shutting down" } });
+                            return;
+                        }
                         worktree = wt.path;
                         branch = wt.branch;
                         baseCommit = wt.baseCommit;
@@ -239,6 +299,8 @@ class Daemon {
                 send({ result: { session } });
                 // Now start driver in background
                 this.startDriverForSession(sessionId, prompt, p.model).catch((e) => {
+                    if (this.shuttingDown)
+                        return;
                     const msg = e instanceof Error ? e.message : String(e);
                     const failure = classifyFailure(msg);
                     const failEv = {
@@ -293,21 +355,56 @@ class Daemon {
                     send({ error: { code: "SESSION_BUSY", message: `Session ${s.id} has another lifecycle operation in progress` } });
                     return;
                 }
-                const handle = driver.getHandle?.(s.id);
-                const runtimeState = handle && typeof handle === "object"
-                    ? handle
-                    : undefined;
-                const runtimeDraining = handle !== undefined && (runtimeState?.done !== true || runtimeState?.drained !== true);
-                if (s.status === "starting" || runtimeDraining || (s.status === "working" && s.pid != null && processAlive(s.pid))) {
-                    send({ error: { code: "SESSION_BUSY", message: `Session ${s.id} is still running` } });
-                    return;
+                if (s.status === "interrupted") {
+                    // Resume-turn admission for power-interrupted sessions: capability
+                    // BEFORE liveness, and liveness by process identity (same rule as
+                    // stop). A recycled PID must not block a legitimate resume.
+                    if (!s.nativeSessionId || !driver.capabilities().resume) {
+                        send({ error: { code: "CAPABILITY_NOT_SUPPORTED", message: `Session ${s.id} cannot resume (no native session id or agent ${s.agent} does not support resume)` } });
+                        return;
+                    }
+                    const liveIdentity = s.pid != null &&
+                        s.pidStartTime != null &&
+                        processAlive(s.pid) &&
+                        processStartTime(s.pid) === s.pidStartTime;
+                    if (liveIdentity) {
+                        send({ error: { code: "SESSION_BUSY", message: `Session ${s.id} is still running (stop it first)` } });
+                        return;
+                    }
                 }
-                if (!driver.capabilities().resume) {
-                    send({ error: { code: "CAPABILITY_NOT_SUPPORTED", message: `Agent ${s.agent} does not support resume` } });
-                    return;
+                else {
+                    const handle = driver.getHandle?.(s.id);
+                    const runtimeState = handle && typeof handle === "object"
+                        ? handle
+                        : undefined;
+                    const runtimeDraining = handle !== undefined && (runtimeState?.done !== true || runtimeState?.drained !== true);
+                    if (s.status === "starting" || runtimeDraining || (s.status === "working" && s.pid != null && processAlive(s.pid))) {
+                        send({ error: { code: "SESSION_BUSY", message: `Session ${s.id} is still running` } });
+                        return;
+                    }
+                    if (!driver.capabilities().resume) {
+                        send({ error: { code: "CAPABILITY_NOT_SUPPORTED", message: `Agent ${s.agent} does not support resume` } });
+                        return;
+                    }
                 }
+                const drvSession = {
+                    id: s.id,
+                    nativeSessionId: s.nativeSessionId,
+                    cwd: s.worktree || s.cwd,
+                    model: s.model,
+                    effort: s.effort,
+                    fast: s.fast,
+                    sandbox: s.sandbox,
+                    dangerouslyBypassApprovalsAndSandbox: s.dangerouslyBypassApprovalsAndSandbox,
+                    pid: s.pid,
+                    pidStartTime: s.pidStartTime,
+                };
                 this.sessionLocks.add(s.id);
                 try {
+                    if (this.shuttingDown) {
+                        send({ error: { code: "SERVICE_UNAVAILABLE", message: "daemon is shutting down" } });
+                        return;
+                    }
                     this.sessions.setStatus(s.id, "working", { lastEvent: `send: ${p.message.slice(0, 80)}` });
                     const turnEvent = {
                         type: "turn.started",
@@ -317,19 +414,15 @@ class Daemon {
                     };
                     this.events.append(s.id, turnEvent);
                     this.broadcast(s.id, turnEvent);
-                    const drvSession = {
-                        id: s.id,
-                        nativeSessionId: s.nativeSessionId,
