pi-freeflow 1.44.0 → 1.45.0

package/src/relay-state.ts

@@ -46,6 +46,7 @@ function isPrivateRelayHostname(hostname: string): boolean {
   return false;
  }
  if (host.includes(":")) {
+  if (host.startsWith("64:ff9b:") || host.startsWith("2002:")) return true;
   if (host.startsWith("fc") || host.startsWith("fd")) return true; // ULA fc00::/7
   if (/^fe[89ab]/.test(host)) return true; // link-local fe80::/10
   return false;
@@ -611,7 +612,8 @@ const RELAY_STATE_LOCK_FILE = `${RELAY_STATE_FILE}.lock`;
 /** A lock older than this is presumed abandoned (crashed holder) and taken over. */
 const LOCK_STALE_MS = 30_000;
 
-function tryAcquireRelayLock(): boolean {
+export function tryAcquireRelayLock(depth = 0): boolean {
+ if (depth >= 3) return false;
  try {
   fs.writeFileSync(RELAY_STATE_LOCK_FILE, String(process.pid), { flag: "wx" });
   return true;
@@ -630,9 +632,12 @@ function tryAcquireRelayLock(): boolean {
    stale = Date.now() - fs.statSync(RELAY_STATE_LOCK_FILE).mtimeMs > LOCK_STALE_MS;
   } catch {
    // The lock vanished between the failed create and the stat — retry once.
-   return tryAcquireRelayLock();
+   return tryAcquireRelayLock(depth + 1);
+  }
+  if (!stale) {
+   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
+   return tryAcquireRelayLock(depth + 1);
   }
-  if (!stale) return false;
   try {
    fs.rmSync(RELAY_STATE_LOCK_FILE, { force: true });
   } catch {
@@ -640,7 +645,7 @@ function tryAcquireRelayLock(): boolean {
    // the proxy request path.
    return false;
   }
-  return tryAcquireRelayLock();
+  return tryAcquireRelayLock(depth + 1);
  }
 }
 
@@ -964,366 +969,4 @@ export function updateRelayStatusUi(targetUrl?: string): void {
  activeStatusUi.setStatus("freeflow", label ?? undefined);
 }
 
-// ── Relay export/import codec (relay-pool portability) ─────────────────────
-// Pure in-memory codec for `/freeflow export` + `/freeflow import`. These
-// functions never touch disk, never prompt, and never validate the live pool:
-// the command layer parses 100% in memory, then commits via one CAS write.
-
-/** Envelope marker identifying a pi-freeflow relay export file. */
-export const EXPORT_KIND = "pi-freeflow/relay-export" as const;
-/** Current relay export file version. Bump on any envelope breaking change. */
-export const EXPORT_VERSION = 1;
-/** Default file name used by `/freeflow export` when no path is given. */
-export const EXPORT_DEFAULT_FILENAME = "freeflow-relays.json";
-/** Hard cap on accepted import file size (1 MiB). */
-export const EXPORT_MAX_BYTES = 1_048_576;
-
-/** A parsed relay export file envelope. */
-export interface RelayExportArtifact {
- kind: "pi-freeflow/relay-export";
- version: 1;
- exportedAt: string;
- state: {
-  mode?: RelayMode;
-  enabled: boolean;
-  url: string;
-  relays: KnownRelay[];
-  hideWidget?: boolean;
- };
-}
-
-/** One import candidate entry that was skipped instead of aborting the file. */
-export interface RelayImportSkipped {
- index: number;
- url: string;
- reason: string;
-}
-
-/** RelayState subset carried by an import file (pool scope only). */
-export type RelayImportFragment = Pick<
- RelayState,
- "mode" | "enabled" | "url" | "relays" | "hideWidget"
->;
-
-/** Result of planning an import against the current pool. */
-export interface RelayImportPlanResult {
- next: RelayState;
- added: number;
- updated: number;
- removed: number;
- skipped: RelayImportSkipped[];
-}
-
-/** Alias kept for the cross-slice contract name. */
-export type PlanResult = RelayImportPlanResult;
-
-/**
- * Build an export artifact from live relay state. Passwords are stripped by
- * default (the key is absent, not null); pass `{ includeSecrets: true }` to
- * carry them verbatim.
