vexp-cli 3.1.1 → 3.1.3

package/dist/mcp-supervisor.js

@@ -3,7 +3,7 @@ import { CLI_VERSION } from "./version.js";
 import * as net from "net";
 import * as os from "os";
 import * as path from "path";
-import { spawn } from "child_process";
+import { spawn, spawnSync } from "child_process";
 import { randomUUID } from "crypto";
 import { getMcpServerPath } from "./binary.js";
 const DEFAULT_PORT = 7821;
@@ -33,6 +33,8 @@ export function readPidRecord() {
                 // pass (measured 60.7s replacement period). The reuse fast path
                 // is only as good as the record it reads.
                 version: typeof rec.version === "string" ? rec.version : undefined,
+                spawnedBy: typeof rec.spawnedBy === "string" ? rec.spawnedBy : undefined,
+                spawnedByPid: typeof rec.spawnedByPid === "number" ? rec.spawnedByPid : undefined,
             };
         }
     }
@@ -97,6 +99,71 @@ export function resolveOrGenerateMcpToken() {
  * The MCP server is deliberately workspace-agnostic: clients disambiguate
  * via URL path /ws/<workspaceHash>/mcp. No VEXP_WORKSPACE env is passed.
  */
+/**
+ * Is the running server's version strictly older than ours?
+ *
+ * A record with no version predates version tracking (< 2.4) and counts as
+ * older. An unparseable version counts as older too: replacing it once is
+ * recoverable, whereas deferring to it forever is what the field report
+ * showed. A NEWER server is left alone — this process is the stale one.
+ */
+/**
+ * The version of the MCP bundle at `mcpPath`, read from the package.json that
+ * ships it — the build a client will actually be served, as opposed to the
+ * version of whatever process happens to be spawning it.
+ */
+/**
+ * The parent of a running process, or undefined.
+ *
+ * The supervisor that spawned the MCP server is its parent, and that is true
+ * however old the build that wrote ~/.vexp/mcp.pid — which is what makes it
+ * the right evidence for a record written before vexp recorded the spawner.
+ * Best-effort by design: an unreadable parent must degrade to "cannot tell",
+ * never to silence.
+ */
+export function parentPid(pid) {
+    try {
+        const r = process.platform === "win32"
+            ? spawnSync("powershell", ["-NoProfile", "-Command", `(Get-CimInstance Win32_Process -Filter "ProcessId=${pid}").ParentProcessId`], { encoding: "utf-8", timeout: 4000 })
+            : spawnSync("ps", ["-o", "ppid=", "-p", String(pid)], { encoding: "utf-8", timeout: 4000 });
+        const n = Number.parseInt(String(r.stdout ?? "").trim(), 10);
+        // pid 1 is init adopting an orphan: a real parent, but never OUR
+        // supervisor, and naming it would invite someone to kill init.
+        return Number.isFinite(n) && n > 1 ? n : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function mcpBundleVersion(mcpPath) {
+    const pkg = path.resolve(path.dirname(mcpPath), "..", "package.json");
+    try {
+        const parsed = JSON.parse(fs.readFileSync(pkg, "utf-8"));
+        if (typeof parsed.version === "string")
+            return parsed.version;
+    }
+    catch { /* not readable: fall back to the caller's own version */ }
+    return undefined;
+}
+export function isOlderVersion(recorded, mine) {
+    if (!recorded)
+        return true;
+    if (recorded === mine)
+        return false;
+    const parts = (v) => {
+        const nums = v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10));
+        return nums.length === 3 && nums.every((n) => Number.isFinite(n)) ? nums : null;
+    };
+    const a = parts(recorded);
+    const b = parts(mine);
+    if (!a || !b)
+        return true;
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    }
+    return false;
+}
 export async function ensureMcpHttpServer(opts = {}) {
     const port = opts.port ?? DEFAULT_PORT;
     const owner = opts.owner ?? "unknown";
@@ -104,17 +171,37 @@ export async function ensureMcpHttpServer(opts = {}) {
     const mcpPath = getMcpServerPath();
     if (!mcpPath)
         return null;
-    // Fast path: already alive and tracked - but only if it is OUR version.
-    // Field report (Nathan): a 2.3.0 http server stayed authoritative for
-    // 9 days across extension upgrades because reuse never compared
-    // versions. On mismatch (or a legacy record without one) we take over:
-    // SIGTERM the old listener and spawn the current build.
+    // Fast path: already alive and tracked - but only if it is not OLDER than
+    // us. Field report (Nathan): a 2.3.0 http server stayed authoritative for
+    // 9 days across extension upgrades because reuse never compared versions.
+    // On an older server we take over: SIGTERM the old listener and spawn the
+    // current build.
+    //
+    // The comparison is ORDERED, not an equality check. Equality made takeover
+    // symmetric, so two installs of different versions each saw the other as
+    // "not mine" and reclaimed the port from it — and `vexp serve` re-runs this
+    // every 60s, so a supervisor left behind by an older install resurrected
+    // its own build indefinitely. A tester watched a v3.0.1 server come back
+    // after being replaced by v3.1.1, with a fresh pid (tier-4 field report,
+    // 2026-09-05). An older build now stands down and reuses what is there.
     {
         const existing = readPidRecord();
         if (existing && existing.port === port && isPidAlive(existing.pid) && (await isPortInUse(port))) {
-            if (existing.version === CLI_VERSION) {
+            if (!isOlderVersion(existing.version, CLI_VERSION)) {
                 return { pid: existing.pid, port, started: false };
             }
+            // Name the process that will undo this in sixty seconds, HERE, where the
+            // takeover happens — a user who never runs doctor otherwise watches the
+            // port revert with nothing to read. The supervisor is the parent of the
+            // server we are about to end; the recorded pid, when a recent build
+            // wrote it, says the same thing without a process lookup.
+            const boss = existing.spawnedByPid ?? parentPid(existing.pid);
+            if (boss !== undefined && isPidAlive(boss)) {
+                console.error(`  ⚠ replacing the MCP server on :${port} (was v${existing.version ?? "pre-2.4"}). ` +
+                    `It was started by pid ${boss}, a supervisor from an older install.\n` +
+                    `     If :${port} reverts, end that process FIRST — before restarting any daemon: its ` +
+                    `health loop deletes daemon registrations as fast as they are written.`);
+            }
             try {
                 process.kill(existing.pid, "SIGTERM");
             }
@@ -184,7 +271,15 @@ export async function ensureMcpHttpServer(opts = {}) {
         const pid = child.pid;
         if (!pid)
             return null;
-        writePidRecord({ pid, port, startedAt: Date.now(), owner, version: CLI_VERSION });
+        writePidRecord({
+            pid,
+            port,
+            startedAt: Date.now(),
+            owner,
+            version: mcpBundleVersion(mcpPath) ?? CLI_VERSION,
+            spawnedBy: CLI_VERSION,
+            spawnedByPid: process.pid,
+        });
         // Wait for the child to actually bind the port BEFORE releasing the
         // lock. Without this, a second caller arriving right after release
         // sees pidfile+live-pid but port-not-yet-bound → falsely concludes

