moshcode 0.89.0 → 0.90.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moshcode",
-  "version": "0.89.0",
+  "version": "0.90.0",
   "type": "module",
   "description": "moshcode \u2014 a metal wrapper for coding engines and native UGig/CoinPay workflow CLIs, with OpenPRD and moshscript",
   "repository": {

package/src/dns-service.mjs

@@ -29,9 +29,8 @@
 // it, and the entry is the script this very command was invoked from. Nothing
 // is guessed and nothing depends on PATH.
 import { spawn } from "node:child_process";
-import { mkdir, rm, writeFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { operatorHome } from "./trust.mjs";
 
@@ -48,10 +47,49 @@ export const UNIT_NAME = "moshcode-dns.service";
  * /run/user/<uid>/moshpit-dns.pid for the daemon and for the person asking
  * after it. Under a system unit those are two different paths.
  */
-export function servicePaths({ system = false, home = homedir() } = {}) {
+export function servicePaths({ system = false, home = operatorHome(), env = process.env } = {}) {
   return system
     ? { path: join("/etc/systemd/system", UNIT_NAME), systemctl: ["systemctl"], scope: "system" }
-    : { path: join(home, ".config/systemd/user", UNIT_NAME), systemctl: ["systemctl", "--user"], scope: "user" };
+    : { path: join(home, ".config/systemd/user", UNIT_NAME), systemctl: userSystemctl(env), scope: "user" };
+}
+
+/**
+ * How to reach the operator's own systemd from wherever this is running.
+ *
+ * `systemctl --user` talks to the session of whoever is running it. `dns enable`
+ * escalates, so from there it is root's session — which has no bridge in it, has
+ * never had one, and reports every query about one as "not loaded". Meanwhile
+ * the operator's bridge keeps running with whatever it started with.
+ *
+ * That is why enabling proxy mode could be detected, written, and still not take
+ * effect: the unit that had to change belongs to a session the escalated half of
+ * the command cannot see.
+ *
+ * So an escalated run drops back to the invoking user, and hands them the runtime
+ * directory their session bus lives in — deriving it rather than inheriting it,
+ * because sudo does not carry XDG_RUNTIME_DIR across and the default under sudo
+ * points at root's.
+ */
+export function userSystemctl(env = process.env, { home = operatorHome({ env }), owner = ownerOf } = {}) {
+  const user = env.SUDO_USER || env.DOAS_USER;
+  // Not escalated, or escalated from root itself: the session in reach is the
+  // right one.
+  if (!user || user === "root") return ["systemctl", "--user"];
+  // sudo publishes the uid; doas publishes only the name. Falling back to the
+  // owner of the operator's home covers that, and covers an escalator that
+  // publishes neither — without it, a doas machine would quietly address root's
+  // session, which has no bridge in it and never will.
+  const uid = env.SUDO_UID || env.DOAS_UID || owner(home);
+  if (uid === null || uid === undefined) return ["systemctl", "--user"];
+  return ["sudo", "-u", user, "env", `XDG_RUNTIME_DIR=/run/user/${uid}`, "systemctl", "--user"];
+}
+
+function ownerOf(path) {
+  try {
+    return statSync(path).uid;
+  } catch {
+    return null;
+  }
 }
 
 /**
@@ -127,6 +165,8 @@ export function serviceUnit({
   return lines.join("\n");
 }
 
+const defaultRead = async (path) => readFile(path, "utf8").catch(() => "");
+
 function run(command, args) {
   return new Promise((resolve) => {
     const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
@@ -140,8 +180,8 @@ function run(command, args) {
 }
 