- */
-export function buildRelayExport(
- state: RelayState,
- opts?: { includeSecrets?: boolean },
-): RelayExportArtifact {
- const includeSecrets = opts?.includeSecrets === true;
- return {
-  kind: EXPORT_KIND,
-  version: EXPORT_VERSION,
-  exportedAt: new Date().toISOString(),
-  state: {
-   mode: state.mode,
-   enabled: state.enabled,
-   url: state.url,
-   relays: state.relays.map((r) => {
-    const out: KnownRelay = { url: r.url };
-    if (r.label !== undefined) out.label = r.label;
-    if (r.addedAt !== undefined) out.addedAt = r.addedAt;
-    if (
-     includeSecrets &&
-     typeof r.auth === "string" &&
-     r.auth.length > 0
-    ) {
-     out.auth = r.auth;
-    }
-    return out;
-   }),
-   hideWidget: state.hideWidget,
-  },
- };
-}
-
-/**
- * Parse raw import file text into a relay fragment. Throws on envelope
- * failure (oversize, bad JSON, wrong kind/version, missing pool); per-entry
- * problems fail closed to `skipped` so one bad relay never wipes the pool.
- */
-export function parseRelayImport(raw: string): {
- fragment: RelayImportFragment;
- skipped: RelayImportSkipped[];
- warnings: string[];
-} {
- if (raw.length > EXPORT_MAX_BYTES) {
-  throw new Error(
-   `Relay import file too large (${raw.length} bytes, limit ${EXPORT_MAX_BYTES})`,
-  );
- }
- let doc: unknown;
- try {
-  doc = JSON.parse(raw);
- } catch {
-  throw new Error("Relay import file is not valid JSON");
- }
- const envelope =
-  typeof doc === "object" && doc !== null
-   ? (doc as Record<string, unknown>)
-   : null;
- if (envelope?.kind !== EXPORT_KIND) {
-  throw new Error("File is not a relay export (bad kind marker)");
- }
- if (
-  typeof envelope.version !== "number" ||
-  !Number.isInteger(envelope.version) ||
-  envelope.version !== EXPORT_VERSION
- ) {
-  throw new Error(
-   `Unsupported relay export version (${String(envelope.version)}); this build reads version ${EXPORT_VERSION}`,
-  );
- }
- const rawState =
-  typeof envelope.state === "object" && envelope.state !== null
-   ? (envelope.state as Record<string, unknown>)
-   : null;
- if (!rawState || !Array.isArray(rawState.relays)) {
-  throw new Error("File is not a relay export (state pool is missing)");
- }
-
- const warnings: string[] = [];
- const skipped: RelayImportSkipped[] = [];
-
- const rawMode = rawState.mode;
- const mode: RelayMode =
-  rawMode === "on" || rawMode === "off" || rawMode === "auto" || rawMode === "spread"
-   ? rawMode
-   : "auto";
- if (rawMode !== "on" && rawMode !== "off" && rawMode !== "auto" && rawMode !== "spread") {
-  warnings.push("Unknown relay mode in file; using automatic mode.");
- }
-
- const rawEnabled = rawState.enabled;
- const enabled =
-  typeof rawEnabled === "boolean"
-   ? rawEnabled
-   : mode === "on"
-    ? true
-    : mode === "off"
-     ? false
-     : (rawState.relays as unknown[]).length > 0;
-
- const rawUrl = rawState.url;
- let url = "";
- if (typeof rawUrl === "string" && rawUrl.trim()) {
-  const trimmed = rawUrl.trim();
-  if (validateRelayUrl(trimmed).ok) {
-   url = trimmed;
-  } else {
-   warnings.push("Active relay address in file is not usable; ignoring it.");
-  }
- }
-
- const hideWidget = rawState.hideWidget === true;
- const relays: KnownRelay[] = [];
- const seen = new Set<string>();
- const entries = rawState.relays as unknown[];
- for (let index = 0; index < entries.length; index++) {
-  const entry = entries[index];
-  if (typeof entry !== "object" || entry === null) {
-   skipped.push({ index, url: "", reason: "entry is not an object" });
-   continue;
-  }
-  const record = entry as Record<string, unknown>;
-  const trimmedUrl =
-   typeof record.url === "string" ? record.url.trim() : "";
-  if (!trimmedUrl) {
-   skipped.push({ index, url: "", reason: "missing relay address" });
-   continue;
-  }
-  const check = validateRelayUrl(trimmedUrl);
-  if (!check.ok) {
-   skipped.push({ index, url: trimmedUrl, reason: check.reason });
-   continue;
-  }
-  // Exact trimmed-address dedupe (first wins), mirroring ensureRelay.
