dsh-autorestart 0.8.4 → 0.8.6

package/lib/restart.js

@@ -15,9 +15,125 @@
  * ESM only, Node builtins only. No DSH / npm imports.
  */
 import { execFileSync, spawn } from 'node:child_process';
-import { mkdirSync, readFileSync, readlinkSync, renameSync, writeFileSync } from 'node:fs';
+import {
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  readlinkSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
 import path from 'node:path';
 
+/**
+ * THE V1 ROLLBACK WATCHER IS A POWERSHELL SCRIPT (2026-11-02).
+ *
+ * `buildWatchScript` writes PowerShell, so the whole v1 path is a Windows path.
+ * Older builds did not say so: they wrote `restart-<n>-watch.ps1` on EVERY
+ * platform and then tried to launch it, which on Linux/WSL could only fail —
+ * and left the file behind. A real WSL machine had SEVEN of them
+ * (restart-4/5/6/7/8/9/16), which is why the release checklist item
+ * "leftover files = 0" was failing.
+ *
+ * This pattern is the only name the plugin ever writes, so it is also the only
+ * name the sweep below is allowed to touch.
+ */
+export const LEGACY_WATCH_SCRIPT_PATTERN = /^restart-\d+-watch\.ps1$/;
+
+/**
+ * Does this text look like OUR rollback watcher (and not like a user's file that
+ * happens to have the same name)?
+ *
+ * The check is deliberately narrow: the three markers below all come from
+ * `buildWatchScript`, and a file that misses any of them is left alone. A sweep
+ * that deletes the wrong file in a rescue path is worse than a leftover.
+ *
+ * @param {string} text
+ * @returns {boolean}
+ */
+export function looksLikeWatchScript(text) {
+  if (typeof text !== 'string' || text === '') return false;
+  return /param\s*\(/.test(text)
+    && /Start-Sleep|Wait-Job/.test(text)
+    && /_dsh_autorestart|dsh-autorestart/.test(text);
+}
+
+/**
+ * Remove the watcher scripts the old builds left on a NON-Windows machine.
+ *
+ * Rules (all of them are "be conservative"):
+ *   - Windows keeps everything: there those files really are used, and the one
+ *     that is running right now must not be pulled from under it.
+ *   - Only `restart-<digits>-watch.ps1` is considered.
+ *   - The CONTENT must look like our watcher (`looksLikeWatchScript`).
+ *   - A file modified in the last `minAgeMs` is skipped: a process that just
+ *     wrote it may still be starting.
+ *   - Nothing here throws: a failure is returned.
+ *
+ * @param {string} dir the plugin's state directory
+ * @param {{ platform?: string, minAgeMs?: number, now?: number }} [options]
+ * @returns {{ skipped: boolean, reason: string|null, removed: string[], kept: string[], scanned: number, error: string|null }}
+ */
+export function sweepLegacyWatcherScripts(
+  dir,
+  { platform = process.platform, minAgeMs = 60_000, now = Date.now() } = {},
+) {
+  const result = { skipped: false, reason: null, removed: [], kept: [], scanned: 0, error: null };
+  if (platform === 'win32') {
+    result.skipped = true;
+    result.reason = 'not-applicable: on Windows these watcher scripts are really used, so none is removed';
+    return result;
+  }
+  if (typeof dir !== 'string' || dir === '') {
+    result.skipped = true;
+    result.reason = 'no state directory to sweep';
+    return result;
+  }
+  let names = [];
+  try {
+    names = readdirSync(dir);
+  } catch (error) {
+    // A directory that does not exist yet is not a failure: nothing was left.
+    const code = error && error.code;
+    if (code === 'ENOENT') {
+      result.skipped = true;
+      result.reason = 'no state directory yet';
+      return result;
+    }
+    result.error = error && error.message ? String(error.message) : String(error);
+    return result;
+  }
+  for (const name of names) {
+    if (!LEGACY_WATCH_SCRIPT_PATTERN.test(name)) continue;
+    result.scanned += 1;
+    const file = path.join(dir, name);
+    try {
+      const stat = statSync(file);
+      if (!stat.isFile()) {
+        result.kept.push(name);
+        continue;
+      }
+      // Never touch a file that was just written: the writer may still be running.
+      if (minAgeMs > 0 && now - stat.mtimeMs < minAgeMs) {
+        result.kept.push(name);
+        continue;
+      }
+      if (!looksLikeWatchScript(readFileSync(file, 'utf8'))) {
+        result.kept.push(name);
+        continue;
+      }
+      unlinkSync(file);
+      result.removed.push(name);
+    } catch (error) {
+      result.kept.push(name);
+      result.error = error && error.message ? String(error.message) : String(error);
+    }
+  }
+  return result;
+}
+
 /** Default name of the one-shot scheduled-task fallback. */
 export const DEFAULT_TASK_NAME = 'dsh-autorestart-restart';
 
