kandev 0.45.0 → 0.49.0

package/dist/dev.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runDev = runDev;
 exports.resolveDevBackendEnv = resolveDevBackendEnv;
 const node_child_process_1 = require("node:child_process");
+const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const constants_1 = require("./constants");
 const health_1 = require("./health");
@@ -28,7 +29,12 @@ async function runDev({ repoRoot, backendPort, webPort }) {
     });
     const supervisor = (0, process_1.createProcessSupervisor)();
     supervisor.attachSignalHandlers();
-    const backendProc = (0, node_child_process_1.spawn)("make", ["-C", node_path_1.default.join("apps", "backend"), "dev"], {
+    const { cmd: backendCmd, args: backendArgs } = withWinjobWrap(repoRoot, "make", [
+        "-C",
+        node_path_1.default.join("apps", "backend"),
+        "dev",
+    ]);
+    const backendProc = (0, node_child_process_1.spawn)(backendCmd, backendArgs, {
         cwd: repoRoot,
         env: backendEnv,
         stdio: "inherit",
@@ -97,3 +103,29 @@ function resolveDevBackendEnv(repoRoot) {
         },
     };
 }
+// withWinjobWrap on Windows prepends apps/backend/bin/winjob.exe to a spawn
+// command so the child runs inside a Job Object configured with
+// JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE. That makes "kill the whole backend
+// subtree" a kernel-level guarantee tied to winjob's process exit, instead of
+// relying on the bash → make → pnpm → node → make → sh → kandev signal chain
+// (which drops Ctrl-C at multiple links because MSYS bash, native Win32
+// processes, and Node disagree on signal propagation semantics).
+//
+// On Unix this is a passthrough — POSIX process groups already give us
+// reliable cascading termination.
+//
+// If the winjob binary isn't built yet (the user ran `make dev` before
+// `make -C apps/backend build-winjob`), we fall back to a direct spawn and
+// emit a one-line note. The supervisor's tree-kill still handles the happy
+// path; users only notice the gap if Ctrl-C drops mid-chain.
+function withWinjobWrap(repoRoot, cmd, args) {
+    if (process.platform !== "win32")
+        return { cmd, args };
+    const winjob = node_path_1.default.join(repoRoot, "apps", "backend", "bin", "winjob.exe");
+    if (!node_fs_1.default.existsSync(winjob)) {
+        console.warn(`[kandev] winjob.exe not built — Ctrl-C may leak processes on Windows. ` +
+            `Run \`make -C apps/backend build-winjob\` once to enable.`);
+        return { cmd, args };
+    }
+    return { cmd: winjob, args: [cmd, ...args] };
+}

package/dist/ports.js

@@ -38,18 +38,52 @@ function isPortInUse(port, host) {
         });
     });
 }
+/**
+ * Tries to bind a port on the given host. Returns true if the bind succeeds
+ * (port is free). Closes immediately on success.
+ *
+ * This catches Windows "phantom" port reservations: Hyper-V/WSL silently
+ * reserve random port ranges at boot that don't appear in netstat or via a
+ * connect probe (nothing is listening, so connect-check thinks the port is
+ * free) — but bind fails with "Only one usage of each socket address". A
+ * connect-only check causes kandev's backend to choose a reserved port and
+ * then die when it tries to actually listen on it.
+ */
+function canBindPort(port, host) {
+    return new Promise((resolve) => {
+        const server = node_net_1.default.createServer();
+        server.once("error", () => resolve(false));
+        server.listen(port, host, () => {
+            server.close(() => resolve(true));
+        });
+    });
+}
 /**
  * Checks if a port is available by probing both IPv4 and IPv6 loopback.
  *
- * Uses a connect-based check: if we can connect to the port on either
- * 127.0.0.1 or ::1, something is already listening and the port is taken.
+ * Uses BOTH a connect check and a bind check:
+ *   - connect: detects ports where a listener is bound with SO_REUSEADDR
+ *     (Node's default on macOS — bind-only check would falsely succeed)
+ *   - bind:    detects Windows phantom reservations (Hyper-V/WSL) and
+ *     ports in TIME_WAIT that connect-only check misses
+ *
+ * The port is available IFF nobody answers a connect AND a fresh bind
+ * succeeds — covers macOS, Linux, and Windows.
  */
 async function isPortAvailable(port) {
+    // Run connect probes first, then the bind probe — they cannot share the
+    // port concurrently. On loopback, server.listen() completes in the kernel
+    // before a connect SYN to the same address is processed, so a concurrent
+    // canBindPort+isPortInUse pair can answer each other and report a free
+    // port as occupied. Sequencing keeps the bind probe's temporary listener
+    // out of the connect probes' view.
     const [v4InUse, v6InUse] = await Promise.all([
         isPortInUse(port, "127.0.0.1"),
         isPortInUse(port, "::1"),
     ]);
-    return !v4InUse && !v6InUse;
+    if (v4InUse || v6InUse)
+        return false;
+    return canBindPort(port, "127.0.0.1");
 }
 async function reserveSpecificPort(port, host = "127.0.0.1") {
     return new Promise((resolve) => {

