supbuddy 3.1.18 → 3.1.23

package/dist/bin.js

@@ -19207,6 +19207,12 @@ function startRelayServer(child, opts) {
   let hostBridgeOwner = null;
   let seq2 = 0;
   const pending = /* @__PURE__ */ new Map();
+  const sendOwnerReady = () => {
+    try {
+      child.send?.({ type: "host-bridge:owner-ready" });
+    } catch {
+    }
+  };
   const failAllPending = (reason) => {
     for (const [, p] of pending) {
       clearTimeout(p.timer);
@@ -19225,17 +19231,11 @@ function startRelayServer(child, opts) {
       }
     });
     socket2.on("host-bridge:claim", () => {
-      const hadOwner = hostBridgeOwner !== null;
       if (hostBridgeOwner && hostBridgeOwner.id !== socket2.id) {
         hostBridgeOwner.emit("host-bridge:revoked");
       }
       hostBridgeOwner = socket2;
-      if (!hadOwner) {
-        try {
-          child.send?.({ type: "host-bridge:owner-ready" });
-        } catch {
-        }
-      }
+      sendOwnerReady();
     });
     socket2.on("host-bridge:reply", ({ correlationId, reply }) => {
       const p = pending.get(correlationId);
@@ -19265,6 +19265,10 @@ function startRelayServer(child, opts) {
     });
   };
   const onChildMessage = (m) => {
+    if (m?.type === "host-bridge:owner?") {
+      if (hostBridgeOwner) sendOwnerReady();
+      return;
+    }
     if (isHostBridgeMessage(m)) return;
     io2.emit("worker:message", m);
   };
@@ -19803,7 +19807,7 @@ function cliBuildKind(env3 = process.env) {
   return raw === "host" || raw === "npm" ? raw : "dev";
 }
 function cliVersion(env3 = process.env) {
-  return "3.1.18".trim() || "0.0.0-dev";
+  return "3.1.23".trim() || "0.0.0-dev";
 }
 function isDevBuild(env3) {
   return cliBuildKind(env3) === "dev";
@@ -28192,18 +28196,39 @@ var init_store = __esm({
         }));
       },
       setDoctorSummary: (s, report) => set2({ doctorSummary: s, doctorReport: report }),
+      // ── A WRITE THAT CHANGES NOTHING MUST NOT LOOK LIKE A CHANGE ───────────────────
+      //
+      // Both setters used to build a NEW proxyState object unconditionally, so writing the
+      // value that was already there still produced a fresh reference. The store subscriber
+      // publishes on `state.proxyState !== prevState.proxyState`, so a no-op write emitted
+      // `proxy-state-updated` to every client.
+      //
+      // That turned a read into a loop. `port-forwarding:status` — a QUERY — ends by calling
+      // `setPortForwardingEnabled(status.enabled)`, almost always with the value already
+      // held. The renderer re-probed whenever proxyState changed, so: poll → no-op write →
+      // emit → poll. Bounded only by IPC latency, which measured at **51 probes per second**,
+      // each opening a TCP connection to the redirected :443. Under that self-inflicted load
+      // some connects timed out, and each timeout was painted as `NOT ENFORCING` on a machine
+      // answering 30 of 30 sequential probes.
+      //
+      // The renderer's dependency was also fixed, but this is the half that matters: no UI
+      // should be able to induce a feedback loop by reading status. Equality-guard the write,
+      // and the loop cannot form.
       setPortForwardingEnabled: (enabled) => {
-        set2((state) => ({
-          proxyState: {
-            ...state.proxyState,
-            portForwardingEnabled: enabled
-          }
-        }));
+        set2((state) => state.proxyState.portForwardingEnabled === enabled ? {} : { proxyState: { ...state.proxyState, portForwardingEnabled: enabled } });
       },
       // Patch arbitrary proxy fields (restartAttempt/lastExit/networkingDegraded/…) without
       // touching status — used by the supervisor + the drift-gated networking repair.
