pi-lens 4.3.0 → 4.4.0

package/dist/clients/warm-attach.js

@@ -1,305 +0,0 @@
-import * as fs from "node:fs";
-import * as net from "node:net";
-import * as path from "node:path";
-import { readInstanceRegistry, selectLivePeerInstances, } from "./instance-registry.js";
-import { realIsPidAlive } from "./instance-reaper.js";
-import { logLatency } from "./latency-logger.js";
-import { touchCoverageGap } from "./lsp/diagnostic-binding.js";
-import { loadLspService } from "./lsp-lazy.js";
-import { contentHash, createWarmIpcLineReader, diagnosticsIpcPathForCwd, requestWarmCodeActions, requestWarmDiagnostics, WARM_CODE_ACTION_LOOKUP_LIMIT, WARM_DIAGNOSTICS_SCHEMA_VERSION, } from "./mcp/ipc.js";
-import { incrementDegradationCount, recordDegradationOnce, } from "./degradation-ledger.js";
-import { normalizeFilePath } from "./path-utils.js";
-const state = { local: true, servedDiagnosticHashes: new Map() };
-function record(event, cwd, reason, pid, source) {
-    logLatency({
-        type: "phase",
-        phase: "lsp_warm_attach",
-        filePath: cwd,
-        durationMs: 0,
-        metadata: { event, reason, incumbentPid: pid, source },
-    });
-}
-/**
- * The oldest live peer on this root, if any. The liveness rule itself lives
- * in `selectLivePeerInstances` (#2007) so warm-attach and the shared-checkout
- * guard cannot drift apart about what "another session is here" means.
- */
-export function selectWarmAttachIncumbent(entries, cwd, now = Date.now(), isPidAlive = realIsPidAlive) {
-    return selectLivePeerInstances(entries, cwd, now, isPidAlive)[0];
-}
-async function serveRequest(req) {
-    if (req.route === "code-actions") {
-        if (req.version !== WARM_DIAGNOSTICS_SCHEMA_VERSION ||
-            req.ranges.length > WARM_CODE_ACTION_LOOKUP_LIMIT ||
-            Date.now() > req.deadlineAt ||
-            state.servedDiagnosticHashes.get(normalizeFilePath(req.file)) !==
-                req.contentHash) {
-            return { error: "stale request" };
-        }
-        try {
-            const actions = await Promise.all(req.ranges.map(async (range) => {
-                if (Date.now() > req.deadlineAt) {
-                    throw new Error("deadline exceeded");
-                }
-                return (await loadLspService())
-                    .getLSPService()
-                    .codeAction(req.file, range.start.line, range.start.character, range.end.line, range.end.character);
-            }));
-            const servedAt = Date.now();
-            if (servedAt > req.deadlineAt)
-                return { error: "deadline exceeded" };
-            return {
-                result: {
-                    route: "code-actions",
-                    version: WARM_DIAGNOSTICS_SCHEMA_VERSION,
-                    contentHash: req.contentHash,
-                    servedAt,
-                    actions,
-                },
-            };
-        }
-        catch (error) {
-            return { error: String(error) };
-        }
-    }
-    if (req.route !== "diagnostics" ||
-        req.version !== WARM_DIAGNOSTICS_SCHEMA_VERSION) {
-        return { error: "schema mismatch" };
-    }
-    if (Date.now() > req.deadlineAt ||
-        contentHash(req.content) !== req.contentHash) {
-        return { error: "stale request" };
-    }
-    const touched = await (await loadLspService())
-        .getLSPService()
-        .touchFile(req.file, req.content, {
-        diagnostics: "document",
-        collectDiagnostics: true,
-        clientScope: "with-auxiliary",
-        maxClientWaitMs: Math.max(1, req.deadlineAt - Date.now()),
-        maxDiagnosticsWaitMs: Math.max(1, req.deadlineAt - Date.now()),
-        source: "warm-attach-incumbent",
-    });
-    const servedAt = Date.now();
-    // #1470: the coverage gap is read through the shared helper, never re-derived
-    // from `confirmation === "partial"`. The two fields are set together today, so
-    // either test passes — which is exactly the coincidence `touchCoverageGap`'s
-    // own doc comment warns against. One reader, one rule.
-    const coverageGap = touchCoverageGap(touched);
-    if (servedAt <= req.deadlineAt &&
-        touched !== undefined &&
-        !touched.inconclusive) {
-        state.servedDiagnosticHashes.set(normalizeFilePath(req.file), req.contentHash);
-    }
-    return {
-        result: {
-            route: "diagnostics",
-            version: WARM_DIAGNOSTICS_SCHEMA_VERSION,
-            // #1179: `touchFile` now returns the `{ diags, inconclusive, binding }`
-            // wrapper — take the array off `.diags`. This is the canonical shape-5
-            // serialization boundary: the diagnostics array crosses the IPC socket
-            // and `inconclusive` is re-surfaced below as an EXPLICIT enumerable DTO
-            // field (no side-channel survives `JSON.stringify`).
