livedesk 0.1.446 → 0.1.448

package/bootstrap/legacy-client-update.js

@@ -16,6 +16,10 @@ import {
 import http from 'node:http';
 import os from 'node:os';
 import { dirname, join, resolve } from 'node:path';
+import {
+  createWindowsProcessTreeTracker,
+  drainOwnedWindowsAgentTreeUntilStopped
+} from '../client/src/runtime/agent-process-lifecycle.js';
 
 const DEFAULT_RUNTIME_PORT = 5179;
 const TARGET_ATTEMPT_LIMIT = 3;
@@ -1101,6 +1105,11 @@ export function spawnReplacement(version, preference, env = process.env, restart
       stdio: outputFd === null ? 'ignore' : ['ignore', outputFd, outputFd],
       windowsHide: true
     });
+    if (process.platform === 'win32' && Number(child?.pid || 0) > 1) {
+      const tracker = createWindowsProcessTreeTracker(child);
+      child.livedeskWindowsTreeTracker = tracker;
+      child.once('exit', () => tracker.markRootExited());
+    }
   } finally {
     if (outputFd !== null) closeSync(outputFd);
   }
@@ -1208,27 +1217,20 @@ async function terminateReplacementTree(child) {
   const pid = positivePid(child?.pid);
   if (pid <= 1) return;
   if (process.platform === 'win32') {
-    await new Promise(resolve => {
-      const killer = spawn('taskkill.exe', ['/PID', String(pid), '/T', '/F'], {
-        windowsHide: true,
-        stdio: 'ignore'
-      });
-      let settled = false;
-      const finish = () => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        resolve();
-      };
-      const timer = setTimeout(() => {
-        try { killer.kill('SIGKILL'); } catch { /* taskkill already stopped */ }
-        finish();
-      }, 10_000);
-      killer.once('error', finish);
-      killer.once('exit', finish);
+    if (!child.livedeskWindowsTreeTracker) {
+      const tracker = createWindowsProcessTreeTracker(child);
+      child.livedeskWindowsTreeTracker = tracker;
+      child.once('exit', () => tracker.markRootExited());
+    }
+    const result = await drainOwnedWindowsAgentTreeUntilStopped(child, {
+      reportTerminationFailure: message => console.error(
+        `[LiveDesk update] ${message}`
+      )
     });
-    if (isAlive(pid)) {
-      try { child.kill('SIGKILL'); } catch { /* best effort after bounded taskkill */ }
+    if (result?.ok === false) {
+      throw result.error || new Error(
+        `Exact Windows replacement tree pid=${pid} could not be drained.`
+      );
     }
     return;
   }

package/bootstrap/runtime-lock.js

@@ -1,8 +1,10 @@
-import { existsSync, linkSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, linkSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
 import os from 'node:os';
-
+
+const MAX_TAKEOVER_LEASE_AGE_MS = 15_000;
+
 function readLock(path) {
   try {
     return JSON.parse(readFileSync(path, 'utf8'));
@@ -43,7 +45,56 @@ function releaseOwnedLock(path, payload) {
   }
 }
 
