relay-companion 0.1.511 → 0.1.513

package/bootstrap/mac-registration-transaction.cjs

@@ -9,6 +9,23 @@ const defaultRun = (cmd, args, options = {}) => spawnSync(cmd, args, { encoding:
 const snapshotPath = homeDir => path.join(homeDir, ".relay", "runtime", "mac-registrations.json");
 const ok = r => Boolean(r && !r.error && r.status === 0);
 
+// Windows antivirus and indexing hold a handle on a file for a moment after it
+// is written, and rename fails with EPERM/EBUSY for exactly that moment. Retry
+// briefly instead of failing an entire repair on a hold that clears by itself.
+const RENAME_RETRY_CODES = new Set(["EPERM", "EBUSY", "EACCES"]);
+function renameWithRetry(fsImpl, from, to, { totalMs = 3000, sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms) } = {}) {
+  const started = Date.now();
+  let wait = 50;
+  for (;;) {
+    try { fsImpl.renameSync(from, to); return; }
+    catch (error) {
+      if (!RENAME_RETRY_CODES.has(error?.code) || Date.now() - started + wait > totalMs) throw error;
+      sleep(wait);
+      wait = Math.min(500, wait * 2);
+    }
+  }
+}
+
 function atomicFile(file, bytes, fsImpl = fs) {
   fsImpl.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
   const temporary = `${file}.${crypto.randomUUID()}.tmp`;
@@ -16,7 +33,7 @@ function atomicFile(file, bytes, fsImpl = fs) {
   try {
     fd = fsImpl.openSync(temporary, "wx", 0o600);
     fsImpl.writeFileSync(fd, bytes); fsImpl.fsyncSync(fd); fsImpl.closeSync(fd); fd = undefined;
-    fsImpl.renameSync(temporary, file);
+    renameWithRetry(fsImpl, temporary, file);
     // macOS can flush a directory after rename. Keep this conditional for test
     // hosts (Windows cannot open directory handles through this API).
     if (process.platform !== "win32") {
@@ -162,4 +179,4 @@ async function restoreSnapshot({ homeDir = os.homedir(), fsImpl = fs, run = defa
   }
 }
 
-module.exports = { atomicFile, snapshotPath, readSnapshot, clearSnapshot, prepareSnapshot, restoreSnapshot };
+module.exports = { atomicFile, renameWithRetry, snapshotPath, readSnapshot, clearSnapshot, prepareSnapshot, restoreSnapshot };

package/bootstrap/recovery-install.cjs

@@ -13,6 +13,32 @@ const ok = (r) => r?.ok === true || (!r?.error && r?.status === 0);
 const xml = (s) => String(s).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
 const unit = (s) => '"' + String(s).replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%") + '"';
 function run(command, args) { return spawnSync(command, args, { encoding: "utf8", windowsHide: true, timeout: 30_000 }); }
+// Why a command failed, in one line: the spawn error first, then whatever the
+// child said. Callers embed this in their own error so update.log names the step.
+function commandDetail(r) {
+  const text = r?.error?.message || String(r?.stderr || r?.out || r?.stdout || "").trim();
+  return `${r?.error ? "" : `exit ${r?.status ?? "unknown"}`}${text ? `${r?.error ? "" : ": "}${text}` : ""}`.slice(0, 600);
+}
+// Windows refuses to rename a directory or file while an antivirus scanner or
+// indexer still holds a handle on something it just wrote. Those holds last
+// milliseconds to a couple of seconds and then clear on their own, so a short
+// bounded retry turns a spurious EPERM into the rename that was asked for. The
+// same install step, run by hand a minute later, succeeded on the first try on
+// Dino's machine (2026-09-13) after eight consecutive worker failures.
+const RENAME_RETRY_CODES = new Set(["EPERM", "EBUSY", "EACCES", "ENOTEMPTY"]);
+const RENAME_RETRY_TOTAL_MS = 3000;
+function renameWithRetry(from, to, { fsImpl = fs, totalMs = RENAME_RETRY_TOTAL_MS, sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms) } = {}) {
+  const started = Date.now();
+  let wait = 50;
+  for (;;) {
+    try { fsImpl.renameSync(from, to); return; }
+    catch (error) {
+      if (!RENAME_RETRY_CODES.has(error?.code) || Date.now() - started + wait > totalMs) throw error;
+      sleep(wait);
+      wait = Math.min(500, wait * 2);
+    }
+  }
+}
 
