skydive-cli 0.5.0-beta.8 → 0.5.0

package/dist/js/{client-c4c5MmgN.mjs → client-Btq6bMzX.mjs}

@@ -1,6 +1,108 @@
 #!/usr/bin/env node
 import { WebSocket } from "ws";
 
+//#region ../sandbox-stream-protocol/src/fs.ts
+/** fs frame type bytes. Disjoint from FRAME.* in ./index.ts. */
+const FS_FRAME = {
+	REQ: 32,
+	RES: 33
+};
+/** Filesystem operations the channel supports. One byte on the wire. */
+const FS_OP = {
+	LIST: 1,
+	STAT: 2,
+	READ: 3,
+	WRITE: 4,
+	MKDIR: 5,
+	RENAME: 6,
+	REMOVE: 7,
+	EXISTS: 8
+};
+/** Reply status. OK carries a result; ERR carries a message in `json.message`. */
+const FS_STATUS = {
+	OK: 0,
+	ERR: 1
+};
+const FS_MAX_BLOB_BYTES = 8 * 1024 * 1024;
+const OP_TO_CODE = {
+	list: FS_OP.LIST,
+	stat: FS_OP.STAT,
+	read: FS_OP.READ,
+	write: FS_OP.WRITE,
+	mkdir: FS_OP.MKDIR,
+	rename: FS_OP.RENAME,
+	remove: FS_OP.REMOVE,
+	exists: FS_OP.EXISTS
+};
+const CODE_TO_OP = new Map(Object.entries(OP_TO_CODE).map(([op, code]) => [code, op]));
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+function frame(type, reqId, byte2, json, blob) {
+	const jsonBytes = textEncoder.encode(JSON.stringify(json ?? {}));
+	const out = new Uint8Array(10 + jsonBytes.length + blob.length);
+	const dv = new DataView(out.buffer);
+	out[0] = type;
+	dv.setUint32(1, reqId >>> 0);
+	out[5] = byte2;
+	dv.setUint32(6, jsonBytes.length);
+	out.set(jsonBytes, 10);
+	out.set(blob, 10 + jsonBytes.length);
+	return out;
+}
+const EMPTY = new Uint8Array(0);
+/** client → server: encode an fs request. `blob` is the write payload, or null. */
+function encodeFsRequest(reqId, req, blob) {
+	return frame(FS_FRAME.REQ, reqId, OP_TO_CODE[req.op], req, blob ?? EMPTY);
+}
+/**
+* Decode a server fs reply frame. Returns null for a malformed frame so a peer
+* on a newer protocol can't crash the client.
+*/
+function decodeFsResponse(frameBytes) {
+	const parsed = parseFrame(FS_FRAME.RES, frameBytes);
+	if (!parsed) return null;
+	if (parsed.byte2 === FS_STATUS.ERR) {
+		const message = typeof parsed.json.message === "string" ? parsed.json.message : "fs operation failed";
+		return {
+			reqId: parsed.reqId,
+			status: "error",
+			message
+		};
+	}
+	return {
+		reqId: parsed.reqId,
+		status: "ok",
+		result: parsed.json,
+		blob: parsed.blob
+	};
+}
+function parseFrame(expectedType, frameBytes) {
+	if (frameBytes.length < 10) return null;
+	if (frameBytes[0] !== expectedType) return null;
+	const dv = new DataView(frameBytes.buffer, frameBytes.byteOffset, frameBytes.byteLength);
+	const reqId = dv.getUint32(1);
+	const byte2 = frameBytes[5] ?? 0;
+	const jsonLen = dv.getUint32(6);
+	const jsonStart = 10;
+	const jsonEnd = jsonStart + jsonLen;
+	if (jsonEnd > frameBytes.length) return null;
+	let json;
+	try {
+		const parsed = jsonLen ? JSON.parse(textDecoder.decode(frameBytes.subarray(jsonStart, jsonEnd))) : {};
+		if (typeof parsed !== "object" || parsed === null) return null;
+		json = parsed;
+	} catch {
+		return null;
+	}
+	return {
+		reqId,
+		byte2,
+		json,
+		blob: frameBytes.subarray(jsonEnd)
+	};
+}
+
+//#endregion
 //#region ../sandbox-stream-protocol/src/index.ts
 const SANDBOX_STREAM_PATH = "/api/v1/sandbox/stream";
 const FRAME = {
@@ -19,11 +121,15 @@ function streamSpecToQuery(spec) {
 		cols: String(spec.cols),
 		rows: String(spec.rows)
 	};
-	return {
+	if (spec.mode === "exec") return {
 		agentId: spec.agentId,
 		mode: "exec",
 		command: spec.command
 	};
+	return {
+		agentId: spec.agentId,
+		mode: "fs"
+	};
 }
 function withType(type, payload) {
 	const frame = new Uint8Array(1 + payload.length);
@@ -166,4 +272,4 @@ function toBuffer(data) {
 }
 
