herdr-remote 0.2.30 → 0.2.32

package/dist/connector/host-connector.js

@@ -191,6 +191,7 @@ export class HostConnector {
                     ? { shellProfile: 'git-bash' }
                     : {}),
                 arch: process.arch,
+                version: this.updates.runningVersion,
                 terminalPalette: this.terminalPalette || null,
                 terminalFont: this.font.publicFont(),
                 capabilities: [

package/dist/connector/lock.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { ensureDir } from 'herdr-remote-relay/state';
-import { pidAlive } from '../lib/process.js';
+import { processStart, stillRunning } from '../lib/process.js';
 function readOwner(lockPath) {
     try {
         return JSON.parse(fs.readFileSync(lockPath, 'utf8'));
@@ -19,21 +19,28 @@ function lockError(message, code) {
 }
 /**
  * Take the lock, or throw `HOST_ALREADY_RUNNING` when a live process holds it.
- * A lock left by a dead process is removed and taken over.
+ * A lock left by a dead process is removed and taken over — including one whose
+ * pid a reboot handed to an unrelated process, which would otherwise keep every
+ * later connector standing down.
  */
 export function acquireHostLock(lockPath, hostId) {
     ensureDir(path.dirname(lockPath));
     for (let attempt = 0; attempt < 2; attempt += 1) {
         try {
             const fd = fs.openSync(lockPath, 'wx', 0o600);
-            fs.writeFileSync(fd, `${JSON.stringify({ pid: process.pid, hostId, startedAt: new Date().toISOString() })}\n`);
+            fs.writeFileSync(fd, `${JSON.stringify({
+                pid: process.pid,
+                processStart: processStart(process.pid),
+                hostId,
+                startedAt: new Date().toISOString(),
+            })}\n`);
             return fd;
         }
         catch (error) {
             if (error.code !== 'EEXIST')
                 throw error;
             const owner = readOwner(lockPath);
-            if (owner && pidAlive(owner.pid)) {
+            if (owner && stillRunning([owner]).length > 0) {
                 throw lockError(`another host connector is already running (pid ${owner.pid})`, 'HOST_ALREADY_RUNNING');
             }
             try {

package/dist/connector/update-report.js

@@ -10,6 +10,7 @@ const UPDATE_RECHECK_MS = 60_000;
 export class UpdateReport {
     checkUpdate;
     readInstalledVersion;
+    /** The release this process runs, fixed at start. */
     runningVersion;
     send;
     checkedAt = 0;

package/dist/keepalive/detached.js

@@ -4,19 +4,23 @@ import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { ensureDir, readJson, writeJsonAtomic } from 'herdr-remote-relay/state';
-import { pidAlive } from '../lib/process.js';
+import { processStart, stillRunning } from '../lib/process.js';
 import { logPath, stateDir } from '../paths.js';
 import { cliEntryPoint, serviceEnvironment } from './environment.js';
 function fallbackPidPath() {
     return path.join(stateDir(), 'supervisor.pid');
 }
-function readPid() {
+/**
+ * The supervisor the pid file names, if it is still that process. The file
+ * outlives a reboot; its pid alone would then name something unrelated.
+ */
+function runningPid() {
     const record = readJson(fallbackPidPath(), {});
-    return Number.isInteger(record.pid) ? record.pid : null;
+    return stillRunning([record]).length > 0 ? record.pid : null;
 }
 function start() {
-    const running = readPid();
-    if (pidAlive(running))
+    const running = runningPid();
+    if (running !== null)
         return { ok: true, alreadyRunning: true, pid: running };
     ensureDir(stateDir());
     const logFd = fs.openSync(logPath('supervisor'), 'a');
@@ -30,7 +34,11 @@ function start() {
             stdio: ['ignore', logFd, logFd],
         });
         child.unref();
-        writeJsonAtomic(fallbackPidPath(), { pid: child.pid, startedAt: new Date().toISOString() });
+        writeJsonAtomic(fallbackPidPath(), {
+            pid: child.pid,
+            processStart: child.pid ? processStart(child.pid) : null,
+            startedAt: new Date().toISOString(),
+        });
         return { ok: true, pid: child.pid, note: 'this fallback does not survive a reboot' };
     }
     finally {
@@ -38,8 +46,8 @@ function start() {
     }
 }
 function stopAndForget() {
-    const pid = readPid();
-    if (pid !== null && pidAlive(pid)) {
+    const pid = runningPid();
+    if (pid !== null) {
         try {
             process.kill(pid, 'SIGTERM');
         }
@@ -58,8 +66,8 @@ export function detachedLogsHint(platform = process.platform, logFile = logPath(
 export const detached = {
     name: 'supervisor',
     status() {
-        const pid = readPid();
-        const alive = pidAlive(pid);
+        const pid = runningPid();
+        const alive = pid !== null;
         return {
             manager: 'supervisor',
             installed: alive,

