dahrk-node 0.1.17 → 0.1.19

package/dist/main.js

@@ -2740,12 +2740,30 @@ function tokenise(cmd) {
   let quoted = false;
   let started = false;
   let quote = null;
+  const pendingHeredocs = [];
   const push = () => {
     if (started) tokens.push({ value: cur, quoted });
     cur = "";
     quoted = false;
     started = false;
   };
+  const consumeHeredocs = (s) => {
+    let p = s;
+    for (; ; ) {
+      let lineEnd = p;
+      while (lineEnd < cmd.length && cmd[lineEnd] !== "\n") lineEnd++;
+      const line = cmd.slice(p, lineEnd);
+      const { delim, dash } = pendingHeredocs[0];
+      const terminator = dash ? line.replace(/^\t+/, "") : line;
+      const atEnd = lineEnd >= cmd.length;
+      if (terminator === delim) {
+        pendingHeredocs.shift();
+        if (pendingHeredocs.length === 0) return atEnd ? lineEnd : lineEnd + 1;
+      }
+      if (atEnd) return -1;
+      p = lineEnd + 1;
+    }
+  };
   for (let i = 0; i < cmd.length; i++) {
     const c = cmd[i];
     if (quote) {
@@ -2793,6 +2811,13 @@ function tokenise(cmd) {
       i = j;
       continue;
     }
+    if (c === "\n" && pendingHeredocs.length > 0) {
+      push();
+      const resume = consumeHeredocs(i + 1);
+      if (resume < 0) return null;
+      i = resume - 1;
+      continue;
+    }
     if (/\s/.test(c)) {
       push();
       continue;
@@ -2805,6 +2830,38 @@ function tokenise(cmd) {
       i += 2;
       continue;
     }
+    if (two === "<<" && cmd[i + 2] !== "<") {
+      push();
+      let k = i + 2;
+      const dash = cmd[k] === "-";
+      if (dash) k++;
+      while (k < cmd.length && (cmd[k] === " " || cmd[k] === "	")) k++;
+      let delim = "";
+      let dq = null;
+      for (; k < cmd.length; k++) {
+        const d = cmd[k];
+        if (dq) {
+          if (d === dq) dq = null;
+          else delim += d;
+          continue;
+        }
+        if (d === '"' || d === "'") {
+          dq = d;
+          continue;
+        }
+        if (d === "\\" && k + 1 < cmd.length) {
+          delim += cmd[++k];
+          continue;
+        }
+        if (/[\s;&|<>]/.test(d)) break;
+        delim += d;
+      }
+      if (dq) return null;
+      if (!delim) return null;
+      pendingHeredocs.push({ delim, dash });
+      i = k - 1;
+      continue;
+    }
     if (["&&", "||", ">>", "2>", "&>"].includes(two)) {
       push();
       tokens.push({ value: two, quoted: false, operator: two });
@@ -2820,6 +2877,7 @@ function tokenise(cmd) {
     started = true;
   }
   if (quote) return null;
+  if (pendingHeredocs.length > 0) return null;
   push();
   return { tokens, subshells };
 }
@@ -2949,7 +3007,7 @@ function scanCommand(cmd, roots, cwd = roots.cwd) {
     }
     if (out2.kind !== "ok") return out2;
   }
-  return { kind: "ok" };
+  return { kind: "ok", cwd: cwdNow };
 }
 
 // ../../packages/edge/src/builtins.ts
@@ -3028,6 +3086,7 @@ function pathsIn(input) {
   return out2;
 }
 function fsConfineRule(roots) {
+  let sessionCwd = roots.cwd;
   return {
     name: "fs_confine",
     evaluate(event) {
@@ -3038,8 +3097,12 @@ function fsConfineRule(roots) {
         reason: `${need2 === "write" ? "write to" : "read of"} "${path}" is outside the run's worktree`
       });
       if (SHELL_TOOLS.has(event.tool)) {
-        const result = scanCommand(commandOf(event.input), roots);
+        const result = scanCommand(commandOf(event.input), roots, sessionCwd);
         if (result.kind === "escape") return deny(result.path, result.need);
+        if (result.kind === "ok") {
+          if (result.cwd) sessionCwd = result.cwd;
+          return null;
+        }
         if (result.kind === "unparseable") {
           return {
