dsh-autorestart 0.8.4 → 0.8.6

package/lib/sleep.js

@@ -32,6 +32,7 @@ import fs from 'node:fs';
 
 import { blockerTaskKeys, countBlockerTasks } from './blockers.js';
 import { detectHostKind, detectWslEvidence, HOST_KINDS, WSL_PROC_VERSION, WSL_SHUTDOWN_EXE } from './host-kind.js';
+import { detectContainer } from './supervisor-config.js';
 
 /**
  * The Windows shutdown binary as it is reachable from WSL.
@@ -201,6 +202,30 @@ export function detectShutdownPlan({
         platform: plat,
       };
     }
+    // A CONTAINER IS NOT A LINUX MACHINE (2026-11-02). `systemctl poweroff`
+    // inside a container either fails or takes the container's own PID 1 down
+    // with it, and `shutdown -h now` is no better. The old code fell through to
+    // the plain Linux plan and the page then promised "关闭这台 Linux 主机" —
+    // a promise this machine cannot keep. The honest answer is the same one the
+    // unsupported platforms get: there is no reliable way to switch it off.
+    const container = detectContainer({
+      env: env && typeof env === 'object' ? env : process.env,
+      existsSyncFn: existsSafe,
+    });
+    if (container.container === true) {
+      return {
+        kind: 'container',
+        label: '这台机器没有可靠的关机方式',
+        source: 'container: ' + container.evidence,
+        command: null,
+        args: [],
+        fallbacks: [],
+        platform: plat,
+        reason: 'this host runs in a container (evidence: '
+          + container.evidence
+          + '): the orchestrator owns the process, and there is no reliable way to switch this machine off',
+      };
+    }
     return {
       kind: 'linux',
       label: '关闭这台 Linux 主机',
@@ -273,11 +298,32 @@ export function planInvocation(plan, { sleepCommand = '', platform = process.pla
 export const SPAWN_TIMEOUT_MS = 5000;
 