 /** Write the unit and start it. Returns the steps taken, in order, for printing. */
-export async function installService(unit, { system = false, home = homedir(), exec = run } = {}) {
-  const { path, systemctl, scope } = servicePaths({ system, home });
+export async function installService(unit, { system = false, home = operatorHome(), exec = run, env = process.env } = {}) {
+  const { path, systemctl, scope } = servicePaths({ system, home, env });
   const steps = [];
   try {
     await mkdir(dirname(path), { recursive: true });
@@ -152,7 +192,14 @@ export async function installService(unit, { system = false, home = homedir(), e
   }
 
   const [cmd, ...flags] = systemctl;
-  for (const args of [[...flags, "daemon-reload"], [...flags, "enable", "--now", UNIT_NAME]]) {
+  // Enable *and* restart. `enable --now` starts a stopped unit and does nothing
+  // to a running one, so rewriting the unit to add `--proxy` would leave the old
+  // bridge running without it — the change on disk, no change in behaviour.
+  for (const args of [
+    [...flags, "daemon-reload"],
+    [...flags, "enable", UNIT_NAME],
+    [...flags, "restart", UNIT_NAME],
+  ]) {
     const result = await exec(cmd, args);
     steps.push({ step: `${cmd} ${args.join(" ")}`, ok: result.ok, error: result.error });
     if (!result.ok) return { ok: false, path, scope, steps };
@@ -160,9 +207,119 @@ export async function installService(unit, { system = false, home = homedir(), e
   return { ok: true, path, scope, steps };
 }
 
+/**
+ * The `--upstream` servers an installed unit already forwards to.
+ *
+ * Read back rather than recomputed. A supervised bridge needs upstreams to hand
+ * the clearnet to, and the machine may already be routing every lookup at that
+ * bridge — so asking the system resolver what its upstreams are can answer
+ * "this bridge", and a bridge whose upstream is itself resolves nothing at all.
+ * Whatever the unit was working with is the safe answer to keep.
+ */
+export function unitUpstreams(text) {
+  const line = String(text ?? "").split("\n").find((l) => l.startsWith("ExecStart="));
+  if (!line) return [];
+  const parts = line.trim().split(/\s+/);
+  const found = [];
+  for (let i = 0; i < parts.length; i += 1) {
+    if (parts[i] !== "--upstream") continue;
+    const value = parts[i + 1];
+    if (!value || value.startsWith("--")) continue;
+    if (!found.includes(value)) found.push(value);
+  }
+  return found;
+}
+
+/**
+ * Re-describe the bridge unit to match the run happening now, and restart it so
+ * the description becomes the truth.
+ *
+ * This is the step that made proxy mode arrive one reboot late. A supervised
+ * bridge is not started by `enable`: it is already up under `Restart=always`,
+ * so `startDaemon` finds a live pidfile and reports "already running" — true,
+ * and useless, because what a resolver answers with is fixed when it spawns. A
+ * bridge that came up before the proxy existed goes on answering origins
+ * forever, and stopping it by hand does not help, since systemd brings the same
+ * ExecStart straight back.
+ *
+ * The only thing that changes a supervised bridge's mind is rewriting its unit
+ * and restarting it. That is all this is.
+ *
+ * With no unit installed it does nothing and says so. An unsupervised machine
+ * is `startDaemon`'s business, and writing a unit here would be `enable`
+ * quietly making the bridge outlive a reboot on a machine that never asked for
+ * that — a different decision, and one `dns service --write` exists to make.
