rollbridge 0.1.22 → 0.1.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.22",
+  "version": "0.1.23",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/daemon.js

@@ -837,6 +837,7 @@ export default class RollbridgeDaemon {
     }
     this.persistenceEnabled = false
     if (this.pendingWrite) await this.pendingWrite
+    this.stateCleanupEnabled = false
     this.controlClosePromise = this.closeServer(this.controlServer)
     for (const socket of this.controlSockets) if (socket !== completionSocket) socket.destroy()
     await Promise.all([

package/src/managed-process.js

@@ -364,18 +364,24 @@ export default class ManagedProcess extends EventEmitter {
 
     // 3. Stop whatever is still running, then SIGKILL if it outlasts the graceful window.
     if (this.processGroupExists(pgid)) {
-      if (stopCommand) await this.runHook(stopCommand, hookTimeoutMs, "stop command", pgid)
-      else {
+      const timeoutMs = options.timeoutMs ?? this.stopTimeoutMs
+      let gracefulDeadline
+
+      if (stopCommand) {
+        await this.runHook(stopCommand, hookTimeoutMs, "stop command", pgid)
+        gracefulDeadline = timeoutMs === "indefinite" ? undefined : Date.now() + timeoutMs
+      } else {
         this.intentionalStopSignal = /** @type {ProcessExitSignal} */ (this.stopSignal)
-        await this.signalProcessGroup(this.stopSignal, pgid, options.timeoutMs ?? this.stopTimeoutMs)
+        gracefulDeadline = timeoutMs === "indefinite" ? undefined : Date.now() + timeoutMs
+        await this.signalProcessGroup(this.stopSignal, pgid, gracefulDeadline)
       }
 
-      const timeoutMs = options.timeoutMs ?? this.stopTimeoutMs
-
-      if (!(await this.waitForProcessGroupExit(pgid, timeoutMs))) {
+      if (!(await this.waitForProcessGroupExit(pgid, gracefulDeadline))) {
         this.logger("process stop timed out; sending SIGKILL", {id: this.id, pid: pgid})
-        await this.signalProcessGroup("SIGKILL", pgid, 5000)
-        await this.waitForProcessGroupExit(pgid, 5000)
+        const killDeadline = Date.now() + 5000
+
+        await this.signalProcessGroup("SIGKILL", pgid, killDeadline)
+        await this.waitForProcessGroupExit(pgid, killDeadline)
       }
     }
 
@@ -499,10 +505,10 @@ export default class ManagedProcess extends EventEmitter {
    * Falls back to the portable group signal when procfs cannot identify group members.
    * @param {string} signal - Signal name.
    * @param {number} pgid - Process group id.
-   * @param {StopTimeoutMs} timeoutMs - Maximum time to wait for descendant reaping.
+   * @param {number | undefined} deadline - Absolute graceful deadline, or undefined to wait indefinitely.
    * @returns {Promise<void>} Resolves after the leader has been signalled.
    */
-  async signalProcessGroup(signal, pgid, timeoutMs) {
+  async signalProcessGroup(signal, pgid, deadline) {
     const members = processGroupMembers(pgid)
     const descendants = members.filter((member) => member.pid !== pgid)
 
@@ -512,11 +518,11 @@ export default class ManagedProcess extends EventEmitter {
     }
 
     for (const descendant of descendants) this.killProcess(descendant.pid, signal)
-    const deadline = timeoutMs === "indefinite" ? undefined : Date.now() + timeoutMs
-
     while (processGroupMembers(pgid).some((member) => member.pid !== pgid)) {
       if (deadline !== undefined && Date.now() >= deadline) break
-      await new Promise((resolve) => setTimeout(resolve, 25))
+      const waitMs = deadline === undefined ? 25 : Math.min(25, deadline - Date.now())
+
+      await new Promise((resolve) => setTimeout(resolve, waitMs))
     }
 
     this.killProcess(pgid, signal)
@@ -558,15 +564,15 @@ export default class ManagedProcess extends EventEmitter {
 