-function isProcessAlive(pid) {
+function updateOwnedLockRole(path, payload, nextRole) {
+  const role = String(nextRole || '').trim().toLowerCase();
+  if (!['hub', 'client'].includes(role)) {
+    throw new Error(`Unsupported LiveDesk runtime-lock role: ${role || '<empty>'}.`);
+  }
+  const current = readLock(path);
+  if (Number(current?.pid) !== Number(payload?.pid)
+    || current?.ownerToken !== payload?.ownerToken
+    || current?.ownerInstanceMarker !== payload?.ownerInstanceMarker
+    || current?.ownerStartOrder !== payload?.ownerStartOrder) {
+    throw new Error('LiveDesk runtime-lock ownership changed before its role could be updated.');
+  }
+  if (current.role === role) {
+    payload.role = role;
+    return;
+  }
+
+  const next = {
+    ...current,
+    role,
+    roleUpdatedAt: new Date().toISOString()
+  };
+  const stagedPath = `${path}.${process.pid}.${payload.ownerToken}.${randomBytes(6).toString('hex')}.role.pending`;
+  let renamed = false;
+  try {
+    writeFileSync(stagedPath, JSON.stringify(next, null, 2), {
+      flag: 'wx',
+      mode: 0o600
+    });
+    const revalidated = readLock(path);
+    if (Number(revalidated?.pid) !== Number(payload.pid)
+      || revalidated?.ownerToken !== payload.ownerToken
+      || revalidated?.ownerInstanceMarker !== payload.ownerInstanceMarker
+      || revalidated?.ownerStartOrder !== payload.ownerStartOrder
+      || revalidated?.role !== current.role) {
+      throw new Error('LiveDesk runtime-lock ownership changed during its role update.');
+    }
+    // The path remains continuously present: contenders observe either the old
+    // live role or the new live role, never a missing-lock acquisition window.
+    renameSync(stagedPath, path);
+    renamed = true;
+    payload.role = role;
+  } finally {
+    if (!renamed) {
+      try { unlinkSync(stagedPath); } catch { /* staged role update was never published */ }
+    }
+  }
+}
+
+function isProcessAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 1) {
     return false;
   }
@@ -52,17 +103,138 @@ function isProcessAlive(pid) {
     return true;
   } catch (error) {
     return error?.code !== 'ESRCH';
-  }
-}
-
-export function getRuntimeLockPath(stateDir = join(os.homedir(), '.livedesk')) {
-  return join(stateDir, 'livedesk-runtime.lock');
-}
+  }
+}
+
+function exactStaleOwnerProofMatches(lock, proof) {
+  const pid = Number(lock?.pid);
+  const ownerToken = String(lock?.ownerToken || '').trim();
+  const ownerInstanceMarker = String(lock?.ownerInstanceMarker || '').trim();
+  const ownerStartOrder = String(lock?.ownerStartOrder || '').trim();
+  return Number.isInteger(pid)
+    && pid > 1
+    && ownerToken.length >= 16
+    && ownerInstanceMarker.length > 0
+    && ownerStartOrder.length > 0
+    && Number(proof?.pid) === pid
+    && String(proof?.ownerToken || '').trim() === ownerToken
+    && String(proof?.ownerInstanceMarker || '').trim() === ownerInstanceMarker
+    && String(proof?.ownerStartOrder || '').trim() === ownerStartOrder;
+}
+
+function isRuntimeOwnerAlive(lock, staleOwnerProof) {
+  return isProcessAlive(Number(lock?.pid))
+    && !exactStaleOwnerProofMatches(lock, staleOwnerProof);
+}
+
+function isCompleteTakeoverLease(lock, role = 'runtime-lock-takeover') {
+  const pid = Number(lock?.pid);
+  const ownerToken = String(lock?.ownerToken || '').trim();