+ */
+export async function refreshService({
+  entry,
+  port,
+  registryBase = null,
+  proxy = null,
+  system = false,
+  home = operatorHome(),
+  env = process.env,
+  exec = run,
+  exists = existsSync,
+  read = defaultRead,
+} = {}) {
+  const { path, scope } = servicePaths({ system, home, env });
+  if (!exists(path)) return { refreshed: false, reason: "no unit installed", path, scope, upstreams: [], steps: [] };
+
+  const current = await read(path);
+  const upstreams = unitUpstreams(current);
+  const unit = serviceUnit({ system, entry, port, registryBase, upstreams, proxy });
+
+  // Deliberately not short-circuited on `current === unit`. Matching text says
+  // the unit describes the right bridge, not that the bridge is running it: a
+  // unit can be installed and stopped, installed and never enabled, or running
+  // what it was spawned with before the file last changed. Since the whole
+  // point here is to make what is running match what is written, the enable and
+  // restart happen either way, and cost a moment of no resolver during a
+  // command that is already rewriting the machine's routing.
+
+  const result = await installService(unit, { system, home, env, exec });
+  return {
+    refreshed: result.ok,
+    reason: result.ok ? null : "systemctl refused the unit",
+    path,
+    scope,
+    upstreams,
+    steps: result.steps,
+  };
+}
+
+/**
+ * Stop the supervised bridge and leave the unit where it is.
+ *
+ * `stopDaemon` cannot do this. It reads the pidfile and signals that process,
+ * which is right for a bridge started by hand and useless for one systemd owns:
+ * the unit is `Restart=always`, so the pid dies and the same ExecStart is back
+ * within the second. `disable` printed "bridge stopped" and left a bridge
+ * running — on a machine whose routing had just been put back, so the bridge
+ * was still up, still answering, and no longer on anybody's path.
+ *
+ * The unit file stays. Removing it is a different decision than turning
+ * resolution off for an afternoon, and `enable` re-enables what it finds — so
+ * leaving it costs nothing and deleting it would quietly take away a unit the
+ * operator may have written themselves.
+ */
+export async function stopService({ system = false, home = operatorHome(), env = process.env, exec = run, exists = existsSync } = {}) {
+  const { path, systemctl, scope } = servicePaths({ system, home, env });
+  if (!exists(path)) return { stopped: false, reason: "no unit installed", path, scope, steps: [] };
+  const [cmd, ...flags] = systemctl;
+  const result = await exec(cmd, [...flags, "disable", "--now", UNIT_NAME]);
+  return {
+    stopped: result.ok,
+    reason: result.ok ? null : (result.error || "systemctl refused"),
+    path,
+    scope,
+    steps: [{ step: `${cmd} ${flags.join(" ")} disable --now ${UNIT_NAME}`, ok: result.ok, error: result.error }],
+  };
+}
+
 /** Stop it and take the unit away. Missing is not a failure — removal is idempotent. */
-export async function removeService({ system = false, home = homedir(), exec = run } = {}) {
-  const { path, systemctl, scope } = servicePaths({ system, home });
+export async function removeService({ system = false, home = operatorHome(), exec = run, env = process.env } = {}) {
+  const { path, systemctl, scope } = servicePaths({ system, home, env });
   const [cmd, ...flags] = systemctl;
   const steps = [];
   for (const args of [[...flags, "disable", "--now", UNIT_NAME]]) {