-                        cwd: s.worktree || s.cwd,
-                        model: s.model,
-                        effort: s.effort,
-                        fast: s.fast,
-                        sandbox: s.sandbox,
-                        dangerouslyBypassApprovalsAndSandbox: s.dangerouslyBypassApprovalsAndSandbox,
-                        pid: s.pid,
-                        pidStartTime: s.pidStartTime,
-                    };
                     await driver.send(drvSession, p.message);
+                    if (this.shuttingDown) {
+                        try {
+                            await driver.stop(drvSession);
+                        }
+                        catch { }
+                        send({ error: { code: "SERVICE_UNAVAILABLE", message: "daemon is shutting down" } });
+                        return;
+                    }
                     const handle = driver.getHandle?.(s.id);
                     const handleNativeId = handle &&
                         typeof handle === "object" &&
@@ -354,6 +447,14 @@ class Daemon {
                 }
                 catch (e) {
                     const message = e instanceof Error ? e.message : String(e);
+                    if (this.shuttingDown) {
+                        try {
+                            await driver.stop(drvSession);
+                        }
+                        catch { }
+                        send({ error: { code: "SERVICE_UNAVAILABLE", message: "daemon is shutting down" } });
+                        return;
+                    }
                     try {
                         this.sessions.setStatus(s.id, "failed");
                     }
@@ -361,7 +462,8 @@ class Daemon {
                     send({ error: { code: "SEND_FAILED", message } });
                 }
                 finally {
-                    this.sessionLocks.delete(s.id);
+                    if (!this.shuttingDown)
+                        this.sessionLocks.delete(s.id);
                 }
                 break;
             }
@@ -383,7 +485,7 @@ class Daemon {
                     s.pidStartTime != null &&
                     processAlive(s.pid) &&
                     processStartTime(s.pid) === s.pidStartTime;
-                if (s.status === "stopped" || ((s.status === "completed" || s.status === "failed") && !hasRuntime && !liveIdentity)) {
+                if (isTerminalStatus(s.status) && !hasRuntime && !liveIdentity) {
                     send({ error: { code: "SESSION_NOT_RUNNING", message: `Session ${s.id} is ${s.status}` } });
                     return;
                 }
@@ -393,7 +495,7 @@ class Daemon {
                 }
                 this.sessionLocks.add(s.id);
                 const previousStatus = s.status;
-                const hadTerminalStatus = s.status === "completed" || s.status === "failed";
+                const hadTerminalStatus = isTerminalStatus(s.status);
                 const eventsBeforeStop = this.events.count(s.id);
                 try {
                     // Mark active sessions first so an attached event loop that ends
@@ -407,6 +509,10 @@ class Daemon {
                         pid: s.pid,
                         pidStartTime: s.pidStartTime,
                     });
+                    if (this.shuttingDown) {
+                        send({ error: { code: "SERVICE_UNAVAILABLE", message: "daemon is shutting down" } });
+                        return;
+                    }
                     const last = this.events.last(s.id);
                     const terminalArrivedDuringStop = this.events.count(s.id) > eventsBeforeStop &&
                         (last?.type === "session.completed" || last?.type === "session.failed");
@@ -432,6 +538,10 @@ class Daemon {
                     send({ result: { ok: true } });
                 }
                 catch (e) {
+                    if (this.shuttingDown) {
+                        send({ error: { code: "SERVICE_UNAVAILABLE", message: "daemon is shutting down" } });
+                        return;
+                    }
                     try {
                         this.sessions.setStatus(s.id, previousStatus);
                     }
@@ -439,7 +549,8 @@ class Daemon {
                     send({ error: { code: "STOP_FAILED", message: e instanceof Error ? e.message : String(e) } });
                 }
                 finally {
-                    this.sessionLocks.delete(s.id);
+                    if (!this.shuttingDown)
+                        this.sessionLocks.delete(s.id);
                 }
                 break;
             }
@@ -553,10 +664,31 @@ class Daemon {
                         agents: agentsWithCaps,
                         daemon: { running: true, pid: process.pid, uptime: Date.now() - this.startTime },
                         database: { path: paths.db, exists: dbExists },
+                        // Power readiness from the daemon's view (field names fixed by
+                        // cross-worker contract; CLI falls back to local detection).