package/dist/lib/process.js

@@ -1,3 +1,10 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+const PROCESS_QUERY_TIMEOUT_MS = 10_000;
+// Records written before start tokens existed carry only a pid. Until none are
+// left, such a record is trusted only while its process runs one of our entry
+// points: the relay, the host connector or `herdr-remote run`.
+const OUR_ENTRY_POINT = /herdr-remote-relay\.js|connector[\\/]main\.js|herdr-remote\.js"?\s+run\b/;
 /** Whether `pid` names a running process, including one owned by another user. */
 export function pidAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0)
@@ -10,3 +17,116 @@ export function pidAlive(pid) {
         return error.code === 'EPERM';
     }
 }
+function runCommand(command, args) {
+    const result = spawnSync(command, args, {
+        encoding: 'utf8',
+        // The same instant must print the same text whenever and wherever it is asked.
+        env: { ...process.env, LC_ALL: 'C', TZ: 'UTC' },
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: PROCESS_QUERY_TIMEOUT_MS,
+        windowsHide: true,
+    });
+    // The exit code is not trusted: ps and PowerShell fail when any one pid is
+    // gone, yet still print the rest. A command that could not run prints nothing.
+    return typeof result.stdout === 'string' ? result.stdout : '';
+}
+/** `<pid> <value>` lines, as ps and our PowerShell queries print them. */
+function parsePidLines(output) {
+    const details = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        const match = /^\s*(\d+)\s+(\S.*?)\s*$/.exec(line);
+        if (match)
+            details.set(Number(match[1]), match[2]);
+    }
+    return details;
+}
+function linuxDetails(pids, detail, run) {
+    let bootId = '';
+    if (detail === 'start') {
+        try {
+            // Start times count clock ticks since boot, so they only identify a
+            // process together with the boot they were counted in.
+            bootId = fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+        }
+        catch {
+            // A /proc without boot ids (some sandboxes) still has ps.
+            return psDetails(pids, detail, run);
+        }
+    }
+    const details = new Map();
+    for (const pid of pids) {
+        let text;
+        try {
+            text = fs.readFileSync(`/proc/${pid}/${detail === 'start' ? 'stat' : 'cmdline'}`, 'utf8');
+        }
+        catch {
+            // Not running, or hidden from us: either way it is not a process we can vouch for.
+            continue;
+        }
+        if (detail === 'command') {
+            details.set(pid, text.replaceAll('\0', ' ').trim());
+            continue;
+        }
+        // The command name before this may itself contain spaces and parentheses;
+        // after it, field 3 (state) comes first and field 22 is the start time.
+        const fields = text.slice(text.lastIndexOf(')') + 2).split(' ');
+        if (fields[19])
+            details.set(pid, `${bootId}:${fields[19]}`);
+    }
+    return details;
+}
+function psDetails(pids, detail, run) {
+    const column = detail === 'start' ? 'lstart' : 'command';
+    return parsePidLines(run('ps', ['-o', `pid=,${column}=`, '-p', pids.join(',')]));
+}
+function windowsDetails(pids, detail, run) {
+    const script = detail === 'start'
+        ? // StartTime is empty for processes we may not inspect; those are not ours anyway.
+            `Get-Process -Id ${pids.join(',')} -ErrorAction SilentlyContinue | Where-Object StartTime | ForEach-Object { "$($_.Id) $($_.StartTime.ToFileTimeUtc())" }`
+        : `Get-CimInstance Win32_Process -Filter "${pids.map((pid) => `ProcessId=${pid}`).join(' OR ')}" | ForEach-Object { "$($_.ProcessId) $($_.CommandLine)" }`;
+    return parsePidLines(run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]));
+}
+function processDetails(pids, detail, platform, run) {
+    // Dead pids are the common case after a clean stop, and ruling them out here
+    // saves spawning ps or PowerShell just to hear so.
+    const candidates = [...new Set(pids)].filter(pidAlive);
+    if (candidates.length === 0)
+        return new Map();
+    if (platform === 'linux')
+        return linuxDetails(candidates, detail, run);
+    if (platform === 'win32')
+        return windowsDetails(candidates, detail, run);
+    return psDetails(candidates, detail, run);
+}
+/**
+ * When each running process in `pids` started, as opaque tokens; pids that are
+ * not running, or that the system will not describe, are left out.
+ *
+ * A pid alone does not identify a process: the number goes to another process
+ * once this one exits, and after a reboot the same boot-time services land on
+ * the same numbers again. On Linux the number of a thread in another process
+ * even passes `pidAlive`. Recorded next to its pid, this token only ever
+ * matches the process it was read from.
+ */
+export function processStarts(pids, platform = process.platform, run = runCommand) {
+    return processDetails(pids, 'start', platform, run);
+}
+/** The command line of each running process in `pids`, which the system is willing to show. */
+export function processCommands(pids, platform = process.platform, run = runCommand) {
+    return processDetails(pids, 'command', platform, run);
+}
+export function processStart(pid, platform = process.platform) {
+    return processStarts([pid], platform).get(pid) ?? null;
+}
+/** The records that still name the very process they were taken from. */
+export function stillRunning(records) {
+    const pidsOf = (list) => list.map((record) => record.pid).filter((pid) => Number.isInteger(pid));
+    const legacy = records.filter((record) => typeof record.processStart !== 'string');
+    const starts = processStarts(pidsOf(records.filter((record) => !legacy.includes(record))));
+    const commands = legacy.length > 0 ? processCommands(pidsOf(legacy)) : new Map();
+    return records.filter((record) => legacy.includes(record)
+        ? // We only ever write start tokens, so a legacy record naming our own pid
+            // was left by an earlier process that happened to have it.
+            record.pid !== process.pid && OUR_ENTRY_POINT.test(commands.get(record.pid) ?? '')
+        : starts.get(record.pid) === record.processStart);
+}