-  if (seen.has(trimmedUrl)) {
-   skipped.push({ index, url: trimmedUrl, reason: "duplicate relay address" });
-   continue;
-  }
-  seen.add(trimmedUrl);
-  const candidate: KnownRelay = { url: trimmedUrl };
-  if (typeof record.label === "string") {
-   const cleanLabel = record.label.trim();
-   if (cleanLabel && cleanLabel !== "manual") {
-    if (cleanLabel.length > 64) {
-     candidate.label = cleanLabel.slice(0, 64);
-     warnings.push(
-      `Short name for ${trimmedUrl} truncated to 64 characters.`,
-     );
-    } else {
-     candidate.label = cleanLabel;
-    }
-   }
-  }
-  if (
-   typeof record.addedAt === "string" &&
-   Number.isNaN(Date.parse(record.addedAt)) === false
-  ) {
-   candidate.addedAt = record.addedAt;
-  }
-  if (
-   typeof record.auth === "string" &&
-   record.auth.length > 0
-  ) {
-   candidate.auth = record.auth;
-  } else if (record.auth !== undefined) {
-   warnings.push(`Password for ${trimmedUrl} is not usable; ignoring it.`);
-  }
-  relays.push(candidate);
- }
-
- return {
-  fragment: { mode, enabled, url, relays, hideWidget },
-  skipped,
-  warnings,
- };
-}
-
-function copyRelayEntry(r: KnownRelay): KnownRelay {
- const out: KnownRelay = { url: r.url };
- if (r.label !== undefined) out.label = r.label;
- if (r.addedAt !== undefined) out.addedAt = r.addedAt;
- if (r.auth !== undefined) out.auth = r.auth;
- return out;
-}
-
-/**
- * Plan an import against the current pool without touching disk or prompting.
- * Merge folds the file pool into the current one via ensureRelay semantics and
- * keeps the current mode/switch/widget; replace installs the file pool fresh.
- */
-export function planRelayImport(
- current: RelayState,
- fragment: RelayImportFragment,
- opts: { mode: "merge" | "replace" },
-): RelayImportPlanResult {
- if (opts.mode === "replace") {
-  const installed: KnownRelay[] = [];
-  const seen = new Set<string>();
-  const skipped: RelayImportSkipped[] = [];
-  const source = fragment.relays ?? [];
-  for (let index = 0; index < source.length; index++) {
-   const entry = source[index];
-   const trimmedUrl =
-    typeof entry?.url === "string" ? entry.url.trim() : "";
-   if (!trimmedUrl || !validateRelayUrl(trimmedUrl).ok) {
-    skipped.push({
-     index,
-     url: trimmedUrl,
-     reason: "relay address is not usable",
-    });
-    continue;
-   }
-   if (seen.has(trimmedUrl)) {
-    skipped.push({
-     index,
-     url: trimmedUrl,
-     reason: "duplicate relay address",
-    });
-    continue;
-   }
-   seen.add(trimmedUrl);
-   installed.push(copyRelayEntry({ ...entry, url: trimmedUrl }));
-  }
-  // Empty file pool installs nothing: fail closed here (not just in the
-  // command handler) so no caller can turn zero usable addresses into a wipe.
