skydive-cli 0.5.0 → 0.6.0-beta.100

package/dist/js/client-BfwRLRDF.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { n as PortalClient, r as RATE_LIMIT_STAND_DOWN_MS, t as AUTH_STAND_DOWN_MS } from "./client-HdxGBXPK.mjs";
+import "./api-BFQ4PQDA.mjs";
+
+export { PortalClient };

package/dist/js/{client-Btq6bMzX.mjs → client-Cxk3khQu.mjs}

@@ -91,7 +91,7 @@ function parseFrame(expectedType, frameBytes) {
 		const parsed = jsonLen ? JSON.parse(textDecoder.decode(frameBytes.subarray(jsonStart, jsonEnd))) : {};
 		if (typeof parsed !== "object" || parsed === null) return null;
 		json = parsed;
-	} catch {
+	} catch (_error) {
 		return null;
 	}
 	return {
@@ -113,6 +113,18 @@ const FRAME = {
 	RESIZE: 17
 };
 const MAX_INPUT_BYTES = 1 * 1024 * 1024;
+/** Upper bound for an exec's `timeoutMs`; larger asks are clamped to this. */
+const MAX_EXEC_TIMEOUT_MS = 1440 * 60 * 1e3;
+/**
+* The exec budget applied when the client sends no `timeoutMs` of its own.
+* Liberal by design — one-shot execs legitimately run installs, builds, and
+* long data pulls — but not absent: without it, the e2b SDK's own default
+* (60s) silently kills anything longer mid-run with an opaque
+* `deadline_exceeded`, which is far below what the CLI's `--timeout` help
+* promises ("the server default (~10 min) applies"). Callers with a bigger
+* budget send an explicit `timeoutMs` (clamped to {@link MAX_EXEC_TIMEOUT_MS}).
+*/
+const DEFAULT_EXEC_TIMEOUT_MS = 600 * 1e3;
 /** Query params for the upgrade URL, from a spec. Inverse of {@link parseStreamSpec}. */
 function streamSpecToQuery(spec) {
 	if (spec.mode === "pty") return {
@@ -124,7 +136,8 @@ function streamSpecToQuery(spec) {
 	if (spec.mode === "exec") return {
 		agentId: spec.agentId,
 		mode: "exec",
-		command: spec.command
+		command: spec.command,
+		...spec.timeoutMs !== void 0 ? { timeoutMs: String(spec.timeoutMs) } : {}
 	};
 	return {
 		agentId: spec.agentId,
@@ -223,8 +236,23 @@ var SandboxStream = class SandboxStream {
 			}
 		});
 		let failure = null;
+		ws.on("unexpected-response", (_request, response) => {
+			const chunks = [];
+			let bytes = 0;
+			response.on("data", (chunk) => {
+				if (bytes >= MAX_HANDSHAKE_BODY_BYTES) return;
+				const remaining = MAX_HANDSHAKE_BODY_BYTES - bytes;
+				const kept = Buffer.from(chunk).subarray(0, remaining);
+				chunks.push(kept);
+				bytes += kept.length;
+			});
+			response.on("end", () => {
+				failure = formatHandshakeRejection(response.statusCode, response.statusMessage, Buffer.concat(chunks).toString("utf8"));
+				ws.terminate();
+			});
+		});
 		ws.on("error", (err) => {
-			failure = err.message;
+			failure ??= err.message;
 		});
 		ws.on("close", () => {
 			this.closed = true;
@@ -258,13 +286,20 @@ var SandboxStream = class SandboxStream {
 		} : {
 			mode: "exec",
 			agentId: opts.agentId,
-			command: opts.command
+			command: opts.command,
+			...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
 		};
 		const url = new URL(`${wsBase(opts.appUrl)}${SANDBOX_STREAM_PATH}`);
 		for (const [key, value] of Object.entries(streamSpecToQuery(spec))) url.searchParams.set(key, value);
 		return new SandboxStream(new WebSocket(url.toString(), { headers: { authorization: `Bearer ${opts.sessionToken}` } }), opts.onEvent);
 	}
 };
+const MAX_HANDSHAKE_BODY_BYTES = 512;
+function formatHandshakeRejection(statusCode, statusMessage, body) {
+	const status = [statusCode, statusMessage].filter(Boolean).join(" ");
+	const reason = Array.from(body, (char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127 ? " " : char).join("").replace(/\s+/g, " ").trim();
+	return reason ? `${status}: ${reason}` : status || "WebSocket upgrade rejected";
+}
 function toBuffer(data) {
 	if (Buffer.isBuffer(data)) return data;
 	if (Array.isArray(data)) return Buffer.concat(data);
@@ -272,4 +307,4 @@ function toBuffer(data) {
 }
 
