dsh-update-status 0.3.1 → 0.4.0

package/lib/index.js

@@ -1,8 +1,10 @@
+import { c as parseSystemdMainPid, d as bootStampFile, f as countRecentRestarts, h as serviceLogDir, i as SYSTEMD_UNIT, m as recordBootStamp, p as dshHomeOf, r as LAUNCHD_LABEL, s as parseLaunchdTrackedPid, t as planFor, u as RESTART_STORM_WINDOW_MS } from "./plan-BornHBEZ.js";
 import { createRequire } from "node:module";
-import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, join, normalize, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
+import { execFile } from "node:child_process";
 //#region src/shared/types.ts
 const PACKAGE_NAME = "@deepseek-ai/dsh";
 /** Shared Connection RPC channel. Custom prefixes 405 on the SPA fallback. */
@@ -242,14 +244,14 @@ function createUpdateStatusRpcHandler(service, restart, restartContext) {
 				if (restart === void 0) return failure("dsh-update-status/restart-unavailable", "restart support is not configured");
 				return {
 					ok: true,
-					value: restart.status()
+					value: await restart.assess()
 				};
 			}
 			if (endpoint === RESTART_ENDPOINTS.check) {
 				if (restart === void 0 || restartContext === void 0) return failure("dsh-update-status/restart-unavailable", "restart support is not configured");
 				return {
 					ok: true,
-					value: restart.check(restartContext)
+					value: await restart.check(restartContext)
 				};
 			}
 			if (endpoint === RESTART_ENDPOINTS.request) {
@@ -258,7 +260,7 @@ function createUpdateStatusRpcHandler(service, restart, restartContext) {
 				if (restart === void 0 || restartContext === void 0) return failure("dsh-update-status/restart-unavailable", "restart support is not configured");
 				return {
 					ok: true,
-					value: restart.request(restartContext, request.force, request.expectedInstanceId)
+					value: await restart.request(restartContext, request.force, request.expectedInstanceId)
 				};
 			}
 			return failure("dsh-update-status/unknown-endpoint", `unknown endpoint: ${endpoint}`);
@@ -291,7 +293,228 @@ function installUpdateStatusRpc(ctx, service, restart) {
 		}
 	});
 }
+//#endregion
+//#region src/host/service-record.ts
+/**
+* What the *service* is, read back from our own installer receipt.
+*
+* The panel must be able to tell an operator how to get supervision back after
+* it was lost — a restart storm tripped the wrapper's ceiling, or another tool's
+* instance took the port. Those steps are platform commands, and the plugin
+* never guesses them: the installer wrote the receipt, so the receipt is where
+* the port and the matching recover command come from.
+*
+* Read-only and best effort. A missing, foreign or unreadable receipt simply
+* means "no recovery hint", never an error on a status route.
+*/
+const SERVICE_RECEIPT_FILE = "dsh-update-status-service.json";
+/** Whoever is listening on the port, without touching it — per platform. */
+function portListCommand(platform, port) {
+	if (platform === "win32") return `netstat -ano | findstr :${String(port)}`;
+	return `lsof -nP -iTCP:${String(port)} -sTCP:LISTEN`;
+}
+function specOf(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const spec = value;
+	if (spec.platform !== "darwin" && spec.platform !== "linux" && spec.platform !== "win32") return void 0;
+	if (typeof spec.port !== "number" || !Number.isInteger(spec.port) || spec.port < 1 || spec.port > 65535) return void 0;
+	if (typeof spec.label !== "string" || spec.label === "") return void 0;
+	for (const field of [
+		spec.nodePath,
+		spec.dshPath,
+		spec.profile,
+		spec.workspace,
+		spec.host,
+		spec.home,
+		spec.logDir
+	]) if (typeof field !== "string" || field === "") return void 0;
+	if (spec.supervisorMarker !== "dsh-update-status") return void 0;
+	return spec;
+}
+const CACHE_TTL_MS = 3e4;
+/**
+* Cached for a short window: the receipt changes only when the operator re-installs,
+* and this runs on every restart-status poll while a restart is unavailable.
