goosetools-worker 0.2.1 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "goosetools-worker",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "The Goose Tools carousel worker — your computer drafts and renders carousel slides for goosetools.com using your own Claude account.",
   "repository": {
     "type": "git",

package/worker/index.js

@@ -11,11 +11,19 @@ import { join, dirname, resolve, extname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import yaml from "js-yaml";
-import { upload } from "@vercel/blob/client";
+import { upload } from "./upload.js";
 import { skillSection } from "./skill.js";
 import { extFromUrl } from "./style.js";
 import { FONT_SPECS, sanitizeFonts } from "../src/fonts.js";
 import { assertFfmpeg, isVideoPath, posterFrame } from "../src/video.js";
+import { acquireWorkerLock } from "./lock.js";
+
+// One worker of each kind per machine — a second one would split the queue
+// with this one. Stands down with an explanation if another already holds it.
+acquireWorkerLock("worker", {
+  label: "The Carousel Maker worker",
+  stopHint: "launchctl bootout gui/$(id -u)/com.goosetools.worker   (or close its terminal)",
+});
 
 const execFileAsync = promisify(execFile);
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
@@ -683,11 +691,10 @@ Do not rewrite any slide's text and do not switch templates.`;
   await api("complete", { jobId: job.id, ok: true, slidesYml, resultUrls });
   console.log(`✓ job ${job.id}: ${resultUrls.length} slides uploaded`);
 
-  // The slides are safely in Blob storage now, so the local scratch dir (photos
-  // + rendered PNGs, tens of MB per job) has done its job. Without this it
-  // accumulates forever under carousels/. Only reached on success — a failed
-  // job keeps its dir for debugging (the main loop's catch handles those).
-  rmSync(dir, { recursive: true, force: true });
+  // The local copy stays. carousels/web-<id>/output/ is the creator's own
+  // archive of every deck this machine rendered — it is what let the renders
+  // the 2026 retention purge deleted be put back. Disk is theirs to spend;
+  // nothing a creator made is thrown away by a tool.
 }
 
 // ── Main loop ────────────────────────────────────────────────────────────────

package/worker/lock.js

@@ -0,0 +1,103 @@
+// One worker of each kind per machine.
+//
+// Nothing stops you starting a second worker: the daemon runs in the
+// background, and `run` in a terminal is the normal way to watch one work or
+// to try a change from a checkout. Both then poll the same queue with the same
+// token.
+//
+// The server is safe — claiming a job is a single compare-and-set, so two
+// workers never get the same one. The damage is quieter than that. They SPLIT
+// the queue, so jobs land on whichever copy happened to pick them up: half
+// from the code you're editing, half from the installed release, with a
+// different state directory behind each. And the polling doubles, which is
+// what the idle interval exists to keep down in the first place.
+//
+// So: whoever gets here first holds the lock, and the second one stands down
+// with an explanation instead of quietly competing.
+
+import { execFileSync } from "node:child_process";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, writeSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const LOCK_DIR = join(homedir(), ".goosetools", "locks");
+
+/**
+ * Take the lock for `name` ("worker", "caption", "brand", "overlay"), or print
+ * who has it and exit. Returns nothing — it either succeeds or ends the
+ * process.
+ *
+ * `stopHint` is the command that stops the OTHER copy, and it's the whole
+ * point of the message: "already running" without it just moves the puzzle.
+ */
+export function acquireWorkerLock(name, { label, stopHint }) {
+  mkdirSync(LOCK_DIR, { recursive: true });
+  const file = join(LOCK_DIR, `${name}.pid`);
+
+  const holder = readHolder(file);
+  if (holder && isAlive(holder.pid)) {
+    console.log(
+      `\n${label} is already running on this computer (pid ${holder.pid}${
+        holder.since ? `, since ${holder.since}` : ""
+      }).\n\n` +
+        "Two of them would split the queue between them — some jobs done by\n" +
+        "one copy, some by the other. Stopping here instead.\n\n" +
+        `  Stop the other one:  ${stopHint}\n`,
+    );
+    process.exit(0);
+  }
+
+  // Either no lock, or one left behind by a worker that was killed. Both are
+  // ours to take: an O_EXCL create loses to a worker that beat us here by
+  // milliseconds, which is the one race worth caring about.
+  if (holder) rmSync(file, { force: true });
+  let fd;
+  try {
+    fd = openSync(file, "wx");
+  } catch {
+    console.log(`\n${label} started somewhere else a moment ago. Stopping here.\n`);
+    process.exit(0);
+  }
+  writeSync(fd, `${process.pid}\n${new Date().toISOString()}\n`);
+  closeSync(fd);
+
+  const release = () => rmSync(file, { force: true });
+  process.on("exit", release);
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(sig, () => {
+      release();
+      process.exit(0);
+    });
+  }
+}
+
+function readHolder(file) {
+  if (!existsSync(file)) return null;
+  try {
+    const [pid, since] = readFileSync(file, "utf8").split("\n");
+    const n = Number.parseInt(pid, 10);
+    return Number.isFinite(n) ? { pid: n, since: since?.trim() || null } : null;
+  } catch {
+    return null;
+  }
+}
+
+// A pid file outlives a SIGKILLed worker, and pids get reused — so "is that
+// pid alive" isn't enough on its own. Checking that it's a node process is
+// cheap and rules out the reuse case that would otherwise lock out the daemon
+// until someone deleted the file by hand.
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+  } catch {
+    return false;
+  }
+  try {
+    return /node/.test(execFileSync("ps", ["-p", String(pid), "-o", "command="], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+    }));
+  } catch {
+    return false;
+  }
+}

