pi-orchestrator-config 4.26.0 → 4.26.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [4.26.1] - 2026-11-06
+
+- The tmp sweep carries no hardcoded control-file name list: it asks
+  `daemon-manager.isLiveLegacyDaemonFile()`, which owns the two legacy names, so a future daemon
+  writing to `.pi/run` can never require the sweep to be edited. A legacy `pidiff.port`/`pidiff.pid`
+  is kept only while its recorded PID is alive (`EPERM` counts as alive — another user's running
+  process), and a dead daemon's leftovers plus every `reload.*` marker are swept like any other
+  entry. Deleting a live daemon's lockfiles would make the next connect() spawn a duplicate on its
+  port.
+- A control file can no longer block or exhaust a session: `readLockfile` accepts only regular
+  files, so a project FIFO at `pidiff.port`/`pidiff.pid` is ignored, and the pid read is capped at
+  64 bytes so an oversized file is rejected without being read.
+
 ## [4.26.0] - 2026-11-06
 
 - Async `chain` mode: steps run in sequence and each step's result is substituted into `{previous}`,

package/extensions/orchestrator/tmp-cleanup.ts

@@ -15,6 +15,7 @@ import * as fs from "node:fs";
 import { promises as fsp } from "node:fs";
 import * as path from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { isLiveLegacyDaemonFile } from "../shared/daemon-manager.js";
 import { createLogger } from "../shared/logger.js";
 import { isPiOneshotInvocation } from "../shared/oneshot.js";
 import { getGlobalSettingsPath, getSettingDynamic, getSettingsPath, SETTINGS_KEYS } from "./project-settings.js";
@@ -29,21 +30,6 @@ const DAY_MS = 24 * 60 * 60 * 1000;
 /** Defaults live in `settings-keys.json` only — never restated here. */
 export const DEFAULT_MAX_SIZE = String(SETTINGS_KEYS.project_tmp_max_size.default);
 export const DEFAULT_RETENTION_DAYS = Number(SETTINGS_KEYS.project_tmp_retention_days.default);
-/**
- * Transitional debris from pre-#1020 daemons: `.pi/tmp` was the control-file home
- * before `.pi/run`, so a daemon started before the upgrade still holds its pid/port and
- * reload handshake here, and the read-both fallback (#1025) needs these files to find it.
- * Sweeping them would make the next connect() miss the live daemon and spawn a duplicate
- * on the same port. Never deleted, whatever their age; the set disappears once no
- * pre-upgrade daemon remains.
- */
-export const TMP_PROTECTED_NAMES = new Set([
-  "pidiff.pid",
-  "pidiff.port",
-  "reload.flag",
-  "reload.done",
-  "reload.pending",
-]);
 /** Lives in `.pi/run`, never in the swept dir. */
 export const TMP_SWEEP_LOCK = ".tmp-sweep.lock";
 /** A crashed sweep would otherwise block every later session forever. */
@@ -171,7 +157,14 @@ export async function sweepProjectTmp(opts: TmpSweepOptions): Promise<TmpSweepRe
   let total = 0;
   for (const name of names) {
     const target = path.join(base, name);
-    if (!isInside(base, target) || TMP_PROTECTED_NAMES.has(name)) continue;
+    if (!isInside(base, target)) continue;
+    // One exemption, decided by the daemon layer: a pre-`.pi/run` daemon that is still ALIVE
+    // owns its lockfile here, and sweeping it makes the next connect() spawn a duplicate on
+    // that port. A dead daemon's leftovers are throwaway like everything else (#1020).
+    if (isLiveLegacyDaemonFile(base, name)) {
+      log.debug("tmp_sweep_kept_live_legacy_daemon", { tmpDir: base, name });
+      continue;
+    }
     let stat: fs.Stats;
     try {
       stat = await fsp.lstat(target);

package/extensions/shared/daemon-manager.ts

@@ -193,19 +193,36 @@ export function writeLockfile(lockDir: string, port: number, pid: number | null,
   } catch (e: any) { log(`writeLockfile error: ${e.message}`); }
 }
 