@@ -497,6 +613,7 @@ export function relaunchCommandLine(exe) {
  *   appExePath?: string|null,
  *   relaunchDelaySeconds?: number,
  *   taskkillImageName?: string,
+ *   cookieClearCommand?: string,
  * }} [options]
  * @returns {string}
  */
@@ -504,6 +621,7 @@ export function buildRestartCommand({
   appExePath = null,
   relaunchDelaySeconds = DEFAULT_RELAUNCH_DELAY_SECONDS,
   taskkillImageName = DEFAULT_IMAGE_NAME,
+  cookieClearCommand = '',
 } = {}) {
   const seconds =
     typeof relaunchDelaySeconds === 'number' && Number.isFinite(relaunchDelaySeconds) && relaunchDelaySeconds >= 0
@@ -511,9 +629,18 @@ export function buildRestartCommand({
       : DEFAULT_RELAUNCH_DELAY_SECONDS;
   const image = nonEmptyString(taskkillImageName) ?? DEFAULT_IMAGE_NAME;
   const exe = typeof appExePath === 'string' ? appExePath : '';
+  const clear = nonEmptyString(cookieClearCommand);
   // `ping -n N` where N = seconds + 1: one packet is sent immediately, so a
   // 4-second delay needs 5 pings. `>nul` keeps the detached console silent.
-  return `cmd.exe /c ping -n ${seconds + 1} 127.0.0.1 >nul & taskkill /IM "${image}" /T /F & ${relaunchCommandLine(exe)}`;
+  const steps = [
+    `cmd.exe /c ping -n ${seconds + 1} 127.0.0.1 >nul`,
+    `taskkill /IM "${image}" /T /F`,
+  ];
+  // The cleanup runs AFTER the kill and BEFORE the relaunch: only then has
+  // Chromium left, and only then is the cookie jar unlocked.
+  if (clear !== null) steps.push(clear);
+  steps.push(relaunchCommandLine(exe));
+  return steps.join(' & ');
 }
 
 /**
@@ -550,6 +677,7 @@ export function buildWmiRestartCommand(command) {
  *   relaunchDelaySeconds?: number,
  *   gateUrl?: string,
  *   taskkillImageName?: string,
+ *   cookieClearCommand?: string,
  * }} [options]
  * @returns {string} `.cmd` script text (CRLF line endings, no BOM)
  */
@@ -559,6 +687,7 @@ export function buildGateScript({
   gateUrl = '',
   taskkillImageName = DEFAULT_IMAGE_NAME,
   watchScriptPath = null,
+  cookieClearCommand = '',
 } = {}) {
   const seconds =
     typeof relaunchDelaySeconds === 'number' && Number.isFinite(relaunchDelaySeconds) && relaunchDelaySeconds >= 0
@@ -573,6 +702,7 @@ export function buildGateScript({
     + gateArgument
     + ' -TimeoutSec 5; if ($r.allowRestart -ne $true) { exit 3 } } catch { exit 4 }"';
   const watch = nonEmptyString(watchScriptPath);
+  const clear = nonEmptyString(cookieClearCommand);
   const lines = [
     '@echo off',
     'rem dsh-autorestart: wait, re-check the idle gate, then kill + relaunch DeepSeek Harness.',
@@ -581,8 +711,11 @@ export function buildGateScript({
     'if errorlevel 1 exit /b 0',
     'taskkill /IM "' + image + '" /T /F',
     'ping -n 3 127.0.0.1 >nul',
-    relaunchCommandLine(exe),
   ];
+  // The cleanup runs AFTER the kill and BEFORE the relaunch: only then has
+  // Chromium left, and only then is the cookie jar unlocked.
+  if (clear !== null) lines.push(clear);
+  lines.push(relaunchCommandLine(exe));
   if (watch !== null) {
     lines.push('rem dsh-autorestart: wait for the host to come back; roll the backup back when it does not.');
     // Launched as its own hidden process so the .cmd can end immediately: the
@@ -820,6 +953,77 @@ export function writeTextFileAtomic(file, text) {
   }
 }
 