   /**
    * @param {number} pgid - Process group id.
-   * @param {StopTimeoutMs} timeoutMs - Timeout.
+   * @param {number | undefined} deadline - Absolute deadline, or undefined to wait indefinitely.
    * @returns {Promise<boolean>} True once the process group no longer exists.
    */
-  async waitForProcessGroupExit(pgid, timeoutMs) {
-    const deadline = timeoutMs === "indefinite" ? undefined : Date.now() + timeoutMs
-
+  async waitForProcessGroupExit(pgid, deadline) {
     while (this.processGroupExists(pgid)) {
       if (deadline !== undefined && Date.now() >= deadline) return false
-      await new Promise((resolve) => setTimeout(resolve, 10))
+      const waitMs = deadline === undefined ? 10 : Math.min(10, deadline - Date.now())
+
+      await new Promise((resolve) => setTimeout(resolve, waitMs))
     }
 
     return true

package/test/managed-process.test.js

@@ -386,8 +386,10 @@ test("a hanging lifecycle hook is bounded so stop still completes", async () =>
 })
 
 test("sends the configured stopSignal as the graceful stop signal", async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rollbridge-stop-signal-"))
+  const readyPath = path.join(dir, "ready")
   const managed = new ManagedProcess({
-    command: `${JSON.stringify(process.execPath)} -e ${JSON.stringify("setInterval(() => {}, 1000)")}`,
+    command: `${JSON.stringify(process.execPath)} -e ${JSON.stringify(`require("node:fs").writeFileSync(${JSON.stringify(readyPath)}, "ready"); setInterval(() => {}, 1000)`)}`,
     cwd: undefined,
     env: {},
     id: "worker",
@@ -408,12 +410,18 @@ test("sends the configured stopSignal as the graceful stop signal", async () =>
     killProcess(pid, signal)
   }
 
-  await managed.start()
-  await managed.stop()
+  try {
+    await managed.start()
+    await waitFor(() => fs.existsSync(readyPath))
+    await managed.stop()
 
-  // The graceful stop uses the configured signal (a SIGKILL fallback, if any, comes after).
-  assert.deepEqual(signals, ["SIGINT", "SIGINT"])
-  assert.equal(managed.status().state, "stopped")
+    // The graceful stop reaches the ready descendant and its shell leader without SIGKILL.
+    assert.deepEqual(signals, ["SIGINT", "SIGINT"])
+    assert.equal(managed.status().state, "stopped")
+  } finally {
+    await managed.stop()
+    fs.rmSync(dir, {force: true, recursive: true})
+  }
 })
 
 test("indefinite stop waits for the process to exit without SIGKILL", async () => {
@@ -527,6 +535,39 @@ test("stop does not return while a gracefully stopped descendant remains unreape
   }
 })
 
+test("descendant reaping and leader shutdown share one graceful deadline", async () => {
+  const managed = buildProcess(50)
+  const originalNow = Date.now
+  let now = 1000
+  /** @type {{deadline: number | undefined, signal?: string}[]} */
+  const calls = []
+
+  managed.pid = 123
+  managed.exitPromise = Promise.resolve()
+  managed.quiesce = async () => {}
+  managed.processGroupExists = () => true
+  managed.signalProcessGroup = async (signal, _pgid, deadline) => {
+    calls.push({deadline, signal})
+    now += signal === "SIGTERM" ? 100 : 0
+  }
+  managed.waitForProcessGroupExit = async (_pgid, deadline) => {
+    calls.push({deadline})
+    return calls.length > 2
+  }
+  Date.now = () => now
+
+  try {
+    await managed.stop({timeoutMs: 150})
+
+    assert.deepEqual(calls.slice(0, 2), [
+      {deadline: 1150, signal: "SIGTERM"},
+      {deadline: 1150}
+    ])
+  } finally {
+    Date.now = originalNow
+  }
+})
+
 test("a memory restart respawns and is counted when the supervisor still wants the process", async () => {
   const managed = buildLongLived(() => true)
 

package/test/release-runtime-retention.test.js

@@ -214,12 +214,15 @@ test("concurrent startup loser re-attests the winner before sending deploy", asy
       proxy: {drainTimeoutMs: 100, forceStopTimeoutMs: 100, host: "127.0.0.1", port: 0}
     }, null, 2)}\n`)
 