+*/
+function createServiceRecovery(options = {}) {
+	const now = options.now ?? Date.now;
+	const read = options.readFile ?? ((path) => {
+		try {
+			if (!existsSync(path) || !statSync(path).isFile()) return void 0;
+			return readFileSync(path, "utf8");
+		} catch {
+			return;
+		}
+	});
+	let cached;
+	return () => {
+		const at = now();
+		if (cached !== void 0 && at - cached.at < CACHE_TTL_MS) return cached.value;
+		const value = readRecovery(options, read);
+		cached = {
+			at,
+			value
+		};
+		return value;
+	};
+}
+function readRecovery(options, read) {
+	const text = read(join(dshHomeOf(options.env ?? process.env), SERVICE_RECEIPT_FILE));
+	if (text === void 0) return void 0;
+	try {
+		const receipt = JSON.parse(text);
+		if (receipt.version !== 1 || receipt.managedBy !== "dsh-update-status") return void 0;
+		const spec = specOf(receipt.spec);
+		if (spec === void 0) return void 0;
+		const plan = planFor(spec, options.uid ?? (typeof process.getuid === "function" ? process.getuid() : 0));
+		return { commands: `${portListCommand(spec.platform, spec.port)}\n${plan.recoverCommand}` };
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/host/supervision.ts
+/**
+* Platform ownership of the running DSH Web process, plus restart-storm evidence.
+*
+* The environment marker (`DSH_WEB_SUPERVISOR`) is necessary but *not* sufficient:
+* every descendant of a supervised process inherits it. A foreign launcher — a
+* second plugin's restart helper, a `nohup` script — therefore looks supervised
+* while the real job is stuck respawning a process that can never bind the port.
+* The panel would offer a destructive restart and promise a recovery the platform
+* cannot deliver, so ownership is asked of the platform itself:
+*
+* - launchd: the tracked pid of our fixed job label must be this process or its
+*   wrapper parent (asked by label, never from the environment);
+* - systemd: the unit's `MainPID` must be this process or its wrapper parent;
+* - Task Scheduler: the parent process must be the wrapper this plugin installed.
+*
+* Anything unverifiable fails closed: restart is destructive, and a false "yes"
+* strands the page, while a false "no" only asks the user to restart DSH by hand.
+*/
+function defaultRun(file, args) {
+	return new Promise((resolve) => {
+		execFile(file, [...args], {
+			encoding: "utf8",
+			timeout: 5e3,
+			windowsHide: true
+		}, (error, stdout, stderr) => {
+			const code = error === null ? 0 : error.code;
+			resolve({
+				status: typeof code === "number" ? code : error === null ? 0 : null,
+				stdout: stdout ?? "",
+				stderr: stderr ?? "",
+				...error === null ? {} : { error: error.message }
+			});
+		});
+	});
+}
+async function probeSupervisorOwnership(options = {}) {
+	const platform = options.platform ?? process.platform;
+	const pid = options.pid ?? process.pid;
+	const ppid = options.ppid ?? process.ppid;
+	const run = options.run ?? defaultRun;
+	try {
+		if (platform === "darwin") {
+			const uid = options.uid ?? (typeof process.getuid === "function" ? process.getuid() : void 0);
+			if (uid === void 0) return "unverifiable";
+			const result = await run("/bin/launchctl", ["print", `gui/${String(uid)}/${LAUNCHD_LABEL}`]);
+			if (result.status === null && result.error !== void 0) return "unverifiable";
+			const tracked = parseLaunchdTrackedPid(result.stdout);
+			if (tracked === void 0) return "not-owner";
+			return tracked === pid || tracked === ppid ? "owned" : "not-owner";
+		}
+		if (platform === "linux") {
+			const result = await run("systemctl", [
+				"--user",
+				"show",
+				SYSTEMD_UNIT,
+				"-p",
+				"MainPID",
+				"--value"
+			]);
+			if (result.status === null && result.error !== void 0) return "unverifiable";
+			const tracked = parseSystemdMainPid(result.stdout);
+			if (tracked === void 0) return "not-owner";
+			return tracked === pid || tracked === ppid ? "owned" : "not-owner";
+		}
+		if (platform === "win32") {
+			const result = await run("powershell.exe", [
+				"-NoProfile",
+				"-NonInteractive",
+				"-Command",
+				`(Get-CimInstance Win32_Process -Filter "ProcessId=${String(ppid)}").CommandLine`
+			]);
+			if (result.status === null && result.error !== void 0) return "unverifiable";
+			return result.stdout.includes("dsh-web-supervisor.ps1") ? "owned" : "not-owner";
+		}
+		return "unverifiable";
+	} catch {
+		return "unverifiable";
+	}
+}
+/**
+* Ownership is cheap to cache: the answer cannot change while a restart is not in
+* flight, and the status route is polled by every open panel.