package/dist/web.js

@@ -4,6 +4,24 @@ exports.openBrowser = openBrowser;
 exports.launchWebApp = launchWebApp;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+// Node CLIs that install as .cmd shims on Windows. Anything in this set goes
+// through cmd.exe /c on win32 so we can spawn the shim safely:
+//   - Node's spawn doesn't apply PATHEXT, so spawn("pnpm", …) hits ENOENT.
+//   - spawn("pnpm.cmd", …) directly returns EINVAL on Node 21+ (the
+//     CVE-2024-27980 fix forbids direct .bat/.cmd spawning).
+//   - spawn(…, {shell:true}) works but trips DEP0190 (the args-aren't-escaped
+//     security warning) and forks an extra cmd.exe per spawn.
+// Going through cmd.exe explicitly is the cleanest option: no warning, no
+// EINVAL, and the args (-C, --filter, identifier-like strings) contain no
+// cmd metacharacters that need extra escaping.
+const WIN_SHIM_COMMANDS = new Set(["pnpm", "npm", "npx", "yarn"]);
+function resolveWindowsShim(command, args) {
+    if (process.platform !== "win32")
+        return { command, args };
+    if (!WIN_SHIM_COMMANDS.has(command))
+        return { command, args };
+    return { command: "cmd.exe", args: ["/c", command, ...args] };
+}
 let _isWSL;
 function isWSL() {
     if (_isWSL === undefined) {
@@ -34,7 +52,8 @@ function openBrowser(url) {
 }
 function launchWebApp({ command, args, cwd, env, supervisor, label, quiet = false, }) {
     const stdio = quiet ? ["ignore", "pipe", "pipe"] : "inherit";
-    const proc = (0, node_child_process_1.spawn)(command, args, { cwd, env, stdio });
+    const resolved = resolveWindowsShim(command, args);
+    const proc = (0, node_child_process_1.spawn)(resolved.command, resolved.args, { cwd, env, stdio });
     supervisor.children.push(proc);
     // In quiet mode, only forward stderr
     if (quiet && proc.stderr) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kandev",
-  "version": "0.45.0",
+  "version": "0.49.0",
   "private": false,
   "description": "Launcher for Kandev — manage tasks, orchestrate agents, review changes, and ship value",
   "license": "AGPL-3.0-only",
@@ -22,11 +22,11 @@
     "npm": ">=7"
   },
   "optionalDependencies": {
-    "@kdlbs/runtime-linux-x64": "0.45.0",
-    "@kdlbs/runtime-linux-arm64": "0.45.0",
-    "@kdlbs/runtime-darwin-x64": "0.45.0",
-    "@kdlbs/runtime-darwin-arm64": "0.45.0",
-    "@kdlbs/runtime-win32-x64": "0.45.0"
+    "@kdlbs/runtime-linux-x64": "0.49.0",
+    "@kdlbs/runtime-linux-arm64": "0.49.0",
+    "@kdlbs/runtime-darwin-x64": "0.49.0",
+    "@kdlbs/runtime-darwin-arm64": "0.49.0",
+    "@kdlbs/runtime-win32-x64": "0.49.0"
   },
   "dependencies": {
     "tar": "^7.5.11",
@@ -40,7 +40,7 @@
     "vitest": "^1.6.0"
   },
   "scripts": {
-    "dev": "unset npm_config_prefix && tsx src/cli.ts",
+    "dev": "tsx src/cli.ts",
     "build": "tsc -p tsconfig.json",
     "bundle": "esbuild dist/cli.js --bundle --platform=node --format=cjs --outfile=dist/cli.bundle.js",
     "start": "node dist/cli.js",