livedesk 0.1.445 → 0.1.447

package/bootstrap/client-process-identity.js

@@ -50,11 +50,25 @@ export function isKnownLiveDeskClientAgentProcess(processName, commandLine, exec
 export function isKnownLiveDeskCaptureHelperProcess(processName, commandLine, executablePath = '') {
   const normalizedName = String(processName || '').trim().replaceAll('\\', '/').split('/').pop() || '';
   const normalizedCommandLine = String(commandLine || '').replaceAll('\\', '/');
-  const helperPathPattern = /(?:^|\/)\.livedesk\/helpers\/macos-sck-h264\/livedesk-sck-h264$/i;
-  const knownCommand = /(?:^|\/)\.livedesk\/helpers\/macos-sck-h264\/livedesk-sck-h264(?:\s|["']|$)/i
+  const normalizedExecutablePath = normalizeExecutablePath(executablePath);
+  const argvExecutable = normalizeExecutablePath(firstCommandArgument(normalizedCommandLine));
+  const videoHelperPath = /(?:^|\/)\.livedesk\/helpers\/macos-sck-h264\/livedesk-sck-h264$/i;
+  const audioHelperPath = /(?:^|\/)\.livedesk\/helpers\/macos-sck-audio\/livedesk-sck-audio$/i;
+  const knownVideoCommand = /(?:^|\/)\.livedesk\/helpers\/macos-sck-h264\/livedesk-sck-h264(?:\s|["']|$)/i
+    .test(normalizedCommandLine);
+  const knownAudioCommand = /(?:^|\/)\.livedesk\/helpers\/macos-sck-audio\/livedesk-sck-audio(?:\s|["']|$)/i
     .test(normalizedCommandLine);
-  const strictExecutableProof = helperPathPattern.test(normalizeExecutablePath(executablePath))
-    || helperPathPattern.test(normalizeExecutablePath(firstCommandArgument(normalizedCommandLine)));
-  return (/^livedesk-sck-h264$/i.test(normalizedName) && knownCommand)
-    || (/^livedesk-sck-h2$/i.test(normalizedName) && strictExecutableProof);
+  const strictVideoExecutableProof = videoHelperPath.test(normalizedExecutablePath)
+    || videoHelperPath.test(argvExecutable);
+  const strictAudioExecutableProof = audioHelperPath.test(normalizedExecutablePath)
+    || audioHelperPath.test(argvExecutable);
+  const knownRawCaptureCommand = new RegExp(
+    `^(?:"[^"]*"|'[^']*'|\\S+)\\s+["']?\\S*${FAST_ROOT}/livedesk-raw-capture-helper\\.mjs(?:["']|\\s|$)`,
+    'i'
+  ).test(normalizedCommandLine);
+  return (/^livedesk-sck-h264$/i.test(normalizedName) && knownVideoCommand)
+    || (/^livedesk-sck-h2$/i.test(normalizedName) && strictVideoExecutableProof)
+    || (/^livedesk-sck-audio$/i.test(normalizedName) && knownAudioCommand)
+    || (/^livedesk-sck-aud$/i.test(normalizedName) && strictAudioExecutableProof)
+    || (/^(?:node|node\.exe)$/i.test(normalizedName) && knownRawCaptureCommand);
 }

package/bootstrap/legacy-client-update.js

@@ -16,6 +16,10 @@ import {
 import http from 'node:http';
 import os from 'node:os';
 import { dirname, join, resolve } from 'node:path';
+import {
+  createWindowsProcessTreeTracker,
+  drainOwnedWindowsAgentTreeUntilStopped
+} from '../client/src/runtime/agent-process-lifecycle.js';
 
 const DEFAULT_RUNTIME_PORT = 5179;
 const TARGET_ATTEMPT_LIMIT = 3;
@@ -1101,6 +1105,11 @@ export function spawnReplacement(version, preference, env = process.env, restart
       stdio: outputFd === null ? 'ignore' : ['ignore', outputFd, outputFd],
       windowsHide: true
     });
+    if (process.platform === 'win32' && Number(child?.pid || 0) > 1) {
+      const tracker = createWindowsProcessTreeTracker(child);
+      child.livedeskWindowsTreeTracker = tracker;
+      child.once('exit', () => tracker.markRootExited());
+    }
   } finally {
     if (outputFd !== null) closeSync(outputFd);
   }
@@ -1208,27 +1217,20 @@ async function terminateReplacementTree(child) {
   const pid = positivePid(child?.pid);
   if (pid <= 1) return;
   if (process.platform === 'win32') {
-    await new Promise(resolve => {
-      const killer = spawn('taskkill.exe', ['/PID', String(pid), '/T', '/F'], {
-        windowsHide: true,
-        stdio: 'ignore'
-      });
-      let settled = false;
-      const finish = () => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        resolve();