+      //
+      // Same guard, generalised: the supervisor and the health paths call this on a timer
+      // with values that are usually unchanged, and each such call was a broadcast.
       setProxyFields: (fields) => {
-        set2((state) => ({ proxyState: { ...state.proxyState, ...fields } }));
+        set2((state) => {
+          const current = state.proxyState;
+          const changed = Object.entries(fields).some(([k, v]) => current[k] !== v);
+          if (!changed) return {};
+          return { proxyState: { ...state.proxyState, ...fields } };
+        });
       },
       updateSettings: (updates) => {
         set2((state) => ({
@@ -39154,7 +39179,10 @@ async function probe443(timeoutMs = 1e3) {
 }
 async function probePort(port, timeoutMs = 1e3) {
   const results = await Promise.all(["127.0.0.1", "::1"].map((host) => probeHost(host, port, timeoutMs)));
-  return results.some(Boolean);
+  if (results.some(Boolean)) return true;
+  await new Promise((r) => setTimeout(r, 150));
+  const confirm = await Promise.all(["127.0.0.1", "::1"].map((host) => probeHost(host, port, timeoutMs)));
+  return confirm.some(Boolean);
 }
 async function probeHost(host, port, timeoutMs) {
   const net2 = await import("net");

package/dist/daemon/worker.cjs

@@ -26296,18 +26296,39 @@ const useStore = create((set2, get2) => ({
     }));
   },
   setDoctorSummary: (s, report) => set2({ doctorSummary: s, doctorReport: report }),
+  // ── A WRITE THAT CHANGES NOTHING MUST NOT LOOK LIKE A CHANGE ───────────────────
+  //
+  // Both setters used to build a NEW proxyState object unconditionally, so writing the
+  // value that was already there still produced a fresh reference. The store subscriber
+  // publishes on `state.proxyState !== prevState.proxyState`, so a no-op write emitted
+  // `proxy-state-updated` to every client.
+  //
+  // That turned a read into a loop. `port-forwarding:status` — a QUERY — ends by calling
+  // `setPortForwardingEnabled(status.enabled)`, almost always with the value already
+  // held. The renderer re-probed whenever proxyState changed, so: poll → no-op write →
+  // emit → poll. Bounded only by IPC latency, which measured at **51 probes per second**,
+  // each opening a TCP connection to the redirected :443. Under that self-inflicted load
+  // some connects timed out, and each timeout was painted as `NOT ENFORCING` on a machine
+  // answering 30 of 30 sequential probes.
+  //
+  // The renderer's dependency was also fixed, but this is the half that matters: no UI
+  // should be able to induce a feedback loop by reading status. Equality-guard the write,
+  // and the loop cannot form.
   setPortForwardingEnabled: (enabled) => {
-    set2((state) => ({
-      proxyState: {
-        ...state.proxyState,
-        portForwardingEnabled: enabled
-      }
-    }));
+    set2((state) => state.proxyState.portForwardingEnabled === enabled ? {} : { proxyState: { ...state.proxyState, portForwardingEnabled: enabled } });
   },
   // Patch arbitrary proxy fields (restartAttempt/lastExit/networkingDegraded/…) without
   // touching status — used by the supervisor + the drift-gated networking repair.
+  //
+  // Same guard, generalised: the supervisor and the health paths call this on a timer
+  // with values that are usually unchanged, and each such call was a broadcast.
   setProxyFields: (fields) => {
-    set2((state) => ({ proxyState: { ...state.proxyState, ...fields } }));
+    set2((state) => {
+      const current = state.proxyState;
+      const changed = Object.entries(fields).some(([k, v]) => current[k] !== v);
+      if (!changed) return {};
+      return { proxyState: { ...state.proxyState, ...fields } };
+    });
   },
   updateSettings: (updates) => {
     set2((state) => ({
@@ -30248,7 +30269,10 @@ async function probe443(timeoutMs = 1e3) {
 }
 async function probePort(port, timeoutMs = 1e3) {
   const results = await Promise.all(["127.0.0.1", "::1"].map((host) => probeHost(host, port, timeoutMs)));
-  return results.some(Boolean);
+  if (results.some(Boolean)) return true;
+  await new Promise((r) => setTimeout(r, 150));
+  const confirm2 = await Promise.all(["127.0.0.1", "::1"].map((host) => probeHost(host, port, timeoutMs)));
+  return confirm2.some(Boolean);
 }
 async function probeHost(host, port, timeoutMs) {
   const net2 = await __vitePreload(() => import("net"), false ? __VITE_PRELOAD__ : void 0);