 //#endregion
-export { SandboxStream as t };
+export { encodeFsRequest as a, decodeFsResponse as i, SANDBOX_STREAM_PATH as n, streamSpecToQuery as r, SandboxStream as t };

package/dist/js/client-Ct0-JZSS.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { t as PortalClient } from "./client--k9cjfkX.mjs";
+import "./api-BFQ4PQDA.mjs";
+
+export { PortalClient };

package/dist/js/daemon-CCgNLD0H.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import "./client--k9cjfkX.mjs";
+import "./tls-cert-Rua2oV7n.mjs";
+import "./api-BFQ4PQDA.mjs";
+import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-Do1jU2UF.mjs";
+
+export { runPortalDaemon };

package/dist/js/{daemon-k2kVkJ8D.mjs → daemon-Do1jU2UF.mjs}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import { n as isRecord, t as PortalClient } from "./client-DabRpc_T.mjs";
+import { i as isRecord, n as isNewerBuild, r as portalDaemonBuild, t as PortalClient } from "./client--k9cjfkX.mjs";
+import { t as defaultTlsCertSource } from "./tls-cert-Rua2oV7n.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
@@ -8,43 +9,6 @@ import { createHash } from "node:crypto";
 import { connect, createServer } from "node:net";
 import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 
-//#region ../portal-daemon/src/build-stamp.ts
-/**
-* This build's stamp: the unix commit time (seconds) of the source it was
-* compiled from. Empty string when unstamped (a dev source run without the
-* env override).
-*
-* Why a commit time and not a package version: the daemon ships inside two
-* independently-versioned installers (the skydive CLI and the desktop app),
-* so their semvers are not comparable — but both build from this repo, so
-* the commit time of the built tree is one monotonic clock they share.
-*/
-function portalDaemonBuild() {
-	return "1786596877";
-}
-/**
-* Whether a client carrying `mine` should replace a running daemon carrying
-* `theirs` (newest build wins):
-*
-*  - an unstamped client never takes over — it can't prove it's newer;
-*  - a stamped client replaces an unstamped daemon — every stamped build
-*    postdates stamping, so the unstamped daemon is older by construction;
-*  - otherwise strictly greater wins; equal keeps the incumbent, so two
-*    identical builds never bounce the daemon between them.
-*/
-function isNewerBuild(mine, theirs) {
-	const mineAt = parseStamp(mine);
-	if (mineAt === null) return false;
-	const theirsAt = parseStamp(theirs);
-	if (theirsAt === null) return true;
-	return mineAt > theirsAt;
-}
-function parseStamp(stamp) {
-	if (!/^[0-9]+$/.test(stamp)) return null;
-	return Number(stamp);
-}
-
-//#endregion
 //#region ../portal-daemon/src/local-protocol.ts
 /**
 * Local IPC between the portal DAEMON and the `skydive` CLI processes attached
@@ -219,6 +183,20 @@ const clientStatusSchema = z.object({ t: z.literal("status") });
 * exits — cutting live exec/tunnel connections, not just refusing new ones.
 */
 const clientShutdownSchema = z.object({ t: z.literal("shutdown") });
+/**
+* `shutdown_handoff` — a newer daemon taking over (self-update / newest-build-
+* wins) asks the incumbent to step down WITHOUT dropping the portal connection
+* first. The incumbent frees the control socket and disconnects attached CLIs
+* (they reconnect to the new daemon in ~500ms, unchanged), but KEEPS its
+* outbound portal WebSocket — and thus its presence claim — alive until the
+* new daemon has dialled out and claimed the machine's presence slot, at which
+* point the server supersedes the incumbent's socket and it exits. This is a
+* make-before-break handoff: the presence key is owned by one daemon or the
+* other for the entire takeover, so `exec`/`file write` never sees a
+* `registered but not connected` gap mid-upgrade. A bounded fallback timeout
+* ensures the incumbent still exits if the successor never comes up.
+*/
+const clientShutdownHandoffSchema = z.object({ t: z.literal("shutdown_handoff") });
 const clientMessageSchema = z.discriminatedUnion("t", [
 	clientHelloSchema,
 	clientBindSchema,
@@ -229,7 +207,8 @@ const clientMessageSchema = z.discriminatedUnion("t", [
 	clientDeclineSchema,
 	clientByeSchema,
 	clientStatusSchema,
-	clientShutdownSchema
+	clientShutdownSchema,
+	clientShutdownHandoffSchema
 ]);
 /**
 * `state` — the shared portal status, pushed to every attached client so each
@@ -356,6 +335,14 @@ function parseDaemonMessage(line) {
 */
