vexp-cli 3.3.3 → 3.3.4

package/dist/daemon-upgrade.js

@@ -0,0 +1,337 @@
+import * as fs from "fs";
+import * as net from "net";
+import * as path from "path";
+import { isOlderVersion } from "./mcp-supervisor.js";
+import { vexpHome } from "./state-home.js";
+/** How long a workspace is left alone after a replacement was tried for it. */
+export const UPGRADE_COOLDOWN_MS = 10 * 60_000;
+/** How long the daemon is given to answer `index_status`. */
+export const UPGRADE_STATUS_TIMEOUT_MS = 1_500;
+/**
+ * Whether a launcher replaces the daemon that answered. The rules, in order:
+ *
+ *  1. Switched off: VEXP_NO_DAEMON_UPGRADE=1, or VEXP_NO_AUTOSTART=1, which
+ *     already means "start nothing on my behalf".
+ *  2. A version that is missing, or is not a version: nothing to compare.
+ *  3. ORDERED, not merely different. An older daemon is replaced and a newer
+ *     one is left alone: two installs at two versions never converge under
+ *     "different", each replaces the other's daemon at its next use (the
+ *     extension learnt it with three editors on one machine, 3.1.1).
+ *  4. A daemon running the engine inside an editor extension's folder
+ *     belongs to an editor window, which starts the same build again the
+ *     moment this one stops. It changes when the editor updates.
+ *  5. A daemon still building or syncing its index is left to finish, since
+ *     a restart begins the sync again; it is replaced at a later use. Only
+ *     "healthy" is a settled state: the engine also answers "empty" and
+ *     "degraded" before its startup sync is done.
+ *  6. The seat belt: one attempt per workspace in ten minutes, whatever
+ *     kept the last one from taking. A launcher never restarts a daemon on
+ *     every invocation.
+ */
+export function daemonUpgradeDecision(o) {
+    if (o.disabled)
+        return { replace: false, why: "switched off" };
+    // isOlderVersion counts what it cannot parse as older: right for a pid
+    // record it must take over, wrong for a process it would restart.
+    const version = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+    if (!o.running || !o.engine || !version.test(o.running) || !version.test(o.engine)) {
+        return { replace: false, why: "version unknown" };
+    }
+    if (!isOlderVersion(o.running, o.engine))
+        return { replace: false, why: "daemon is not older" };
+    if (o.exe && /vexp\.vexp-vscode-\d/i.test(o.exe))
+        return { replace: false, why: "started by an editor window" };
+    if (o.status !== "healthy")
+        return { replace: false, why: "index not settled" };
+    // Either side of now: a record from a clock that was ahead holds as well.
+    if (o.lastAttemptMs !== undefined && Math.abs(o.nowMs - o.lastAttemptMs) < UPGRADE_COOLDOWN_MS) {
+        return { replace: false, why: "tried in the last ten minutes" };
+    }
+    return { replace: true };
+}
+/**
+ * Where the attempts are remembered: vexp's own state directory, one small
+ * file for the machine, shared by the CLI and the MCP server so that they
+ * keep ONE cool-down between them. Not a file in `<workspace>/.vexp/`:
+ * everything there has to be named in the .gitignore the engine generates,
+ * and a file this side added on its own would show up in `git status`.
+ */
+export function upgradeAttemptsPath() {
+    return path.join(vexpHome(), ".vexp", "daemon-upgrade.json");
+}
+/** The key a workspace's attempt is kept under: its resolved path, so the
+ *  two launchers agree however each was told the folder; lowercased on
+ *  Windows, as the daemon registry is. */
+export function upgradeAttemptKey(workspace) {
+    let resolved = path.resolve(workspace);
+    try {
+        resolved = fs.realpathSync.native(resolved);
+    }
+    catch {
+        /* not there: the spelling given */
+    }
+    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+/** Workspace key -> epoch ms of the last attempt. A file that is missing,
+ *  corrupt or of another shape reads as no attempts. */
+export function readUpgradeAttempts(file = upgradeAttemptsPath()) {
+    const attempts = {};
+    try {
+        const raw = JSON.parse(fs.readFileSync(file, "utf-8"));
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return attempts;
+        for (const [key, at] of Object.entries(raw)) {
+            if (typeof at === "number" && Number.isFinite(at))
+                attempts[key] = at;
+        }
+    }
+    catch {
+        /* no file yet, or not JSON */
+    }
+    return attempts;
+}
+/**
+ * Remember that a replacement is being tried for `workspace`. Entries past
+ * their cool-down are dropped on the way, so the file stays as small as the
+ * last ten minutes. Temp file and rename: a reader never sees half a file.