-      };
-      const timer = setTimeout(() => {
-        try { killer.kill('SIGKILL'); } catch { /* taskkill already stopped */ }
-        finish();
-      }, 10_000);
-      killer.once('error', finish);
-      killer.once('exit', finish);
+    if (!child.livedeskWindowsTreeTracker) {
+      const tracker = createWindowsProcessTreeTracker(child);
+      child.livedeskWindowsTreeTracker = tracker;
+      child.once('exit', () => tracker.markRootExited());
+    }
+    const result = await drainOwnedWindowsAgentTreeUntilStopped(child, {
+      reportTerminationFailure: message => console.error(
+        `[LiveDesk update] ${message}`
+      )
     });
-    if (isAlive(pid)) {
-      try { child.kill('SIGKILL'); } catch { /* best effort after bounded taskkill */ }
+    if (result?.ok === false) {
+      throw result.error || new Error(
+        `Exact Windows replacement tree pid=${pid} could not be drained.`
+      );
     }
     return;
   }

package/bootstrap/runtime-lock.js

@@ -1,16 +1,100 @@
-import { existsSync, openSync, readFileSync, closeSync, unlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import os from 'node:os';
-
-function readLock(path) {
+import { existsSync, linkSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import os from 'node:os';
+
+const MAX_TAKEOVER_LEASE_AGE_MS = 15_000;
+
+function readLock(path) {
   try {
     return JSON.parse(readFileSync(path, 'utf8'));
   } catch {
     return null;
   }
-}
-
-function isProcessAlive(pid) {
+}
+
+function readLockText(path) {
+  try {
+    return readFileSync(path, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function publishCompleteLock(targetPath, stagedPath, payload) {
+  writeFileSync(stagedPath, JSON.stringify(payload, null, 2), {
+    flag: 'wx',
+    mode: 0o600
+  });
+  try {
+    linkSync(stagedPath, targetPath);
+  } finally {
+    try { unlinkSync(stagedPath); } catch { /* staged inode was already removed */ }
+  }
+}
+
+function releaseOwnedLock(path, payload) {
+  try {
+    const current = readLock(path);
+    if (Number(current?.pid) === payload.pid
+      && current?.ownerToken === payload.ownerToken) {
+      unlinkSync(path);
+    }
+  } catch {
+    // The exact owner already released the lock.
+  }
+}
+
+function updateOwnedLockRole(path, payload, nextRole) {
+  const role = String(nextRole || '').trim().toLowerCase();
+  if (!['hub', 'client'].includes(role)) {
+    throw new Error(`Unsupported LiveDesk runtime-lock role: ${role || '<empty>'}.`);
+  }
+  const current = readLock(path);
+  if (Number(current?.pid) !== Number(payload?.pid)
+    || current?.ownerToken !== payload?.ownerToken
+    || current?.ownerInstanceMarker !== payload?.ownerInstanceMarker
+    || current?.ownerStartOrder !== payload?.ownerStartOrder) {
+    throw new Error('LiveDesk runtime-lock ownership changed before its role could be updated.');
+  }
+  if (current.role === role) {
+    payload.role = role;
+    return;
+  }
+
+  const next = {
+    ...current,
+    role,
+    roleUpdatedAt: new Date().toISOString()
+  };
+  const stagedPath = `${path}.${process.pid}.${payload.ownerToken}.${randomBytes(6).toString('hex')}.role.pending`;
+  let renamed = false;
+  try {
+    writeFileSync(stagedPath, JSON.stringify(next, null, 2), {
+      flag: 'wx',
+      mode: 0o600
+    });
+    const revalidated = readLock(path);
+    if (Number(revalidated?.pid) !== Number(payload.pid)
+      || revalidated?.ownerToken !== payload.ownerToken
+      || revalidated?.ownerInstanceMarker !== payload.ownerInstanceMarker
+      || revalidated?.ownerStartOrder !== payload.ownerStartOrder
+      || revalidated?.role !== current.role) {
+      throw new Error('LiveDesk runtime-lock ownership changed during its role update.');
+    }
+    // The path remains continuously present: contenders observe either the old
+    // live role or the new live role, never a missing-lock acquisition window.
