skydive-cli 0.5.0-beta.9 → 0.6.0-beta.3

package/dist/js/{daemon-D21wQ7DI.mjs → daemon-Cuy4S6Rw.mjs}

@@ -1,50 +1,14 @@
 #!/usr/bin/env node
-import { n as isRecord, t as PortalClient } from "./client-DabRpc_T.mjs";
+import { i as isRecord, n as isNewerBuild, r as portalDaemonBuild, t as PortalClient } from "./client-CErCpXl9.mjs";
+import { t as defaultTlsCertSource } from "./tls-cert-Rua2oV7n.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { connect, createServer } from "node:net";
-import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { access, appendFile, mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
 
-//#region ../portal-daemon/src/build-stamp.ts
-/**
-* This build's stamp: the unix commit time (seconds) of the source it was
-* compiled from. Empty string when unstamped (a dev source run without the
-* env override).
-*
-* Why a commit time and not a package version: the daemon ships inside two
-* independently-versioned installers (the skydive CLI and the desktop app),
-* so their semvers are not comparable — but both build from this repo, so
-* the commit time of the built tree is one monotonic clock they share.
-*/
-function portalDaemonBuild() {
-	return "1786597531";
-}
-/**
-* Whether a client carrying `mine` should replace a running daemon carrying
-* `theirs` (newest build wins):
-*
-*  - an unstamped client never takes over — it can't prove it's newer;
-*  - a stamped client replaces an unstamped daemon — every stamped build
-*    postdates stamping, so the unstamped daemon is older by construction;
-*  - otherwise strictly greater wins; equal keeps the incumbent, so two
-*    identical builds never bounce the daemon between them.
-*/
-function isNewerBuild(mine, theirs) {
-	const mineAt = parseStamp(mine);
-	if (mineAt === null) return false;
-	const theirsAt = parseStamp(theirs);
-	if (theirsAt === null) return true;
-	return mineAt > theirsAt;
-}
-function parseStamp(stamp) {
-	if (!/^[0-9]+$/.test(stamp)) return null;
-	return Number(stamp);
-}
-
-//#endregion
 //#region ../portal-daemon/src/local-protocol.ts
 /**
 * Local IPC between the portal DAEMON and the `skydive` CLI processes attached
@@ -219,6 +183,20 @@ const clientStatusSchema = z.object({ t: z.literal("status") });
 * exits — cutting live exec/tunnel connections, not just refusing new ones.
 */
 const clientShutdownSchema = z.object({ t: z.literal("shutdown") });
+/**
+* `shutdown_handoff` — a newer daemon taking over (self-update / newest-build-
+* wins) asks the incumbent to step down WITHOUT dropping the portal connection
+* first. The incumbent frees the control socket and disconnects attached CLIs
+* (they reconnect to the new daemon in ~500ms, unchanged), but KEEPS its
+* outbound portal WebSocket — and thus its presence claim — alive until the
+* new daemon has dialled out and claimed the machine's presence slot, at which
+* point the server supersedes the incumbent's socket and it exits. This is a
+* make-before-break handoff: the presence key is owned by one daemon or the
+* other for the entire takeover, so `exec`/`file write` never sees a
+* `registered but not connected` gap mid-upgrade. A bounded fallback timeout
+* ensures the incumbent still exits if the successor never comes up.
+*/
+const clientShutdownHandoffSchema = z.object({ t: z.literal("shutdown_handoff") });
 const clientMessageSchema = z.discriminatedUnion("t", [
 	clientHelloSchema,
 	clientBindSchema,
@@ -229,7 +207,8 @@ const clientMessageSchema = z.discriminatedUnion("t", [
 	clientDeclineSchema,
 	clientByeSchema,
 	clientStatusSchema,
-	clientShutdownSchema
+	clientShutdownSchema,
+	clientShutdownHandoffSchema
 ]);
 /**
 * `state` — the shared portal status, pushed to every attached client so each
@@ -356,6 +335,22 @@ function parseDaemonMessage(line) {
 */
 /** Grace period after the last client detaches before the daemon exits. */
 const IDLE_SHUTDOWN_MS = 3e4;
+/**
+* Cadence of the socket-ownership watch (see checkSocketOwnership). The
+* singleton is enforced ONLY through the socket path, so this bounds how long
+* a daemon can keep dialing after losing the path — the window in which a
+* spawner can create a duplicate dialer. The server-side connect flap guard
+* caps the damage inside that window.