             verdict: "deny",
@@ -3884,6 +3947,9 @@ function createStageRunner(deps) {
 
 // ../../packages/edge/src/ws-client.ts
 var ENROLMENT_REJECTED_EXIT_CODE = 78;
+var RECONNECT_BASE_MS = 500;
+var RECONNECT_MAX_MS = 3e4;
+var PARK_POLL_MS = 6e4;
 function classifyError(e) {
   const msg = e instanceof Error ? e.message : String(e);
   if (/\bgit\b|worktree|clone|fetch|branch|checkout|remote/i.test(msg)) return "git";
@@ -3919,7 +3985,11 @@ async function startEdgeNode(opts) {
   let lastPongAt = 0;
   let shuttingDown = false;
   let connectCount = 0;
+  let enrolToken = opts.enrolToken;
+  let reconnectAttempts = 0;
+  let parkTimer;
   let onFatal;
+  let onParked;
   const send = (msg) => {
     if (ws && ws.readyState === WebSocket.OPEN) ws.send(encode(msg));
   };
@@ -4042,7 +4112,7 @@ async function startEdgeNode(opts) {
   const sendHello = () => {
     send({
       type: "hello",
-      enrolToken: opts.enrolToken ?? "",
+      enrolToken: enrolToken ?? "",
       detectedRuntimes: currentRuntimes,
       servesRepoIds: opts.servesRepoIds ?? [],
       ...opts.credentialModeExplicit && opts.credentialMode ? { credentialMode: opts.credentialMode } : {},
@@ -4102,6 +4172,7 @@ async function startEdgeNode(opts) {
     const msg = decode(raw);
     if (msg.type === "welcome") {
       stageDeps.tenantId = msg.tenantId;
+      reconnectAttempts = 0;
       if (opts.retention === void 0 && msg.retention) stageDeps.retention = msg.retention;
       if (opts.heartbeatMs === void 0 && msg.heartbeatMs > 0 && ws) {
         startHeartbeat(ws, msg.heartbeatMs);
@@ -4286,19 +4357,59 @@ async function startEdgeNode(opts) {
       if (heartbeat) clearInterval(heartbeat);
       heartbeat = void 0;
       if (isEnrolmentRejection(code)) {
-        shuttingDown = true;
         const detail = reason.toString() || "enrolment rejected";
-        log.error({ closeCode: code, detail, fatal: true }, `EDGE_REJECTED:${code} ${detail}`);
-        process.exitCode = ENROLMENT_REJECTED_EXIT_CODE;
-        onFatal?.(new Error(`hub rejected edge enrolment (${code}): ${detail}`));
+        const refresh = opts.refreshEnrolToken;
+        log.error({ closeCode: code, detail, fatal: !refresh }, `EDGE_REJECTED:${code} ${detail}`);
+        if (!refresh) {
+          shuttingDown = true;
+          process.exitCode = ENROLMENT_REJECTED_EXIT_CODE;
+          onFatal?.(new Error(`hub rejected edge enrolment (${code}): ${detail}`));
+          return;
+        }
+        park(refresh);
         return;
       }
       if (!shuttingDown) {
-        log.warn({ closeCode: code, reason: reason.toString(), connectCount }, `EDGE_DISCONNECTED:${code} reconnecting in 500ms`);
-        reconnectTimer = setTimeout(connect, 500);
+        const delay = reconnectDelay();
+        log.warn(
+          { closeCode: code, reason: reason.toString(), connectCount, delayMs: delay, attempt: reconnectAttempts },
+          `EDGE_DISCONNECTED:${code} reconnecting in ${delay}ms`
+        );
+        reconnectTimer = setTimeout(connect, delay);
       }
     });
   };
+  const reconnectDelay = () => {
+    const ceiling = Math.min(RECONNECT_BASE_MS * 2 ** reconnectAttempts, RECONNECT_MAX_MS);
+    reconnectAttempts++;
+    return Math.round(ceiling / 2 + Math.random() * (ceiling / 2));
+  };
+  const park = (refresh) => {
+    const rejected = enrolToken;
+    if (parkTimer) return;
+    const pollMs = opts.parkPollMs ?? PARK_POLL_MS;
+    log.error(
+      { pollMs },
+      "EDGE_PARKED:enrolment rejected - the node is up but serving nothing. Re-enrol with `dahrk start --token <token>` (get one at https://app.dahrk.ai); it will reconnect on its own."