+    renameSync(stagedPath, path);
+    renamed = true;
+    payload.role = role;
+  } finally {
+    if (!renamed) {
+      try { unlinkSync(stagedPath); } catch { /* staged role update was never published */ }
+    }
+  }
+}
+
+function isProcessAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 1) {
     return false;
   }
@@ -19,41 +103,274 @@ function isProcessAlive(pid) {
     return true;
   } catch (error) {
     return error?.code !== 'ESRCH';
-  }
-}
-
-export function getRuntimeLockPath(stateDir = join(os.homedir(), '.livedesk')) {
-  return join(stateDir, 'livedesk-runtime.lock');
-}
+  }
+}
+
+function exactStaleOwnerProofMatches(lock, proof) {
+  const pid = Number(lock?.pid);
+  const ownerToken = String(lock?.ownerToken || '').trim();
+  const ownerInstanceMarker = String(lock?.ownerInstanceMarker || '').trim();
+  const ownerStartOrder = String(lock?.ownerStartOrder || '').trim();
+  return Number.isInteger(pid)
+    && pid > 1
+    && ownerToken.length >= 16
+    && ownerInstanceMarker.length > 0
+    && ownerStartOrder.length > 0
+    && Number(proof?.pid) === pid
+    && String(proof?.ownerToken || '').trim() === ownerToken
+    && String(proof?.ownerInstanceMarker || '').trim() === ownerInstanceMarker
+    && String(proof?.ownerStartOrder || '').trim() === ownerStartOrder;
+}
+
+function isRuntimeOwnerAlive(lock, staleOwnerProof) {
+  return isProcessAlive(Number(lock?.pid))
+    && !exactStaleOwnerProofMatches(lock, staleOwnerProof);
+}
+
+function isCompleteTakeoverLease(lock, role = 'runtime-lock-takeover') {
+  const pid = Number(lock?.pid);
+  const ownerToken = String(lock?.ownerToken || '').trim();
+  const startedAt = String(lock?.startedAt || '').trim();
+  return Number.isInteger(pid)
+    && pid > 1
+    && lock?.role === role
+    && /^[a-f0-9]{32}$/i.test(ownerToken)
+    && Number.isFinite(Date.parse(startedAt));
+}
+
+function isTakeoverLeaseOwnerAlive(lock) {
+  const startedAt = Date.parse(String(lock?.startedAt || ''));
+  const ageMs = Date.now() - startedAt;
+  // Takeover code performs only synchronous local filesystem operations. A
+  // lease older than this cannot still be a legitimate repair, even if its PID
+  // has since been reused by an unrelated long-lived process.
+  if (Number.isFinite(ageMs) && ageMs > MAX_TAKEOVER_LEASE_AGE_MS) {
+    return false;
+  }
+  return isProcessAlive(Number(lock?.pid));
+}
+
+function acquireDeadTakeoverReclaimLease(path, observed, ownerInstanceMarker) {
+  if (!isCompleteTakeoverLease(observed) || isTakeoverLeaseOwnerAlive(observed)) {
+    return null;
+  }
+
+  const payload = {
+    pid: process.pid,
+    role: 'runtime-lock-takeover-reclaim',
+    startedAt: new Date().toISOString(),
+    ownerToken: randomBytes(16).toString('hex'),
+    ownerInstanceMarker: String(ownerInstanceMarker || '').trim()
+  };
+  let generationToken = observed.ownerToken;
+
+  // Each dead recovery owner creates the next immutable generation path. The
+  // hard-link publication is the cross-process winner election: contenders
+  // can never delete/replace a live winner, while a crashed winner is followed
+  // through its token to a fresh generation instead of being unlinked with an
+  // unsafe read-then-delete race.
