rollbridge 0.1.41 → 0.1.43

package/README.md

@@ -89,6 +89,7 @@ export default {
       command: "env VELOCIOUS_BACKGROUND_JOBS_PORT={{port}} npx velocious background-jobs-main",
       lifecycle: {
         activateCommand: 'npx velocious background-jobs:activate --generation "$ROLLBRIDGE_RELEASE_ID" --socket "$VELOCIOUS_BACKGROUND_JOBS_LIFECYCLE_SOCKET"',
+        activateTimeoutMs: 60000,
         quietCommand: 'npx velocious background-jobs:retire --generation "$ROLLBRIDGE_RELEASE_ID" --socket "$VELOCIOUS_BACKGROUND_JOBS_LIFECYCLE_SOCKET"'
       },
       port: {from: 7331, to: 7399}
@@ -188,7 +189,8 @@ generation-scoped and resumable; failures remain visible and block unrelated
 deploys. Post-commit singleton replacement is also journaled and must complete
 before an exact retry reports success. If the active coordinator restarts,
 Rollbridge restores its active role with the same bounded, generation-scoped
-activation command before reporting it running. Omit `activateCommand` to
+activation command before reporting it running. Set `activateTimeoutMs` when the
+activation acknowledgement can exceed its 30-second default. Omit `activateCommand` to
 preserve the existing hook-free ordering.
 
 See [`docs/workers.md`](docs/workers.md) for the full release-generation

package/docs/config.md

@@ -303,8 +303,8 @@ service when the service starts as a quiescent candidate and requires an explici
 generation transition. Rollbridge starts and health-checks the complete candidate,
 waits for the old generation's strict retirement acknowledgement, waits for the
 candidate's strict activation acknowledgement, then commits the active release and
-proxy target synchronously. Activation is always bounded to 30 seconds;
-retirement uses the process's `gracefulStopMs` bound (or 30 seconds when that
+proxy target synchronously. Activation is bounded by `lifecycle.activateTimeoutMs`,
+which defaults to 30 seconds; retirement uses the process's `gracefulStopMs` bound (or 30 seconds when that
 window is `"indefinite"`). Both run with the process environment plus
 `ROLLBRIDGE_PID`.
 
@@ -347,7 +347,8 @@ legitimate hours-long generation drains are valid.
 
 | Field | Type | Default | Description |
 | --- | --- | --- | --- |
-| `lifecycle.activateCommand` | string | unset | For one handoff service, acknowledge activation of its already-started candidate generation after the previous generation has acknowledged retirement. Requires `quietCommand`, `statePath`, and `ownerRecovery`; bounded to 30 seconds. |
+| `lifecycle.activateCommand` | string | unset | For one handoff service, acknowledge activation of its already-started candidate generation after the previous generation has acknowledged retirement. Requires `quietCommand`, `statePath`, and `ownerRecovery`; bounded by `activateTimeoutMs`. |
+| `lifecycle.activateTimeoutMs` | positive number | `30000` | Bounds activation, reactivation, and active-role restoration commands. |
 | `lifecycle.quietCommand` | string | unset | Run first to tell the process to stop accepting new work. Bounded by `gracefulStopMs`, or 30 seconds when that window is `"indefinite"`. |
 | `lifecycle.drainCommand` | string | unset | Run after quieting to wait until the process has drained (it blocks until done). When unset, Rollbridge instead waits up to `drainTimeoutMs` for the process to exit on its own. Requires a positive `drainTimeoutMs` (which bounds it). |
 | `lifecycle.drainTimeoutMs` | non-negative number | `0` | Bounds the drain step. `0` **skips the drain step entirely** (no `drainCommand`, no wait). |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rollbridge",
-  "version": "0.1.41",
+  "version": "0.1.43",
   "description": "Zero-downtime process supervisor and local traffic switcher for deploy-managed apps.",
   "keywords": [
     "deploy",

package/src/config.js

@@ -14,7 +14,7 @@ import {pathToFileURL} from "node:url"
  * @typedef {"proxied" | "companion" | "singleton" | "service"} ProcessPolicy
  * @typedef {{backoffFactor: number, maxDelayMs: number, maxRestarts: number | undefined, windowMs: number}} RestartConfig
  * @typedef {{checkIntervalMs: number, limitBytes: number, warnBytes: number}} MemoryConfig
- * @typedef {{activateCommand?: string, drainCommand?: string, drainTimeoutMs: number, quietCommand?: string, reactivateCommand?: string, stopCommand?: string}} LifecycleConfig
+ * @typedef {{activateCommand?: string, activateTimeoutMs?: number, drainCommand?: string, drainTimeoutMs: number, quietCommand?: string, reactivateCommand?: string, stopCommand?: string}} LifecycleConfig
  * @typedef {number | "indefinite"} StopTimeoutMs
  * @typedef {"persistent" | "handoff"} ServiceDeployStrategy
  * @typedef {{cwd?: string, deployStrategy: ServiceDeployStrategy, env: Record<string, string>, gracefulStopMs: StopTimeoutMs, health?: HealthConfig, id: string, lifecycle: LifecycleConfig, memory?: MemoryConfig, nonBlockingDrain: boolean, outputLines: number, policy: ProcessPolicy, port?: PortRange, replicas: number, restart: RestartConfig, restartDelayMs: number, stopSignal: string, command: string}} ProcessConfig
@@ -343,17 +343,25 @@ function normalizeMemory(value, key, issues) {
  * @returns {LifecycleConfig} Normalized lifecycle hooks (no commands and a 0 drain by default).
  */
 function normalizeLifecycle(value, key, issues) {
-  if (value === undefined || value === null) return {drainTimeoutMs: 0}
+  if (value === undefined || value === null) return {activateTimeoutMs: 30000, drainTimeoutMs: 0}
 