@@ -51581,9 +51605,15 @@ async function requestPrivilegedBatch(command, prompt, tmpFiles = []) {
     process.on("message", handler);
   });
 }
+let privilegedRepairAttempted = false;
 let guiProxyAutoStartDone = false;
 let lastPrivilegedError = null;
+let privilegedWorkPending = null;
 const TRANSIENT_PRIVILEGED_FAILURE = /TTY|ASKPASS|detached/i;
+function shouldFinishPrivilegedSetup(proxyState, privilegedError, workPending) {
+  if (shouldRetryPrivilegedSetup(proxyState, privilegedError)) return true;
+  return TRANSIENT_PRIVILEGED_FAILURE.test(workPending || "");
+}
 function shouldRetryPrivilegedSetup(proxyState, privilegedError) {
   if (!proxyState.needsPrivilegedRepair) return false;
   return TRANSIENT_PRIVILEGED_FAILURE.test(privilegedError || "");
@@ -51594,14 +51624,21 @@ function isPfRulesetRejection(err, stderr) {
   return stderr.trim().length > 0;
 }
 async function maybeAutoStartProxyForGui() {
-  if (guiProxyAutoStartDone) return;
   const store2 = useStore.getState();
   const status = store2.proxyState.status;
+  if (privilegedWorkPending && !privilegedRepairAttempted) {
+    console.log(
+      `[Proxy] owner-ready: status=${status} repairAttempted=${privilegedRepairAttempted} needsRepair=${!!store2.proxyState.needsPrivilegedRepair} pending=${JSON.stringify(privilegedWorkPending)}`
+    );
+  }
+  if (status === "running" && !privilegedRepairAttempted && shouldFinishPrivilegedSetup(store2.proxyState, lastPrivilegedError, privilegedWorkPending)) {
+    privilegedRepairAttempted = true;
+    await retryPrivilegedSetupOnce("proxy is running but its privileged setup never ran (no GUI owner at boot)");
+    return;
+  }
+  if (guiProxyAutoStartDone) return;
   if (status === "running" || status === "starting") {
     guiProxyAutoStartDone = true;
-    if (status === "running" && shouldRetryPrivilegedSetup(store2.proxyState, lastPrivilegedError)) {
-      await retryPrivilegedSetupOnce("proxy is running but its privileged setup never ran (no GUI owner at boot)");
-    }
     return;
   }
   if (!store2.settings.autoStart) return;
@@ -51632,7 +51669,7 @@ async function retryPrivilegedSetupOnce(reason) {
 }
 async function handleStartProxy() {
   const alreadyRunning = isCaddyRunning();
-  const repairPending = !!useStore.getState().proxyState.needsPrivilegedRepair;
+  const repairPending = !!useStore.getState().proxyState.needsPrivilegedRepair || !!privilegedWorkPending;
   if (alreadyRunning && !repairPending) {
     const { probeProxyReachability: probeProxyReachability2 } = await __vitePreload(async () => {
       const { probeProxyReachability: probeProxyReachability3 } = await Promise.resolve().then(() => dnsPlatform);
@@ -51762,11 +51799,13 @@ async function handleStartProxy() {
         });
         if (!sudoResult.success) {
           privilegedFailure = sudoResult.error || "unknown error";
+          privilegedWorkPending = privilegedFailure;
           console.error(
             `[Proxy] privileged setup failed (continuing degraded — Caddy still starts): ${privilegedFailure}`
           );
         } else {
           console.log("[Proxy] sudo setup result: success");
+          privilegedWorkPending = null;
           const resolverAudit = await auditResolverState().catch(() => null);
           if (resolverAudit && resolverAudit.in_sync === false && resolverAudit.missing.length > 0) {
             privilegedFailure = `DNS resolver files missing after privileged setup: ${resolverAudit.missing.join(", ")}`;
@@ -51775,6 +51814,7 @@ async function handleStartProxy() {
       }
     } catch (privErr) {
       privilegedFailure = privErr?.message || String(privErr);
+      privilegedWorkPending = privilegedFailure;
       console.error(
         "[Proxy] privileged setup threw (continuing degraded — Caddy still starts):",
         privilegedFailure
@@ -54668,6 +54708,10 @@ async function init() {
       process.exit(0);
     }
   };
+  try {
+    process.send?.({ type: "host-bridge:owner?" });
+  } catch {
+  }
   process.on("SIGINT", () => cleanup());
   process.on("SIGTERM", () => cleanup());
   shutdownHandler = async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supbuddy",
-  "version": "3.1.18",
+  "version": "3.1.23",
   "description": "Run multiple Supabase projects at once on custom local domains with HTTPS. A headless CLI and daemon (proxy, DNS, Supabase/Compose lifecycle, MCP) for macOS and Linux.",
   "keywords": [
     "supabase",