+  for (let depth = 0; depth < 64; depth += 1) {
+    const leasePath = `${path}.reclaim.${generationToken}`;
+    const stagedPath = `${leasePath}.${process.pid}.${payload.ownerToken}.pending`;
+    const existingLease = readLock(leasePath);
+    if (existingLease || existsSync(leasePath)) {
+      if (!isCompleteTakeoverLease(existingLease, 'runtime-lock-takeover-reclaim')) {
+        return null;
+      }
+      if (isTakeoverLeaseOwnerAlive(existingLease)) {
+        return null;
+      }
+      generationToken = existingLease.ownerToken;
+      continue;
+    }
+
+    try {
+      publishCompleteLock(leasePath, stagedPath, payload);
+    } catch {
+      try { unlinkSync(stagedPath); } catch { /* another contender won */ }
+      const winner = readLock(leasePath);
+      if (!isCompleteTakeoverLease(winner, 'runtime-lock-takeover-reclaim')) {
+        return null;
+      }
+      if (isTakeoverLeaseOwnerAlive(winner)) {
+        return null;
+      }
+      generationToken = winner.ownerToken;
+      continue;
+    }
+
+    const current = readLock(path);
+    if (!isCompleteTakeoverLease(current)
+      || Number(current.pid) !== Number(observed.pid)
+      || current.ownerToken !== observed.ownerToken
+      || current.startedAt !== observed.startedAt
+      || isTakeoverLeaseOwnerAlive(current)) {
+      releaseOwnedLock(leasePath, payload);
+      return null;
+    }
+
+    try {
+      unlinkSync(path);
+    } catch {
+      releaseOwnedLock(leasePath, payload);
+      return null;
+    }
+    return {
+      path: leasePath,
+      payload,
+      release: () => releaseOwnedLock(leasePath, payload)
+    };
+  }
+
+  return null;
+}
+
+export function getRuntimeLockPath(stateDir = join(os.homedir(), '.livedesk')) {
+  return join(stateDir, 'livedesk-runtime.lock');
+}
 
-export function acquireRuntimeLock({ stateDir, role = '', openExisting } = {}) {
-  const path = getRuntimeLockPath(stateDir);
-  const payload = {
-    pid: process.pid,
-    role: String(role || '').trim(),
-    startedAt: new Date().toISOString()
-  };
-
-  try {
-    const descriptor = openSync(path, 'wx');
-    writeFileSync(descriptor, JSON.stringify(payload, null, 2));
-    closeSync(descriptor);
-    let released = false;
-    const release = () => {
-      if (released) return;
-      released = true;
-      try { unlinkSync(path); } catch { /* already released */ }
-    };
-    return { acquired: true, path, payload, release };
-  } catch (error) {
-    const existing = readLock(path);
-    if (!existing || !isProcessAlive(Number(existing.pid))) {
-      try { unlinkSync(path); } catch { /* another process may repair it */ }
-      return acquireRuntimeLock({ stateDir, role, openExisting });
-    }
-    if (typeof openExisting === 'function') {
-      openExisting(existing);
-    }
-    return { acquired: false, path, existing, error };
-  }
-}
+export function acquireRuntimeLock({
+  stateDir,
+  role = '',
+  ownerInstanceMarker = '',
+  ownerStartOrder = '',
+  staleOwnerProof,
+  openExisting
+} = {}) {
+  const path = getRuntimeLockPath(stateDir);
+  const payload = {
+    pid: process.pid,
+    role: String(role || '').trim(),
+    startedAt: new Date().toISOString(),
+    ownerToken: randomBytes(16).toString('hex'),
+    ownerInstanceMarker: String(ownerInstanceMarker || '').trim(),
+    ownerStartOrder: String(ownerStartOrder || '').trim()
+  };
+  const stagedPath = `${path}.${process.pid}.${payload.ownerToken}.pending`;
+  const takeoverPath = `${path}.takeover`;
+  const takeoverStagedPath = `${takeoverPath}.${process.pid}.${payload.ownerToken}.pending`;
+  const existingTakeover = readLock(takeoverPath);
+  let reclaimLease = null;
+  const releaseReclaimLease = () => {
+    reclaimLease?.release();
+    reclaimLease = null;
+  };
+
+  // Stale repair is synchronous and normally lasts only a few filesystem
+  // operations. Every contender that observes its marker must fail closed so
+  // nobody can acquire the main path in the unlink/link handoff window. A
+  // complete marker whose exact owner PID is dead is the one exception: the
+  // prior repair crashed, so elect one cross-process reclaimer through an
+  // immutable generation hard-link before removing that exact marker.