package/dist/lifecycle.js

@@ -6,8 +6,7 @@
 // here so the managed and unmanaged paths behave the same from the outside.
 import { loadConfig } from './config.js';
 import * as keepalive from './keepalive/index.js';
-import { pidAlive } from './lib/process.js';
-import { readRuntime } from './runtime.js';
+import { managedPids, readRuntime } from './runtime.js';
 import { restartServices, startServices, statusServices, stopServices } from './service.js';
 function managerInUse(config) {
     const status = keepalive.status(config);
@@ -51,7 +50,10 @@ function restartAll(config = loadConfig()) {
 }
 /** Whether the host connector is up, under a keep-alive manager or detached. */
 function servicesRunning(config = loadConfig()) {
-    return Boolean(managerInUse(config)?.active || pidAlive(readRuntime().hostPid));
+    if (managerInUse(config)?.active)
+        return true;
+    const state = readRuntime();
+    return managedPids(state).some(({ pid }) => pid === state.hostPid);
 }
 /** Stop Windows keep-alive processes while npm replaces their package files. */
 async function whileServicesStopped(config, task, { platform = process.platform, isRunning = () => servicesRunning(config), stop = stopAll, start = startAll, } = {}) {

package/dist/runtime.js

@@ -2,7 +2,7 @@
 // for it, and facts other modules remember there (terminal palette and font).
 // Every read and write of that file goes through here.
 import { ensureDir, randomToken, readJson, writeJsonAtomic } from 'herdr-remote-relay/state';
-import { pidAlive } from './lib/process.js';
+import { processStart, stillRunning } from './lib/process.js';
 import { configDir, runtimeStatePath, stateDir } from './paths.js';
 const RUNTIME_VERSION = 2;
 export function readRuntime() {
@@ -73,34 +73,35 @@ export function regenerateHostIdentity() {
  * (minus dead entries) precisely so no writer can lose another writer's pids.
  */
 export function recordManagedPid(state, name, pid) {
-    const existing = Array.isArray(state.managedPids) ? state.managedPids : [];
-    const kept = existing.filter((entry) => entry && entry.pid !== pid && pidAlive(entry.pid));
-    // Only track something that is actually running: a pid that already exited
-    // would sit in the ledger until its number is recycled by an unrelated
-    // process, which we would then happily signal.
-    if (Number.isInteger(pid) && pidAlive(pid)) {
-        kept.push({ name, pid: pid, startedAt: new Date().toISOString() });
+    const existing = Array.isArray(state.managedPids) ? state.managedPids.filter(Boolean) : [];
+    const kept = stillRunning(existing.filter((entry) => entry.pid !== pid));
+    // Only track something that is actually running, and together with its start
+    // token: the ledger outlives a reboot, and a bare pid it kept would then name
+    // whichever unrelated process got that number next — which we would signal.
+    const start = Number.isInteger(pid) ? processStart(pid) : null;
+    if (start) {
+        kept.push({
+            name,
+            pid: pid,
+            processStart: start,
+            startedAt: new Date().toISOString(),
+        });
     }
     state.managedPids = kept;
     return state;
 }
-/** Every process we believe we started, alive right now. */
+/**
+ * Every process we started that is still running, and still that process.
+ *
+ * Only the ledger counts. `supervisorPid`, `relayPid` and `hostPid` are bare
+ * numbers that survive a reboot, and trusting them would signal whichever
+ * unrelated process inherited one.
+ */
 export function managedPids(state = readRuntime()) {
-    const pids = new Map();
-    // Supervisor first and never overwritten: `stopServices` relies on the order
-    // to signal it before its children, and one pid can appear under several
-    // fields.
-    for (const [name, pid] of [
-        ['supervisor', state.supervisorPid],
-        ['host', state.hostPid],
-        ['relay', state.relayPid],
-    ]) {
-        if (pidAlive(pid) && !pids.has(pid))
-            pids.set(pid, name);
-    }