+                        power: {
+                            serviceInstalled: powerServiceInstalled(),
+                            inhibitAvailable: resolveInhibitBin() !== null,
+                        },
                     },
                 });
                 break;
             }
+            case "models.list": {
+                const p = (params || {});
+                if (p.agent && !this.registry.has(p.agent)) {
+                    send({ error: { code: "AGENT_NOT_FOUND", message: `Unknown agent ${p.agent}` } });
+                    return;
+                }
+                const agents = await this.fetchModels(p.agent, p.refresh);
+                send({ result: { agents } });
+                break;
+            }
+            case "daemon.stop": {
+                send({ result: { ok: true } });
+                void this.handleShutdown("daemon.stop").finally(() => process.exit(0));
+                break;
+            }
             default:
                 send({ error: { code: "UNKNOWN_METHOD", message: `Unknown method ${method}` } });
         }
@@ -596,10 +728,16 @@ class Daemon {
         }
     }
     async startDriverForSession(sessionId, prompt, model) {
+        if (this.shuttingDown)
+            return;
         const session = this.sessions.get(sessionId);
         if (!session)
             throw new Error("Session not found for driver start");
+        if (this.shuttingDown)
+            return;
         const driver = this.registry.get(session.agent);
+        if (this.shuttingDown)
+            return;
         this.sessions.update(sessionId, { status: "working" });
         const turnEvent = { type: "turn.started", sessionId, timestamp: new Date().toISOString(), prompt };
         this.events.append(sessionId, turnEvent);
@@ -616,16 +754,34 @@ class Daemon {
             sandbox: session.sandbox,
             dangerouslyBypassApprovalsAndSandbox: session.dangerouslyBypassApprovalsAndSandbox,
         });
+        if (this.shuttingDown) {
+            try {
+                await driver.stop(drvSession);
+            }
+            catch { }
+            return;
+        }
         // Update pid and native id when available
         if (drvSession.pid)
             this.sessions.update(sessionId, { pid: drvSession.pid, pidStartTime: processStartTime(drvSession.pid) });
         // Poll native id shortly
         for (let i = 0; i < 10; i++) {
             await new Promise((r) => setTimeout(r, 200));
-            const h = driver.getHandle?.(sessionId);
-            if (h?.nativeSessionId && h.nativeSessionId !== session.nativeSessionId) {
-                this.sessions.update(sessionId, { nativeSessionId: h.nativeSessionId });
-                session.nativeSessionId = h.nativeSessionId;
+            if (this.shuttingDown) {
+                try {
+                    await driver.stop(drvSession);
+                }
+                catch { }
+                return;
+            }
+            const handle = driver.getHandle?.(sessionId);
+            if (handle &&
+                typeof handle === "object" &&
+                "nativeSessionId" in handle &&
+                typeof handle.nativeSessionId === "string" &&
+                handle.nativeSessionId !== session.nativeSessionId) {
+                this.sessions.update(sessionId, { nativeSessionId: handle.nativeSessionId });
+                session.nativeSessionId = handle.nativeSessionId;
                 break;
             }
             if (drvSession.nativeSessionId) {
@@ -633,6 +789,13 @@ class Daemon {
                 break;
             }
         }
+        if (this.shuttingDown) {
+            try {
+                await driver.stop(drvSession);
+            }
+            catch { }
+            return;
+        }
         // Attach events
         await this.attachDriverEvents(sessionId, driver, drvSession);
     }
@@ -673,6 +836,8 @@ class Daemon {
             }
         }
         catch (e) {
+            if (this.shuttingDown)
+                return;
             // A driver exception mid-stream is a harness/pipe failure, not task
             // output — classify so agents can retry instead of blaming the work.