+*/
+const SOCKET_WATCH_TICK_MS = 3e4;
+/**
+* Upper bound an incumbent daemon waits, during a graceful handoff, for the
+* successor to dial out and claim presence before giving up and releasing the
+* slot itself. Comfortably above a normal successor boot + WS dial (a few
+* hundred ms to a couple of seconds), and short enough that a failed successor
+* doesn't strand the machine as reachable-but-dead for long.
+*/
+const HANDOFF_MAX_WAIT_MS = 1e4;
 var PortalDaemon = class {
 	appUrl;
 	paths;
@@ -365,21 +360,30 @@ var PortalDaemon = class {
 	conns = /* @__PURE__ */ new Set();
 	cwds = /* @__PURE__ */ new Map();
 	declined = /* @__PURE__ */ new Set();
+	persistedMachineName = null;
 	fallbackCwd;
 	idleTimer = null;
+	handingOff = false;
 	sessionToken = null;
 	deviceToken = null;
-	constructor(appUrl) {
+	socketWatch = null;
+	socketId = null;
+	socketCheckRunning = false;
+	socketWatchTickMs;
+	exit;
+	constructor(appUrl, options) {
 		this.appUrl = canonicalPortalAppUrl(appUrl);
 		this.paths = daemonPaths(this.appUrl);
 		this.fallbackCwd = process.env.HOME ?? process.cwd();
+		this.socketWatchTickMs = options?.socketWatchTickMs ?? SOCKET_WATCH_TICK_MS;
+		this.exit = options?.exit ?? (() => process.exit(0));
 	}
 	/** Start listening. Rejects if the socket is already held by another daemon. */
 	async listen() {
 		await mkdir(this.paths.dir, { recursive: true });
 		await this.loadState();
 		await this.clearStaleSocket();
-		return new Promise((resolve, reject) => {
+		await new Promise((resolve, reject) => {
 			const server = createServer((socket) => this.onClientConnect(socket));
 			server.on("error", reject);
 			server.listen(this.paths.socketPath, () => {
@@ -388,6 +392,102 @@ var PortalDaemon = class {
 				resolve();
 			});
 		});
+		await this.recordSocketIdentity();
+		this.startSocketWatch();
+	}
+	/**
+	* Remember which socket FILE we bound (dev+ino), so the watch can tell "our
+	* file is still there" from "someone re-created the path" — the path alone
+	* can't: a duplicate daemon's fresh socket lives at the identical path.
+	*/
+	async recordSocketIdentity() {
+		const s = await stat(this.paths.socketPath);
+		this.socketId = {
+			dev: s.dev,
+			ino: s.ino
+		};
+	}
+	/**
+	* The singleton is enforced ONLY through the socket path — status, stop, and
+	* newest-build takeover all reach a daemon by connecting to it. If the file
+	* vanishes under us (the OS tmp cleaner purges /var/folders temp items that
+	* haven't been touched in days; the daemon holds the bound fd and never
+	* notices), this daemon keeps its portal connection and its attached clients
+	* but becomes unreachable and unmanageable: every new `skydive` spawn finds
+	* no socket and starts a DUPLICATE daemon, and the two fight a supersede war
+	* over the machine's presence slot (the 2026-08-25 flap loop). So the daemon
+	* re-verifies its claim on a timer: re-bind if the path is free, stand down
+	* if another daemon beat us to it.