 //#endregion
-export { encodeFsRequest as a, decodeFsResponse as i, SANDBOX_STREAM_PATH as n, streamSpecToQuery as r, SandboxStream as t };
+export { FS_MAX_BLOB_BYTES as a, streamSpecToQuery as i, DEFAULT_EXEC_TIMEOUT_MS as n, decodeFsResponse as o, SANDBOX_STREAM_PATH as r, encodeFsRequest as s, SandboxStream as t };

package/dist/js/{client--k9cjfkX.mjs → client-HdxGBXPK.mjs}

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, l as startTlsForward, n as fetchPortalDevices, r as findThisDevice } from "./api-BFQ4PQDA.mjs";
 import os from "node:os";
 import { z } from "zod";
@@ -160,7 +161,7 @@ function errorMessage(err) {
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1787785513";
+	return "1792017288";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying
@@ -186,6 +187,8 @@ function parseStamp(stamp) {
 
 //#endregion
 //#region ../portal-protocol/src/index.ts
+const CLOSE_SUPERSEDED = 4001;
+const CLOSE_FLAP_COOLDOWN = 4002;
 const MAX_WS_FRAME_BYTES = 16 * 1024 * 1024;
 const T_DATA = 1;
 const T_CTRL = 2;
@@ -577,14 +580,41 @@ var JobManager = class {
 