             const msg = e instanceof Error ? e.message : String(e);
@@ -690,9 +855,13 @@ class Daemon {
             this.sessions.setStatus(sessionId, "failed", { lastEvent: msg.slice(0, 200), failure });
             return;
         }
-        // When events done, ensure terminal status if not already
+        if (this.shuttingDown)
+            return;
+        // When events done, ensure terminal status if not already. Any terminal
+        // status counts — including `interrupted`, which must survive the drain
+        // instead of flipping to a synthesized `failed`.
         const sess = this.sessions.get(sessionId);
-        if (sess && !["completed", "failed", "stopped", "orphaned"].includes(sess.status)) {
+        if (sess && !isTerminalStatus(sess.status)) {
             // Check last event
             const last = this.events.last(sessionId);
             if (last?.type === "session.completed") {
@@ -752,7 +921,103 @@ class Daemon {
         }
         catch { }
     }
-    shutdown() {
+    onSignal(reason) {
+        // A repeated signal while draining is ignored instead of restarting the
+        // flush. This also covers cross-signal repeats like TERM-then-INT.
+        if (this.shuttingDown)
+            return;
+        void this.handleShutdown(reason).finally(() => process.exit(0));
+    }
+    // Best-effort delay lock: while this child lives, systemd/logind delays
+    // shutdown up to InhibitDelayMaxSec so the drain can finish. Silent no-op
+    // when the binary is absent. The binary resolves through fixed absolute
+    // paths only, never PATH (typescript:S4036). Public so tests can drive it
+    // without start() (no socket binding); binOverride is the test seam for
+    // a fake binary.
+    maybeSpawnInhibit(binOverride) {
+        if (this.inhibitChild)
+            return;
+        const bin = binOverride ?? resolveInhibitBin();
+        if (!bin)
+            return;
+        // Absent binary (removed between resolve and spawn, or a bogus test
+        // seam path) is a silent no-op: spawn(2) failure would only surface
+        // as an async error event, leaving a dead child behind.
+        try {
+            if (!fs.existsSync(bin))
+                return;
+        }
+        catch {
+            return;
+        }
+        try {
+            const child = spawn(bin, ["--what=shutdown:sleep", "--who=CodeDeck", "--why=flush sessions", "--mode=delay", "sleep", "infinity"], { stdio: "ignore", detached: true });
+            child.on("error", () => { });
+            child.unref();
+            this.inhibitChild = child;
+            if (!this.inhibitExitHookInstalled) {
+                this.inhibitExitHookInstalled = true;
+                process.once("exit", () => this.killInhibitChild());
+            }
+        }
+        catch {
+            this.inhibitChild = null;
+        }
+    }
+    killInhibitChild() {
+        const child = this.inhibitChild;
+        this.inhibitChild = null;
+        if (!child)
+            return;
+        try {
+            child.kill();
+        }
+        catch { }
+    }
+    // Graceful power shutdown. Exposed as a method so tests can drive the
+    // drain without signals/systemd: exactly-once (concurrent callers share
+    // one drain), never throws, never exits — callers decide on exit.
+    handleShutdown(reason) {
+        if (!this.shutdownPromise) {
+            this.shuttingDown = true;
+            this.shutdownPromise = this.runShutdown(reason).catch(() => { });
+        }
+        return this.shutdownPromise;
+    }
+    async runShutdown(reason) {
+        const handle = this.db.getHandle();
+        // Never close mid-transaction: roll back a stale BEGIN (best-effort)
+        // BEFORE persisting, so the interrupted writes below stay durable.