+	*/
+	startSocketWatch() {
+		this.socketWatch = setInterval(() => {
+			if (this.socketCheckRunning) return;
+			this.socketCheckRunning = true;
+			this.checkSocketOwnership().catch((error) => this.logError("socket ownership check failed", error)).finally(() => {
+				this.socketCheckRunning = false;
+			});
+		}, this.socketWatchTickMs);
+		this.socketWatch.unref();
+	}
+	stopSocketWatch() {
+		if (this.socketWatch) {
+			clearInterval(this.socketWatch);
+			this.socketWatch = null;
+		}
+	}
+	async checkSocketOwnership() {
+		if (!this.server || this.handingOff) return;
+		const current = await stat(this.paths.socketPath).catch(() => null);
+		if (current && this.socketId && current.dev === this.socketId.dev && current.ino === this.socketId.ino) return;
+		if (current) {
+			this.logInfo("control socket path is owned by another daemon; standing down");
+			this.standDown();
+			return;
+		}
+		try {
+			await this.rebindSocket();
+			this.logInfo("control socket file vanished (tmp cleaner?); re-bound");
+		} catch (error) {
+			this.logError("control socket re-bind failed; standing down", error);
+			this.standDown();
+		}
+	}
+	/**
+	* Re-create the socket file at our path. The old server object keeps serving
+	* its ESTABLISHED connections (close() only stops accepting), so attached
+	* clients ride through the swap; only the listener moves to the new file.
+	*/
+	async rebindSocket() {
+		const old = this.server;
+		this.server = null;
+		old?.close();
+		await mkdir(this.paths.dir, { recursive: true });
+		await new Promise((resolve, reject) => {
+			const server = createServer((socket) => this.onClientConnect(socket));
+			server.on("error", reject);
+			server.listen(this.paths.socketPath, () => {
+				this.server = server;
+				resolve();
+			});
+		});
+		await this.recordSocketIdentity();
+	}
+	/**
+	* This daemon lost the singleton claim: tear everything down and exit.
+	* Attached clients see their control socket close and re-attach through the
+	* path — reaching whichever daemon owns it now (or spawning a fresh one) —
+	* so the machine converges on a single dialer instead of a supersede war.
+	*/
+	standDown() {
+		this.stopSocketWatch();
+		for (const conn of this.conns) try {
+			conn.socket.destroy();
+		} catch (_error) {}
+		this.conns.clear();
+		this.client?.dispose();
+		this.server?.close();
+		this.server = null;
+		this.exit();
 	}
 	async clearStaleSocket() {
 		if (!await pathExists(this.paths.socketPath)) return;
@@ -476,6 +576,9 @@ var PortalDaemon = class {
 			case "shutdown":
 				this.forceShutdown();
 				return;
+			case "shutdown_handoff":
+				this.gracefulHandoffShutdown();
+				return;
 			default: return msg;
 		}
 	}
@@ -499,12 +602,29 @@ var PortalDaemon = class {
 				deviceToken: this.deviceToken
 			}),
 			resolveCwd: (conversationId) => this.resolveCwd(conversationId),
+			tlsCertSource: defaultTlsCertSource(process.env, (msg) => this.logInfo(msg)),
+			persistedMachineName: this.persistedMachineName,
+			onMachineName: (name, source) => this.onMachineName(name, source),
 			onState: (state) => {
 				this.lastState = state;
 				this.broadcastState();
 			}
 		});
 	}
+	/**
+	* The identity resolved on connect. Persist the name so a later scutil
+	* failure reuses it instead of adopting the volatile hostname, and log the
+	* source — a `hostname-fallback` after we'd previously registered under
+	* scutil is the tell that a flap just orphaned this machine's grants.