-            diagnostics: touched?.diags ?? [],
-            contentHash: req.contentHash,
-            servedAt,
-            fresh: servedAt <= req.deadlineAt && touched !== undefined,
-            inconclusive: touched?.inconclusive === true,
-            // #1253: carry the touch's own confirmation verdict across the socket
-            // as an explicit enumerable field (same doctrine as `inconclusive`) —
-            // without it, an incumbent-served empty result from a silent-on-clean
-            // server is indistinguishable from "never answered" on the far side.
-            ...(touched?.confirmation === "confirmed"
-                ? { confirmation: "confirmed" }
-                : {}),
-            // #1470: a PARTIAL touch crosses the socket as itself rather than as a
-            // missing key. Omitting it would still fail closed on the far side, but it
-            // would be indistinguishable from an old incumbent that never sent the
-            // field — and the whole point of narrowing is that the reader can tell
-            // which coverage is real.
-            ...(coverageGap.length > 0
-                ? {
-                    confirmation: "partial",
-                    unconfirmedServerIds: [...coverageGap],
-                }
-                : {}),
-        },
-    };
-}
-function startServer(cwd) {
-    state.server?.close();
-    const endpoint = diagnosticsIpcPathForCwd(cwd, process.pid);
-    if (process.platform !== "win32") {
-        try {
-            fs.unlinkSync(endpoint);
-        }
-        catch {
-            // No stale socket.
-        }
-    }
-    const server = net.createServer((socket) => {
-        socket.setEncoding("utf8");
-        // #3389: an ACCEPTED socket with no `error` listener rethrows, and
-        // `server.on("error")` below covers only the listener. A client that walks
-        // away while this incumbent is answering — every `requestWarmDiagnostics`
-        // timeout, schema refusal and validation refusal destroys its socket
-        // (`clients/mcp/ipc.ts:312`) — therefore turned a routine
-        // `read ECONNRESET` into an uncaught exception in THIS host, the same
-        // ending #3375 closed for an unbounded `data` handler. The handler does NOT
-        // tear the connection down: a real system failure has already destroyed the
-        // stream before this runs (measured: `destroyed` is true at entry), and an
-        // `error` emitted with no errno leaves a socket that is still answering
-        // (review round 1) — destroying that one would drop a live request. So the
-        // handler exists to keep the event catchable and to leave the peer's
-        // behavior visible in the ledger.
-        socket.on("error", (failure) => {
-            incrementDegradationCount({
-                // Subject is the errno, so one peer's repeated resets stay one row.
-                // No `?? "unknown"` fallback: `normalizeForLedger`
-                // (`clients/ledger-bounds.ts:29`) already maps a missing value to
-                // `"unknown"`, and a second copy of that rule here was a branch no
-                // mutation could red (#3389 review round 1, F3395-01) — an error
-                // emitted with no `code` is pinned end-to-end in
-                // `tests/clients/warm-attach-socket-error.test.ts`.
-                kind: "warm-attach-socket-error",
-                subject: failure.code,
-                reason: String(failure),
-            });
-        });
-        // One-shot per connection (#1219 family): the same defect shape as the
-        // MCP warm socket — clients write exactly one request and read one
-        // reply, so a handler that kept re-reading the same buffered line
-        // re-dispatched the request on stray bytes. The shared reader consumes
-        // the line and ignores anything after it.
-        socket.on("data", createWarmIpcLineReader((line) => {
-            void (async () => {
-                try {
-                    const req = JSON.parse(line);
-                    socket.end(`${JSON.stringify(await serveRequest(req))}\n`);
-                }
-                catch (error) {
-                    socket.end(`${JSON.stringify({ error: String(error) })}\n`);
-                }
-            })();
-        }, {
-            label: "warm-attach-server",
-            // #3383: an unterminated request line is answered like any other
-            // unusable request rather than buffered without a ceiling.