+        try {
+            handle.exec("ROLLBACK");
+        }
+        catch { }
+        // Incremental checkpoint first: protects the DB even if SIGKILL lands
+        // mid-drain. Order: PASSIVE -> persist -> kill -> TRUNCATE -> close.
+        try {
+            handle.exec("PRAGMA wal_checkpoint(PASSIVE)");
+        }
+        catch { }
+        const actives = this.safeListActive();
+        this.prepareLiveRuntimes(actives);
+        for (const s of actives) {
+            await this.markInterrupted(s, reason);
+        }
+        // Bounded grace per session, in parallel so 5+ sessions fit the delay
+        // budget. Identity-checked: a recycled PID is never signaled.
+        await Promise.allSettled(actives
+            .filter((s) => s.pid != null)
+            .map((s) => killTree(s.pid, 1500, s.pidStartTime)));
+        // Force any live runtime to consume complete lines before the final WAL
+        // checkpoint. Unterminated writes are deliberately discarded by the
+        // runtime's shutdown drain.
+        await this.drainLiveRuntimes(actives);
+        try {
+            handle.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+        }
+        catch { }
+        // The delay lock has served its purpose; release it before closing.
+        this.killInhibitChild();
         try {
             const paths = getPaths();
             try {
@@ -773,7 +1038,75 @@ class Daemon {
             catch { }
         }
         catch { }
-        process.exit(0);
+    }
+    safeListActive() {
+        try {
+            return this.sessions.listActive();
+        }
+        catch {
+            // EROFS/EIO with the FS already gone: abort the flush, still close.
+            return [];
+        }
+    }
+    prepareLiveRuntimes(sessions) {
+        for (const session of sessions) {
+            try {
+                const runtime = this.registry.get(session.agent).getHandle?.(session.id);
+                if (!runtime || typeof runtime !== "object")
+                    continue;
+                if ("prepareForShutdown" in runtime && typeof runtime.prepareForShutdown === "function") {
+                    runtime.prepareForShutdown();
+                }
+            }
+            catch { }
+        }
+    }
+    async drainLiveRuntimes(sessions) {
+        const drains = [];
+        for (const session of sessions) {
+            try {
+                const runtime = this.registry.get(session.agent).getHandle?.(session.id);
+                if (!runtime || typeof runtime !== "object")
+                    continue;
+                if ("drainForShutdown" in runtime && typeof runtime.drainForShutdown === "function") {
+                    drains.push(Promise.resolve(runtime.drainForShutdown()));
+                }
+            }
+            catch { }
+        }
+        await Promise.allSettled(drains);
+    }
+    async markInterrupted(s, reason) {
+        try {
+            // Serialize against an in-flight send/stop owner (bounded: the drain
+            // must fit in InhibitDelayMaxSec), then hold the lock so attached
+            // event loops discard terminal frames instead of overwriting
+            // `interrupted` (see attachDriverEvents).
+            const deadline = Date.now() + 500;
+            while (this.sessionLocks.has(s.id) && Date.now() < deadline) {
+                await sleep(50);
+            }
+            this.sessionLocks.add(s.id);
+            const detail = `interrupted by ${reason}`;
+            const failure = {
+                code: "SHUTDOWN",
+                blame: "infra",
+                retryable: true,
+                detail,
+            };
+            const event = {
+                type: "session.failed",
+                sessionId: s.id,
+                timestamp: new Date().toISOString(),
+                error: detail,
+                failure,
+                raw: { reason },
+            };
+            this.events.append(s.id, event);
+            this.broadcast(s.id, event);
+            this.sessions.setStatus(s.id, "interrupted", { lastEvent: detail.slice(0, 200), failure });
+        }
+        catch { }
     }
 }
 // Entry