   if (!isPlainObject(value)) {
     issues.push({fix: `Set ${key} to a mapping with optional activateCommand, quietCommand, reactivateCommand, drainCommand, stopCommand, and drainTimeoutMs.`, message: `${key} must be an object`})
 
-    return {drainTimeoutMs: 0}
+    return {activateTimeoutMs: 30000, drainTimeoutMs: 0}
   }
 
+  const activateTimeoutMs = normalizeNumber(value.activateTimeoutMs, `${key}.activateTimeoutMs`, issues, {default: 30000})
   const drainTimeoutMs = normalizeNumber(value.drainTimeoutMs, `${key}.drainTimeoutMs`, issues, {default: 0})
   /** @type {LifecycleConfig} */
-  const lifecycle = {drainTimeoutMs: nonNegativeOrDefault(drainTimeoutMs, `${key}.drainTimeoutMs`, issues, 0, false)}
+  const lifecycle = {
+    activateTimeoutMs: activateTimeoutMs > 0 ? activateTimeoutMs : 30000,
+    drainTimeoutMs: nonNegativeOrDefault(drainTimeoutMs, `${key}.drainTimeoutMs`, issues, 0, false)
+  }
+
+  if (activateTimeoutMs <= 0) {
+    issues.push({fix: `Set ${key}.activateTimeoutMs to a positive number of milliseconds, e.g. 30000.`, message: `${key}.activateTimeoutMs must be a positive number`})
+  }
 
   if (value.activateCommand !== undefined) lifecycle.activateCommand = normalizeString(value.activateCommand, `${key}.activateCommand`, issues, {nonEmpty: true})
   if (value.quietCommand !== undefined) lifecycle.quietCommand = normalizeString(value.quietCommand, `${key}.quietCommand`, issues, {nonEmpty: true})

package/src/daemon.js

@@ -1814,7 +1814,7 @@ export default class RollbridgeDaemon {
     }
 
     if (transition.phase === "restoring_previous") {
-      if (candidate.state !== "draining") throw new Error(`Failed candidate ${candidate.releaseId} is not retired before incumbent restoration`)
+      if (candidate.state !== "draining" && candidate.state !== "stopped") throw new Error(`Failed candidate ${candidate.releaseId} is not retired before incumbent restoration`)
       try {
         await previous.reactivateGeneration()
       } catch (error) {

package/src/managed-process.js

@@ -4,7 +4,7 @@ import {EventEmitter} from "node:events"
 import {spawn} from "node:child_process"
 import {processGroupHasLiveMembers, processGroupMembers} from "./process-memory.js"
 
-const ACTIVATION_HOOK_TIMEOUT_MS = 30000
+const DEFAULT_ACTIVATION_HOOK_TIMEOUT_MS = 30000
 const MAX_BUFFERED_OUTPUT_CHARACTERS = 64 * 1024
 
 /**
@@ -554,7 +554,7 @@ export default class ManagedProcess extends EventEmitter {
     const command = this.lifecycle.activateCommand
 
     if (!command) return
-    const error = await this.runHook(command, ACTIVATION_HOOK_TIMEOUT_MS, "activate command", pid)
+    const error = await this.runHook(command, this.activationHookTimeoutMs(), "activate command", pid)
 
     if (error) throw error
   }
@@ -570,7 +570,7 @@ export default class ManagedProcess extends EventEmitter {
 
     if (!command) return
     const label = this.lifecycle.reactivateCommand ? "reactivate command" : "activate command"
-    const error = await this.runHook(command, ACTIVATION_HOOK_TIMEOUT_MS, label, pid)
+    const error = await this.runHook(command, this.activationHookTimeoutMs(), label, pid)
 
     if (error) throw error
   }
@@ -596,13 +596,18 @@ export default class ManagedProcess extends EventEmitter {
       : this.lifecycle.quietCommand
 