package/dist/serve.js

@@ -207,7 +207,46 @@ async function resurrectAll() {
         if (resurrected.get(sock))
             live[ws] = sock;
     }
-    writeRegistry(live);
+    // A row this supervisor did not resurrect is not thereby dead.
+    //
+    // `live` used to become the WHOLE new registry, so every row the plan
+    // skipped — another supervisor's daemon, a linked worktree, a workspace
+    // whose manifest had moved — was deleted while its daemon was still
+    // running and answering on its socket. The health loop re-runs this every
+    // 60s, so the deletion was permanent and self-renewing: on a tester's
+    // machine two daemons that had been serving a pre-upgrade build for five
+    // days disappeared from `vexp daemons`, from `index_status`'s "other live
+    // daemons" and from the concurrency fence the moment a supervisor
+    // restarted, leaving a three-daemon box reporting a clean single-workspace
+    // install (field report, 2026-09-07).
+    //
+    // Liveness decides what stays in the registry, never ownership. The fence
+    // counts these rows, so dropping a live daemon also made the cap evadable
+    // by restarting a supervisor.
+    writeRegistry(await survivingRegistryRows(reg, live, isSocketAlive, appendLog));
+}
+/**
+ * The rows that stay in `~/.vexp/daemons.json` after a resurrection pass:
+ * everything this supervisor brought up, PLUS every other row whose daemon is
+ * still answering. Only a row that is neither is dropped.
+ *
+ * Separated out because the rule is the whole bug: a supervisor may only
+ * report what it could not find, never delete what it does not own.
+ */
+export async function survivingRegistryRows(before, resurrected, alive, log = () => { }) {
+    const canonical = (ws) => (process.platform === "win32" ? ws.toLowerCase() : ws);
+    const out = { ...resurrected };
+    const kept = new Set(Object.keys(out).map(canonical));
+    for (const [ws, sock] of Object.entries(before)) {
+        if (kept.has(canonical(ws)))
+            continue;
+        if (await alive(sock)) {
+            out[ws] = sock;
+            kept.add(canonical(ws));
+            log(`registry keep: ${ws} (not ours to resurrect, but its daemon is alive)`);
+        }
+    }
+    return out;
 }
 async function startMcp() {
     const port = parseInt(process.env.VEXP_PORT ?? String(DEFAULT_MCP_PORT), 10);