package/src/dns.mjs

@@ -2148,6 +2148,59 @@ export async function verifyResolution({
   return { ok: checks.every((c) => c.ok), checks };
 }
 
+/**
+ * Wait for a bridge that systemd has just restarted to start answering.
+ *
+ * `startDaemon` cannot be asked this. It spawns, watches its own child, and
+ * decides from a pidfile — none of which describes a unit that systemd owns and
+ * has just cycled. Calling it here would either report the pre-restart pid as
+ * "already running" or, on a pidfile not yet rewritten, spawn a second bridge
+ * against the one systemd is bringing up.
+ *
+ * `Type=simple` reports active the moment the process forks, so systemd saying
+ * the restart worked is not yet a resolver that answers. Hence the probe.
+ *
+ * A timeout is reported as started-but-unverified rather than as a failure, the
+ * same way `startDaemon` treats a live process that has not answered yet: the
+ * unit is active, and refusing this machine its DNS over a slow first registry
+ * fetch would be the worse mistake.
+ */
+export async function supervisedReady({
+  host = DEFAULT_HOST,
+  port,
+  probe = probeResolver,
+  status = daemonStatus,
+  timeoutMs = READY_TIMEOUT_MS,
+  sleep = (ms) => new Promise((r) => setTimeout(r, ms)),
+} = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let answered = false;
+  while (Date.now() < deadline) {
+    if (await probe({ host, port }).catch(() => false)) {
+      answered = true;
+      break;
+    }
+    await sleep(150);
+  }
+  const current = await Promise.resolve(status()).catch(() => null);
+  if (!answered) {
+    // Reported as a failure, unlike `startDaemon`'s slow-but-alive case, and
+    // for a reason that does not apply there: that one has watched its own
+    // child and knows it is running. Nothing here has. `systemctl restart`
+    // returns as soon as a Type=simple unit forks, so it returns 0 for a bridge
+    // that forked and died — and the next thing this run does is point every
+    // lookup on the machine at that port. Refusing is the safe direction.
+    return {
+      started: false,
+      alreadyRunning: false,
+      pid: current?.pid ?? null,
+      supervised: true,
+      error: `${UNIT_NAME} restarted but the bridge did not answer on ${host}:${port}`,
+    };
+  }
+  return { started: true, pid: current?.pid ?? null, alreadyRunning: false, supervised: true, verified: true };
+}
+
 const defaultReadMaybe = async (path) => {
   const { readFile: rf } = await import("node:fs/promises");
   return rf(path, "utf8").catch(() => null);
@@ -2407,10 +2460,10 @@ import { readFile, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { isRealTld } from "./iana-tlds.mjs";
-import { installService, removeService, serviceUnit, servicePaths, UNIT_NAME, ensureProxyService, removeProxyService, proxyServicePaths, proxyWrapperPath } from "./dns-service.mjs";
+import { installService, refreshService, removeService, serviceUnit, servicePaths, stopService, UNIT_NAME, ensureProxyService, removeProxyService, proxyServicePaths, proxyWrapperPath } from "./dns-service.mjs";
 import {
   applyPlan, daemonStatus, describePlan, detectPlatform, disablePlan, enablePlan,
-  probeResolver, requiredPort, startDaemon, stopDaemon,
+  probeResolver, READY_TIMEOUT_MS, requiredPort, startDaemon, stopDaemon,
 } from "./dns-system.mjs";
 import { escalateSelf } from "./escalate.mjs";
 
@@ -2508,10 +2561,13 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     presenceImpl = bridgePresence,
     exists = existsSync,
     startBridge = startDaemon,
+    refreshBridge = refreshService,
+    bridgeReady = supervisedReady,
     proxyReachableImpl = proxyReachable,
     findLocalProxyImpl = findLocalProxy,
     autoTrustImpl = createAutoTrust,
     stopBridge = stopDaemon,
+    stopSupervised = stopService,
     // The two proxy-service calls, injected for the same reason as every
     // other system call here: a test must be able to exercise the branch
     // without shelling out to systemctl or writing to /etc.
@@ -3224,6 +3280,19 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
         return 1;
       }
 
+      // The supervised bridge first, and by asking systemd rather than by
+      // signalling a pid. `stopDaemon` kills what the pidfile names, and the
+      // unit is `Restart=always` — so the process died, systemd replaced it
+      // within the second, and this command reported "bridge stopped" on a
+      // machine where the bridge was still up and answering, just no longer on
+      // anything's path.
+      const unsupervised = await stopSupervised();
+      if (unsupervised.reason !== "no unit installed") {
+        out(unsupervised.stopped
+          ? `  ok   ${UNIT_NAME} stopped and disabled`
+          : `  --   could not stop ${UNIT_NAME} (${unsupervised.reason}) — it will restart itself`);
+      }
+
       const stopped = await stopBridge();
       out(stopped.stopped ? "  ok   bridge stopped" : `  ok   bridge was not running${stopped.reason ? ` (${stopped.reason})` : ""}`);
 
@@ -3412,17 +3481,42 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
       }
     }
 