+/**
+ * Is this pid still alive?
+ *
+ * Best effort, never throws: `process.kill(pid, 0)` sends no signal, it only
+ * asks the operating system whether the process exists. `EPERM` means "it
+ * exists, but it is not mine" — still alive.
+ *
+ * @param {number|null} pid
+ * @param {{ kill?: Function }} [options]
+ * @returns {boolean}
+ */
+export function isProcessAlive(pid, { kill = process.kill } = {}) {
+  const value = Number(pid);
+  if (!Number.isFinite(value) || value <= 0) return false;
+  try {
+    kill(value, 0);
+    return true;
+  } catch (error) {
+    return Boolean(error && error.code === 'EPERM');
+  }
+}
+
+/**
+ * Did the rollback watcher really survive its own start?
+ *
+ * The POSIX launch only proves that `spawn` returned a pid: the detached child
+ * may still die a moment later (a missing `node`, a script that cannot be read).
+ * Waiting a moment and asking again is the difference between "armed" and
+ * "probably armed" — and the caller is told which one it got.
+ *
+ * @param {{
+ *   pid?: number|null,
+ *   waitMs?: number,
+ *   sleep?: (ms: number) => Promise<void>,
+ *   isAlive?: (pid: number) => boolean,
+ * }} [options]
+ * @returns {Promise<{ confirmed: boolean, alive: boolean, pid: number|null, reason: string }>}
+ */
+export async function confirmWatcherAlive({
+  pid = null,
+  waitMs = 250,
+  sleep = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); }),
+  isAlive = isProcessAlive,
+} = {}) {
+  const value = Number(pid);
+  if (!Number.isFinite(value) || value <= 0) {
+    return { confirmed: false, alive: false, pid: null, reason: 'no pid was reported, so nothing could be confirmed' };
+  }
+  const wait = Number.isFinite(Number(waitMs)) && Number(waitMs) > 0 ? Math.trunc(Number(waitMs)) : 0;
+  if (wait > 0) {
+    try {
+      await sleep(wait);
+    } catch { /* a clock that fails must not turn into "confirmed" */ }
+  }
+  const alive = (() => {
+    try {
+      return isAlive(value) === true;
+    } catch {
+      return false;
+    }
+  })();
+  return {
+    confirmed: alive,
+    alive,
+    pid: value,
+    reason: alive
+      ? `the watcher process ${value} is alive`
+      : `the watcher process ${value} is gone right after its start`,
+  };
+}
+
 /**
  * Start the rollback watcher as a process that survives the death of the host.
  *
@@ -833,6 +1037,11 @@ export function writeTextFileAtomic(file, text) {
  *     its own session and therefore immune to a kill of the host's process
  *     group.
  *
+ * WHAT `ok: true` MEANS (2026-11-02): the launch mechanism accepted the command.
+ * It does NOT mean "somebody is definitely waiting" — on POSIX the child may
+ * still die a moment later, so the caller must confirm the pid
+ * ({@link confirmWatcherAlive}) before it reports "the rollback is armed".
+ *
  * @param {{
  *   watchScriptPath?: string|null,
  *   watchCommand?: string|null,
@@ -849,6 +1058,8 @@ export function writeTextFileAtomic(file, text) {
  *   command: string,
  *   error: string|null,
  *   dryRun: boolean,
+ *   pid: number|null,
+ *   spawnError: string|null,
  * }}
  */
 export function launchDetachedWatcher({
@@ -869,6 +1080,10 @@ export function launchDetachedWatcher({
     command,
     error: null,
     dryRun: dryRun === true,
+    // The pid is what the caller needs to confirm that somebody is really
+    // waiting: `ok: true` alone only says "the launcher accepted it".
+    pid: /** @type {number|null} */ (null),
+    spawnError: /** @type {string|null} */ (null),
   };
   if (command === '') {
     return { ...base, error: 'launchDetachedWatcher requires a watcher command' };
@@ -926,18 +1141,31 @@ export function launchDetachedWatcher({
 