+*/
+function cacheOwnershipProbe(probe, ttlMs = 1e4, now = Date.now) {
+	let cached;
+	let inflight;
+	return async () => {
+		if (cached !== void 0 && now() - cached.at < ttlMs) return cached.verdict;
+		if (inflight !== void 0) return inflight;
+		inflight = probe().catch(() => "unverifiable").then((verdict) => {
+			cached = {
+				at: now(),
+				verdict
+			};
+			return verdict;
+		}).finally(() => {
+			inflight = void 0;
+		});
+		return inflight;
+	};
+}
+function classifySupervisorHealth(ownership, recentRestarts, windowMs = RESTART_STORM_WINDOW_MS, threshold = 4) {
+	if (ownership === "unverifiable") return { kind: "unverifiable" };
+	if (ownership === "not-owner") return { kind: "not-owner" };
+	if (recentRestarts >= threshold) return {
+		kind: "thrashing",
+		recentRestarts,
+		windowMs
+	};
+	return { kind: "owned" };
+}
+/**
+* Ownership first, storm second: "not the supervisor's own process" is the more
+* precise explanation whenever both are true.
+*/
+function createSupervisorHealth(options) {
+	const now = options.now ?? Date.now;
+	const windowMs = options.windowMs ?? 18e4;
+	const threshold = options.threshold ?? 4;
+	const probe = options.probe ?? cacheOwnershipProbe(() => probeSupervisorOwnership(), 1e4, now);
+	return async () => {
+		const ownership = await probe();
+		if (ownership !== "owned") return classifySupervisorHealth(ownership, 0, windowMs, threshold);
+		return classifySupervisorHealth(ownership, countRecentRestarts(options.logDir, options.bootLog, now(), windowMs), windowMs, threshold);
+	};
+}
+const BOOT_STAMPED = Symbol.for("dsh-update-status/boot-stamped");
+/**
+* One stamp per Node process, not per plugin composition: DSH can recompose this
+* plugin (HMR) inside a generation that already stamped itself, and counting
+* those would fake a storm.
+*/
+function recordBootOnce(stamp, path = bootStampFile()) {
+	const carrier = globalThis;
+	if (carrier[BOOT_STAMPED] === true) return false;
+	carrier[BOOT_STAMPED] = true;
+	recordBootStamp(path, stamp);
+	return true;
+}
 const INSTANCE_KEY = Symbol.for("dsh-update-status/process-instance-id");
+const STARTED_AT_KEY = Symbol.for("dsh-update-status/process-started-at");
 /**
 * This must outlive plugin HMR/recomposition inside one Node process. A module
 * local random value would make a Host reload look like a successful restart.
@@ -305,63 +528,76 @@ function processInstanceId() {
 	return created;
 }
 /**
-* Strict supervisor recognition: the marker is written only by this package's
-* user-service installer. Platform-specific signals defend against a user
-* copying that environment variable into an arbitrary terminal by accident.