package/dist/slow-mount.js

@@ -0,0 +1,81 @@
+/**
+ * Slow-filesystem detection for doctor.
+ *
+ * CLI and VS Code twins: packages/vexp-cli/src/slow-mount.ts and
+ * packages/vexp-vscode/src/slow-mount.ts must stay byte-identical (a
+ * lockstep test compares them). Pure functions take the /proc/mounts text
+ * so they are testable anywhere; only `slowMountNotice` touches the OS.
+ *
+ * Field report (2026-09-09): a 229-file repo on /app inside Docker Desktop,
+ * a Windows drive over 9p. verify_done at 41-170 s, 19 slow-statement
+ * warnings from SQLite (a bare INSERT at 1.25 s), 49 slow connection
+ * acquires. Nothing in vexp was wrong on that machine except that the whole
+ * workspace, index included, sat behind an OS boundary. Doctor said
+ * everything was [OK]. It now says this.
+ */
+import * as fs from "fs";
+/** Filesystem types where every stat, read and git walk crosses an OS boundary. */
+export const SLOW_FS_TYPES = {
+    "9p": "a host drive mounted over 9p (WSL2 /mnt/*, Docker Desktop bind mount)",
+    drvfs: "a Windows drive mounted in WSL (drvfs)",
+    "fuse.grpcfuse": "a macOS host folder bind-mounted into Docker Desktop (grpcfuse)",
+    virtiofs: "a host folder shared into a VM (virtiofs)",
+    vboxsf: "a VirtualBox shared folder",
+    prl_fs: "a Parallels shared folder",
+    cifs: "a network share (CIFS/SMB)",
+    smb3: "a network share (SMB3)",
+    nfs: "a network share (NFS)",
+    nfs4: "a network share (NFS)",
+    "fuse.sshfs": "a remote folder over sshfs",
+};
+/** The mount that holds `root`: the longest mount point that is a prefix of it. */
+export function mountFor(root, mountsText) {
+    let best = null;
+    for (const line of mountsText.split("\n")) {
+        const parts = line.split(" ");
+        if (parts.length < 3)
+            continue;
+        // /proc/mounts escapes spaces in mount points as \040.
+        const mountPoint = parts[1].replace(/\\040/g, " ");
+        const fsType = parts[2];
+        const prefix = mountPoint.endsWith("/") ? mountPoint : mountPoint + "/";
+        if (root === mountPoint || root.startsWith(prefix)) {
+            if (!best || mountPoint.length > best.mountPoint.length)
+                best = { mountPoint, fsType };
+        }
+    }
+    return best;
+}
+/** The WARN text when the workspace sits on a slow mount; null when it does not. */
+export function slowMountVerdict(root, mountsText) {
+    const m = mountFor(root, mountsText);
+    if (!m)
+        return null;
+    const what = SLOW_FS_TYPES[m.fsType];
+    if (!what)
+        return null;
+    return (`workspace is on ${what}: ${m.fsType} at ${m.mountPoint}. Every stat, read and git walk ` +
+        "crosses an OS boundary, 10-50x slower than a native disk; indexing, verify_done and the " +
+        "SQLite index in .vexp/ all pay it on every call. Keep the clone on the Linux filesystem " +
+        "(WSL: under ~, not /mnt/c; Docker: a named volume, not a bind mount from the host).");
+}
+/** Linux only: reads /proc/mounts. Any other platform, or an unreadable table, is silent. */
+export function slowMountNotice(root) {
+    if (process.platform !== "linux")
+        return null;
+    let text;
+    try {
+        text = fs.readFileSync("/proc/mounts", "utf8");
+    }
+    catch {
+        return null;
+    }
+    let real = root;
+    try {
+        real = fs.realpathSync(root);
+    }
+    catch {
+        /* an unresolvable root is still matchable as given */
+    }
+    return slowMountVerdict(real, text);
+}

package/dist/socket-path.js

@@ -27,6 +27,30 @@ export function socketPathFor(workspaceRoot) {
         return candidate;
     return `/tmp/vexp-${fnvHash(workspaceRoot).slice(0, 12)}.sock`;
 }
+/** Longest `<root>/.vexp/daemon.sock` vexp binds in place; past it the socket lives in /tmp. */
+export const UNIX_SOCKET_PATH_LIMIT = 100;
+/**
+ * How close a workspace is to the relocation above — the number doctor
+ * prints. A tester measured his Claude Code worktrees at 78-89 characters
+ * (auto-named `adjective-name-hash` directories under `.claude/worktrees/`)
+ * and found nothing that would have announced the move when a longer name
+ * crossed the line (field report, 2026-09-10). On Windows there is no path
+ * to measure: the pipe name is a hash.
+ */
+export function socketPathMargin(workspaceRoot) {
+    const candidate = path.join(workspaceRoot, ".vexp", "daemon.sock");
+    if (process.platform === "win32") {
+        return { candidate, length: candidate.length, limit: UNIX_SOCKET_PATH_LIMIT, margin: Infinity, relocated: false };
+    }
+    const length = candidate.length;
+    return {
+        candidate,
+        length,
+        limit: UNIX_SOCKET_PATH_LIMIT,
+        margin: UNIX_SOCKET_PATH_LIMIT - length,
+        relocated: length > UNIX_SOCKET_PATH_LIMIT,
+    };
+}
 /** FNV-1a 64-bit, hex, unpadded — mirrors md5_hash() in vexp-core/src/utils.rs. */
 export function fnvHash(input) {
     let hash = BigInt("0xcbf29ce484222325");