 /**
- * Start ONE command and wait for the real answer.
+ * How long the shutdown command may run before "it started" is the only answer.
+ *
+ * A real shutdown binary answers in well under a second: `shutdown.exe /s /f
+ * /t 0`, `systemctl poweroff`, `osascript -e …` all return immediately (the
+ * machine goes off in the background). A CUSTOM `sleepCommand` may instead keep
+ * running in the foreground (`a script that starts something`), and the plugin
+ * must not wait for it forever — so the wait is bounded and the answer then says
+ * exactly what is known: it started, and it had not finished yet.
+ */
+export const EXIT_TIMEOUT_MS = 1500;
+
+/**
+ * Start ONE command, wait for the real answer, AND read its exit code.
+ *
+ * Three outcomes, all of them distinguishable:
+ *
+ *   - `spawn-failed`  the command never started (missing binary, permission);
+ *   - `exited`        it ran and exited: `exitCode === 0` is success, anything
+ *                     else is a REFUSAL ("the system said no") and carries the
+ *                     code in the error text;
+ *   - `stillRunning`  it started and was still running when the bounded wait
+ *                     ran out (a custom foreground command).
  *
- * `spawn` means the command really started; `error` means it did not (the
- * binary is missing, the permission is denied, ...). Nothing is swallowed:
- * the caller learns which one of the two happened.
+ * A spawner without events (a test double) cannot report any of that: it counts
+ * as started, `exited` stays `null`, and `observed: false` says that nothing was
+ * actually proven — the caller must not claim more.
  *
  * @param {string} command
  * @param {string[]} args
@@ -285,14 +331,25 @@ export const SPAWN_TIMEOUT_MS = 5000;
  *   spawn?: Function,
  *   log?: { warn?: Function },
  *   timeoutMs?: number,
+ *   exitTimeoutMs?: number,
  *   setTimeout?: Function,
  *   clearTimeout?: Function,
  * }} [options]
- * @returns {Promise<{ ok: boolean, pid: number|null, error: string|null }>}
+ * @returns {Promise<{
+ *   ok: boolean,
+ *   pid: number|null,
+ *   error: string|null,
+ *   exitCode: number|null,
+ *   exited: boolean|null,
+ *   started: boolean,
+ *   stillRunning?: boolean,
+ *   observed?: boolean,
+ * }>}
  */
 function startCommand(command, args, {
   spawn = spawnProcess,
   timeoutMs = SPAWN_TIMEOUT_MS,
+  exitTimeoutMs = EXIT_TIMEOUT_MS,
   setTimeout: setTimeoutFn = setTimeout,
   clearTimeout: clearTimeoutFn = clearTimeout,
 } = {}) {
@@ -301,45 +358,101 @@ function startCommand(command, args, {
     try {
       child = spawn(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
     } catch (error) {
-      resolve({ ok: false, pid: null, error: `spawn-failed: ${errorText(error)}` });
+      resolve({
+        ok: false,
+        pid: null,
+        error: `spawn-failed: ${errorText(error)}`,
+        exitCode: null,
+        exited: null,
+        started: false,
+      });
       return;
     }
     const pid = child && Number.isFinite(child.pid) ? child.pid : null;
     if (!child || typeof child.on !== 'function') {
-      // A spawner without events (a test double) counts as started.
+      // A spawner without events (a test double) counts as started — but the
+      // exit code CANNOT be observed, and `observed: false` says so.
       try {
         if (child && typeof child.unref === 'function') child.unref();
       } catch { /* nothing else to do */ }
-      resolve({ ok: true, pid, error: null });
+      resolve({
+        ok: true,
+        pid,
+        error: null,
+        exitCode: null,
+        exited: null,
+        started: true,
+        observed: false,
+      });
       return;
     }
     let settled = false;
-    let timer = null;
+    let spawnTimer = null;
+    let exitTimer = null;
+    // WHAT THE ANSWER SAYS BESIDES ok/error (2026-11-02): the exit code, whether
+    // it was observed, and whether the command is still running. Kept in a
+    // small record so `finish` keeps its two-argument shape.
+    let outcome = { exitCode: null, exited: null, started: true };
+    const stopTimer = (handle) => {
+      if (handle === null) return;
+      try {
+        clearTimeoutFn(handle);
+      } catch { /* nothing else to do */ }
+    };
     const finish = (ok, error) => {
       if (settled) return;
       settled = true;
-      if (timer !== null) {
-        try {
-          clearTimeoutFn(timer);
-        } catch { /* nothing else to do */ }
-        timer = null;
+      stopTimer(spawnTimer);
+      stopTimer(exitTimer);
+      resolve({ ok, pid, error, ...outcome });
+    };
+    // THE EXIT CODE IS THE ANSWER (2026-11-02). "The command started" is not
+    // "the machine is going off": a refused shutdown exits non-zero and used to
+    // be reported as success, so the page said "正在关机" while the machine
+    // stayed on. Both `exit` and `close` are listened to, because a spawner may
+    // emit only one of them; `finish` makes the second one a no-op.
+    const onExit = (code, signal) => {
+      const numeric = Number.isFinite(code) ? Number(code) : null;
+      if (numeric === 0) {
+        outcome = { exitCode: 0, exited: true, started: true };
+        finish(true, null);
+        return;
       }
-      resolve({ ok, pid, error });
+      const why = numeric === null
+        ? `the command was killed by ${signal || 'a signal'}`
+        : `the command exited with code ${numeric}`;
+      outcome = { exitCode: numeric, exited: true, started: true };
+      finish(false, `shutdown-refused: ${why}`);
     };
     child.on('spawn', () => {
       try {
         if (child && typeof child.unref === 'function') child.unref();
       } catch { /* nothing else to do */ }
-      finish(true, null);
+      stopTimer(spawnTimer);
+      // The command started; now give it a bounded window to answer with its
+      // exit code.
+      try {
+        exitTimer = setTimeoutFn(() => {
+          outcome = { exitCode: null, exited: false, started: true, stillRunning: true };
+          finish(true, null);
+        }, exitTimeoutMs);
+        if (exitTimer && typeof exitTimer.unref === 'function') exitTimer.unref();
+      } catch { /* the wait is only a safety net the other way round */ }
     });
     child.on('error', (error) => {
+      outcome = { exitCode: null, exited: null, started: false };
       finish(false, `spawn-failed: ${errorText(error)}`);
     });
+    if (typeof child.once === 'function' || typeof child.on === 'function') {
+      child.on('exit', onExit);
+      child.on('close', onExit);
+    }
     try {
-      timer = setTimeoutFn(() => {
+      spawnTimer = setTimeoutFn(() => {
+        outcome = { exitCode: null, exited: null, started: false };
         finish(false, `spawn-timeout: ${command} did not start within ${timeoutMs}ms`);
       }, timeoutMs);
-      if (timer && typeof timer.unref === 'function') timer.unref();
+      if (spawnTimer && typeof spawnTimer.unref === 'function') spawnTimer.unref();
     } catch { /* the timeout is only a safety net */ }
   });
 }
@@ -350,11 +463,15 @@ function startCommand(command, args, {
  * The gate is checked ONE more time right before the command runs: a session
  * that started working in the meantime must be able to stop the shutdown.
  *
- * The command is really started, not merely requested: the answer arrives
- * with the child's `spawn` event, and a command that does not start is
- * reported as a FAILURE (`executed: false`). When the main command does not
- * start, the plan's fallbacks are tried one after another (the WSL plan
- * reaches Windows through two of them), and the first one that starts wins.
+ * The command is really started AND its exit code is read: a command that does
+ * not start, and a command the system REFUSED (non-zero exit code), are both a
+ * FAILURE (`executed: false`) with the reason in `error`. When the main command
+ * fails that way, the plan's fallbacks are tried one after another (the WSL
+ * plan reaches Windows through two of them), and the first one that works wins.
+ *
+ * `executed: true` therefore means: the command ran and the system did not
+ * refuse it. `exitCode` / `exited` / `stillRunning` travel with the answer so a
+ * caller can tell "confirmed" from "started, not confirmed".
  *
  * With `dryRun` nothing is executed at all: the command that WOULD run is
  * reported instead.
@@ -366,6 +483,7 @@ function startCommand(command, args, {
  *   log?: { warn?: Function, info?: Function },
  *   gate?: () => { allow?: boolean } | null,
  *   timeoutMs?: number,
+ *   exitTimeoutMs?: number,
  * }} [options]
  * @returns {Promise<{
  *   ok: boolean,
@@ -375,6 +493,10 @@ function startCommand(command, args, {
  *   executed: boolean,
  *   pid: number|null,
  *   error: string|null,
+ *   exitCode?: number|null,
+ *   exited?: boolean|null,
+ *   stillRunning?: boolean,
+ *   observed?: boolean,
  *   dryRun?: boolean,
  * }>}
  */
@@ -384,6 +506,7 @@ export function runShutdown(plan, {
   log = console,
   gate = null,
   timeoutMs = SPAWN_TIMEOUT_MS,
+  exitTimeoutMs = EXIT_TIMEOUT_MS,
 } = {}) {
   const at = new Date().toISOString();
   const source = plan && typeof plan === 'object' ? plan : {};
@@ -425,8 +548,9 @@ export function runShutdown(plan, {
 
