gm-plugkit 2.0.1541 → 2.0.1543

package/bootstrap.js

@@ -606,7 +606,25 @@ function copyWasmToGmTools(wasmPath, version) {
       if (cur === src) wasmFresh = true;
     } catch (_) {}
   }
-  if (!wasmFresh) fs.copyFileSync(wasmPath, target);
+  if (!wasmFresh) {
+    // copyFileSync truncates the target before streaming ~149MB, leaving a window where
+    // a crash or a concurrent watcher load sees a truncated/absent wasm (the
+    // "self-heal: wasm not installed" crash-loop during an upgrade). Copy to a
+    // pid-suffixed temp and rename over the target: same-volume rename is atomic,
+    // with the Windows EEXIST/EPERM unlink+retry.
+    const tmp = `${target}.partial-${process.pid}`;
+    fs.copyFileSync(wasmPath, tmp);
+    try { fs.renameSync(tmp, target); }
+    catch (err) {
+      if (err.code === 'EEXIST' || err.code === 'EPERM') {
+        try { fs.unlinkSync(target); } catch (_) {}
+        fs.renameSync(tmp, target);
+      } else {
+        try { fs.unlinkSync(tmp); } catch (_) {}
+        throw err;
+      }
+    }
+  }
   fs.writeFileSync(path.join(dst, 'plugkit.version'), version);
 
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.1541",
+  "version": "2.0.1543",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform binary, verifies SHA256, and starts the spool watcher daemon. Includes plugkit-wasm-wrapper for WASM-based spool watching.",
   "main": "index.js",
   "bin": {

package/plugkit-wasm-wrapper.js

@@ -2212,6 +2212,32 @@ async function runSpoolWatcher(instance, spoolDir) {
           detected_at: Date.now(),
         });
         try { console.error(`[plugkit-wasm] VERB ABORT detected: prior watcher pid=${priorVerb.pid} died inside verb=${priorVerb.verb} task=${priorVerb.task}`); } catch (_) {}
+        // The aborted dispatch otherwise gets NO response file: the in-file was consumed,
+        // the prior watcher died before writing out/, and the agent waits forever on a
+        // Read that never lands (then must git-archaeology whether the verb's side effects
+        // happened). Write a definite failure response so the agent's Read returns
+        // immediately and it re-dispatches. Both out-name shapes are written because
+        // .verb-active.json does not record whether the dispatch was root or nested;
+        // the agent reads whichever its dispatch shape expects, the other is swept.
+        if (priorVerb.verb && priorVerb.task) {
+          try {
+            const abortBody = JSON.stringify({
+              ok: false,
+              error: `verb aborted: watcher pid=${priorVerb.pid} died mid-verb; side effects may be partial -- verify state, then re-dispatch`,
+              verb_aborted: true,
+              verb: priorVerb.verb,
+              task: priorVerb.task,
+            });
+            const abortOutDir = path.join(path.dirname(STATUS_PATH_FOR_VERB_ABORT), 'out');
+            fs.mkdirSync(abortOutDir, { recursive: true });
+            const nestedName = path.join(abortOutDir, `${priorVerb.verb}-${priorVerb.task}.json`);
+            if (!fs.existsSync(nestedName)) fs.writeFileSync(nestedName, abortBody);
+            if (priorVerb.verb !== priorVerb.task) {
+              const rootName = path.join(abortOutDir, `${priorVerb.task}.json`);
+              if (!fs.existsSync(rootName)) fs.writeFileSync(rootName, abortBody);
+            }
+          } catch (_) {}
+        }
       }
       try { fs.unlinkSync(VERB_ACTIVE_PATH); } catch (_) {}
     }
@@ -3628,7 +3654,24 @@ async function selfHealFromGithubReleases() {
         }
         const toolsDir = GM_TOOLS_ROOT;
         fs.mkdirSync(toolsDir, { recursive: true });
-        fs.writeFileSync(path.join(toolsDir, 'plugkit.wasm'), wasm);
+        // Replace the live wasm atomically. A direct writeFileSync truncates the target
+        // before streaming ~149MB, so a crash mid-write or a concurrent watcher load in
+        // that window sees a truncated or absent wasm ("self-heal: wasm not installed"
+        // crash-loop). Write to a pid-suffixed temp and rename over the target; rename
+        // on the same volume is atomic, with the Windows EEXIST/EPERM unlink+retry.
+        const wasmTarget = path.join(toolsDir, 'plugkit.wasm');
+        const wasmTmp = `${wasmTarget}.partial-${process.pid}`;
+        fs.writeFileSync(wasmTmp, wasm);
+        try { fs.renameSync(wasmTmp, wasmTarget); }
+        catch (renameErr) {
+          if (renameErr.code === 'EEXIST' || renameErr.code === 'EPERM') {
+            try { fs.unlinkSync(wasmTarget); } catch (_) {}
+            fs.renameSync(wasmTmp, wasmTarget);
+          } else {
+            try { fs.unlinkSync(wasmTmp); } catch (_) {}
+            throw renameErr;
+          }
+        }
         fs.writeFileSync(path.join(toolsDir, 'plugkit.version'), version);
         const wrapperSrc = __filename;
         const wrapperDst = path.join(toolsDir, 'plugkit-wasm-wrapper.js');