+  const startedAt = String(lock?.startedAt || '').trim();
+  return Number.isInteger(pid)
+    && pid > 1
+    && lock?.role === role
+    && /^[a-f0-9]{32}$/i.test(ownerToken)
+    && Number.isFinite(Date.parse(startedAt));
+}
+
+function isTakeoverLeaseOwnerAlive(lock) {
+  const startedAt = Date.parse(String(lock?.startedAt || ''));
+  const ageMs = Date.now() - startedAt;
+  // Takeover code performs only synchronous local filesystem operations. A
+  // lease older than this cannot still be a legitimate repair, even if its PID
+  // has since been reused by an unrelated long-lived process.
+  if (Number.isFinite(ageMs) && ageMs > MAX_TAKEOVER_LEASE_AGE_MS) {
+    return false;
+  }
+  return isProcessAlive(Number(lock?.pid));
+}
+
+function acquireDeadTakeoverReclaimLease(path, observed, ownerInstanceMarker) {
+  if (!isCompleteTakeoverLease(observed) || isTakeoverLeaseOwnerAlive(observed)) {
+    return null;
+  }
+
+  const payload = {
+    pid: process.pid,
+    role: 'runtime-lock-takeover-reclaim',
+    startedAt: new Date().toISOString(),
+    ownerToken: randomBytes(16).toString('hex'),
+    ownerInstanceMarker: String(ownerInstanceMarker || '').trim()
+  };
+  let generationToken = observed.ownerToken;
+
+  // Each dead recovery owner creates the next immutable generation path. The
+  // hard-link publication is the cross-process winner election: contenders
+  // can never delete/replace a live winner, while a crashed winner is followed
+  // through its token to a fresh generation instead of being unlinked with an
+  // unsafe read-then-delete race.
+  for (let depth = 0; depth < 64; depth += 1) {
+    const leasePath = `${path}.reclaim.${generationToken}`;
+    const stagedPath = `${leasePath}.${process.pid}.${payload.ownerToken}.pending`;
+    const existingLease = readLock(leasePath);
+    if (existingLease || existsSync(leasePath)) {
+      if (!isCompleteTakeoverLease(existingLease, 'runtime-lock-takeover-reclaim')) {
+        return null;
+      }
+      if (isTakeoverLeaseOwnerAlive(existingLease)) {
+        return null;
+      }
+      generationToken = existingLease.ownerToken;
+      continue;
+    }
+
+    try {
+      publishCompleteLock(leasePath, stagedPath, payload);
+    } catch {
+      try { unlinkSync(stagedPath); } catch { /* another contender won */ }
+      const winner = readLock(leasePath);
+      if (!isCompleteTakeoverLease(winner, 'runtime-lock-takeover-reclaim')) {
+        return null;
+      }
+      if (isTakeoverLeaseOwnerAlive(winner)) {
+        return null;
+      }
+      generationToken = winner.ownerToken;
+      continue;
+    }
+
+    const current = readLock(path);
+    if (!isCompleteTakeoverLease(current)
+      || Number(current.pid) !== Number(observed.pid)
+      || current.ownerToken !== observed.ownerToken
+      || current.startedAt !== observed.startedAt
+      || isTakeoverLeaseOwnerAlive(current)) {
+      releaseOwnedLock(leasePath, payload);
+      return null;
+    }
+
+    try {
+      unlinkSync(path);
+    } catch {
+      releaseOwnedLock(leasePath, payload);
+      return null;
+    }
+    return {
+      path: leasePath,
+      payload,
+      release: () => releaseOwnedLock(leasePath, payload)
+    };
+  }
+
+  return null;
+}
+
+export function getRuntimeLockPath(stateDir = join(os.homedir(), '.livedesk')) {
+  return join(stateDir, 'livedesk-runtime.lock');
+}
 