+ * Two processes writing at once can lose one entry, which costs at most one
+ * extra attempt. Returns false when nothing could be written: the caller
+ * then does not restart, because without the record nothing would stop it
+ * from restarting again at the next invocation.
+ */
+export function recordUpgradeAttempt(workspace, nowMs, file = upgradeAttemptsPath()) {
+    try {
+        const kept = {};
+        for (const [key, at] of Object.entries(readUpgradeAttempts(file))) {
+            if (Math.abs(nowMs - at) < UPGRADE_COOLDOWN_MS)
+                kept[key] = at;
+        }
+        kept[upgradeAttemptKey(workspace)] = nowMs;
+        const content = JSON.stringify(kept, null, 2) + "\n";
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const tmp = `${file}.tmp-${process.pid}-${nowMs}`;
+        try {
+            fs.writeFileSync(tmp, content, "utf-8");
+            fs.renameSync(tmp, file);
+        }
+        catch {
+            // A Windows rename refused because another process holds the target.
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch {
+                /* never written */
+            }
+            fs.writeFileSync(file, content, "utf-8");
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `index_status` from the daemon listening on `socket`, or null when it does
+ * not answer in time. One JSON line each way.
+ *
+ * No session id, like the extension's version probe and doctor's: a request
+ * that carries one opens a row in the daemon's session map, where the
+ * sidebar's probe once read as an agent with 360 tool calls an hour (field
+ * report, 2026-09-28). A launcher asks before every command.
+ */
+export function queryIndexStatus(socket, timeoutMs) {
+    return new Promise((resolve) => {
+        let sock;
+        try {
+            sock = net.createConnection({ path: socket });
+        }
+        catch {
+            resolve(null);
+            return;
+        }
+        let buf = "";
+        let settled = false;
+        const finish = (answer) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            sock.destroy();
+            resolve(answer);
+        };
+        const timer = setTimeout(() => finish(null), timeoutMs);
+        sock.on("connect", () => {
+            sock.write(JSON.stringify({ id: 1, tool: "index_status", params: {} }) + "\n");
+        });
+        sock.on("data", (chunk) => {
+            buf += chunk.toString();
+            const end = buf.indexOf("\n");
+            if (end === -1)
+                return;
+            try {
+                const result = JSON.parse(buf.slice(0, end))?.result;
+                finish(result && typeof result === "object" && !Array.isArray(result) ? result : null);
+            }
+            catch {
+                finish(null);
+            }
+        });
+        sock.on("error", () => finish(null));
+        sock.on("close", () => finish(null));
+    });
+}
+/** The version in what `vexp-core --version` prints (`vexp-core 3.3.3`): its
+ *  last word, as the extension and doctor read it. */
+export function parseEngineVersion(stdout) {
+    const last = stdout.trim().split(/\s+/).pop();
+    return last ? last : undefined;
+}
+/**
+ * The folder `daemon-cmd` works on when run in `dir`: the nearest one with a
+ * `.git` at or above it, else `dir` itself (find_repo_root in vexp-core).
+ */
+export function daemonCmdRoot(dir) {
+    let start = path.resolve(dir);
+    try {
+        start = fs.realpathSync.native(start);
+    }
+    catch {
+        /* not there: the spelling given */
+    }
+    let current = start;
+    for (;;) {
+        if (fs.existsSync(path.join(current, ".git")))
+            return current;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return start;
+        current = parent;
+    }
+}
+/**
+ * Why `daemon-cmd restart` run in `dir` would not put a new daemon in the
+ * old one's place, or null when it would. A replacement must never end as a
+ * removal, or as a second daemon somewhere else:
+ *
+ *  - the stop half reads `<dir>/.vexp/daemon.pid`; with none there it stops
+ *    nothing, and the start half then races the daemon that is still up;
+ *  - `daemon-cmd` works on the git root at or above its cwd, so for a
+ *    workspace below one it would start a daemon on the folder above;
+ *  - the engine refuses to start on the home directory, so a daemon an older
+ *    build left there would be stopped and not come back.
