sweet-search 2.5.2 → 2.5.3

package/core/search/server-identity.js

@@ -0,0 +1,93 @@
+/**
+ * Project-scoped warm-server identity (release-gate C3).
+ *
+ * The warm search server was discovered via a single GLOBAL Unix socket
+ * (`/tmp/sweet-search.sock`) + a global legacy symlink (`/tmp/search.sock`) and
+ * an unconditional TCP port (9876). With more than one project on a machine
+ * this silently routed project B's queries to project A's server, and a second
+ * project's server crashed on `EADDRINUSE`.
+ *
+ * The fix derives a per-project socket/pidfile from the canonical project root,
+ * so each project gets its own server and can never answer another project's
+ * queries. The native Rust CLI re-implements the SAME derivation (FNV-1a/64 of
+ * the canonical root → `/tmp/sweet-search-<hash16>.sock`) so both sides agree.
+ *
+ * Why a hashed `/tmp` path and not `<root>/.sweet-search/search.sock`:
+ * `sockaddr_un.sun_path` is capped (~104 bytes on macOS); a deep project path
+ * would overflow it. The hashed `/tmp` path is always short and collision-safe.
+ *
+ * Overrides:
+ *   - `SWEET_SEARCH_SOCKET_PATH` — explicit socket; when set, NO legacy fallback.
+ *   - `SWEET_SEARCH_PID_FILE`    — explicit pidfile.
+ *   - `SWEET_SEARCH_TCP_PORT`    — opt-in TCP (off by default; see search-server).
+ */
+
+import { realpathSync, existsSync } from 'node:fs';
+import path from 'node:path';
+
+const FNV_OFFSET = 14695981039346656037n; // 0xcbf29ce484222325
+const FNV_PRIME = 1099511628211n;         // 0x100000001b3
+const U64_MASK = (1n << 64n) - 1n;
+
+/** FNV-1a 64-bit of a string's UTF-8 bytes → 16 lowercase hex chars. */
+export function fnv1a64Hex(str) {
+  let hash = FNV_OFFSET;
+  const bytes = Buffer.from(String(str), 'utf8');
+  for (let i = 0; i < bytes.length; i++) {
+    hash ^= BigInt(bytes[i]);
+    hash = (hash * FNV_PRIME) & U64_MASK;
+  }
+  return hash.toString(16).padStart(16, '0');
+}
+
+/** Canonicalise a path (resolve symlinks, e.g. macOS /tmp → /private/tmp). */
+function canonicalize(p) {
+  const abs = path.resolve(p);
+  try {
+    return realpathSync.native(abs);
+  } catch {
+    return abs; // path may not exist yet (pre-index cold start) — use lexical.
+  }
+}
+
+/**
+ * Resolve the canonical project root for socket derivation. Honors an explicit
+ * `SWEET_SEARCH_PROJECT_ROOT`; otherwise walks up from `cwd` to the nearest
+ * ancestor containing a `.sweet-search/` state dir (so queries from a
+ * subdirectory map to the same server), falling back to the canonical `cwd`.
+ */
+export function resolveProjectRoot(env = process.env, cwd = process.cwd()) {
+  const base = canonicalize(env.SWEET_SEARCH_PROJECT_ROOT || cwd);
+  let dir = base;
+  while (true) {
+    if (existsSync(path.join(dir, '.sweet-search'))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return base;
+}
+
+/** Project-scoped socket path (or the explicit override). */
+export function projectSocketPath(env = process.env, cwd = process.cwd()) {
+  if (env.SWEET_SEARCH_SOCKET_PATH) return env.SWEET_SEARCH_SOCKET_PATH;
+  return `/tmp/sweet-search-${fnv1a64Hex(resolveProjectRoot(env, cwd))}.sock`;
+}
+
+/** Project-scoped server pidfile (or the explicit override). */
+export function projectPidFile(env = process.env, cwd = process.cwd()) {
+  if (env.SWEET_SEARCH_PID_FILE) return env.SWEET_SEARCH_PID_FILE;
+  return `/tmp/sweet-search-${fnv1a64Hex(resolveProjectRoot(env, cwd))}.pid`;
+}
+
+/**
+ * Opt-in TCP port. Off by default — TCP on a single global port is the
+ * multi-project collision source (EADDRINUSE) and a cross-project leak vector.
+ * Returns a finite port number, or null when TCP should not be bound.
+ */
+export function tcpPort(env = process.env) {
+  const raw = env.SWEET_SEARCH_TCP_PORT;
+  if (raw == null || raw === '') return null;
+  const n = Number.parseInt(String(raw), 10);
+  return Number.isInteger(n) && n > 0 && n < 65536 ? n : null;
+}