   return (async () => {
     let lastError = 'no-shutdown-command';
+    let lastExitCode = null;
     for (const attempt of attempts) {
-      const outcome = await startCommand(attempt.command, attempt.args, { spawn, timeoutMs });
+      const outcome = await startCommand(attempt.command, attempt.args, { spawn, timeoutMs, exitTimeoutMs });
       if (outcome.ok) {
         return {
           ok: true,
@@ -436,14 +560,29 @@ export function runShutdown(plan, {
           executed: true,
           pid: outcome.pid,
           error: null,
+          exitCode: outcome.exitCode === undefined ? null : outcome.exitCode,
+          exited: outcome.exited === undefined ? null : outcome.exited,
+          ...(outcome.stillRunning === true ? { stillRunning: true } : {}),
+          ...(outcome.observed === false ? { observed: false } : {}),
         };
       }
       lastError = outcome.error;
+      lastExitCode = outcome.exitCode === undefined ? null : outcome.exitCode;
       if (log && typeof log.warn === 'function') {
-        log.warn(`the sleep command ${attempt.command} did not start:`, outcome.error);
+        log.warn(`the sleep command ${attempt.command} did not work:`, outcome.error);
       }
     }
-    return { ok: false, at, command, args, executed: false, pid: null, error: lastError };
+    return {
+      ok: false,
+      at,
+      command,
+      args,
+      executed: false,
+      pid: null,
+      error: lastError,
+      exitCode: lastExitCode,
+      exited: true,
+    };
   })();
 }
 