+ */
+export function whyNotRestartable(dir) {
+    let isDir = false;
+    try {
+        isDir = fs.statSync(dir).isDirectory();
+    }
+    catch {
+        /* gone */
+    }
+    if (!isDir)
+        return "workspace folder not found";
+    if (!fs.existsSync(path.join(dir, ".vexp", "daemon.pid")))
+        return "no pid file in the workspace";
+    const key = upgradeAttemptKey(dir);
+    if (upgradeAttemptKey(daemonCmdRoot(dir)) !== key)
+        return "daemon-cmd works on the git root above";
+    if (process.env.VEXP_ALLOW_HOME_WORKSPACE !== "1" && key === upgradeAttemptKey(vexpHome())) {
+        return "the home directory is not a workspace";
+    }
+    return null;
+}
+/**
+ * Ask the daemon on `socket` what it is and, when the rules above say so,
+ * restart it with this launcher's engine. Never throws; a daemon that does
+ * not answer is nobody's to replace.
+ *
+ * The daemon's own `workspace_root` names the folder to restart in, when it
+ * gives one: a session in a subfolder or in a connected repo is served by
+ * the daemon of another folder, and that is the one to replace.
+ *
+ * The attempt is recorded BEFORE the restart, so that a restart which hangs,
+ * fails or does not change the version is still the one attempt of its ten
+ * minutes.
+ */
+export async function replaceOlderDaemon(o) {
+    const disabled = process.env.VEXP_NO_DAEMON_UPGRADE === "1" || process.env.VEXP_NO_AUTOSTART === "1";
+    if (disabled)
+        return { replaced: false, why: "switched off", up: false };
+    const text = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
+    const left = (why) => ({ replaced: false, why, up: true });
+    try {
+        const status = await queryIndexStatus(o.socket, UPGRADE_STATUS_TIMEOUT_MS);
+        if (!status)
+            return { replaced: false, why: "no answer", up: false };
+        const running = text(status.daemon_version);
+        if (!running)
+            return left("version unknown");
+        if (o.launcherVersion && !isOlderVersion(running, o.launcherVersion))
+            return left("daemon is not older");
+        const engine = await o.engineVersion();
+        const dir = text(status.workspace_root) ?? o.workspace;
+        const file = o.attemptsFile ?? upgradeAttemptsPath();
+        const nowMs = o.nowMs ?? Date.now();
+        const decision = daemonUpgradeDecision({
+            running,
+            engine,
+            exe: text(status.daemon_exe),
+            status: text(status.status),
+            lastAttemptMs: readUpgradeAttempts(file)[upgradeAttemptKey(dir)],
+            nowMs,
+            disabled,
+        });
+        if (!decision.replace)
+            return left(decision.why);
+        if (!engine)
+            return left("version unknown");
+        const unfit = whyNotRestartable(dir);
+        if (unfit)
+            return left(unfit);
+        if (!recordUpgradeAttempt(dir, nowMs, file))
+            return left("attempt could not be recorded");
+        try {
+            await o.restart(dir);
+        }
+        catch {
+            return { replaced: false, why: "restart failed", up: false };
+        }
+        if (o.confirm) {
+            // The restart ran and did not fail. One answer makes it no
+            // replacement: the older version again, from a daemon the stop did
+            // not end or that its owner started anew. A daemon too busy starting
+            // to answer is the new one.
+            const after = text((await queryIndexStatus(o.socket, UPGRADE_STATUS_TIMEOUT_MS))?.daemon_version);
+            if (after && isOlderVersion(after, engine))
+                return left("restart did not take");
+        }
+        return { replaced: true, running, engine };
+    }
+    catch {
+        return { replaced: false, why: "check failed", up: false };
+    }
+}
+// ---------------------------------------------------------------------------
+// CLI only: which commands may replace a daemon.
+// ---------------------------------------------------------------------------
+/**
+ * Whether the bootstrap before `vexp <name>` may replace an older daemon.
+ *
+ * Most commands never reach the bootstrap at all (AUTOSTART_SKIP in cli.ts:
+ * `stop`, `forget`, `daemons`, `doctor`, `daemon-cmd`, `setup` and the
+ * others that manage a daemon themselves or need none). Of those that do,
+ * three kinds still must not restart one:
+ *
+ *  - `mcp` is a protocol server an agent starts with every session, often
+ *    several at once: its first seconds belong to the handshake;
+ *  - `daemon` IS a daemon start;
+ *  - `index --finalize`, `--merge-recover` and `--checkout-sync` are run by
+ *    the git hooks, inside someone's commit, merge or checkout.
+ */
+export function commandMayReplaceDaemon(name, opts = {}) {
+    if (name === "mcp" || name === "daemon")
+        return false;
+    if (name === "index" && (opts.finalize || opts.mergeRecover || opts.checkoutSync))
+        return false;
+    return true;
+}