impel-cli 0.18.15-beta.4 → 0.18.15-beta.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.18.15-beta.4",
+  "version": "0.18.15-beta.5",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/apps.js

@@ -37,6 +37,17 @@ const APP_DEFINITIONS = {
     executableNames: ["ChatGPT", "Codex"],
   },
 };
+const BUNDLE_ARTIFACT_REMOVE_OPTIONS = Object.freeze({
+  recursive: true,
+  force: true,
+  maxRetries: 5,
+  retryDelay: 25,
+});
+const BUNDLE_LOCK_WAIT_MS = 120_000;
+const BUNDLE_LOCK_POLL_MS = 100;
+const BUNDLE_LOCK_SLEEP = new Int32Array(new SharedArrayBuffer(4));
+const MACOS_O_EXLOCK = 0x00000020;
+const portableBundleMutationLocks = new Set();
 
 // Vendor updates can change minified renderer contracts without notice. Each
 // CLI release therefore installs and accepts only the exact app builds tested
@@ -972,7 +983,6 @@ function installPinnedVendorApp(target, homeDir) {
       homeDir, ".config", RUNTIME_BRAND.cli.configNamespace, "vendor", target, pin.version, pin.bundleName,
     );
     fs.mkdirSync(path.dirname(destination), { recursive: true });
-    sweepStaleBundleArtifacts(path.dirname(destination), path.basename(destination));
     replaceDirectory(destination, extractedApp);
     return destination;
   } finally {
@@ -1529,6 +1539,12 @@ exec "$NODE" "$CLI" token${tenantArgs}
 }
 
 function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageName) {
+  return withBundleMutationLock(paths.claude.launcher, () => (
+    writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStorageName)
+  ));
+}
+
+function writeVendoredClaudeBundleLocked(paths, vendorPath, gatewayUrl, safeStorageName) {
   if (!vendorPath) throw new Error("Claude vendor app is unavailable");
   if (!isVendableVendorApp("claude", vendorPath)) {
     const bundleId = readBundleIdentifier(vendorPath);
@@ -1542,9 +1558,8 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
   if (!executableName) throw new Error(`Claude executable is missing from ${vendorPath}`);
 
   const bundle = paths.claude.launcher;
-  const staging = `${bundle}.tmp-${process.pid}`;
   sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
-  fs.rmSync(staging, { recursive: true, force: true });
+  const staging = uniqueBundleArtifactPath(bundle, "tmp");
   cloneAppBundle(vendorPath, staging);
   try {
     const plistPath = path.join(staging, "Contents", "Info.plist");
@@ -1626,9 +1641,9 @@ function writeVendoredClaudeBundle(paths, vendorPath, gatewayUrl, safeStorageNam
     }, null, 2) + "\n", 0o644);
 
     signVendoredApp(staging, vendorExecutable, "Claude", signingIdentity);
-    replaceDirectory(bundle, staging);
+    replaceDirectoryUnlocked(bundle, staging);
   } catch (error) {
-    fs.rmSync(staging, { recursive: true, force: true });
+    removeBundleArtifact(staging);
     throw error;
   }
 }
@@ -1642,6 +1657,12 @@ function claudeUsageCompatibilityEnabled(gatewayUrl) {
 }
 
 function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
+  return withBundleMutationLock(paths.chatgpt.launcher, () => (
+    writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir)
+  ));
+}
+
+function writeVendoredChatGPTBundleLocked(paths, vendorPath, gatewayUrl, homeDir) {
   if (!vendorPath) throw new Error("ChatGPT/Codex vendor app is unavailable");
   const definition = APP_DEFINITIONS.chatgpt;
   const executableName = definition.executableNames.find((name) => (
@@ -1650,11 +1671,10 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
   if (!executableName) throw new Error(`ChatGPT/Codex executable is missing from ${vendorPath}`);
 
   const bundle = paths.chatgpt.launcher;
-  const staging = `${bundle}.tmp-${process.pid}`;
+  sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
+  const staging = uniqueBundleArtifactPath(bundle, "tmp");
   const vendorBundleName = path.basename(vendorPath);
   const vendorBundle = path.join(staging, "Contents", "Resources", vendorBundleName);
-  sweepStaleBundleArtifacts(path.dirname(bundle), path.basename(bundle));
-  fs.rmSync(staging, { recursive: true, force: true });
   cloneAppBundle(vendorPath, vendorBundle);
   try {
     const asarPath = path.join(vendorBundle, "Contents", "Resources", "app.asar");
@@ -1730,9 +1750,9 @@ function writeVendoredChatGPTBundle(paths, vendorPath, gatewayUrl, homeDir) {
     }, null, 2) + "\n", 0o644);
 