     if (!command) throw new Error(`Process ${this.id} cannot restore lifecycle role ${this.lifecycleRole} without its paired command`)
-    const timeoutMs = this.lifecycleRole === "active" ? ACTIVATION_HOOK_TIMEOUT_MS : this.hookTimeoutMs()
+    const timeoutMs = this.lifecycleRole === "active" ? this.activationHookTimeoutMs() : this.hookTimeoutMs()
     const activeLabel = this.lifecycle.reactivateCommand ? "reactivate" : "activate"
     const error = await this.runHook(command, timeoutMs, `${this.lifecycleRole === "active" ? activeLabel : "quiet"} command`, this.pid)
 
     if (error) throw error
   }
 
+  /** @returns {number} Timeout used for activation/reactivation hooks. */
+  activationHookTimeoutMs() {
+    return this.lifecycle.activateTimeoutMs ?? DEFAULT_ACTIVATION_HOOK_TIMEOUT_MS
+  }
+
   /** @returns {number} Timeout used for lifecycle hooks. */
   hookTimeoutMs() {
     if (this.stopTimeoutMs === "indefinite") return 30000

package/test/config-validation.test.js

@@ -180,18 +180,20 @@ test("validateConfig defaults lifecycle, accepts hooks, and rejects bad values",
   })
 
   // Omitted → no commands, zero drain.
-  assert.deepEqual(validateLifecycle(undefined).config.processes[0].lifecycle, {drainTimeoutMs: 0})
+  assert.deepEqual(validateLifecycle(undefined).config.processes[0].lifecycle, {activateTimeoutMs: 30000, drainTimeoutMs: 0})
 
-  const custom = validateLifecycle({drainTimeoutMs: 30000, quietCommand: "kill -TSTP $ROLLBRIDGE_PID", stopCommand: "kill -TERM $ROLLBRIDGE_PID"})
+  const custom = validateLifecycle({activateTimeoutMs: 60000, drainTimeoutMs: 30000, quietCommand: "kill -TSTP $ROLLBRIDGE_PID", stopCommand: "kill -TERM $ROLLBRIDGE_PID"})
 
   assert.deepEqual(custom.issues, [])
   assert.equal(custom.config.processes[0].lifecycle.quietCommand, "kill -TSTP $ROLLBRIDGE_PID")
   assert.equal(custom.config.processes[0].lifecycle.stopCommand, "kill -TERM $ROLLBRIDGE_PID")
+  assert.equal(custom.config.processes[0].lifecycle.activateTimeoutMs, 60000)
   assert.equal(custom.config.processes[0].lifecycle.drainTimeoutMs, 30000)
 
-  const invalid = validateLifecycle({drainTimeoutMs: -1, quietCommand: 5})
+  const invalid = validateLifecycle({activateTimeoutMs: 0, drainTimeoutMs: -1, quietCommand: 5})
   const messages = invalid.issues.map((issue) => issue.message)
 
+  assert.ok(messages.includes("processes[0].lifecycle.activateTimeoutMs must be a positive number"), JSON.stringify(messages))
   assert.ok(messages.includes("processes[0].lifecycle.drainTimeoutMs must be a non-negative number"), JSON.stringify(messages))
   assert.ok(messages.includes("processes[0].lifecycle.quietCommand must be a string"), JSON.stringify(messages))
 

package/test/managed-process.test.js

@@ -450,14 +450,14 @@ test("activateStrict runs the configured activation command once per call and re
     const pid = managed.pid
 
     assert.ok(pid)
-    managed.lifecycle = {activateCommand: "jobs activate", drainTimeoutMs: 0}
+    managed.lifecycle = {activateCommand: "jobs activate", activateTimeoutMs: 60000, drainTimeoutMs: 0}
     managed.runHook = async (command, timeoutMs, label, hookPid) => {
       commands.push({command, label, pid: hookPid, timeoutMs})
       return undefined
     }
 
     await managed.activateStrict()
-    assert.deepEqual(commands, [{command: "jobs activate", label: "activate command", pid, timeoutMs: 30000}])
+    assert.deepEqual(commands, [{command: "jobs activate", label: "activate command", pid, timeoutMs: 60000}])
 
     managed.runHook = async () => new Error("activation rejected")
     await assert.rejects(() => managed.activateStrict(), /activation rejected/)

package/test/rollbridge.test.js

@@ -696,7 +696,11 @@ test("candidate activation failure reports restoration failure and exact recover
     assert.match(String(restorationEvent?.data.error), /incumbent restoration rejected/)
     assert.deepEqual(await lifecycleEvents(fixture.lifecycleLogPath), ["activate:v1", "retire:v1", "retire:v2"])
     await assert.rejects(() => daemon.deploy({releaseId: "v3", releasePath: fixture.root, revision: "v3"}), /transition.*v2.*unresolved/i)
+    const failedCandidate = daemon.releases.get("v2")
 
+    assert.ok(failedCandidate)
+    await failedCandidate.stop()
+    assert.equal(failedCandidate.state, "stopped")
     incumbentCoordinator.reactivateStrict = reactivate
     const recovery = await sendControlCommand({
       command: {