-            onOverflow: () => socket.end(`${JSON.stringify({ error: "warm request line exceeded the framing limit" })}\n`),
-        }));
-    });
-    server.on("error", (error) => {
-        record("listener-error", cwd, String(error));
-    });
-    server.listen(endpoint);
-    server.unref();
-    state.server = server;
-}
-export async function configureWarmAttach(cwd) {
-    state.cwd = path.resolve(cwd);
-    state.incumbentPid = undefined;
-    state.local = true;
-    if (process.env.PI_LENS_WARM_ATTACH !== "1") {
-        record("disabled", state.cwd, "opt-in-not-enabled");
-        return;
-    }
-    startServer(state.cwd);
-    const incumbent = selectWarmAttachIncumbent(await readInstanceRegistry(), state.cwd);
-    if (!incumbent) {
-        record("local", state.cwd, "no-live-incumbent");
-        return;
-    }
-    state.incumbentPid = incumbent.pid;
-    state.local = false;
-    record("attached", state.cwd, undefined, incumbent.pid);
-}
-export async function tryWarmAttachedDiagnostics(file, content, timeoutMs, source = "per-edit") {
-    if (state.local || !state.cwd || !state.incumbentPid)
-        return undefined;
-    const entries = await readInstanceRegistry();
-    const incumbent = selectWarmAttachIncumbent(entries, state.cwd);
-    if (incumbent?.pid !== state.incumbentPid) {
-        promoteToLocal("incumbent-stale-or-exited");
-        return undefined;
-    }
-    const result = await requestWarmDiagnostics(state.cwd, state.incumbentPid, file, content, timeoutMs);
-    if (!result.available) {
-        // #3255 H1: a confirmed-alive incumbent whose endpoint has no listener is
-        // the upgrade-stranded shape — narrowing the workspace-id case fold
-        // renamed the socket, so a peer that registered before the upgrade is
-        // still serving the previous name. `promoteToLocal` alone left that in the
-        // latency log only; this is the entry `/lens-perf` renders. Bounded twice
-        // over: once per kind/subject by the ledger, and once per session by
-        // `promoteToLocal`'s latch, which returns early on every later call.
-        if (result.reason === "no-listener") {
-            recordDegradationOnce({
-                kind: "warm-ipc-endpoint-missing",
-                subject: diagnosticsIpcPathForCwd(state.cwd, state.incumbentPid),
-                reason: "the registry confirms this incumbent is alive but nothing is listening on its derived endpoint — if pi-lens was upgraded while it was running, restart it",
-            });
-        }
-        promoteToLocal(result.reason);
-    }
-    else {
-        record("diagnostics-served", file, undefined, state.incumbentPid, source);
-    }
-    return result;
-}
-export async function tryWarmAttachedCodeActions(file, expectedContentHash, ranges, timeoutMs) {
-    if (state.local || !state.cwd || !state.incumbentPid)
-        return undefined;
-    const result = await requestWarmCodeActions(state.cwd, state.incumbentPid, file, expectedContentHash, ranges, timeoutMs);
-    if (result.available) {
-        record("code-actions-served", file, undefined, state.incumbentPid);
-    }
-    else {
-        // Quickfixes are optional enrichment. Diagnostics already succeeded, so a
-        // code-action failure is deliberately softer and must not trigger takeover.
-        record("code-actions-skipped", file, result.reason, state.incumbentPid);
-    }
-    return result;
-}
-export function isWarmAttached() {
-    return !state.local && state.incumbentPid !== undefined;
-}
-function promoteToLocal(reason) {
-    if (state.local)
-        return;
-    const pid = state.incumbentPid;
-    state.local = true;
-    state.incumbentPid = undefined;
-    record("takeover", state.cwd ?? process.cwd(), reason, pid);
-}
-export function _resetWarmAttachForTests() {
-    state.server?.close();
-    state.server = undefined;
-    state.cwd = undefined;
-    state.incumbentPid = undefined;
-    state.local = true;
-    state.servedDiagnosticHashes.clear();
-}
-/**
- * The live diagnostics server, exposed for tests (#3389 review round 1,
- * F3395-01). The `error` handler on an ACCEPTED socket has exactly one input
- * channel — an `error` event on that socket — and a test cannot reach the
- * socket any other way: it is created by `net.createServer` inside the closure
- * above, and Node's ESM namespace for `node:net` is not configurable, so the
- * factory cannot be wrapped from a test either. A test observes the server's
- * own `connection` event through this accessor; nothing in production reads it.
- */
-export function _warmAttachServerForTests() {
-    return state.server;
-}
-export function _setWarmAttachForTests(cwd, incumbentPid) {
-    state.cwd = path.resolve(cwd);
-    state.incumbentPid = incumbentPid;
-    state.local = false;
-}
-/**
- * The incumbent-side request handler, exposed for tests. The socket wiring
- * around it (`startServer`) can only be exercised by a test that actually
- * binds a unix socket, which is not available in every sandbox — this seam
- * lets the DTO-composition half (notably the #1253 `confirmation` field, whose
- * absence is what a consumer reads as unconfirmed) be pinned directly.
- */
-export const _serveWarmRequestForTests = serveRequest;