+    );
+    parkTimer = setInterval(() => {
+      let fresh;
+      try {
+        fresh = refresh();
+      } catch (e) {
+        log.warn({ err: e }, `EDGE_PARK_REFRESH_FAILED ${e.message}`);
+        return;
+      }
+      if (!fresh || fresh === rejected) return;
+      if (parkTimer) clearInterval(parkTimer);
+      parkTimer = void 0;
+      enrolToken = fresh;
+      reconnectAttempts = 0;
+      log.info({}, "EDGE_UNPARKED:a new enrolment token was found, reconnecting");
+      connect();
+    }, pollMs);
+    onParked?.();
+  };
   opts.signal?.addEventListener(
     "abort",
     () => {
@@ -4309,6 +4420,8 @@ async function startEdgeNode(opts) {
       reconnectTimer = void 0;
       if (reprobeTimer) clearInterval(reprobeTimer);
       reprobeTimer = void 0;
+      if (parkTimer) clearInterval(parkTimer);
+      parkTimer = void 0;
       ws?.close(1e3, "shutting down");
     },
     { once: true }
@@ -4325,6 +4438,10 @@ async function startEdgeNode(opts) {
       clearInterval(t);
       reject(err);
     };
+    onParked = () => {
+      clearInterval(t);
+      resolve3();
+    };
   });
 }
 
@@ -5737,6 +5854,7 @@ function persistEnrolment(env, enrolment) {
   });
 }
 function resolveEnrolToken(env, opts = {}) {
+  if (opts.supervised && !opts.ephemeral) return readPersistedToken(env) ?? env.DAHRK_ENROL_TOKEN;
   if (env.DAHRK_ENROL_TOKEN) return env.DAHRK_ENROL_TOKEN;
   if (opts.ephemeral) return void 0;
   return readPersistedToken(env);
@@ -5756,7 +5874,6 @@ function serviceArgv(inputs) {
 }
 function serviceEnv(inputs) {
   return {
-    DAHRK_ENROL_TOKEN: inputs.token,
     DAHRK_SUPERVISED: "1",
     ...inputs.hubUrl ? { DAHRK_HUB_URL: inputs.hubUrl } : {},
     ...inputs.name ? { DAHRK_NODE_NAME: inputs.name } : {},
@@ -5928,7 +6045,6 @@ async function runServiceInstall(inputs, deps = {}) {
     manager,
     nodeBin: d.nodeBin,
     scriptPath: d.scriptPath,
-    token: inputs.token,
     ...inputs.name ? { name: inputs.name } : {},
     ...inputs.hubUrl ? { hubUrl: inputs.hubUrl } : {},
     ...d.pathEnv ? { pathEnv: d.pathEnv } : {},
@@ -5996,21 +6112,19 @@ async function runNodeStart(inputs, deps = {}, opts = {}) {
     manager,
     nodeBin: d.nodeBin,
     scriptPath: d.scriptPath,
-    token: inputs.token ?? "-",
     ...inputs.name ? { name: inputs.name } : {},
     ...inputs.hubUrl ? { hubUrl: inputs.hubUrl } : {},
     ...d.pathEnv ? { pathEnv: d.pathEnv } : {},
     homeDir: d.homeDir,
     logDir: d.logDir
   });
-  const canRender = inputs.token !== void 0;
-  const current = canRender && unitExists && unitIsCurrent(plan, d.readFile(filePath));
+  const current = unitExists && unitIsCurrent(plan, d.readFile(filePath));
   if (!opts.alwaysLoad) {
     const probe2 = unitExists ? d.capture(statusCommand(manager)) : { code: 1, stdout: "" };
     const status = parseServiceStatus(manager, unitExists, probe2);
     if (current && status.running) return { kind: "running", code: 0, already: true };
   }
-  if (canRender && !current) {
+  if (!current) {
     try {
       d.mkdirp(d.logDir);
       d.mkdirp(dirOf(plan.filePath));
@@ -6040,7 +6154,6 @@ async function runNodeRestart(inputs, deps = {}) {
     manager,
     nodeBin: d.nodeBin,
     scriptPath: d.scriptPath,
-    token: "-",
     homeDir: d.homeDir,
     logDir: d.logDir
   });
@@ -6082,7 +6195,6 @@ async function runNodeStop(inputs = {}, deps = {}) {
     manager,
     nodeBin: d.nodeBin,
     scriptPath: d.scriptPath,
-    token: "-",
     homeDir: d.homeDir,
     logDir: d.logDir
   });
@@ -6119,7 +6231,6 @@ async function runServiceUninstall(deps = {}) {
     manager,
     nodeBin: d.nodeBin,
     scriptPath: d.scriptPath,
-    token: "-",
     homeDir: d.homeDir,
     logDir: d.logDir
   });
@@ -6183,9 +6294,9 @@ var defaultDeps3 = () => ({
   // npm-global bins) that a supervisor's minimal PATH would otherwise hide.