+	*/
+	onMachineName(name, source) {
+		if (source === "hostname-fallback" && this.persistedMachineName) this.logInfo(`portal identity WARNING: fell back to hostname "${name}" but had previously registered as "${this.persistedMachineName}" — grants may be orphaned`);
+		else this.logInfo(`portal identity: "${name}" (source=${source})`);
+		if (name && name !== this.persistedMachineName) {
+			this.persistedMachineName = name;
+			this.persistState();
+		}
+	}
 	/** The cwd an exec for `conversationId` runs in. */
 	resolveCwd(conversationId) {
 		if (conversationId) {
@@ -538,21 +658,30 @@ var PortalDaemon = class {
 	/** Append a line to the daemon log file (best-effort, for post-hoc debugging). */
 	logError(context, error) {
 		const message = error instanceof Error ? error.message : String(error);
-		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${context}: ${message}\n`;
+		this.logLine(`${context}: ${message}`);
+	}
+	/** Append an informational line to the daemon log file (best-effort). */
+	logInfo(message) {
+		this.logLine(message);
+	}
+	logLine(message) {
+		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${message}\n`;
 		appendFile(this.paths.logPath, line).catch((_error) => {});
 	}
 	/** Close the listener without exiting the process (tests own the process). */
 	stopForTest() {
 		this.clearIdleTimer();
+		this.stopSocketWatch();
 		this.client?.dispose();
 		this.server?.close();
 		this.server = null;
 	}
 	shutdown() {
 		if (this.conns.size > 0) return;
+		this.stopSocketWatch();
 		this.client?.dispose();
 		this.server?.close();
-		process.exit(0);
+		this.exit();
 	}
 	/** Snapshot for a `status` control request. */
 	statusResult() {
@@ -581,13 +710,39 @@ var PortalDaemon = class {
 	* their live exec/tunnel relays), drops the portal connection, and exits.
 	*/
 	forceShutdown() {
+		this.standDown();
+	}
+	/**
+	* Graceful takeover step-down (a newer daemon is replacing us). Unlike
+	* `forceShutdown`, this does NOT drop the portal connection up front: doing so
+	* would let this machine's presence key expire (10s TTL) before the successor
+	* dials out and re-claims it, which is the `registered but not connected` gap
+	* that made `exec`/`file write` fail mid-self-update.
+	*
+	* Order matters. We free the control socket and disconnect attached CLIs
+	* first, because the successor cannot bind the singleton socket (and thus
+	* cannot start its own portal client) until we release it. But we KEEP our
+	* outbound portal WebSocket — and its presence claim — alive across that
+	* window. When the successor connects and `claim()`s the slot, the server
+	* supersedes us and closes our socket; `beginHandoff` resolves on that close
+	* and we exit. A bounded fallback inside `beginHandoff` still exits us if the
+	* successor never comes up, so we never hold a dead slot forever.
+	*/
+	async gracefulHandoffShutdown() {
+		if (this.handingOff) return;
+		this.handingOff = true;
+		this.stopSocketWatch();
 		for (const conn of this.conns) try {
 			conn.socket.destroy();
 		} catch (_error) {}
 		this.conns.clear();
-		this.client?.dispose();
 		this.server?.close();
-		process.exit(0);
+		this.server = null;
+		if (this.client) {
+			await this.client.beginHandoff(HANDOFF_MAX_WAIT_MS);
+			this.client.dispose();
+		}
+		this.exit();
 	}
 	async loadState() {
 		try {
@@ -598,6 +753,7 @@ var PortalDaemon = class {
 				if (Array.isArray(parsed.declined)) {
 					for (const id of parsed.declined) if (typeof id === "string") this.declined.add(id);
 				}
+				if (typeof parsed.machineName === "string" && parsed.machineName) this.persistedMachineName = parsed.machineName;
 			}
 		} catch (_error) {}
 	}
@@ -605,7 +761,8 @@ var PortalDaemon = class {
 		const state = {
 			version: LOCAL_PROTOCOL_VERSION,
 			cwds: Object.fromEntries(this.cwds),
-			declined: [...this.declined]
+			declined: [...this.declined],
+			machineName: this.persistedMachineName ?? void 0
 		};
 		writeFile(this.paths.statePath, JSON.stringify(state)).catch((error) => {
 			this.logError("persistState failed", error);
@@ -635,7 +792,7 @@ async function ensureDaemonRunning(appUrl) {
 	if (await isDaemonListening(socketPath)) {
 		const status = await queryDaemonStatus(appUrl);
 		if (!status || !isNewerBuild(portalDaemonBuild(), status.build)) return;
-		if (await stopDaemon(appUrl) === "failed") return;
+		if (await stopDaemonForHandoff(appUrl) === "failed") return;
 	}
 	const entry = process.argv[1];
 	const args = entry ? [
@@ -669,7 +826,7 @@ function runPortalDaemon(argv) {
 * CLI's re-exec entry above and the standalone `main.ts` entry.