+/** A pid file holds digits and a newline; anything bigger is not one. */
+const MAX_PID_FILE_BYTES = 64;
+
+/** True for a path that exists and is a regular file. Lockfiles are never FIFOs, and reading
+ *  one would block the event loop, so every control-file read goes through this. */
+function isRegularFile(target: string): boolean {
+  try {
+    return fs.lstatSync(target).isFile();
+  } catch {
+    return false;
+  }
+}
+
 /** Read port from lockfile. Returns port number or null.
  *  `legacyDir` (`.pi/tmp`) is consulted only when the new dir has no lockfile:
- *  a daemon already running at upgrade time wrote its lockfile there (#1020). */
+ *  a daemon already running at upgrade time wrote its lockfile there (#1020).
+ *  Reading never moves or deletes anything — moving a live daemon's record is what the
+ *  sweep's liveness check exists to avoid. */
 export function readLockfile(lockDir: string, legacyDir?: string): { port: number; pid: number | null } | null {
   const read = (dir: string): { port: number; pid: number | null } | null => {
     try {
       const portFile = path.join(dir, "pidiff.port");
-      if (!fs.existsSync(portFile)) return null;
+      // Only a regular file is a lockfile: the dirs are project-controlled, and reading a
+      // FIFO here would block the event loop for the whole session.
+      if (!isRegularFile(portFile)) return null;
       const port = parseInt(fs.readFileSync(portFile, "utf-8").trim(), 10);
       if (isNaN(port)) return null;
       let pid: number | null = null;
       const pidFile = path.join(dir, "pidiff.pid");
-      if (fs.existsSync(pidFile)) {
+      if (isRegularFile(pidFile)) {
         pid = parseInt(fs.readFileSync(pidFile, "utf-8").trim(), 10);
         if (isNaN(pid)) pid = null;
       }
@@ -215,6 +232,63 @@ export function readLockfile(lockDir: string, legacyDir?: string): { port: numbe
   return read(lockDir) ?? (legacyDir ? read(legacyDir) : null);
 }
 
+/** Read the pid from a lockfile, refusing anything but a regular file: the legacy dir is
+ *  project-controlled, and reading a FIFO there would block session startup. */
+function readLegacyPid(pidFile: string): number | null {
+  try {
+    const st = fs.lstatSync(pidFile);
+    if (!st.isFile()) {
+      log.debug("legacy_pid_not_a_regular_file", { pidFile });
+      return null;
+    }
+    // The file is project-controlled: a pid is a few bytes, so refuse anything larger rather
+    // than reading an arbitrary file into memory during session start.
+    if (st.size > MAX_PID_FILE_BYTES) {
+      log.debug("legacy_pid_file_too_large", { pidFile, size: st.size });
+      return null;
+    }
+    const pid = parseInt(fs.readFileSync(pidFile, "utf-8").trim(), 10);
+    if (isNaN(pid) || pid <= 0) {
+      log.debug("legacy_pid_unparseable", { pidFile });
+      return null;
+    }
+    return pid;
+  } catch (e: any) {
+    log.debug("legacy_pid_unreadable", { pidFile, error: e?.message });
+    return null;
+  }
+}
+
+/** True when the legacy `.pi/tmp` lockfile belongs to a LIVE process. `EPERM` means the
+ *  process exists under another user, so it counts as alive — treating it as dead would let
+ *  the sweep delete a running daemon's files. */
+export function legacyLockfileOwnerAlive(legacyDir: string): boolean {
+  const pid = readLegacyPid(path.join(legacyDir, "pidiff.pid"));
+  if (pid === null) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e: any) {
+    if (e?.code === "EPERM") {
+      log.debug("legacy_daemon_owned_by_another_user", { pid });
+      return true;
+    }
+    log.debug("legacy_daemon_not_running", { pid, code: e?.code });
+    return false;
+  }
+}
+
+/** Control files a pre-`.pi/run` daemon owns inside the legacy dir. Private: the sweep asks
+ *  `isLiveLegacyDaemonFile`, so neither module keeps a second copy of the names (#1020). */
+const LEGACY_CONTROL_FILES = new Set(["pidiff.port", "pidiff.pid"]);
+
+/** True when `name` is a legacy control file whose owner is still alive — the sweep's only
+ *  exemption. A dead daemon's leftovers are ordinary throwaway. */
+export function isLiveLegacyDaemonFile(legacyDir: string, name: string): boolean {
+  if (!LEGACY_CONTROL_FILES.has(name)) return false;
+  return legacyLockfileOwnerAlive(legacyDir);
+}
+
 /** First lockfile port (in `dirs` order) whose daemon answers /api/health, or
  *  null. Exported for testing. */
 export async function findLiveLockfile(dirs: string[]): Promise<number | null> {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-orchestrator-config",
-  "version": "4.26.0",
+  "version": "4.26.1",
   "description": "Orchestrator pattern for pi: specialist subagents, enforcement, code review loop, workflow commands",
   "keywords": [
     "pi-package"