skydive-cli 0.5.0-beta.5 → 0.5.0-beta.52

package/dist/js/daemon-CORAITjj.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import "./client-aFwHzCPG.mjs";
+import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-uzpOdRPL.mjs";
+import "./tls-cert-CV-pwxVN.mjs";
+import "./api-TwLD7ibI.mjs";
+
+export { runPortalDaemon };

package/dist/js/{daemon-client-DcuD4v12.mjs → daemon-client-Cfi66Xy9.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-BhArnzeW.mjs";
+import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-uzpOdRPL.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 
@@ -12,7 +12,7 @@ var PortalDaemonClient = class {
 	lastBind = null;
 	fallbackCwd = null;
 	wantEnabled = false;
-	pendingGrants = /* @__PURE__ */ new Set();
+	pendingGrants = /* @__PURE__ */ new Map();
 	pendingDeclines = /* @__PURE__ */ new Map();
 	grantedAgentIds = /* @__PURE__ */ new Set();
 	constructor(opts) {
@@ -50,9 +50,10 @@ var PortalDaemonClient = class {
 				conversationId: this.lastBind.conversationId,
 				cwd: this.lastBind.cwd
 			});
-			for (const agentId of this.pendingGrants) this.send({
+			for (const [agentId, conversationId] of this.pendingGrants) this.send({
 				t: "grant",
-				agentId
+				agentId,
+				conversationId
 			});
 			for (const [agentId, declined] of this.pendingDeclines) this.send({
 				t: "decline",
@@ -157,13 +158,16 @@ var PortalDaemonClient = class {
 	* Authorize one agent to run commands on this machine. Resolves once the
 	* request is sent to the daemon (the daemon performs the grant and pushes the
 	* updated state); kept async so it's a drop-in for the old in-process client's
-	* awaited `grantAgent`.
+	* awaited `grantAgent`. `conversationId` names the conversation whose run
+	* asked, so the grant can wake the waiting agent; null when the grant is not
+	* answering an in-chat request.
 	*/
-	grantAgent(agentId) {
-		this.pendingGrants.add(agentId);
+	grantAgent(agentId, conversationId) {
+		this.pendingGrants.set(agentId, conversationId);
 		this.send({
 			t: "grant",
-			agentId
+			agentId,
+			conversationId
 		});
 		return Promise.resolve();
 	}

package/dist/js/daemon-client-DJPW9cRp.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client-aFwHzCPG.mjs";
+import "./daemon-uzpOdRPL.mjs";
+import "./tls-cert-CV-pwxVN.mjs";
+import "./api-TwLD7ibI.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-Cfi66Xy9.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-BhArnzeW.mjs → daemon-uzpOdRPL.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { s as isRecord, t as PortalClient } from "./client-Dd5sMXPv.mjs";
+import { n as isRecord, t as PortalClient } from "./client-aFwHzCPG.mjs";
+import { t as defaultTlsCertSource } from "./tls-cert-CV-pwxVN.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
@@ -20,7 +21,7 @@ import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1786586981";
+	return "1787166259";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying
@@ -175,10 +176,18 @@ const clientCwdSchema = z.object({
 	t: z.literal("cwd"),
 	cwd: z.string().min(1)
 });
-/** `grant` — authorize one agent to reach this machine (user-initiated). */
+/**
+* `grant` — authorize one agent to reach this machine (user-initiated).
+* `conversationId` names the conversation whose run asked for access (the
+* in-chat approval card); the grant carries it upstream so the server wakes
+* the waiting agent. Defaults to null on parse so hellos from CLI builds that
+* predate the field keep granting against a newer daemon — they just skip the
+* wake, same as before the field existed.
+*/
 const clientGrantSchema = z.object({
 	t: z.literal("grant"),
-	agentId: z.string().min(1)
+	agentId: z.string().min(1),
+	conversationId: z.string().nullish().default(null)
 });
 /**
 * `decline` — the user answered no to an agent's request for this machine
@@ -211,6 +220,20 @@ const clientStatusSchema = z.object({ t: z.literal("status") });
 * exits — cutting live exec/tunnel connections, not just refusing new ones.
 */
 const clientShutdownSchema = z.object({ t: z.literal("shutdown") });
+/**
+* `shutdown_handoff` — a newer daemon taking over (self-update / newest-build-
+* wins) asks the incumbent to step down WITHOUT dropping the portal connection
+* first. The incumbent frees the control socket and disconnects attached CLIs
+* (they reconnect to the new daemon in ~500ms, unchanged), but KEEPS its
+* outbound portal WebSocket — and thus its presence claim — alive until the
+* new daemon has dialled out and claimed the machine's presence slot, at which
+* point the server supersedes the incumbent's socket and it exits. This is a
+* make-before-break handoff: the presence key is owned by one daemon or the
+* other for the entire takeover, so `exec`/`file write` never sees a
+* `registered but not connected` gap mid-upgrade. A bounded fallback timeout
+* ensures the incumbent still exits if the successor never comes up.
