tamperward 2.29.18 → 2.29.20

package/dist/cli/index.js

@@ -11638,14 +11638,31 @@ function watcherTelemetry(log) {
     return { state: "degraded", health, reason: health.last_error ?? "observer reported an error" };
   return { state: "healthy", health };
 }
-function watchTree(dir, cb, onState, onError) {
+function watchTree(dir, cb, onState, onError, watchFn = watch) {
+  const describe2 = (e) => e instanceof Error ? e.message : String(e);
   if (process.env.TAMPERWARD_WATCH_NO_RECURSIVE !== "1") {
     try {
-      const w = watch(dir, { recursive: true }, (kind, fname) => {
+      let recursiveClosed = false;
+      const closeRecursive = () => {
+        if (recursiveClosed) return;
+        recursiveClosed = true;
+        w.close();
+      };
+      const w = watchFn(dir, { recursive: true }, (kind, fname) => {
         if (fname) cb(kind, String(fname));
       });
+      w.on("error", (e) => {
+        if (recursiveClosed) return;
+        recursiveClosed = true;
+        try {
+          w.close();
+        } catch {
+        }
+        onState("recursive", 0);
+        onError(`recursive watch on ${dir}: ${describe2(e)}`);
+      });
       onState("recursive", 1);
-      return { close: () => w.close() };
+      return { close: closeRecursive };
     } catch {
     }
   }
@@ -11656,7 +11673,7 @@ function watchTree(dir, cb, onState, onError) {
     if (closed || watchers.has(rel) || SKIP2.test(rel + "/")) return;
     let w;
     try {
-      w = watch(rel ? join12(dir, rel) : dir, (kind, fname) => {
+      w = watchFn(rel ? join12(dir, rel) : dir, (kind, fname) => {
         if (closed || !fname) return;
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
@@ -11666,11 +11683,19 @@ function watchTree(dir, cb, onState, onError) {
         }
       });
     } catch (e) {
-      onError(
-        `watch directory ${rel || "."}: ${e instanceof Error ? e.message : String(e)}`
-      );
+      onError(`watch directory ${rel || "."}: ${describe2(e)}`);
       return;
     }
+    w.on("error", (e) => {
+      if (closed || watchers.get(rel) !== w) return;
+      watchers.delete(rel);
+      try {
+        w.close();
+      } catch {
+      }
+      onError(`watch directory ${rel || "."}: ${describe2(e)}`);
+      onState("fallback", watchers.size);
+    });
     watchers.set(rel, w);
     onState("fallback", watchers.size);
   };
@@ -11704,7 +11729,7 @@ function watchTree(dir, cb, onState, onError) {
     }
   };
 }
-function startWatcher(dir, log, policy) {
+function startWatcher(dir, log, policy, watchFn = watch) {
   try {
     mkdirSync4(join12(log, ".."), { recursive: true });
   } catch {
@@ -11784,7 +11809,8 @@ function startWatcher(dir, log, policy) {
       health.watched_dirs = watchedDirs;
       persistHealth();
     },
-    (detail) => degrade(detail)
+    (detail) => degrade(detail),
+    watchFn
   );
   let closed = false;
   return {
@@ -13024,6 +13050,8 @@ async function startHookService(opts) {
   const cache3 = opts.cache ?? new SnapshotCache();
   let served = 0;
   let inFlight = false;
+  const sockets = /* @__PURE__ */ new Set();
+  let acceptedSocket = null;
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const respond = (sock, body) => {
     try {
@@ -13056,6 +13084,7 @@ async function startHookService(opts) {
     if (named !== null && !within(root, named)) return respond(sock, { refused: "payload cwd outside the bound repository" });
     if (inFlight) return respond(sock, { refused: "another request is in flight" });
     inFlight = true;
+    acceptedSocket = sock;
     sock.write(JSON.stringify({ v: HOOK_SERVICE_PROTOCOL, version: TW_VERSION, accepted: true }) + "\n");
     setImmediate(() => {
       try {
@@ -13074,24 +13103,38 @@ async function startHookService(opts) {
         respond(sock, { exitCode: result.exitCode, stdout: result.stdout });
       } finally {
         inFlight = false;
+        acceptedSocket = null;
       }
     });
   };
   const server = createServer((sock) => {
+    sockets.add(sock);
     let buf = "";
     let answered = false;
     sock.setEncoding("utf8");
+    const deadline = setTimeout(() => {
+      if (answered) return;
+      answered = true;
+      respond(sock, { refused: "request deadline exceeded" });
+    }, REQUEST_DEADLINE_MS);
+    deadline.unref?.();
     sock.on("error", () => sock.destroy());
+    sock.on("close", () => {
+      clearTimeout(deadline);
+      sockets.delete(sock);
+    });
     sock.on("data", (chunk) => {
       if (answered) return;
       buf += chunk;
       if (buf.length > MAX_REQUEST_BYTES) {
         answered = true;
+        clearTimeout(deadline);
         return respond(sock, { refused: "request too large" });
       }
       const nl = buf.indexOf("\n");
       if (nl < 0) return;
       answered = true;
+      clearTimeout(deadline);
       handle(sock, buf.slice(0, nl));
     });
   });
@@ -13122,11 +13165,22 @@ async function startHookService(opts) {
       if (closed) return resolve17();
       closed = true;
       setSnapshotCache(null);
-      server.close(() => {
+      let settled = false;
+      let drain;
+      const finalize = () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(drain);
         removeQuietly(paths.socket);
         removeQuietly(paths.state);
         resolve17();
-      });
+      };
+      server.close(finalize);
+      for (const sock of sockets) if (sock !== acceptedSocket) sock.destroy();
+      drain = setTimeout(() => {
+        for (const sock of sockets) sock.destroy();
+      }, SHUTDOWN_DRAIN_MS);
+      drain.unref?.();
     })
   };
 }
@@ -13264,7 +13318,7 @@ function runHookService(args) {
   });
   return -1;
 }
-var MAX_REQUEST_BYTES, STOP_WAIT_MS;
+var MAX_REQUEST_BYTES, STOP_WAIT_MS, REQUEST_DEADLINE_MS, SHUTDOWN_DRAIN_MS;
 var init_hook_service = __esm({
   "src/cli/hook-service.ts"() {
     "use strict";
@@ -13277,6 +13331,8 @@ var init_hook_service = __esm({
     init_hook_client();
     MAX_REQUEST_BYTES = 64 * 1024 * 1024;
     STOP_WAIT_MS = 1e4;
+    REQUEST_DEADLINE_MS = 3e4;
+    SHUTDOWN_DRAIN_MS = 5e3;
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tamperward",
-  "version": "2.29.18",
+  "version": "2.29.20",
   "description": "The deterministic agent-integrity gate. One ruleset, evaluated on the actual diff/commands as a verdict, enforced everywhere a change can be made.",
   "license": "Apache-2.0",
   "author": "hexrift",