 // Task Scheduler reads this XML as UTF-16 (the caller adds the BOM). The settings
 // that differ from schtasks' `/SC MINUTE` defaults are the load-bearing ones: both
@@ -84,16 +110,23 @@ function installRecovery({ packageRoot, node = process.execPath, homeDir = os.ho
     };
     // A live runner may still import these files. Never repair them in place.
     if (fs.existsSync(bundle) && !matches(bundle)) bundle = path.join(root, "versions", crypto.createHash("sha256").update(digest + crypto.randomUUID()).digest("hex"));
-    const runtimeNode = preserveNode(node, { platform, runtimeRoot: root, isTemporary: () => true });
+    let runtimeNode;
+    try { runtimeNode = preserveNode(node, { platform, runtimeRoot: root, isTemporary: () => true }); }
+    catch (error) { throw Error(`recovery-node-preservation-failed: ${error.message}`); }
     if (!fs.existsSync(bundle)) {
       const pending = path.join(root, "versions", '.pending-' + crypto.randomUUID());
       fs.mkdirSync(path.join(pending, "bootstrap"), { recursive: true, mode: 0o700 });
+      // Each step names itself when it fails. The update worker records only the
+      // message, and "recovery-install-failed" alone cost a day of guessing.
       try {
-        for (const name of names) atomicFile(path.join(pending, "bootstrap", name), fs.readFileSync(path.join(source, name)));
-        atomicFile(path.join(pending, "package.json"), fs.readFileSync(path.join(packageRoot, "package.json")));
-        if (!ok(runCommand(runtimeNode, [path.join(pending, "bootstrap", "recovery-runner.cjs"), "--self-check"]))) throw Error("recovery-bundle-verification-failed");
-        try { fs.renameSync(pending, bundle); }
-        catch (error) { if (!matches(bundle)) throw error; }
+        try {
+          for (const name of names) atomicFile(path.join(pending, "bootstrap", name), fs.readFileSync(path.join(source, name)));
+          atomicFile(path.join(pending, "package.json"), fs.readFileSync(path.join(packageRoot, "package.json")));
+        } catch (error) { throw Error(`recovery-bundle-copy-failed: ${error.message}`); }
+        const pendingCheck = runCommand(runtimeNode, [path.join(pending, "bootstrap", "recovery-runner.cjs"), "--self-check"]);
+        if (!ok(pendingCheck)) throw Error(`recovery-bundle-verification-failed: ${commandDetail(pendingCheck)}`);
+        try { renameWithRetry(pending, bundle); }
+        catch (error) { if (!matches(bundle)) throw Error(`recovery-bundle-publish-failed: ${error.message}`); }
       } finally { fs.rmSync(pending, { recursive: true, force: true }); }
     }
     const pointer = path.join(root, "current.json");
@@ -106,7 +139,7 @@ function installRecovery({ packageRoot, node = process.execPath, homeDir = os.ho
       write(path.join(root, "known-good.json"), current);
     }
     const checked = runCommand(runtimeNode, [path.join(bundle, "bootstrap", "recovery-runner.cjs"), "--self-check"]);
-    if (!ok(checked)) throw Error("recovery-bundle-verification-failed");
+    if (!ok(checked)) throw Error(`recovery-bundle-verification-failed: ${commandDetail(checked)}`);
     atomicFile(pointer, JSON.stringify({ schema: 1, version: incoming, node: runtimeNode, bundle }));
     const launcher = path.join(root, "launch.cjs");
     // Static launcher dispatches through a replaceable pointer. Never overwrite
@@ -201,4 +234,4 @@ function uninstallRecovery({ homeDir = os.homedir(), platform = process.platform
   for (const file of files) fs.rmSync(file, { force: true });
   return { ok: true };
 }
-module.exports = { installRecovery, uninstallRecovery, windowsRecoveryTaskXml, LABEL, TASK };
+module.exports = { installRecovery, uninstallRecovery, windowsRecoveryTaskXml, renameWithRetry, commandDetail, LABEL, TASK };

package/bootstrap/relay-setup.cjs

@@ -1051,6 +1051,19 @@ async function activateRuntime(layout, runtime, version, {
   return { candidate, cliLauncher };
 }
 
+// The setup-intent marker, read by the pill (overlay/main.cjs readSetupIntent).
+// Plain setup opens the pill signed out for a person who will sign in there
+// (sendrelays.com's Get started); the marker is what lets the pill start that
+// sign-in without a click. The --code and --agent-protocol paths pair without
+// a pill sign-in, so they must not leave one behind. Only the fact, the time
+// and the version are recorded: never a credential.
+const SETUP_INTENT_FILE = "setup-intent.json";
+function writeSetupIntent(configDir, version, setupCompatibilityArgs = [], { now = new Date(), write = atomicWriteJson } = {}) {
+  if (setupCompatibilityArgs.includes("--code") || setupCompatibilityArgs.includes("--agent-protocol")) return false;
+  write(path.join(configDir, SETUP_INTENT_FILE), { agentInstalled: true, at: now.toISOString(), version });
+  return true;
+}
+
 async function setup(argv = []) {
   assertCompatibleNode();
   const setupCompatibilityArgs = validateSetupCompatibilityArgs(argv);
@@ -1068,6 +1081,12 @@ async function setup(argv = []) {
     if (setupCompatibilityArgs.includes("--agent-protocol") && process.env.RELAY_BACKGROUND_INSTALL_WORKER === "1") {
       await require("./relay-background-install.cjs").waitForAgentAuthorization();
     }
+    // Before activation, so the pill it opens reads the marker on first paint.
+    // A marker that cannot be written costs the person one click, not the
+    // install, so it never fails setup.
+    try {
+      writeSetupIntent(process.env.RELAY_CONFIG_DIR || path.join(os.homedir(), ".relay"), version, setupCompatibilityArgs);
+    } catch {}
     const activated = await activateRuntime(layout, runtime, version, { setupCompatibilityArgs });
     if (setupCompatibilityArgs.includes("--code")) {
       console.log(`Relay ${version} is installed and paired. The Relay pill is open.`);
@@ -1203,6 +1222,7 @@ module.exports = {
   validateArchiveEntries,
   verifyExtractedRuntime,
   waitForRuntimeHealth,
+  writeSetupIntent,
 };
 
 if (require.main === module) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.511",
+  "version": "0.1.513",
   "description": "Install Relay for Claude Code, Cowork, and Codex, then sign in from the Relay pill.",
   "homepage": "https://sendrelays.com/get-started",
   "repository": {