+* Wall-clock start of this process, derived once from `process.uptime()` — the
+* one clock the Host owns without extra bookkeeping. It is cached on globalThis
+* for the same reason as the instance id: a recomposed plugin must keep reporting
+* the start of the process it is running in, not the moment it was recomposed.
+*/
+function processStartedAt() {
+	const carrier = globalThis;
+	const existing = carrier[STARTED_AT_KEY];
+	if (existing !== void 0) return existing;
+	const created = new Date(Date.now() - Math.round(process.uptime() * 1e3)).toISOString();
+	carrier[STARTED_AT_KEY] = created;
+	return created;
+}
+/**
+* The environment/platform half of the verdict: which supervisor this process
+* *claims* to be running under.
+*
+* The explicit marker is never inherited by accident, but every descendant of a
+* supervised process does inherit it, so this function alone can only report a
+* claim. What turns a claim into an answer is `assess()` below, which asks the
+* platform which process the service actually owns. The platform identity is
+* deliberately NOT read from the environment: launchd configures
+* `XPC_SERVICE_NAME=<label>` for the job, yet a DSH process behind the staged
+* `/bin/sh` wrapper reads `XPC_SERVICE_NAME=0`, so an environment check would
+* refuse the very setup this plugin installs.
 */
 function restartStatusOf(options = {}) {
 	const env = options.env ?? process.env;
 	const platform = options.platform ?? process.platform;
 	const versions = options.versions ?? process.versions;
 	const instanceId = options.instanceId ?? processInstanceId();
+	const startedAt = options.startedAt ?? processStartedAt();
 	if (versions.electron !== void 0 && versions.electron !== "") return {
 		instanceId,
+		startedAt,
 		available: false,
 		supervisor: null,
 		unavailableReason: "desktop"
 	};
 	if (env.DSH_WEB_SUPERVISOR !== "dsh-update-status") return {
 		instanceId,
+		startedAt,
 		available: false,
 		supervisor: null,
 		unavailableReason: "not-supervised"
 	};
-	if (platform === "darwin") {
-		if (env.XPC_SERVICE_NAME !== "com.idoall.dsh-update-status.web") return {
-			instanceId,
-			available: false,
-			supervisor: "launchd",
-			unavailableReason: "supervisor-mismatch"
-		};
-		return {
-			instanceId,
-			available: true,
-			supervisor: "launchd",
-			unavailableReason: null
-		};
-	}
-	if (platform === "linux") {
-		if (typeof env.INVOCATION_ID !== "string" || env.INVOCATION_ID === "") return {
-			instanceId,
-			available: false,
-			supervisor: "systemd",
-			unavailableReason: "supervisor-mismatch"
-		};
-		return {
-			instanceId,
-			available: true,
-			supervisor: "systemd",
-			unavailableReason: null
-		};
-	}
+	if (platform === "darwin") return {
+		instanceId,
+		startedAt,
+		available: true,
+		supervisor: "launchd",
+		unavailableReason: null
+	};
+	if (platform === "linux") return {
+		instanceId,
+		startedAt,
+		available: true,
+		supervisor: "systemd",
+		unavailableReason: null
+	};
 	if (platform === "win32") return {
 		instanceId,
+		startedAt,
 		available: true,
 		supervisor: "task-scheduler",
 		unavailableReason: null
 	};
 	return {
 		instanceId,
+		startedAt,
 		available: false,
 		supervisor: "unknown",
 		unavailableReason: "supervisor-mismatch"
@@ -460,10 +696,14 @@ function collectActiveWork(ctx) {
 var RestartController = class {
 	instanceId;
 	options;
+	health;
+	recovery;
 	scheduled = false;
 	constructor(options = {}) {
 		this.options = options;
 		this.instanceId = options.instanceId ?? processInstanceId();
+		this.health = options.health;
+		this.recovery = options.recovery;
 	}
 	status() {
 		return restartStatusOf({
@@ -471,8 +711,50 @@ var RestartController = class {
 			instanceId: this.instanceId
 		});
 	}
-	check(ctx) {
-		const status = this.status();
+	/**
+	* The environment verdict plus what only the platform knows: whether this
+	* process is the one its supervisor is actually tracking, and whether a restart
+	* storm says the supervisor cannot complete a start at all. A probe that throws
+	* is treated as unverifiable, because restart is destructive.