+    const unique = new Map();
     for (const entry of state.managedPids || []) {
-        if (entry && pidAlive(entry.pid) && !pids.has(entry.pid))
-            pids.set(entry.pid, entry.name);
+        if (entry && !unique.has(entry.pid))
+            unique.set(entry.pid, entry);
     }
-    return [...pids].map(([pid, name]) => ({ pid, name }));
+    return stillRunning([...unique.values()]);
 }

package/dist/service.js

@@ -7,7 +7,6 @@ import path from 'node:path';
 import { ensureDir } from 'herdr-remote-relay/state';
 import { loadConfig } from './config.js';
 import { findHerdrCommand, herdrVersion, MIN_HERDR_VERSION, resolveHerdrCommand, } from './herdr-command.js';
-import { pidAlive } from './lib/process.js';
 import { preferredLanAddress } from './net-interfaces.js';
 import { logPath, PACKAGE_ROOT, stateDir } from './paths.js';
 import { healthUrl, hostHeaders, requestJson, waitForHost, waitForRelay } from './relay-client.js';
@@ -119,16 +118,18 @@ export function startServices() {
     const state = ensureRuntime();
     const next = { ...state };
     const specs = serviceSpecs(config, state);
+    const running = managedPids(next);
+    const isRunning = (pid) => running.some((entry) => entry.pid === pid);
     for (const spec of specs) {
         const field = PID_FIELDS[spec.name];
-        if (pidAlive(next[field]))
+        if (isRunning(next[field]))
             continue;
         next[field] = spawnDetached(spec) ?? null;
         recordManagedPid(next, spec.name, next[field]);
     }
     // A relay that is no longer part of the plan (switched to remote mode) must
     // not be left running on the old port.
-    if (!specs.some((spec) => spec.name === 'relay') && pidAlive(next.relayPid)) {
+    if (!specs.some((spec) => spec.name === 'relay') && isRunning(next.relayPid)) {
         try {
             process.kill(next.relayPid, 'SIGTERM');
         }
@@ -140,20 +141,21 @@ export function startServices() {
     next.startedAt = next.startedAt || new Date().toISOString();
     next.mode = config.relay.mode;
     writeRuntime(next);
+    const live = managedPids(next);
     return {
         ok: true,
         mode: config.relay.mode,
         relay: {
             local: runsLocalRelay(config),
             pid: next.relayPid || null,
-            alive: pidAlive(next.relayPid),
+            alive: live.some(({ pid }) => pid === next.relayPid),
             bind: runsLocalRelay(config) ? bindAddress(config) : null,
             port: config.relay.port,
             remoteUrl: config.relay.remoteUrl || null,
         },
         host: {
             pid: next.hostPid || null,
-            alive: pidAlive(next.hostPid),
+            alive: live.some(({ pid }) => pid === next.hostPid),
             socketPath: resolveSocketPath(config.herdr.socketPath),
         },
         publicUrl: resolvePublicUrl(config, preferredLanAddress()),
@@ -190,6 +192,7 @@ export function restartServices() {
 export async function statusServices() {
     const config = loadConfig();
     const state = readRuntime();
+    const live = managedPids(state);
     const lanAddress = preferredLanAddress();
     let health;
     try {
@@ -213,7 +216,7 @@ export async function statusServices() {
         relay: {
             local: runsLocalRelay(config),
             pid: state.relayPid || null,
-            alive: runsLocalRelay(config) ? pidAlive(state.relayPid) : null,
+            alive: runsLocalRelay(config) ? live.some(({ pid }) => pid === state.relayPid) : null,
             bind: runsLocalRelay(config) ? bindAddress(config) : null,
             port: config.relay.port,
             remoteUrl: config.relay.remoteUrl || null,
@@ -221,7 +224,7 @@ export async function statusServices() {
         },
         host: {
             pid: state.hostPid || null,
-            alive: pidAlive(state.hostPid),
+            alive: live.some(({ pid }) => pid === state.hostPid),
             hostId: state.hostId || null,
             socketPath,
             socketExists: Boolean(socketPath) && fs.existsSync(socketPath),