@@ -728,6 +867,13 @@ export function createSleepController({
       pid: Number.isFinite(run.pid) ? run.pid : null,
       error: run.error == null ? null : String(run.error),
     };
+    // THE EXIT CODE TRAVELS WITH THE ANSWER (2026-11-02): "the command exited
+    // with code 1" and "the command is still running" are different facts, and
+    // the interface must be able to say which one happened.
+    if (Number.isFinite(run.exitCode)) normalized.exitCode = Number(run.exitCode);
+    if (typeof run.exited === 'boolean') normalized.exited = run.exited;
+    if (run.stillRunning === true) normalized.stillRunning = true;
+    if (run.observed === false) normalized.observed = false;
     // A dry run is reported as such, because the UI has to know that the
     // command was NOT executed. A real run keeps its shape untouched.
     if (run.dryRun === true) normalized.dryRun = true;
@@ -879,9 +1025,15 @@ export function createSleepController({
       stopTimer();
       // A countdown of zero seconds says so in the message too: the user
       // must see that the machine went off without any countdown.
+      //
+      // THE WORDING IS "REQUESTED", NOT "SHUTTING DOWN" (2026-11-02): at this
+      // moment the command has only been ISSUED. Whether the machine really
+      // goes off is decided by the system, and the exit code arrives a moment
+      // later — the run's answer either keeps this stage or turns it back into
+      // "idle, the machine is still on".
       message = countdownMs > 0
-        ? `正在${target}……`
-        : '0 秒：立即关机，正在关掉这台电脑。';
+        ? `已发出${target}命令，正在等系统的回答……`
+        : '0 秒：立即关机，已发出关机命令，正在等系统的回答……';
       let result = null;
       try {
         result = shutdown();
@@ -941,7 +1093,16 @@ export function createSleepController({
         armed = false;
         blockers = [];
         remainingMs = 0;
-        message = `关机命令没跑起来（${run.error || 'unknown error'}），电脑还开着，可以再点一次月亮按钮。`;
+        // A REFUSAL IS NOT A CRASH (2026-11-02): "the system said no" (a
+        // non-zero exit code) and "the command could not be started" are
+        // different sentences, and the user has to read the right one.
+        const failure = run.error || 'unknown error';
+        if (String(failure).startsWith('shutdown-refused')) {
+          const detail = String(failure).replace(/^shutdown-refused:\s*/, '');
+          message = `关机被系统拒绝（${detail}），电脑还开着，可以再点一次月亮按钮。`;
+        } else {
+          message = `关机命令没跑起来（${failure}），电脑还开着，可以再点一次月亮按钮。`;
+        }
         disarm('shutdown-failed');
       };
       if (result && typeof result.then === 'function') {

package/lib/watchdog-disarm.js

@@ -41,7 +41,7 @@ import {
   readReady,
   writeReady,
 } from './watchdog.js';
-import { removeScheduleItem } from './watchdog-schedule.js';
+import { removeLeftoverProbeTasks, removeScheduleItem } from './watchdog-schedule.js';
 import { TIERS } from './watchdog-tier.js';
 