-    const loserDeploy = runReleaseCli(loserRelease, [
-      "deploy", "--ensure-daemon", "--config", configPath,
-      "--release-path", loserRelease, "--release-id", "loser",
-      "--daemon-log-path", path.join(root, "loser.log"), "--daemon-pid-path", loserPidPath,
-      "--daemon-runtime-path", path.join(root, "loser-runtime")
-    ])
+    const loserRejected = assert.rejects(
+      runReleaseCli(loserRelease, [
+        "deploy", "--ensure-daemon", "--config", configPath,
+        "--release-path", loserRelease, "--release-id", "loser",
+        "--daemon-log-path", path.join(root, "loser.log"), "--daemon-pid-path", loserPidPath,
+        "--daemon-runtime-path", path.join(root, "loser-runtime")
+      ]),
+      /legacy or mismatched runtime.*deploy was not sent/s
+    )
 
     await waitForFile(loserPausedPath)
     await runReleaseCli(winnerRelease, [
@@ -229,7 +232,7 @@ test("concurrent startup loser re-attests the winner before sending deploy", asy
       "--daemon-runtime-path", path.join(root, "winner-runtime")
     ])
 
-    await assert.rejects(loserDeploy, /legacy or mismatched runtime.*deploy was not sent/s)
+    await loserRejected
     const status = await sendControlCommand({command: {command: "status"}, path: socketPath})
 
     assert.equal(status.activeReleaseId, "winner")

package/test/shutdown-completion.test.js

@@ -12,7 +12,7 @@ import {fileURLToPath} from "node:url"
 import {normalizeConfig} from "../src/config.js"
 import {sendControlCommand} from "../src/control-client.js"
 import RollbridgeDaemon from "../src/daemon.js"
-import {isProcessAlive} from "../src/state-store.js"
+import {isProcessAlive, readState} from "../src/state-store.js"
 
 const dummyAppPath = path.join(path.dirname(fileURLToPath(import.meta.url)), "fixtures", "dummy-app.js")
 
@@ -152,6 +152,41 @@ test("external-owner retirement releases listeners before a long-draining compan
   }
 })
 
+test("a retired owner cannot clear replacement state during late shutdown", async () => {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-retired-owner-state-"))
+  const socketPath = path.join(root, "rollbridge.sock")
+  const statePath = path.join(root, "state.json")
+  const config = normalizeConfig({...rawConfig(socketPath), statePath})
+  const retired = new RollbridgeDaemon({config, logger: () => {}})
+  let replacement
+
+  try {
+    await retired.start()
+    await retired.deploy({releaseId: "retired", releasePath: root, revision: "retired"})
+    if (retired.pendingWrite) await retired.pendingWrite
+    await retired.retireOwner({attestation: `sha256:${"a".repeat(64)}`})
+
+    replacement = new RollbridgeDaemon({config, logger: () => {}})
+    await replacement.start({reportOrphans: false})
+    await replacement.deploy({releaseId: "replacement", releasePath: root, revision: "replacement"})
+    if (replacement.pendingWrite) await replacement.pendingWrite
+
+    const replacementState = /** @type {{activeReleaseId: string} | undefined} */ (await readState(statePath))
+
+    assert.equal(replacementState?.activeReleaseId, "replacement")
+
+    await retired.shutdown()
+
+    const stateAfterRetiredShutdown = /** @type {{activeReleaseId: string} | undefined} */ (await readState(statePath))
+
+    assert.equal(stateAfterRetiredShutdown?.activeReleaseId, "replacement", "late shutdown of the retired owner must preserve replacement state")
+  } finally {
+    if (replacement) await replacement.shutdown()
+    await retired.shutdown()
+    await fs.rm(root, {force: true, recursive: true})
+  }
+})
+
 test("control socket unlink failure is reported only after owned cleanup completes", async () => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), "rollbridge-shutdown-unlink-failure-"))
   const socketPath = path.join(root, "control.sock")