 //#endregion
 //#region ../portal-daemon/src/client.ts
+const INITIAL_BACKOFF_MS = 500;
+const MAX_BACKOFF_MS = 1e4;
+const AUTH_STAND_DOWN_MS = 5 * 6e4;
+const AUTH_STAND_DOWN_MESSAGE = "portal sign-in expired — reopen Skydive Desktop (or run `skydive portal open`) to reconnect";
+/**
+* True when the error means the server could not authenticate us: a token-mint
+* failure (HttpError 401) or a WS upgrade rejected at the auth layer. `ws`
+* reports a rejected upgrade as `Unexpected server response: <status>` with no
+* structured status property, so the status is read from the message. A 429 is
+* deliberately NOT an auth failure — see isRateLimited.
+*/
+function isAuthFailure(err) {
+	if (err instanceof HttpError) return err.status === 401;
+	return /Unexpected server response: 401\b/.test(errorMessage(err));
+}
+const RATE_LIMIT_STAND_DOWN_MS = 12e4;
+const RATE_LIMIT_STAND_DOWN_MESSAGE = "portal connection rate limited — retrying in 2 minutes";
+function isRateLimited(err) {
+	if (err instanceof HttpError) return err.status === 429;
+	return /Unexpected server response: 429\b/.test(errorMessage(err));
+}
 const DEFAULT_HEARTBEAT = {
 	intervalMs: 15e3,
 	maxMissed: 2,
 	wakeTickMs: 2e3,
 	wakeGapThresholdMs: 1e4,
 	netWatchTickMs: 2e3,
-	initialBackoffMs: 500,
-	maxBackoffMs: 1e4
+	initialBackoffMs: INITIAL_BACKOFF_MS,
+	maxBackoffMs: MAX_BACKOFF_MS,
+	supersededBackoffFloorMs: 5e3,
+	flapWindowMs: 6e4,
+	flapMaxStandDowns: 3,
+	flapBackoffMs: 6e4,
+	authStandDownMs: AUTH_STAND_DOWN_MS,
+	rateLimitStandDownMs: RATE_LIMIT_STAND_DOWN_MS
 };
 /**
 * A cheap fingerprint of the machine's network identity: every non-internal
@@ -664,11 +694,14 @@ var PortalClient = class {
 	machineName = "";
 	friendlyName = "";
 	legacyGrantsChecked = false;
+	authRejected = false;
+	rateLimited = false;
 	wakeWatch = null;
 	lastTick = Date.now();
 	netWatch = null;
 	netFingerprint = networkFingerprint();
 	backoffKick = null;
+	inStandDownSleep = false;
 	dialReason = null;
 	disconnectedAt = null;
 	handingOff = false;
@@ -739,6 +772,7 @@ var PortalClient = class {
 			this.ws.terminate();
 			return;
 		}
+		if (this.inStandDownSleep) return;
 		this.kickBackoff();
 	}
 	kickBackoff() {
@@ -777,6 +811,8 @@ var PortalClient = class {
 		if (this.enabled || this.disposed) return;
 		this.enabled = true;
 		this.error = null;
+		this.authRejected = false;
+		this.rateLimited = false;
 		this.connectLoop();
 	}
 	disable() {
@@ -914,29 +950,68 @@ var PortalClient = class {
 			this.opts.onMachineName(identity.machineName, identity.machineNameSource);
 		}
 		let backoff = this.heartbeatConfig.initialBackoffMs;
+		let standDowns = [];
 		while (this.enabled && !this.disposed && !this.handingOff) {
 			this.setStatus("connecting");
+			let sleepFloor = 0;
 			try {
 				const token = await this.wsToken();
-				if (await this.runConnection(token)) backoff = this.heartbeatConfig.initialBackoffMs;
-				else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				const { healthy, standDown } = await this.runConnection(token);
+				if (standDown) {
+					this.setStatus("stand-down");
+					const now = Date.now();
+					standDowns.push(now);
+					standDowns = standDowns.filter((at) => now - at <= this.heartbeatConfig.flapWindowMs);
+					if (standDowns.length >= this.heartbeatConfig.flapMaxStandDowns) {
+						backoff = this.heartbeatConfig.flapBackoffMs;
+						this.setStatus("error", "another portal connection for this machine keeps taking over — if Skydive Desktop or `skydive portal open` is running twice, quit the duplicate; an unstable network can also cause this briefly");
+					} else backoff = Math.max(Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs), this.heartbeatConfig.supersededBackoffFloorMs);
+					sleepFloor = backoff / 2;
+				} else if (healthy) backoff = this.heartbeatConfig.initialBackoffMs;
+				else if (this.authRejected) {
+					this.setStatus("error", AUTH_STAND_DOWN_MESSAGE);
+					this.authRejected = false;
+					backoff = this.heartbeatConfig.authStandDownMs;
+					sleepFloor = backoff;
+				} else if (this.rateLimited) {
+					this.setStatus("error", RATE_LIMIT_STAND_DOWN_MESSAGE);
+					this.rateLimited = false;
+					backoff = this.heartbeatConfig.rateLimitStandDownMs;
+					sleepFloor = backoff;
+				} else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
 			} catch (err) {
 				if (!this.enabled || this.disposed || this.handingOff) break;
-				this.setStatus("error", errorMessage(err));
-				backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				if (isAuthFailure(err)) {
+					this.setStatus("error", AUTH_STAND_DOWN_MESSAGE);
+					backoff = this.heartbeatConfig.authStandDownMs;
+					sleepFloor = backoff;
+				} else if (isRateLimited(err)) {
+					this.setStatus("error", RATE_LIMIT_STAND_DOWN_MESSAGE);
+					backoff = this.heartbeatConfig.rateLimitStandDownMs;
+					sleepFloor = backoff;
+				} else {
+					this.setStatus("error", errorMessage(err));
+					backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				}
 			}
 			if (!this.enabled || this.disposed || this.handingOff) break;
-			await this.backoffSleep(Math.random() * backoff);
+			this.inStandDownSleep = sleepFloor > 0;
+			await this.backoffSleep(sleepFloor + Math.random() * Math.max(backoff - sleepFloor, 0));
+			this.inStandDownSleep = false;
 		}
 	}
 	runConnection(token) {
 		return new Promise((resolve) => {
 			let settled = false;
 			let healthy = false;
+			let standDown = false;
 			const settle = () => {
 				if (settled) return;
 				settled = true;
-				resolve(healthy);
+				resolve({
+					healthy,
+					standDown
+				});
 			};
 			const ws = new WebSocket(portalWsUrl(this.opts.appUrl, this.machineName, this.friendlyName, {
 				build: portalDaemonBuild(),
@@ -974,6 +1049,8 @@ var PortalClient = class {
 			};
 			ws.on("open", () => {
 				missed = 0;
+				this.authRejected = false;
+				this.rateLimited = false;
 				this.dialReason = null;
 				this.disconnectedAt = null;
 				this.setStatus("connected");
@@ -987,8 +1064,18 @@ var PortalClient = class {
 			});
 			ws.on("error", (err) => {
 				this.error = errorMessage(err);
+				if (isAuthFailure(err)) {
+					this.authRejected = true;
+					this.dialReason ??= "portal credentials rejected; standing down";
+				}
+				if (isRateLimited(err)) {
+					this.rateLimited = true;
+					this.dialReason ??= "portal connection rate limited; standing down";
+				}
 			});
-			ws.on("close", (code) => {
+			ws.on("close", (code, reason) => {
+				standDown = code === CLOSE_SUPERSEDED || code === CLOSE_FLAP_COOLDOWN || code === 1e3 && reason.toString() === "superseded";
+				if (standDown) this.dialReason ??= `superseded (code ${code})`;
 				this.dialReason ??= `connection closed (code ${code})`;
 				this.disconnectedAt ??= Date.now();
 				clearInterval(heartbeat);
@@ -1048,4 +1135,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { resolveMachineIdentity as a, isRecord as i, isNewerBuild as n, portalDaemonBuild as r, PortalClient as t };
+export { portalDaemonBuild as a, isNewerBuild as i, PortalClient as n, isRecord as o, RATE_LIMIT_STAND_DOWN_MS as r, resolveMachineIdentity as s, AUTH_STAND_DOWN_MS as t };

package/dist/js/{daemon-CCgNLD0H.mjs → daemon--Yp4BWJq.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import "./client--k9cjfkX.mjs";
+import "./client-HdxGBXPK.mjs";
 import "./tls-cert-Rua2oV7n.mjs";
 import "./api-BFQ4PQDA.mjs";
-import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-Do1jU2UF.mjs";
+import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-B8c3Z1Te.mjs";
 
 export { runPortalDaemon };