+  // Unreadable/incomplete/live markers stay closed.
+  if (existingTakeover || existsSync(takeoverPath)) {
+    reclaimLease = acquireDeadTakeoverReclaimLease(
+      takeoverPath,
+      existingTakeover,
+      ownerInstanceMarker
+    );
+    if (!reclaimLease) {
+      const existing = readLock(path);
+      if (typeof openExisting === 'function') {
+        openExisting(existing || existingTakeover);
+      }
+      return {
+        acquired: false,
+        path,
+        existing: existing || existingTakeover,
+        error: new Error('LiveDesk runtime lock takeover is already in progress.')
+      };
+    }
+  }
+
+  try {
+    // Publish a fully written inode with one atomic hard-link operation. With
+    // open(path, 'wx') followed by write(), another launcher could observe the
+    // temporary zero-byte file, classify it as stale, unlink it on macOS, and
+    // acquire a second lock while the first owner still held the old inode.
+    publishCompleteLock(path, stagedPath, payload);
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      releaseOwnedLock(path, payload);
+    };
+    releaseReclaimLease();
+    return {
+      acquired: true,
+      path,
+      payload,
+      release,
+      updateRole: nextRole => updateOwnedLockRole(path, payload, nextRole)
+    };
+  } catch (error) {
+    try { unlinkSync(stagedPath); } catch { /* staged inode was never created or was already removed */ }
+    const existingText = readLockText(path);
+    const existing = readLock(path);
+    if (existing && !isRuntimeOwnerAlive(existing, staleOwnerProof)) {
+      const takeoverPayload = {
+        pid: process.pid,
+        role: 'runtime-lock-takeover',
+        startedAt: new Date().toISOString(),
+        ownerToken: randomBytes(16).toString('hex'),
+        ownerInstanceMarker: String(ownerInstanceMarker || '').trim()
+      };
+      try {
+        publishCompleteLock(takeoverPath, takeoverStagedPath, takeoverPayload);
+      } catch {
+        releaseReclaimLease();
+        if (typeof openExisting === 'function') {
+          openExisting(existing);
+        }
+        return { acquired: false, path, existing, error };
+      }
+
+      try {
+        const currentText = readLockText(path);
+        const current = readLock(path);
+        if (!current
+          || currentText !== existingText
+          || isRuntimeOwnerAlive(current, staleOwnerProof)) {
+          if (typeof openExisting === 'function') {
+            openExisting(current);
+          }
+          return { acquired: false, path, existing: current, error };
+        }
+        unlinkSync(path);
+        try {
+          publishCompleteLock(path, stagedPath, payload);
+        } catch (takeoverError) {
+          const winner = readLock(path);
+          if (typeof openExisting === 'function') {
+            openExisting(winner);
+          }
+          return { acquired: false, path, existing: winner, error: takeoverError };
+        }
+        let released = false;
+        const release = () => {
+          if (released) return;
+          released = true;
+          releaseOwnedLock(path, payload);
+        };
+        return {
+          acquired: true,
+          path,
+          payload,
+          release,
+          updateRole: nextRole => updateOwnedLockRole(path, payload, nextRole)
+        };
+      } finally {
+        releaseOwnedLock(takeoverPath, takeoverPayload);
+        releaseReclaimLease();
+      }
+    }
+    // An unreadable existing file is never evidence that the lock is stale.
+    // Preserve it and fail closed; the next invocation can repair it after its
+    // owner disappears, without ever admitting two launchers concurrently.
+    if (typeof openExisting === 'function') {
+      openExisting(existing);
+    }
+    releaseReclaimLease();
+    return { acquired: false, path, existing, error };
+  }
+}