package/plugkit.version

@@ -1 +1 @@
-0.1.639
+0.1.640

package/supervisor.js

@@ -85,10 +85,39 @@ function acquireSingleInstance() {
         let other = NaN;
         try { other = parseInt(fs.readFileSync(SUPERVISOR_PID_PATH, 'utf-8').trim(), 10); } catch (_) {}
         if (Number.isFinite(other) && other !== process.pid && pidAlive(other)) {
-          logEvent('supervisor.refused-duplicate', { existing_pid: other, severity: 'warn' });
-          return false;
+          // An alive holder pid is not the same as a working holder: a wedged supervisor
+          // (event loop stuck, watcher dead, neither .supervisor.json nor .status.json
+          // advancing) blocks every newcomer forever under a pidAlive-only check, forcing
+          // manual process kills to recover the spool. Discriminate by progress, not
+          // liveness: holder is wedged only when its own status heartbeat AND the spool
+          // status are both stale past the takeover window, honoring a future busy_until
+          // exactly as checkWatcherHealth does.
+          const TAKEOVER_STALE_MS = 45_000;
+          const now = Date.now();
+          let supTs = 0;
+          try { supTs = (JSON.parse(fs.readFileSync(SUPERVISOR_PATH, 'utf-8')).ts) || 0; } catch (_) {}
+          const spool = readStatus();
+          const spoolBusy = spool && spool.busy_until && spool.busy_until > now;
+          const spoolTs = (spool && spool.ts) || 0;
+          const holderWedged = !spoolBusy
+            && (now - supTs) > TAKEOVER_STALE_MS
+            && (now - spoolTs) > TAKEOVER_STALE_MS;
+          if (!holderWedged) {
+            logEvent('supervisor.refused-duplicate', { existing_pid: other, severity: 'warn' });
+            return false;
+          }
+          logEvent('supervisor.takeover-wedged', {
+            existing_pid: other,
+            supervisor_status_age_ms: now - supTs,
+            spool_status_age_ms: now - spoolTs,
+            severity: 'critical',
+          });
+          try { process.kill(other, 'SIGTERM'); } catch (_) {}
+          if (process.platform === 'win32') {
+            try { spawnSync('taskkill', ['/F', '/T', '/PID', String(other)], { stdio: 'ignore', windowsHide: true, timeout: 3000 }); } catch (_) {}
+          }
         }
-        // Holder is dead/stale: remove and retry the exclusive create once.
+        // Holder is dead/stale/wedged: remove and retry the exclusive create once.
         try { fs.unlinkSync(SUPERVISOR_PID_PATH); } catch (_) {}
         continue;
       }