 /** The file that records how the last disarm went. */
@@ -270,7 +270,9 @@ export function disarmOnce({
   clearPendingFn = clearPending,
   removeItem = removeScheduleItem,
   taskExists = defaultTaskExists,
+  removeProbes = removeLeftoverProbeTasks,
   pendingHint = null,
+  platform = process.platform,
 } = {}) {
   const dir = typeof stateDir === 'string' ? stateDir : '';
   const errors = [];
@@ -377,6 +379,40 @@ export function disarmOnce({
     }
   }
 
+  // (4) THE LEFTOVER CAPABILITY PROBES (2026-11-01).
+  //
+  // The capability probe (lib/scheduler-capability.js) registers a one-off task
+  // and deletes it as its LAST step, so a crash, a kill or a refused delete
+  // leaves it behind: two were found on the real machine, both `Ready`, neither
+  // with a next run time. The old disarm only removed the watchdog item named by
+  // the pending marker and never looked for them, so they accumulated one per
+  // boot.
+  //
+  // A refusal here is recorded and NOT pushed into `errors`: those decide whether
+  // the disarm itself counts as done, and the host being up does not depend on
+  // cleaning a stale probe task. The caller logs it and the record carries it, so
+  // "the cleanup did not work" is still visible.
+  let probes = null;
+  if (typeof removeProbes === 'function') {
+    try {
+      // THE PLATFORM TRAVELS WITH THE REQUEST (2026-11-02): off Windows there
+      // are no scheduled tasks to clean, so the cleanup says `skipped` instead
+      // of reporting a `schtasks` failure on every single boot.
+      probes = removeProbes({ platform: typeof platform === 'string' && platform !== '' ? platform : process.platform });
+    } catch (error) {
+      probes = {
+        ok: false,
+        prefix: '',
+        matched: [],
+        removed: [],
+        failed: [],
+        skipped: false,
+        reason: null,
+        error: error && error.message ? String(error.message) : String(error),
+      };
+    }
+  }
+
   const ready = (() => {
     try {
       const marker = read(dir);
@@ -389,7 +425,7 @@ export function disarmOnce({
   const pendingLeft = pendingAfter !== null && pendingAfter !== undefined;
   const ok = errors.length === 0 && ready === true && pendingLeft === false
     && (removed === null || removed.ok === true);
-  return { ok, ready, pending: pendingLeft, removed, errors };
+  return { ok, ready, pending: pendingLeft, removed, errors, probes };
 }
 
 /**
@@ -437,8 +473,10 @@ export async function disarmWatchdog({
   clearPendingFn = clearPending,
   removeItem = removeScheduleItem,
   taskExists = defaultTaskExists,
+  removeProbes = removeLeftoverProbeTasks,
   writeRecord = true,
   log = null,
+  platform = process.platform,
 } = {}) {
   const dir = typeof stateDir === 'string' ? stateDir : '';
   const wanted = Number.isFinite(Number(attempts)) && Number(attempts) > 0
@@ -469,7 +507,9 @@ export async function disarmWatchdog({
       clearPendingFn,
       removeItem,
       taskExists,
+      removeProbes,
       pendingHint: hint,
+      platform,
     });
     errors.push(...last.errors);
     if (last.ok) break;
@@ -493,6 +533,10 @@ export async function disarmWatchdog({
     scheduleError: last !== null && last.removed !== null && last.removed.error
       ? String(last.removed.error)
       : null,
+    // THE LEFTOVER CAPABILITY PROBES: what the cleanup found and what it did.
+    // Kept OUT of `errors` on purpose — a refused cleanup of a stale probe task
+    // is not a failed disarm, but it must not be invisible either.
+    probes: last !== null && last.probes !== null && last.probes !== undefined ? last.probes : null,
     errors,
   };
   if (writeRecord) writeDisarmRecord(dir, record);