package/dist/supervisor.js

@@ -6,7 +6,7 @@ import { ensureDir } from 'herdr-remote-relay/state';
 import { ensureRuntime, managedPids, recordManagedPid, updateRuntime, } from './runtime.js';
 import { baseEnvironment, serviceSpecs } from './service.js';
 import { EXIT_REPLACED, EXIT_AUTH_FAILED } from './exit-codes.js';
-import { pidAlive } from './lib/process.js';
+import { pidAlive, stillRunning } from './lib/process.js';
 const MIN_BACKOFF_MS = 500;
 const MAX_BACKOFF_MS = 30_000;
 // A child that stayed up this long is considered healthy, so the next crash
@@ -50,6 +50,10 @@ class Supervisor {
      * spawned died with EADDRINUSE and retried forever, while the orphaned host
      * connector and ours both claimed the same host id on the relay and kicked
      * each other off — which is what browsers saw as an endless reconnect.
+     *
+     * Only ledger entries whose start token still matches are touched: the
+     * ledger survives a reboot, and its pids then belong to whatever the new
+     * boot started.
      */
     async reclaimStrays({ timeoutMs = 5000 } = {}) {
         const strays = managedPids().filter((entry) => entry.pid !== process.pid);
@@ -79,9 +83,8 @@ class Supervisor {
                 setTimeout(resolve, 100);
             });
         }
-        for (const { pid, name } of strays) {
-            if (!pidAlive(pid))
-                continue;
+        // Checked again before the harder signal, in case the number moved on meanwhile.
+        for (const { pid, name } of stillRunning(strays)) {
             this.emit({
                 type: 'reclaim',
                 name,
@@ -284,7 +287,7 @@ class Supervisor {
                 current.relayPid = null;
                 current.hostPid = null;
                 current.startedAt = null;
-                current.managedPids = (current.managedPids || []).filter((entry) => entry && pidAlive(entry.pid));
+                current.managedPids = stillRunning((current.managedPids || []).filter(Boolean));
             });
         }
         catch {

package/herdr-plugin.toml

@@ -1,6 +1,6 @@
 id = "herdr.remote.web"
 name = "Herdr Remote Web"
-version = "0.2.30"
+version = "0.2.32"
 min_herdr_version = "0.9.1"
 description = "Browser access to Herdr workspaces via local or self-hosted relay"
 platforms = ["linux", "macos", "windows"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herdr-remote",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "description": "Browser access to Herdr workspaces: plugin, host connector, and configuration TUI",
   "license": "MIT",
   "type": "module",