+*/
+const clientShutdownHandoffSchema = z.object({ t: z.literal("shutdown_handoff") });
 const clientMessageSchema = z.discriminatedUnion("t", [
 	clientHelloSchema,
 	clientBindSchema,
@@ -221,7 +244,8 @@ const clientMessageSchema = z.discriminatedUnion("t", [
 	clientDeclineSchema,
 	clientByeSchema,
 	clientStatusSchema,
-	clientShutdownSchema
+	clientShutdownSchema,
+	clientShutdownHandoffSchema
 ]);
 /**
 * `state` — the shared portal status, pushed to every attached client so each
@@ -348,6 +372,14 @@ function parseDaemonMessage(line) {
 */
 /** Grace period after the last client detaches before the daemon exits. */
 const IDLE_SHUTDOWN_MS = 3e4;
+/**
+* Upper bound an incumbent daemon waits, during a graceful handoff, for the
+* successor to dial out and claim presence before giving up and releasing the
+* slot itself. Comfortably above a normal successor boot + WS dial (a few
+* hundred ms to a couple of seconds), and short enough that a failed successor
+* doesn't strand the machine as reachable-but-dead for long.
+*/
+const HANDOFF_MAX_WAIT_MS = 1e4;
 var PortalDaemon = class {
 	appUrl;
 	paths;
@@ -357,8 +389,10 @@ var PortalDaemon = class {
 	conns = /* @__PURE__ */ new Set();
 	cwds = /* @__PURE__ */ new Map();
 	declined = /* @__PURE__ */ new Set();
+	persistedMachineName = null;
 	fallbackCwd;
 	idleTimer = null;
+	handingOff = false;
 	sessionToken = null;
 	deviceToken = null;
 	constructor(appUrl) {
@@ -455,7 +489,7 @@ var PortalDaemon = class {
 			case "grant":
 				this.declined.delete(msg.agentId);
 				this.ensureClient();
-				this.client?.grantAgent(msg.agentId).catch((error) => {
+				this.client?.grantAgent(msg.agentId, msg.conversationId).catch((error) => {
 					this.logError("grantAgent failed", error);
 				});
 				return;
@@ -468,6 +502,9 @@ var PortalDaemon = class {
 			case "shutdown":
 				this.forceShutdown();
 				return;
+			case "shutdown_handoff":
+				this.gracefulHandoffShutdown();
+				return;
 			default: return msg;
 		}
 	}
@@ -491,12 +528,29 @@ var PortalDaemon = class {
 				deviceToken: this.deviceToken
 			}),
 			resolveCwd: (conversationId) => this.resolveCwd(conversationId),
+			tlsCertSource: defaultTlsCertSource(process.env, (msg) => this.logInfo(msg)),
+			persistedMachineName: this.persistedMachineName,
+			onMachineName: (name, source) => this.onMachineName(name, source),
 			onState: (state) => {
 				this.lastState = state;
 				this.broadcastState();
 			}
 		});
 	}
+	/**
+	* The identity resolved on connect. Persist the name so a later scutil
+	* failure reuses it instead of adopting the volatile hostname, and log the
+	* source — a `hostname-fallback` after we'd previously registered under
+	* scutil is the tell that a flap just orphaned this machine's grants.
+	*/
+	onMachineName(name, source) {
+		if (source === "hostname-fallback" && this.persistedMachineName) this.logInfo(`portal identity WARNING: fell back to hostname "${name}" but had previously registered as "${this.persistedMachineName}" — grants may be orphaned`);
+		else this.logInfo(`portal identity: "${name}" (source=${source})`);
+		if (name && name !== this.persistedMachineName) {
+			this.persistedMachineName = name;
+			this.persistState();
+		}
+	}
 	/** The cwd an exec for `conversationId` runs in. */
 	resolveCwd(conversationId) {
 		if (conversationId) {
@@ -530,7 +584,14 @@ var PortalDaemon = class {
 	/** Append a line to the daemon log file (best-effort, for post-hoc debugging). */
 	logError(context, error) {
 		const message = error instanceof Error ? error.message : String(error);
-		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${context}: ${message}\n`;
+		this.logLine(`${context}: ${message}`);
+	}
+	/** Append an informational line to the daemon log file (best-effort). */
+	logInfo(message) {
+		this.logLine(message);
+	}
+	logLine(message) {
+		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${message}\n`;
 		appendFile(this.paths.logPath, line).catch((_error) => {});
 	}
 	/** Close the listener without exiting the process (tests own the process). */
@@ -581,6 +642,37 @@ var PortalDaemon = class {
 		this.server?.close();
 		process.exit(0);
 	}
+	/**
+	* Graceful takeover step-down (a newer daemon is replacing us). Unlike
+	* `forceShutdown`, this does NOT drop the portal connection up front: doing so
+	* would let this machine's presence key expire (10s TTL) before the successor
+	* dials out and re-claims it, which is the `registered but not connected` gap
+	* that made `exec`/`file write` fail mid-self-update.