package/core/search/session-daemon-prewarm.mjs

@@ -26,12 +26,16 @@ import { existsSync, readFileSync, openSync, writeSync, closeSync, unlinkSync }
 import { connect } from 'node:net';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { launchMaintainer } from '../indexing/maintainer-launcher.mjs';
+import { projectSocketPath, projectPidFile } from './server-identity.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
 const SERVER_ENTRY = process.env.SWEET_SEARCH_SERVER_ENTRY || join(__dirname, '..', 'start-server.js');
-const SOCKET_PATH = process.env.SWEET_SEARCH_SOCKET_PATH || '/tmp/sweet-search.sock';
-const PID_FILE = process.env.SWEET_SEARCH_PID_FILE || '/tmp/sweet-search-server.pid';
+// Per-project socket/pidfile (C3) — honors SWEET_SEARCH_SOCKET_PATH /
+// SWEET_SEARCH_PID_FILE overrides, otherwise derives from the canonical root.
+const SOCKET_PATH = projectSocketPath();
+const PID_FILE = projectPidFile();
 const LOCK_PATH = process.env.SWEET_SEARCH_PREWARM_LOCK || '/tmp/sweet-search-prewarm.lock';
 const SOCKET_PROBE_TIMEOUT_MS = Number(process.env.SWEET_SEARCH_PREWARM_PROBE_MS ?? 300);
 
@@ -127,23 +131,25 @@ function releaseLock(fd) {
   try { unlinkSync(LOCK_PATH); } catch { /* ignore */ }
 }
 
-try {
+/**
+ * Spawn the detached search server unless it is already responsive or another
+ * concurrent prewarm hook is mid-spawn. Returns (does not exit) so the
+ * maintainer launch below always runs.
+ */
+async function prewarmServer() {
   if (await daemonHealthy()) {
     log('daemon already responsive on socket');
-    process.exit(0);
+    return;
   }
-
   if (!existsSync(SERVER_ENTRY)) {
     log(`server entry missing: ${SERVER_ENTRY}`);
-    process.exit(0);
+    return;
   }
-
   const lockFd = acquireLock();
   if (lockFd === null) {
     log('another prewarm hook already holds the lock; skipping');
-    process.exit(0);
+    return;
   }
-
   try {
     // Fully detach: new session, no stdio, parent can exit while daemon loads.
     const child = spawn(process.execPath, [SERVER_ENTRY, '--serve'], {
@@ -157,8 +163,25 @@ try {
   } finally {
     releaseLock(lockFd);
   }
+}
+
+// The search server and the index maintainer are independent: a stuck/already
+// running server must not stop the maintainer from starting, and vice versa.
+// Each is isolated in its own try so one failing never blocks the other.
+try {
+  await prewarmServer();
+} catch (err) {
+  log(`server prewarm non-fatal: ${err?.message || err}`);
+}
+
+try {
+  // Delegate to the shared launcher (core/indexing/maintainer-launcher.mjs).
+  // The hook is a best-effort convenience layer; the durable guarantee lives in
+  // the warm search-server startup, which calls this same launcher. Pass our
+  // verbose-gated logger so output keeps the prewarm prefix + stays stderr-only.
+  launchMaintainer({ log });
 } catch (err) {
-  log(`non-fatal: ${err?.message || err}`);
+  log(`maintainer prewarm non-fatal: ${err?.message || err}`);
 }
 
 process.exit(0);