   pathEnv: process.env.PATH,
   mkdirp: (dir) => void mkdirSync12(dir, { recursive: true }),
-  // The unit's environment block carries the enrolment token, so the file is a secret: write it
-  // owner-only. `writeFileSync`'s `mode` applies only when it CREATES the file, so chmod explicitly
-  // too - re-installing over a unit an older client left at 0644 must tighten it, not keep it.
+  // The unit holds no secret any more, but it stays owner-only: it names paths on this host, and there is
+  // no reason for it to be world-readable. `writeFileSync`'s `mode` applies only when it CREATES the file,
+  // so chmod explicitly too - re-installing over a unit an older client left at 0644 must tighten it.
   writeFile: (path, content) => {
     writeFileSync11(path, content, { mode: UNIT_FILE_MODE });
     chmodSync3(path, UNIT_FILE_MODE);
@@ -6527,6 +6638,12 @@ function renderStatus(f) {
     lines.push(kv("Work", jobLine(first, f.now)));
     for (const j of rest) lines.push(kv("", jobLine(j, f.now)));
   }
+  if (isEnrolmentBlocked(f.connection)) {
+    lines.push("");
+    lines.push(verdict("fail", "The hub rejected this node's enrolment token; it is serving no Jobs."));
+    lines.push("");
+    lines.push(hint("Re-enrol with `dahrk start --token <token>`. Get one at https://app.dahrk.ai."));
+  }
   lines.push(...presenceHints(f).flatMap((h) => ["", h]));
   lines.push("", dim(`  State file: ${f.stateFile}`));
   return lines;
@@ -6549,7 +6666,7 @@ function jobLine(j, now) {
   return `${where}  ${dim(humanDuration(now - j.startedAt))}`;
 }
 function isUnhealthy(f) {
-  return f.presence.kind === "crashed";
+  return f.presence.kind === "crashed" || isEnrolmentBlocked(f.connection);
 }
 function resolvePresence(service, lockedPid, desired) {
   if (service?.running) return { kind: "running", ...service.pid ? { pid: service.pid } : {} };
@@ -6592,10 +6709,21 @@ async function gatherFacts(inputs, deps) {
 }
 var CONNECTION_MARKERS = [
   { prefix: "EDGE_WELCOMED", event: "welcomed", detail: false },
+  // The two markers whose absence here was itself the bug. `EDGE_CONNECTED` is written when the SOCKET
+  // opens, which is before the hub has looked at our token - so a node whose enrolment was rejected has
+  // `EDGE_CONNECTED` as its last marker, and `status` used to read that and cheerfully report a connected
+  // node while it served nothing. The rejection is the newer marker, and it is the true one.