-  if (installed.length === 0) {
-   return {
-    next: { ...current, relays: current.relays.map(copyRelayEntry) },
-    added: 0,
-    updated: 0,
-    removed: 0,
-    skipped,
-   };
-  }
-  const installedUrls = new Set(installed.map((r) => r.url));
-  const active =
-   fragment.url && installedUrls.has(fragment.url)
-    ? fragment.url
-    : (installed[0]?.url ?? "");
-  return {
-   next: {
-    mode: fragment.mode ?? "auto",
-    enabled: fragment.enabled,
-    url: active,
-    relays: installed,
-    hideWidget: fragment.hideWidget === true,
-   },
-   added: installed.length,
-   updated: 0,
-   removed: Math.max(0, current.relays.length - installed.length),
-   skipped,
-  };
- }
-
- const next: RelayState = {
-  ...current,
-  relays: current.relays.map(copyRelayEntry),
- };
- let added = 0;
- let updated = 0;
- const skipped: RelayImportSkipped[] = [];
- const source = fragment.relays ?? [];
- for (let index = 0; index < source.length; index++) {
-  const entry = source[index];
-  const trimmedUrl =
-   typeof entry?.url === "string" ? entry.url.trim() : "";
-  if (!trimmedUrl) {
-   skipped.push({ index, url: "", reason: "missing relay address" });
-   continue;
-  }
-  let relay: KnownRelay | undefined;
-  try {
-   const already = next.relays.some((r) => r.url === trimmedUrl);
-   relay = ensureRelay(next, trimmedUrl, entry.label);
-   if (already) {
-    updated += 1;
-   } else {
-    added += 1;
-   }
-  } catch (err) {
-   skipped.push({
-    index,
-    url: trimmedUrl,
-    reason: err instanceof Error ? err.message : "relay address rejected",
-   });
-   continue;
-  }
-  // File password overwrites; an absent file password keeps the stored one.
-  if (typeof entry.auth === "string" && entry.auth.length > 0) {
-   relay.auth = entry.auth;
-  }
-  if (
-   typeof entry.addedAt === "string" &&
-   Number.isNaN(Date.parse(entry.addedAt)) === false
-  ) {
-   relay.addedAt = entry.addedAt;
-  }
- }
- const mergedUrls = new Set(next.relays.map((r) => r.url));
- if (!mergedUrls.has(next.url)) {
-  next.url =
-   fragment.url && mergedUrls.has(fragment.url)
-    ? fragment.url
-    : (next.relays[0]?.url ?? "");
- }
- return { next, added, updated, removed: 0, skipped };
-}
+export * from "./relay-codec.ts";

package/src/relay.ts

@@ -401,50 +401,97 @@ export async function relayFetch(
      fetchA.catch(() => {});
      fetchB.catch(() => {});
      interface HedgedWin { url: string; response: Response; }
+     let hedgeBAbortedByWinner = false;
+     let bProducedOutcome = false;
+     const isCallerAborted = () => Boolean(opts.signal?.aborted);
+     const isNonWinning = (status: number): boolean =>
+      isRetriableStatus(status) || status === 403 || status === 401 || status === 402;
      try {
-      const winner = await new Promise<HedgedWin>((resolve, reject) => {
-       let failures = 0;
-       let firstError: unknown = null;
-       const onError = (err: unknown) => {
-        failures += 1;
-        if (firstError === null) firstError = err;
-        if (failures >= 2) reject(firstError);
-       };
-       fetchA.then(
-        (response) => resolve({ url: primaryUrl, response }),
-        onError,
-       );
-       fetchB.then(
-        (response) => resolve({ url: nextUrl, response }),
-        onError,
-       );
-      });
+      const { promise: winnerPromise, resolve, reject } = Promise.withResolvers<HedgedWin>();
+      let firstBad: HedgedWin | null = null;