package/worker/service.js

@@ -217,11 +217,20 @@ export function install({ url, token, root }) {
   }
 }
 
+// Removes THIS worker, not the whole ~/.goosetools directory. It used to take
+// the directory, which was harmless while everything in there was either this
+// worker's or re-derivable from the server — and stopped being harmless when
+// the Overlay Factory started keeping its puzzle library, learned looks and
+// used-card record in ~/.goosetools/overlay. Nothing else has a copy of those,
+// and `npx goosetools uninstall` runs this. The shared token file stays: the
+// other workers are still using it.
 export function uninstall() {
   if (process.platform === "darwin") macUninstall();
   else if (process.platform === "win32") winUninstall();
-  rmSync(GOOSE_DIR, { recursive: true, force: true });
-  console.log("✓ Background worker removed. This computer is disconnected from Goose Tools.");
+  rmSync(APP_PREFIX, { recursive: true, force: true });
+  rmSync(join(GOOSE_DIR, "worker.log"), { force: true });
+  rmSync(join(GOOSE_DIR, "worker.err.log"), { force: true });
+  console.log("✓ Carousel worker removed. This computer no longer makes carousels.");
 }
 
 // ── update ───────────────────────────────────────────────────────────────────

package/worker/style.js

@@ -15,7 +15,7 @@ import {
 } from "node:fs";
 import { extname, join } from "node:path";
 import yaml from "js-yaml";
-import { upload } from "@vercel/blob/client";
+import { upload } from "./upload.js";
 import { skillSection } from "./skill.js";
 
 const RESERVED_SLUGS = new Set(["graph-paper", "polka-dot"]);

package/worker/upload.js

@@ -0,0 +1,27 @@
+// Worker-side upload, same signature as `upload` from "@vercel/blob/client":
+//
+//   const blob = await upload(pathname, bytes, {
+//     handleUploadUrl, clientPayload, contentType,
+//   });
+//   blob.url
+//
+// Goose Tools moved file storage to Cloudflare R2. The upload route still
+// decides who may write where (worker token in clientPayload), but instead
+// of a Blob token it hands back a signed PUT URL; the bytes go straight to
+// the bucket.
+
+export async function upload(pathname, bytes, opts) {
+  const contentType = opts.contentType ?? "application/octet-stream";
+  const res = await fetch(opts.handleUploadUrl, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ pathname, contentType, size: bytes.length ?? bytes.byteLength ?? 0, clientPayload: opts.clientPayload ?? null }),
+  });
+  const grant = await res.json().catch(() => ({}));
+  if (!res.ok || !grant.uploadUrl || !grant.url) {
+    throw new Error(grant.error ?? `upload not allowed (${res.status})`);
+  }
+  const put = await fetch(grant.uploadUrl, { method: "PUT", headers: { "content-type": contentType }, body: bytes });
+  if (!put.ok) throw new Error(`upload PUT failed (${put.status})`);
+  return { url: grant.url, pathname: grant.pathname ?? pathname, contentType };
+}