tesseract-agent 0.9.8 → 0.9.10

package/dist-bundle/cli.js

@@ -63375,7 +63375,19 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
       issuedAt: Date.now(),
       maxStaleness: DEFAULT_MAX_STALENESS_MS,
       groupTable: [],
-      rules: [{ action: ACTION_ACCEPT, srcGroups: [], srcCidrs: [], proto: PROTO_ANY, ports: [], dstCidrs: [], caps: 0 }],
+      // `--caps exit` grants CAP_EXIT_NODE. It is a SEPARATE grant from being allowed
+      // to reach the machine, which is the whole reason the capability lives in policy
+      // rather than the certificate: revoking "route the internet through it" must not
+      // require re-issuing anyone's identity.
+      rules: [{
+        action: ACTION_ACCEPT,
+        srcGroups: [],
+        srcCidrs: [],
+        proto: PROTO_ANY,
+        ports: [],
+        dstCidrs: [],
+        caps: String(flags.caps ?? "").split(",").includes("exit") ? CAP_EXIT_NODE : 0
+      }],
       roster: [],
       revokedSerials: [],
       revokedStatics: [],
@@ -63392,7 +63404,7 @@ Next, issue an identity for a machine (pick a free address in ${formatPrefix(gen
   die(`Usage:
   tesseract-agent net init  --org NAME [--ca-dir DIR]
   tesseract-agent net mint  --name NODE --ip A.B.C.D [--out DIR] [--exit-node] [--relay] [--groups a,b]
-  tesseract-agent net policy [--epoch N] [--out FILE]`);
+  tesseract-agent net policy [--epoch N] [--caps exit] [--out FILE]`);
 }
 var SEED_LEN;
 var init_mesh_ca = __esm({
@@ -86547,57 +86559,24 @@ async function runDaemon(opts = {}) {
     return pids;
   }
   async function takeoverMachine() {
-    const rivals = /* @__PURE__ */ new Set();
     let lockPid = 0, statusPid = 0;
     const otherPids = [];
     try {
       lockPid = Number(readFileSync31(pidfile(), "utf-8").trim());
-      if (lockPid > 0)
-        rivals.add(lockPid);
     } catch {
     }
     try {
       statusPid = Number(JSON.parse(readFileSync31(statusFile(), "utf-8")).pid ?? 0);
-      if (statusPid > 0)
-        rivals.add(statusPid);
     } catch {
     }
-    for (const p of otherDaemonPids()) {
+    for (const p of otherDaemonPids())
       otherPids.push(p);
-      rivals.add(p);
-    }
     try {
-      log9(`takeover: me=${process.pid} lockPid=${lockPid || "-"} statusPid=${statusPid || "-"} otherDaemonPids=[${otherPids.join(",") || "-"}]`);
+      log9(`takeover(no-kill): me=${process.pid} lockPid=${lockPid || "-"} statusPid=${statusPid || "-"} otherDaemonPids=[${otherPids.join(",") || "-"}]`);
     } catch {
     }
-    rivals.delete(process.pid);
-    const live = [...rivals].filter(isAlive2);
-    if (live.length) {
-      for (const pid of live) {
-        let cmd = "";
-        try {
-          cmd = execFileSync4("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8", timeout: 2e3 }).trim().slice(0, 200);
-        } catch {
-        }
-        log9(`takeover: killing rival daemon pid=${pid} (latest-wins single-instance) cmd=[${cmd}]`);
-        try {
-          process.kill(pid, "SIGTERM");
-        } catch {
-        }
-      }
-      for (let i = 0; i < 25 && live.some(isAlive2); i++)
-        await new Promise((r) => setTimeout(r, 100));
-      for (const pid of live)
-        if (isAlive2(pid)) {
-          log9(`takeover: SIGKILL rival pid=${pid} (ignored SIGTERM)`);
-          try {
-            process.kill(pid, "SIGKILL");
-          } catch {
-          }
-        }
-    }
     try {
-      if (existsSync29(pidfile()))
+      if (existsSync29(pidfile()) && (!lockPid || lockPid === process.pid || !isAlive2(lockPid)))
         unlinkSync4(pidfile());
     } catch {
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tesseract-agent",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "license": "UNLICENSED",
   "publishConfig": {
     "access": "public",