   // POSIX: a detached child is its own session leader (setsid), so it survives
   // the death of the host — even when the host is killed as a process group.
+  //
+  // THE SPAWN ERROR IS NO LONGER SWALLOWED (2026-11-02): the old code attached
+  // an empty `error` handler and returned `ok: true` as soon as a pid existed.
+  // With `shell: true` a pid exists even when the real command cannot be
+  // executed at all (a missing `node`, an unreadable script), so "the rollback
+  // is armed" was reported for a watcher that never ran. The launch now returns
+  // the pid and the caller CONFIRMS it (`confirmWatcherAlive`); the error
+  // listener keeps the reason so a late failure is at least recorded.
   try {
     const child = spawnFn(command, { shell: true, detached: true, stdio: 'ignore' });
-    if (typeof child.on === 'function') child.on('error', () => {});
+    const pid = child && typeof child.pid === 'number' ? child.pid : null;
+    if (typeof child.on === 'function') {
+      child.on('error', (error) => {
+        base.spawnError = errorText(error);
+      });
+    }
     try {
       child.unref();
     } catch {
       /* nothing else to do */
     }
-    if (typeof child.pid !== 'number') {
+    if (pid === null) {
       return { ...base, method: 'spawn', error: 'the watcher could not be started' };
     }
-    return { ...base, ok: true, method: 'spawn' };
+    return { ...base, ok: true, method: 'spawn', pid };
   } catch (error) {
     return { ...base, method: 'spawn', error: errorText(error) };
   }
@@ -959,6 +1187,7 @@ export function launchDetachedWatcher({
  *   dryRun?: boolean,
  *   gateUrl?: string|null,
  *   scriptPath?: string|null,
+ *   cookieClearCommand?: string,
  * }} [options]
  * @returns {{
  *   ok: boolean,
@@ -986,12 +1215,14 @@ export function scheduleDetachedRestart({
   scriptPath = null,
   watchScriptPath = null,
   watchScript = null,
+  cookieClearCommand = '',
 } = {}) {
   const task = nonEmptyString(taskName) ?? DEFAULT_TASK_NAME;
   const gate = nonEmptyString(gateUrl);
   const scriptFile = nonEmptyString(scriptPath);
   const watchFile = nonEmptyString(watchScriptPath);
   const watchText = typeof watchScript === 'string' ? watchScript : null;
+  const clear = nonEmptyString(cookieClearCommand);
   const gated = gate !== null;
   let script = null;
   let command;
@@ -1002,10 +1233,16 @@ export function scheduleDetachedRestart({
       gateUrl: gate,
       taskkillImageName,
       watchScriptPath: watchFile,
+      cookieClearCommand: clear,
     });
     command = scriptFile === null ? '' : 'cmd.exe /c "' + scriptFile + '"';
   } else {
-    command = buildRestartCommand({ appExePath, relaunchDelaySeconds, taskkillImageName });
+    command = buildRestartCommand({
+      appExePath,
+      relaunchDelaySeconds,
+      taskkillImageName,
+      cookieClearCommand: clear,
+    });
   }
   const wmiCommand = buildWmiRestartCommand(command);
   const schtasksCreate = ['/Create', '/SC', 'ONCE', '/ST', '23:59', '/TN', task, '/TR', command, '/F'];

package/lib/scheduler-capability.js

@@ -41,6 +41,16 @@ export const SCHEDULER_OK = 'ok';
 export const SCHEDULER_BLOCKED = 'blocked';
 /** Nobody checked yet. */
 export const SCHEDULER_UNKNOWN = 'unknown';
+/**
+ * THE QUESTION DOES NOT APPLY HERE (2026-11-02).
+ *
+ * Only Windows has the one-off scheduled task this probe is about. The answer
+ * used to be `ok` — a green tick for a check that never ran, which made the
+ * page and the report claim something nobody had measured. `not-applicable` is
+ * a DIFFERENT answer from `ok`: it never counts as "passed", and the caller
+ * must say "this check does not apply on this machine" instead.
+ */
+export const SCHEDULER_NOT_APPLICABLE = 'not-applicable';
 
 /** The name of the probe task. It is unique per run, so two probes cannot collide. */
 export const PROBE_TASK_PREFIX = 'dsh-autorestart-capability-probe';
@@ -173,11 +183,14 @@ export function probeSchedulerCapability({
   const evidence = { platform, taskName, steps: [] };
 
   // Only Windows uses a one-off scheduled task. Everywhere else the question
-  // does not apply (the advice for those platforms is elsewhere).
+  // does not apply — and the answer SAYS SO (`not-applicable`), because `ok`
+  // was a green tick for a check that never ran (2026-11-02).
   if (platform !== 'win32') {
     return {
-      scheduler: SCHEDULER_OK,
+      scheduler: SCHEDULER_NOT_APPLICABLE,
       checkedAt,
+      applicable: false,
+      reason: 'not applicable: this platform does not use a one-off scheduled task',
       evidence: {
         ...evidence,
         applicable: false,
@@ -296,5 +309,8 @@ export function emptyCapabilities() {
 export function isCapabilities(raw) {
   if (!raw || typeof raw !== 'object') return false;
   const scheduler = raw.scheduler;
-  return scheduler === SCHEDULER_OK || scheduler === SCHEDULER_BLOCKED || scheduler === SCHEDULER_UNKNOWN;
+  return scheduler === SCHEDULER_OK
+    || scheduler === SCHEDULER_BLOCKED
+    || scheduler === SCHEDULER_UNKNOWN
+    || scheduler === SCHEDULER_NOT_APPLICABLE;
 }