 /** Grace period after the last client detaches before the daemon exits. */
 const IDLE_SHUTDOWN_MS = 3e4;
+/**
+* Upper bound an incumbent daemon waits, during a graceful handoff, for the
+* successor to dial out and claim presence before giving up and releasing the
+* slot itself. Comfortably above a normal successor boot + WS dial (a few
+* hundred ms to a couple of seconds), and short enough that a failed successor
+* doesn't strand the machine as reachable-but-dead for long.
+*/
+const HANDOFF_MAX_WAIT_MS = 1e4;
 var PortalDaemon = class {
 	appUrl;
 	paths;
@@ -365,8 +352,10 @@ var PortalDaemon = class {
 	conns = /* @__PURE__ */ new Set();
 	cwds = /* @__PURE__ */ new Map();
 	declined = /* @__PURE__ */ new Set();
+	persistedMachineName = null;
 	fallbackCwd;
 	idleTimer = null;
+	handingOff = false;
 	sessionToken = null;
 	deviceToken = null;
 	constructor(appUrl) {
@@ -476,6 +465,9 @@ var PortalDaemon = class {
 			case "shutdown":
 				this.forceShutdown();
 				return;
+			case "shutdown_handoff":
+				this.gracefulHandoffShutdown();
+				return;
 			default: return msg;
 		}
 	}
@@ -499,12 +491,29 @@ var PortalDaemon = class {
 				deviceToken: this.deviceToken
 			}),
 			resolveCwd: (conversationId) => this.resolveCwd(conversationId),
+			tlsCertSource: defaultTlsCertSource(process.env, (msg) => this.logInfo(msg)),
+			persistedMachineName: this.persistedMachineName,
+			onMachineName: (name, source) => this.onMachineName(name, source),
 			onState: (state) => {
 				this.lastState = state;
 				this.broadcastState();
 			}
 		});
 	}
+	/**
+	* The identity resolved on connect. Persist the name so a later scutil
+	* failure reuses it instead of adopting the volatile hostname, and log the
+	* source — a `hostname-fallback` after we'd previously registered under
+	* scutil is the tell that a flap just orphaned this machine's grants.
+	*/
+	onMachineName(name, source) {
+		if (source === "hostname-fallback" && this.persistedMachineName) this.logInfo(`portal identity WARNING: fell back to hostname "${name}" but had previously registered as "${this.persistedMachineName}" — grants may be orphaned`);
+		else this.logInfo(`portal identity: "${name}" (source=${source})`);
+		if (name && name !== this.persistedMachineName) {
+			this.persistedMachineName = name;
+			this.persistState();
+		}
+	}
 	/** The cwd an exec for `conversationId` runs in. */
 	resolveCwd(conversationId) {
 		if (conversationId) {
@@ -538,7 +547,14 @@ var PortalDaemon = class {
 	/** Append a line to the daemon log file (best-effort, for post-hoc debugging). */
 	logError(context, error) {
 		const message = error instanceof Error ? error.message : String(error);
-		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${context}: ${message}\n`;
+		this.logLine(`${context}: ${message}`);
+	}
+	/** Append an informational line to the daemon log file (best-effort). */
+	logInfo(message) {
+		this.logLine(message);
+	}
+	logLine(message) {
+		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${message}\n`;
 		appendFile(this.paths.logPath, line).catch((_error) => {});
 	}
 	/** Close the listener without exiting the process (tests own the process). */
@@ -589,6 +605,37 @@ var PortalDaemon = class {
 		this.server?.close();
 		process.exit(0);
 	}
+	/**
+	* Graceful takeover step-down (a newer daemon is replacing us). Unlike
+	* `forceShutdown`, this does NOT drop the portal connection up front: doing so
+	* would let this machine's presence key expire (10s TTL) before the successor
+	* dials out and re-claims it, which is the `registered but not connected` gap
+	* that made `exec`/`file write` fail mid-self-update.
+	*
+	* Order matters. We free the control socket and disconnect attached CLIs
+	* first, because the successor cannot bind the singleton socket (and thus
+	* cannot start its own portal client) until we release it. But we KEEP our
+	* outbound portal WebSocket — and its presence claim — alive across that
+	* window. When the successor connects and `claim()`s the slot, the server
+	* supersedes us and closes our socket; `beginHandoff` resolves on that close
+	* and we exit. A bounded fallback inside `beginHandoff` still exits us if the
+	* successor never comes up, so we never hold a dead slot forever.
+	*/
+	async gracefulHandoffShutdown() {
+		if (this.handingOff) return;
+		this.handingOff = true;
+		for (const conn of this.conns) try {
+			conn.socket.destroy();