 */
 function startPortalDaemon(appUrl) {
-	return new PortalDaemon(appUrl).listen();
+	return new PortalDaemon(appUrl, null).listen();
 }
 async function isDaemonListening(socketPath) {
 	if (!await pathExists(socketPath)) return false;
@@ -730,6 +887,37 @@ async function queryDaemonStatus(appUrl) {
 	});
 }
 /**
+* Ask a running incumbent daemon to step down for a make-before-break handoff
+* (see the daemon's `gracefulHandoffShutdown`). Sends `shutdown_handoff` and
+* waits for the incumbent to release the CONTROL SOCKET — at which point the
+* successor can bind it and start its own portal client. Crucially, the
+* incumbent keeps its portal connection (and presence) alive past this point,
+* so the successor's subsequent `claim()` supersedes it with no presence gap.
+*
+* Returns `stopped` once the socket is free, `failed` if it never freed (the
+* caller should then leave the incumbent alone rather than fight it — same
+* fallback semantics as `stopDaemon`), or `not-running` if nothing was there.
+* Unlike `stopDaemon` this never SIGKILLs: the incumbent is intentionally still
+* alive (holding presence) after it frees the socket, so killing it by pid is
+* exactly the gap this path exists to avoid.
+*/
+async function stopDaemonForHandoff(appUrl) {
+	const { socketPath } = daemonPaths(appUrl);
+	if (!await isDaemonListening(socketPath)) return "not-running";
+	const sock = await connectControl(socketPath);
+	if (!sock) return "failed";
+	sock.write(encodeLine({ t: "shutdown_handoff" }));
+	for (let i = 0; i < 50; i += 1) {
+		await sleep(100);
+		if (!await isDaemonListening(socketPath)) {
+			sock.destroy();
+			return "stopped";
+		}
+	}
+	sock.destroy();
+	return "failed";
+}
+/**
 * Hard-stop a running daemon. Preferred path: send `shutdown` over the control
 * socket so it drains clients and exits cleanly. If the socket is unresponsive
 * (a wedged daemon), fall back to SIGTERM then SIGKILL by the pid the status
@@ -781,4 +969,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { runPortalDaemon as a, LOCAL_PROTOCOL_VERSION as c, encodeLine as d, makeLineParser as f, queryDaemonStatus as i, PORTAL_DAEMON_FLAG as l, ensureDaemonRunning as n, startPortalDaemon as o, parseDaemonMessage as p, isDaemonListening as r, stopDaemon as s, PortalDaemon as t, daemonPaths as u };
+export { runPortalDaemon as a, stopDaemonForHandoff as c, daemonPaths as d, encodeLine as f, queryDaemonStatus as i, LOCAL_PROTOCOL_VERSION as l, parseDaemonMessage as m, ensureDaemonRunning as n, startPortalDaemon as o, makeLineParser as p, isDaemonListening as r, stopDaemon as s, PortalDaemon as t, PORTAL_DAEMON_FLAG as u };

package/dist/js/daemon-client-BVX-rWfX.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client-CErCpXl9.mjs";
+import "./tls-cert-Rua2oV7n.mjs";
+import "./api-BFQ4PQDA.mjs";
+import "./daemon-Cuy4S6Rw.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-b10uck-j.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-client-DPUNjhBB.mjs → daemon-client-b10uck-j.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-D21wQ7DI.mjs";
+import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-Cuy4S6Rw.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";