+      let firstError: unknown = null;
+      let settledCount = 0;
+      const onResponse = (legUrl: string, response: Response) => {
+       settledCount += 1;
+       if (legUrl === nextUrl) {
+        bProducedOutcome = true;
+       }
+       if (!isNonWinning(response.status)) {
+        if (firstBad) {
+         firstBad.response.body?.cancel().catch(() => {});
+         markRelayFailure(firstBad.url, firstBad.response.status);
+        }
+        resolve({ url: legUrl, response });
+        return;
+       }
+       if (!firstBad) {
+        if (settledCount >= 2) {
+         resolve({ url: legUrl, response });
+        } else {
+         firstBad = { url: legUrl, response };
+        }
+        return;
+       }
+       if (legUrl === nextUrl) {
+        markRelayFailure(nextUrl, response.status);
+        response.body?.cancel().catch(() => {});
+       } else {
+        markRelayFailure(primaryUrl, response.status);
+        response.body?.cancel().catch(() => {});
+       }
+       resolve(firstBad);
+      };
+      const onError = (legUrl: string, err: unknown) => {
+       settledCount += 1;
+       if (legUrl === nextUrl && !hedgeBAbortedByWinner) {
+        bProducedOutcome = true;
+       }
+       if (firstBad) {
+        if (legUrl === nextUrl && !hedgeBAbortedByWinner && !isCallerAborted()) {
+         markRelayFailure(nextUrl, 0, (err as Error)?.message || String(err));
+        }
+        resolve(firstBad);
+        return;
+       }
+       if (firstError === null) {
+        firstError = err;
+       }
+       if (settledCount >= 2) {
+        reject(firstError);
+       }
+      };
+      fetchA.then(
+       (r) => onResponse(primaryUrl, r),
+       (e) => onError(primaryUrl, e),
+      );
+      fetchB.then(
+       (r) => onResponse(nextUrl, r),
+       (e) => onError(nextUrl, e),
+      );
+      const winner = await winnerPromise;
       if (winner.url === nextUrl) {
        hedgeCtlA.abort();
        targetUrl = nextUrl;
        attemptStart = hedgeStart;
       } else {
+       hedgeBAbortedByWinner = true;
        hedgeCtlB.abort();
       }
       res = winner.response;
-      // Both candidates are consumed by this race: skip the next
-      // index so the loser is never retried in this request.
-      hedgeSkipNext = true;
+      if (bProducedOutcome) {
+       hedgeSkipNext = true;
+      }
      } catch (hedgeErr) {
-      // Both hedged attempts failed without usable headers. Caller
-      // abort must propagate unmarked (the outer catch rethrows);
-      // otherwise record the next relay here and let the outer
-      // catch record the primary.
       if ((hedgeErr as Error)?.name === "AbortError" && opts.signal?.aborted) {
        throw hedgeErr;
       }
-      markRelayFailure(nextUrl, 0, (hedgeErr as Error)?.message || String(hedgeErr));
-      // Both legs of this race were abandoned; the outer catch
-      // reports the primary one, this reports the hedge leg.
-      reportAbandoned(
-       (hedgeErr as Error)?.name === "AbortError" ? "header-timeout" : "network-error",
-      );
-      hedgeSkipNext = true;
+      if (bProducedOutcome) {
+       markRelayFailure(nextUrl, 0, (hedgeErr as Error)?.message || String(hedgeErr));
+       reportAbandoned(
+        (hedgeErr as Error)?.name === "AbortError" ? "header-timeout" : "network-error",
+       );
+       hedgeSkipNext = true;
+      }
       throw hedgeErr;
      }
     }