     signVendoredApp(staging, vendorExecutable, "ChatGPT", signingIdentity);
-    replaceDirectory(bundle, staging);
+    replaceDirectoryUnlocked(bundle, staging);
   } catch (error) {
-    fs.rmSync(staging, { recursive: true, force: true });
+    removeBundleArtifact(staging);
     throw error;
   }
 }
@@ -2536,24 +2556,105 @@ export function sweepStaleBundleArtifacts(dir, baseName) {
     throw error;
   }
   const prefixes = [`${baseName}.tmp-`, `${baseName}.previous-`];
-  const removed = entries.filter((entry) => prefixes.some((prefix) => entry.startsWith(prefix)));
-  for (const entry of removed) {
-    fs.rmSync(path.join(dir, entry), { recursive: true, force: true });
+  const removed = [];
+  for (const entry of entries.filter((candidate) => prefixes.some((prefix) => candidate.startsWith(prefix)))) {
+    if (removeBundleArtifact(path.join(dir, entry))) removed.push(entry);
   }
   return removed;
 }
 
-function replaceDirectory(destination, staging) {
-  const backup = `${destination}.previous-${process.pid}`;
-  fs.rmSync(backup, { recursive: true, force: true });
-  if (fs.existsSync(destination)) fs.renameSync(destination, backup);
+function uniqueBundleArtifactPath(destination, kind) {
+  return `${destination}.${kind}-${process.pid}-${crypto.randomBytes(6).toString("hex")}`;
+}
+
+function removeBundleArtifact(candidate) {
+  try {
+    fs.rmSync(candidate, BUNDLE_ARTIFACT_REMOVE_OPTIONS);
+    return !fs.existsSync(candidate);
+  } catch {
+    return false;
+  }
+}
+
+export function withBundleMutationLock(destination, run) {
+  const lockPath = path.join(
+    path.dirname(destination),
+    `.${path.basename(destination)}.impel-install.lock`,
+  );
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+
+  if (process.platform !== "darwin") {
+    if (portableBundleMutationLocks.has(lockPath)) {
+      throw new Error(`another Impel app update is already replacing ${path.basename(destination)}`);
+    }
+    const descriptor = fs.openSync(lockPath, fs.constants.O_CREAT | fs.constants.O_RDWR, 0o600);
+    portableBundleMutationLocks.add(lockPath);
+    try {
+      return run();
+    } finally {
+      portableBundleMutationLocks.delete(lockPath);
+      fs.closeSync(descriptor);
+    }
+  }
+
+  const deadline = Date.now() + BUNDLE_LOCK_WAIT_MS;
+  let descriptor;
+  while (descriptor === undefined) {
+    try {
+      descriptor = fs.openSync(
+        lockPath,
+        fs.constants.O_CREAT | fs.constants.O_RDWR | fs.constants.O_NONBLOCK | MACOS_O_EXLOCK,
+        0o600,
+      );
+    } catch (error) {
+      if (!["EAGAIN", "EWOULDBLOCK"].includes(error?.code)) throw error;
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for another Impel app update to replace ${path.basename(destination)}`);
+      }
+      Atomics.wait(BUNDLE_LOCK_SLEEP, 0, 0, BUNDLE_LOCK_POLL_MS);
+    }
+  }
+  try {
+    return run();
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function replaceDirectoryUnlocked(destination, staging, {
+  removeArtifact = removeBundleArtifact,
+} = {}) {
+  const backup = fs.existsSync(destination)
+    ? uniqueBundleArtifactPath(destination, "previous")
+    : null;
+  if (backup) fs.renameSync(destination, backup);
   try {
     fs.renameSync(staging, destination);
-    fs.rmSync(backup, { recursive: true, force: true });
   } catch (error) {
-    if (!fs.existsSync(destination) && fs.existsSync(backup)) fs.renameSync(backup, destination);
+    if (backup && !fs.existsSync(destination) && fs.existsSync(backup)) {
+      fs.renameSync(backup, destination);
+    }
     throw error;
   }
+
+  // The new bundle is committed once staging has been renamed into place.
+  // Finder, LaunchServices, or a just-closed helper can briefly keep changing
+  // the old tree and make recursive removal end with ENOTEMPTY. Do not turn
+  // that post-commit housekeeping race into a failed tenant update: the next
+  // sweep will retry any backup that remains.
+  if (backup) {
+    try {
+      removeArtifact(backup);
+    } catch {
+      // Cleanup is best-effort after the committed rename.
+    }
+  }
+}
+
+export function replaceDirectory(destination, staging, options = {}) {
+  return withBundleMutationLock(destination, () => (
+    replaceDirectoryUnlocked(destination, staging, options)
+  ));
 }
 
 function isGatewayModel(model) {