+	*/
+	async assess() {
+		const base = this.status();
+		if (!base.available) return this.withRecovery(base);
+		let health;
+		if (this.health === void 0) health = { kind: "unverifiable" };
+		else try {
+			health = await this.health();
+		} catch {
+			health = { kind: "unverifiable" };
+		}
+		if (health.kind === "thrashing") return this.withRecovery({
+			...base,
+			available: false,
+			unavailableReason: "supervisor-thrashing"
+		});
+		if (health.kind === "not-owner" || health.kind === "unverifiable") return this.withRecovery({
+			...base,
+			available: false,
+			unavailableReason: "supervisor-mismatch"
+		});
+		return base;
+	}
+	/** A refused restart carries the steps back; an offerable one does not need them. */
+	withRecovery(status) {
+		if (this.recovery === void 0) return status;
+		let recovery;
+		try {
+			recovery = this.recovery();
+		} catch {
+			recovery = void 0;
+		}
+		return recovery === void 0 ? status : {
+			...status,
+			recovery
+		};
+	}
+	async check(ctx) {
+		const status = await this.assess();
 		if (!status.available) return {
 			kind: "unavailable",
 			status
@@ -496,7 +778,7 @@ var RestartController = class {
 			status
 		};
 	}
-	request(ctx, force, expectedInstanceId) {
+	async request(ctx, force, expectedInstanceId) {
 		if (expectedInstanceId !== this.instanceId) return {
 			kind: "unavailable",
 			status: {
@@ -505,7 +787,7 @@ var RestartController = class {
 				unavailableReason: "stale-instance"
 			}
 		};
-		const checked = this.check(ctx);
+		const checked = await this.check(ctx);
 		if (checked.kind === "unavailable") return checked;
 		if (checked.kind === "active-work" && !force) return checked;
 		if (this.scheduled) return {
@@ -542,9 +824,24 @@ var RestartController = class {
 		};
 	}
 };
-/** Creates the process-scoped controller once per DSH Host generation. */
-function createRestartController() {
-	return new RestartController();
+/**
+* Creates the process-scoped controller once per DSH Host generation.
+*
+* The health probe is wired here rather than inside the CLI's plan so the Host
+* and the installer agree on where the evidence lives: `$DSH_HOME/logs`.
+*/
+function createRestartController(options = {}) {
+	const env = options.env ?? process.env;
+	const health = options.health ?? createSupervisorHealth({
+		logDir: serviceLogDir(env),
+		bootLog: bootStampFile(env)
+	});
+	const recovery = options.recovery ?? createServiceRecovery({ env });
+	return new RestartController({
+		...options,
+		health,
+		recovery
+	});
 }
 //#endregion
 //#region src/host/schemastery.ts
@@ -1178,7 +1475,14 @@ function apply(ctx, config = {}) {
 		runtimeWarnings: schema.warning === null ? [] : [schema.warning]
 	});
 	installSettings(ctx);
-	installUpdateStatusRpc(ctx, service, createRestartController());
+	const restart = createRestartController();
+	const restartStatus = restart.status();
+	recordBootOnce({
+		pid: process.pid,
+		instanceId: restartStatus.instanceId,
+		supervisor: restartStatus.supervisor
+	});
+	installUpdateStatusRpc(ctx, service, restart);
 	if (config.autoCheckOnMount !== false) service.getStatus();
 }
 //#endregion