+		} catch (_error) {}
+		this.conns.clear();
+		this.server?.close();
+		this.server = null;
+		if (this.client) {
+			await this.client.beginHandoff(HANDOFF_MAX_WAIT_MS);
+			this.client.dispose();
+		}
+		process.exit(0);
+	}
 	async loadState() {
 		try {
 			const raw = await readFile(this.paths.statePath, "utf8");
@@ -598,6 +645,7 @@ var PortalDaemon = class {
 				if (Array.isArray(parsed.declined)) {
 					for (const id of parsed.declined) if (typeof id === "string") this.declined.add(id);
 				}
+				if (typeof parsed.machineName === "string" && parsed.machineName) this.persistedMachineName = parsed.machineName;
 			}
 		} catch (_error) {}
 	}
@@ -605,7 +653,8 @@ var PortalDaemon = class {
 		const state = {
 			version: LOCAL_PROTOCOL_VERSION,
 			cwds: Object.fromEntries(this.cwds),
-			declined: [...this.declined]
+			declined: [...this.declined],
+			machineName: this.persistedMachineName ?? void 0
 		};
 		writeFile(this.paths.statePath, JSON.stringify(state)).catch((error) => {
 			this.logError("persistState failed", error);
@@ -635,7 +684,7 @@ async function ensureDaemonRunning(appUrl) {
 	if (await isDaemonListening(socketPath)) {
 		const status = await queryDaemonStatus(appUrl);
 		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return;
-		if (await stopDaemon(appUrl) === "failed") return;
+		if (await stopDaemonForHandoff(appUrl) === "failed") return;
 	}
 	const entry = process.argv[1];
 	const args = entry ? [
@@ -730,6 +779,37 @@ async function queryDaemonStatus(appUrl) {
 	});
 }
 /**
+* Ask a running incumbent daemon to step down for a make-before-break handoff
+* (see the daemon's `gracefulHandoffShutdown`). Sends `shutdown_handoff` and
+* waits for the incumbent to release the CONTROL SOCKET — at which point the
+* successor can bind it and start its own portal client. Crucially, the
+* incumbent keeps its portal connection (and presence) alive past this point,
+* so the successor's subsequent `claim()` supersedes it with no presence gap.
+*
+* Returns `stopped` once the socket is free, `failed` if it never freed (the
+* caller should then leave the incumbent alone rather than fight it — same
+* fallback semantics as `stopDaemon`), or `not-running` if nothing was there.
+* Unlike `stopDaemon` this never SIGKILLs: the incumbent is intentionally still
+* alive (holding presence) after it frees the socket, so killing it by pid is
+* exactly the gap this path exists to avoid.
+*/
+async function stopDaemonForHandoff(appUrl) {
+	const { socketPath } = daemonPaths(appUrl);
+	if (!await isDaemonListening(socketPath)) return "not-running";
+	const sock = await connectControl(socketPath);
+	if (!sock) return "failed";
+	sock.write(encodeLine({ t: "shutdown_handoff" }));
+	for (let i = 0; i < 50; i += 1) {
+		await sleep(100);
+		if (!await isDaemonListening(socketPath)) {
+			sock.destroy();
+			return "stopped";
+		}
+	}
+	sock.destroy();
+	return "failed";
+}
+/**
 * Hard-stop a running daemon. Preferred path: send `shutdown` over the control
 * socket so it drains clients and exits cleanly. If the socket is unresponsive
 * (a wedged daemon), fall back to SIGTERM then SIGKILL by the pid the status
@@ -781,4 +861,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { runPortalDaemon as a, LOCAL_PROTOCOL_VERSION as c, encodeLine as d, makeLineParser as f, queryDaemonStatus as i, PORTAL_DAEMON_FLAG as l, ensureDaemonRunning as n, startPortalDaemon as o, parseDaemonMessage as p, isDaemonListening as r, stopDaemon as s, PortalDaemon as t, daemonPaths as u };
+export { runPortalDaemon as a, stopDaemonForHandoff as c, daemonPaths as d, encodeLine as f, queryDaemonStatus as i, LOCAL_PROTOCOL_VERSION as l, parseDaemonMessage as m, ensureDaemonRunning as n, startPortalDaemon as o, makeLineParser as p, isDaemonListening as r, stopDaemon as s, PortalDaemon as t, PORTAL_DAEMON_FLAG as u };

package/dist/js/daemon-client-C7nE-lLK.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client--k9cjfkX.mjs";
+import "./tls-cert-Rua2oV7n.mjs";
+import "./api-BFQ4PQDA.mjs";
+import "./daemon-Do1jU2UF.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-Dvad009G.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-client-fxf1A25Z.mjs → daemon-client-Dvad009G.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-k2kVkJ8D.mjs";
+import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-Do1jU2UF.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";