+  { prefix: "EDGE_REJECTED", event: "rejected", detail: true },
+  { prefix: "EDGE_PARKED", event: "parked", detail: false },
+  { prefix: "EDGE_UNPARKED", event: "reconnecting", detail: false },
   { prefix: "EDGE_CONNECTED", event: "connected", detail: false },
   { prefix: "EDGE_DISCONNECTED", event: "disconnected", detail: true },
   { prefix: "EDGE_STALE", event: "went stale", detail: false }
 ];
+var BLOCKED_EVENTS = /* @__PURE__ */ new Set(["rejected", "parked"]);
+function isEnrolmentBlocked(connection) {
+  return connection !== void 0 && BLOCKED_EVENTS.has(connection.event);
+}
 function lastConnection(records) {
   for (let i = records.length - 1; i >= 0; i--) {
     const r = records[i];
@@ -6621,7 +6749,7 @@ async function runStatus(inputs, deps) {
 }
 
 // src/main.ts
-var CLIENT_VERSION = "0.1.17";
+var CLIENT_VERSION = "0.1.19";
 var DEFAULT_HUB_URL = "wss://api.dahrk.ai";
 var list = (v) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
 var RUNTIMES2 = ["claude-code", "codex", "pi"];
@@ -6706,6 +6834,8 @@ function wantsForeground(env, flags) {
 async function start(flags) {
   const env = envWithFlags(process.env, flags);
   if (wantsForeground(env, flags)) return startForeground(env, flags);
+  const enrolled = await enrolToDisk(env);
+  if (enrolled !== 0) return enrolled;
   await offerUpdate(env);
   const outcome = await runNodeStart(serviceInputs(env));
   if (outcome.kind === "error") return outcome.code;
@@ -6725,6 +6855,28 @@ var serviceInputs = (env) => ({
   ...env.DAHRK_NODE_NAME ? { name: env.DAHRK_NODE_NAME } : {},
   ...env.DAHRK_HUB_URL ? { hubUrl: env.DAHRK_HUB_URL } : {}
 });
+async function enrolToDisk(env) {
+  const token = resolveEnrolToken(env);
+  if (!token || token === readPersistedToken(env)) return 0;
+  const hubUrl = env.DAHRK_HUB_URL ?? DEFAULT_HUB_URL;
+  const probe2 = await probeHub({ hubUrl, enrolToken: token, clientVersion: CLIENT_VERSION });
+  if (!probe2.ok && probe2.reason === "rejected") {
+    out("");
+    out(verdict("fail", `The hub rejected that enrolment token: ${probe2.detail}`));
+    out("");
+    out(hint("Get a fresh token at https://app.dahrk.ai, then run `dahrk start --token <token>` again."));
+    return 2;
+  }
+  if (!probe2.ok) {
+    out("");
+    out(verdict("warn", `Could not reach ${hubUrl} to check the token (${probe2.detail}); using it anyway.`));
+  }
+  persistEnrolment(env, {
+    token,
+    ...probe2.ok ? { name: probe2.name, tenantId: probe2.tenantId } : {}
+  });
+  return 0;
+}
 async function restart(flags, force) {
   const env = envWithFlags(process.env, flags);
   out("");
@@ -6763,7 +6915,10 @@ async function startForeground(env, flags) {
     clientVersion: CLIENT_VERSION,
     ...env.DAHRK_CRASH_EXIT === "1" ? { exitOnCrash: true } : {}
   });
-  const token = resolveEnrolToken(env, { ephemeral: flags.ephemeral });
+  const token = resolveEnrolToken(env, {
+    ephemeral: flags.ephemeral,
+    supervised: env.DAHRK_SUPERVISED === "1"
+  });
   if (token) env.DAHRK_ENROL_TOKEN = token;
   const runtimes = await resolveRuntimes(env);
   if (!flags.ephemeral) {
@@ -6802,7 +6957,15 @@ async function startForeground(env, flags) {
     ...flags.ephemeral ? {} : { jobLedger: fileJobLedger(jobLedgerFile(stateDir(env))) },
     ...persist ? {
       onEnrolled: (welcome) => persistEnrolment(env, { token, name: welcome.name, tenantId: welcome.tenantId })
-    } : {}
+    } : {},
+    // How a rejected node heals. Reads `node.json` DIRECTLY rather than going through
+    // `resolveEnrolToken`, and that is the whole point: the disk is where re-enrolment writes, so it is
+    // the only place a *newer* token can appear. (Deliberately narrower than boot-time resolution, which
+    // still lets an explicit `DAHRK_ENROL_TOKEN` win - but a stale env var must never be able to shadow
+    // the fresh token on disk forever, which is precisely how a node used to wedge.)
+    //
+    // Only for a persistent node: an ephemeral one has no disk to heal from and must still fail fast.
+    ...flags.ephemeral ? {} : { refreshEnrolToken: () => readPersistedToken(env) }
   });
   return 0;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dahrk-node",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",