+    // A bridge under systemd is re-described, not started — and this is the step
+    // whose absence left the last of this to be done by hand.
+    //
+    // `startBridge` below reports "already running" for a supervised bridge and
+    // leaves it alone. That is correct, and it is also why proxy mode arrived a
+    // reboot late: what a resolver answers with is fixed when it spawns, so a
+    // bridge that came up before the proxy existed goes on answering origins no
+    // matter what this run decides. Stopping it does not help either, since
+    // `Restart=always` brings the same ExecStart back.
+    //
+    // So the unit is rewritten to match the run happening now, and restarted.
+    // v4 by preference: `dns start --proxy` takes one address and probes both
+    // families itself, so handing it the v4 loopback lets it find ::1 too
+    // rather than pinning the answer to one family.
+    const proxyArg = proxyAddress ? (proxyAddress.v4 || proxyAddress.v6) : null;
+
+    let refreshed = null;
+    if (!reusing && platform === "linux") {
+      refreshed = await refreshBridge({ entry: cliEntry(), port: wanted, registryBase, proxy: proxyArg });
+      for (const step of refreshed.steps || []) {
+        out(`  ${step.ok ? "ok  " : "--  "} ${step.step}${step.error ? ` — ${step.error}` : ""}`);
+      }
+      if (refreshed.refreshed) {
+        const forwarding = refreshed.upstreams?.length ? `, forwarding the clearnet to ${refreshed.upstreams.join(", ")}` : "";
+        out(`  ok   ${UNIT_NAME} restarted with proxy mode ${proxyArg ? "on" : "off"}${forwarding}`);
+      } else if (refreshed.reason !== "no unit installed") {
+        out(`  --   could not update ${UNIT_NAME} (${refreshed.reason})`);
+        out("       the bridge already running keeps the mode it started with");
+      }
+    }
+
     const started = reusing
       ? { started: false, pid: reusing.pid, alreadyRunning: true, reused: true }
-      : await startBridge({
-        port: wanted,
-        registryBase,
-        entry: cliEntry(),
-        // v4 by preference: `dns start --proxy` takes one address and probes
-        // both families itself, so handing it the v4 loopback lets it find ::1
-        // too rather than pinning the answer to one family.
-        proxy: proxyAddress ? (proxyAddress.v4 || proxyAddress.v6) : null,
-      });
+      : refreshed?.refreshed
+        ? await bridgeReady({ host: DEFAULT_HOST, port: wanted })
+        : await startBridge({ port: wanted, registryBase, entry: cliEntry(), proxy: proxyArg });
     // The routing this is about to install is catch-all — every lookup on the
     // machine, not just Moshpit ones — so a bridge that did not come up is not
     // a degraded feature, it is the machine's resolver pointed at nothing.
@@ -3504,7 +3598,13 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
       out(`Moshpit names now resolve on this machine. Try: moshcode dns resolve ${moshpitProbe || "<name>"}`);
       out(`Routing covers the ${tlds.length} TLDs claimed right now. New ones do not route`);
       out("until you re-run this — there is no common suffix to match, so every TLD is listed.");
-      out("Note: the bridge does not yet survive a reboot. Re-run `moshcode dns enable` after one.");
+      // Only where it is still true. On a supervised machine the unit was just
+      // enabled and restarted, so the bridge does come back — and telling
+      // someone to re-run a command they do not need is how advice stops being
+      // read at all.
+      out(started.supervised
+        ? `Note: ${UNIT_NAME} brings the bridge back after a reboot.`
+        : "Note: the bridge does not yet survive a reboot. Re-run `moshcode dns enable` after one.");
       return 0;
     }
 
@@ -3512,7 +3612,14 @@ export async function dnsCommand(args = [], out = console.log, deps = {}) {
     report(outcome.rolledBack.results);
     // Started by this run and no longer routed to, so leaving it would be a
     // process holding 5354 that the next enable's preflight refuses to run past.
-    if (started.started) {
+    //
+    // A supervised bridge is exempt: this run did not start it, only restarted
+    // it, so it was holding that port before the run and is meant to go on
+    // holding it. Signalling its pid would not stop it anyway — `Restart=always`
+    // replaces it within the second — so the only thing the old line achieved
+    // there was printing "remove bridge started by this run" about a bridge
+    // that was neither started by this run nor removed.
+    if (started.started && !started.supervised) {
       const stopped = await stopBridge();
       if (stopped.stopped) out("  ok   remove bridge started by this run");
     }