+	*
+	* Order matters. We free the control socket and disconnect attached CLIs
+	* first, because the successor cannot bind the singleton socket (and thus
+	* cannot start its own portal client) until we release it. But we KEEP our
+	* outbound portal WebSocket — and its presence claim — alive across that
+	* window. When the successor connects and `claim()`s the slot, the server
+	* supersedes us and closes our socket; `beginHandoff` resolves on that close
+	* and we exit. A bounded fallback inside `beginHandoff` still exits us if the
+	* successor never comes up, so we never hold a dead slot forever.
+	*/
+	async gracefulHandoffShutdown() {
+		if (this.handingOff) return;
+		this.handingOff = true;
+		for (const conn of this.conns) try {
+			conn.socket.destroy();
+		} catch (_error) {}
+		this.conns.clear();
+		this.server?.close();
+		this.server = null;
+		if (this.client) {
+			await this.client.beginHandoff(HANDOFF_MAX_WAIT_MS);
+			this.client.dispose();
+		}
+		process.exit(0);
+	}
 	async loadState() {
 		try {
 			const raw = await readFile(this.paths.statePath, "utf8");
@@ -590,6 +682,7 @@ var PortalDaemon = class {
 				if (Array.isArray(parsed.declined)) {
 					for (const id of parsed.declined) if (typeof id === "string") this.declined.add(id);
 				}
+				if (typeof parsed.machineName === "string" && parsed.machineName) this.persistedMachineName = parsed.machineName;
 			}
 		} catch (_error) {}
 	}
@@ -597,7 +690,8 @@ var PortalDaemon = class {
 		const state = {
 			version: LOCAL_PROTOCOL_VERSION,
 			cwds: Object.fromEntries(this.cwds),
-			declined: [...this.declined]
+			declined: [...this.declined],
+			machineName: this.persistedMachineName ?? void 0
 		};
 		writeFile(this.paths.statePath, JSON.stringify(state)).catch((error) => {
 			this.logError("persistState failed", error);
@@ -627,7 +721,7 @@ async function ensureDaemonRunning(appUrl) {
 	if (await isDaemonListening(socketPath)) {
 		const status = await queryDaemonStatus(appUrl);
 		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return;
-		if (await stopDaemon(appUrl) === "failed") return;
+		if (await stopDaemonForHandoff(appUrl) === "failed") return;
 	}
 	const entry = process.argv[1];
 	const args = entry ? [
@@ -722,6 +816,37 @@ async function queryDaemonStatus(appUrl) {
 	});
 }
 /**
+* Ask a running incumbent daemon to step down for a make-before-break handoff
+* (see the daemon's `gracefulHandoffShutdown`). Sends `shutdown_handoff` and
+* waits for the incumbent to release the CONTROL SOCKET — at which point the
+* successor can bind it and start its own portal client. Crucially, the
+* incumbent keeps its portal connection (and presence) alive past this point,
+* so the successor's subsequent `claim()` supersedes it with no presence gap.
+*
+* Returns `stopped` once the socket is free, `failed` if it never freed (the
+* caller should then leave the incumbent alone rather than fight it — same
+* fallback semantics as `stopDaemon`), or `not-running` if nothing was there.
+* Unlike `stopDaemon` this never SIGKILLs: the incumbent is intentionally still
+* alive (holding presence) after it frees the socket, so killing it by pid is
+* exactly the gap this path exists to avoid.
+*/
+async function stopDaemonForHandoff(appUrl) {
+	const { socketPath } = daemonPaths(appUrl);
+	if (!await isDaemonListening(socketPath)) return "not-running";
+	const sock = await connectControl(socketPath);
+	if (!sock) return "failed";
+	sock.write(encodeLine({ t: "shutdown_handoff" }));
+	for (let i = 0; i < 50; i += 1) {
+		await sleep(100);
+		if (!await isDaemonListening(socketPath)) {
+			sock.destroy();
+			return "stopped";
+		}
+	}
+	sock.destroy();
+	return "failed";
+}
+/**
 * Hard-stop a running daemon. Preferred path: send `shutdown` over the control
 * socket so it drains clients and exits cleanly. If the socket is unresponsive
 * (a wedged daemon), fall back to SIGTERM then SIGKILL by the pid the status
@@ -773,4 +898,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { runPortalDaemon as a, LOCAL_PROTOCOL_VERSION as c, encodeLine as d, makeLineParser as f, queryDaemonStatus as i, PORTAL_DAEMON_FLAG as l, ensureDaemonRunning as n, startPortalDaemon as o, parseDaemonMessage as p, isDaemonListening as r, stopDaemon as s, PortalDaemon as t, daemonPaths as u };
+export { runPortalDaemon as a, stopDaemonForHandoff as c, daemonPaths as d, encodeLine as f, queryDaemonStatus as i, LOCAL_PROTOCOL_VERSION as l, parseDaemonMessage as m, ensureDaemonRunning as n, startPortalDaemon as o, makeLineParser as p, isDaemonListening as r, stopDaemon as s, PortalDaemon as t, PORTAL_DAEMON_FLAG as u };