 export function acquireRuntimeLock({
   stateDir,
   role = '',
   ownerInstanceMarker = '',
+  ownerStartOrder = '',
+  staleOwnerProof,
   openExisting
 } = {}) {
   const path = getRuntimeLockPath(stateDir);
@@ -71,27 +243,44 @@ export function acquireRuntimeLock({
     role: String(role || '').trim(),
     startedAt: new Date().toISOString(),
     ownerToken: randomBytes(16).toString('hex'),
-    ownerInstanceMarker: String(ownerInstanceMarker || '').trim()
+    ownerInstanceMarker: String(ownerInstanceMarker || '').trim(),
+    ownerStartOrder: String(ownerStartOrder || '').trim()
   };
   const stagedPath = `${path}.${process.pid}.${payload.ownerToken}.pending`;
   const takeoverPath = `${path}.takeover`;
   const takeoverStagedPath = `${takeoverPath}.${process.pid}.${payload.ownerToken}.pending`;
   const existingTakeover = readLock(takeoverPath);
+  let reclaimLease = null;
+  const releaseReclaimLease = () => {
+    reclaimLease?.release();
+    reclaimLease = null;
+  };
 
   // Stale repair is synchronous and normally lasts only a few filesystem
   // operations. Every contender that observes its marker must fail closed so
-  // nobody can acquire the main path in the unlink/link handoff window.
+  // nobody can acquire the main path in the unlink/link handoff window. A
+  // complete marker whose exact owner PID is dead is the one exception: the
+  // prior repair crashed, so elect one cross-process reclaimer through an
+  // immutable generation hard-link before removing that exact marker.
+  // Unreadable/incomplete/live markers stay closed.
   if (existingTakeover || existsSync(takeoverPath)) {
-    const existing = readLock(path);
-    if (typeof openExisting === 'function') {
-      openExisting(existing || existingTakeover);
+    reclaimLease = acquireDeadTakeoverReclaimLease(
+      takeoverPath,
+      existingTakeover,
+      ownerInstanceMarker
+    );
+    if (!reclaimLease) {
+      const existing = readLock(path);
+      if (typeof openExisting === 'function') {
+        openExisting(existing || existingTakeover);
+      }
+      return {
+        acquired: false,
+        path,
+        existing: existing || existingTakeover,
+        error: new Error('LiveDesk runtime lock takeover is already in progress.')
+      };
     }
-    return {
-      acquired: false,
-      path,
-      existing: existing || existingTakeover,
-      error: new Error('LiveDesk runtime lock takeover is already in progress.')
-    };
   }
 
   try {
@@ -106,12 +295,19 @@ export function acquireRuntimeLock({
       released = true;
       releaseOwnedLock(path, payload);
     };
-    return { acquired: true, path, payload, release };
+    releaseReclaimLease();
+    return {
+      acquired: true,
+      path,
+      payload,
+      release,
+      updateRole: nextRole => updateOwnedLockRole(path, payload, nextRole)
+    };
   } catch (error) {
     try { unlinkSync(stagedPath); } catch { /* staged inode was never created or was already removed */ }
     const existingText = readLockText(path);
     const existing = readLock(path);
-    if (existing && !isProcessAlive(Number(existing.pid))) {
+    if (existing && !isRuntimeOwnerAlive(existing, staleOwnerProof)) {
       const takeoverPayload = {
         pid: process.pid,
         role: 'runtime-lock-takeover',
@@ -122,6 +318,7 @@ export function acquireRuntimeLock({
       try {
         publishCompleteLock(takeoverPath, takeoverStagedPath, takeoverPayload);
       } catch {
+        releaseReclaimLease();
         if (typeof openExisting === 'function') {
           openExisting(existing);
         }
@@ -133,7 +330,7 @@ export function acquireRuntimeLock({
         const current = readLock(path);
         if (!current
           || currentText !== existingText
-          || isProcessAlive(Number(current.pid))) {
+          || isRuntimeOwnerAlive(current, staleOwnerProof)) {
           if (typeof openExisting === 'function') {
             openExisting(current);
           }
@@ -155,9 +352,16 @@ export function acquireRuntimeLock({
           released = true;
           releaseOwnedLock(path, payload);
         };
-        return { acquired: true, path, payload, release };
+        return {
+          acquired: true,
+          path,
+          payload,
+          release,
+          updateRole: nextRole => updateOwnedLockRole(path, payload, nextRole)
+        };
       } finally {
         releaseOwnedLock(takeoverPath, takeoverPayload);
+        releaseReclaimLease();
       }
     }
     // An unreadable existing file is never evidence that the lock is stale.
@@ -165,7 +369,8 @@ export function acquireRuntimeLock({
     // owner disappears, without ever admitting two launchers concurrently.
     if (typeof openExisting === 'function') {
       openExisting(existing);
-    }
-    return { acquired: false, path, existing, error };
-  }
-}
+    }
+    releaseReclaimLease();
+    return { acquired: false, path, existing, error };
+  }
+}