zevairouter 1.0.172 → 1.0.174

package/cli/cli.js

@@ -65,6 +65,14 @@ const INSTALL_CMD_LATEST = `npm i -g ${APP_NAME}@latest --prefer-online`;
 const DEFAULT_PORT = 1997;
 const DEFAULT_HOST = "127.0.0.1";
 const MAX_PORT_ATTEMPTS = 10;
+
+function buildDetachedProcessEnv(overrides = {}) {
+  const env = { ...process.env, ...overrides };
+  delete env.ZEVAI_LAUNCHD_JOB;
+  delete env.XPC_SERVICE_NAME;
+  return env;
+}
+
 // Identifiers for killAllAppProcesses - only kill our app specifically.
 // "zevai" matches the current install; "zevairouter" matches the legacy upstream
 // fork so upgrading users' old instances still get cleaned up.
@@ -312,17 +320,27 @@ One-shot install / reinstall (any device):
       const needsPreInstallStop = !skipRestart && (hasCronWatchdog || pm2App) && !wasTray;
       if (needsPreInstallStop) {
         console.log("Stopping server first (frees RAM for install on small VPS)…");
-        if (isPortOccupied(updatePort) && !isZevaiVersionInfo(getLiveVersionInfo(updatePort, 4, updateHost))) {
-          throw new Error(`Port ${updatePort} is owned by an unverified service; refusing to terminate it.`);
-        }
-        if (pm2App) {
-          execFileSync("pm2", ["stop", String(pm2App.id)], { stdio: "inherit", timeout: 30000 });
-        } else {
-          stopOwnedRouterParent(updateRuntime, updatePort);
-        }
-        freePortHard(updatePort, updateHost);
-        if (isPortOccupied(updatePort)) {
-          throw new Error(`ZevaiRouter on port ${updatePort} did not stop cleanly.`);
+        let pm2StopAttempted = false;
+        try {
+          if (pm2App) {
+            pm2StopAttempted = true;
+            execFileSync("pm2", ["stop", String(pm2App.id)], { stdio: "inherit", timeout: 30000 });
+          } else {
+            stopOwnedRouterParent(updateRuntime, updatePort);
+          }
+          freePortHard(updatePort, updateHost);
+          if (isPortOccupied(updatePort)) {
+            throw new Error(`ZevaiRouter on port ${updatePort} did not stop cleanly.`);
+          }
+        } catch (stopError) {
+          if (pm2StopAttempted) {
+            try {
+              execFileSync("pm2", ["restart", String(pm2App.id)], { stdio: "inherit", timeout: 30000 });
+            } catch (restartError) {
+              throw new Error(`${stopError.message}; PM2 recovery also failed: ${restartError.message}`);
+            }
+          }
+          throw stopError;
         }
       }
 
@@ -506,8 +524,14 @@ WantedBy=multi-user.target
       // old child while a detached replacement tries to claim the same port.
       if (launchdManager) {
         try {
-          if (isPortOccupied(updatePort) && !isZevaiVersionInfo(getLiveVersionInfo(updatePort, 4, updateHost))) {
-            throw new Error(`Port ${updatePort} is owned by an unverified service; launchd was not changed.`);
+          // An inactive, validated job can leave its old detached Next child
+          // behind. Reap only a live-verified router or an exact macOS orphan
+          // before asking launchd to start the newly installed package.
+          if (launchdManager.pid == null && isPortOccupied(updatePort)) {
+            freePortHard(updatePort, updateHost);
+            if (isPortOccupied(updatePort)) {
+              throw new Error(`Port ${updatePort} is owned by an unverified service; launchd was not changed.`);
+            }
           }
           console.log(`Restarting validated LaunchAgent ${launchdManager.target}…`);
           execFileSync("launchctl", ["kickstart", "-k", launchdManager.target], {
@@ -599,12 +623,13 @@ WantedBy=multi-user.target
       // Free the port BEFORE spawning — otherwise the new detached process crashes
       // on EADDRINUSE while the old one keeps serving the stale build (buildMismatch).
       const directPort = updatePort;
-      if (isPortOccupied(directPort) && !isZevaiVersionInfo(getLiveVersionInfo(directPort, 4, updateHost))) {
-        rollbackInstall(`Port ${directPort} is owned by an unverified service`);
-        throw new Error(`Port ${directPort} is owned by an unverified service; it was not terminated`);
+      try {
+        stopOwnedRouterParent(updateRuntime, directPort);
+        freePortHard(directPort, updateHost);
+      } catch (stopError) {
+        rollbackInstall(`Could not safely stop port ${directPort}: ${stopError.message}`);
+        throw stopError;
       }
-      stopOwnedRouterParent(updateRuntime, directPort);
-      freePortHard(directPort, updateHost);
       if (isPortOccupied(directPort)) {
         rollbackInstall(`ZevaiRouter on port ${directPort} did not stop`);
         throw new Error(`Port ${directPort} did not become free; the previous package was restored`);
@@ -622,25 +647,23 @@ WantedBy=multi-user.target
             ? spawn(process.execPath, [cliEntry, ...relaunchArgs], {
                 detached: true,
                 stdio: ["ignore", out, out],
-                env: {
-                  ...process.env,
+                env: buildDetachedProcessEnv({
                   PORT: String(updatePort),
                   HOSTNAME: updateHost,
                   TRAY_MODE: wasTray ? "1" : "",
                   ZEVAI_SERVER_MODE: wasTray ? "" : "1",
-                },
+                }),
               })
             : spawn(result.zevaiPath || "zevai", relaunchArgs, {
                 detached: true,
                 stdio: ["ignore", out, out],
                 shell: process.platform === "win32",
-                env: {
-                  ...process.env,
+                env: buildDetachedProcessEnv({
                   PORT: String(updatePort),
                   HOSTNAME: updateHost,
                   TRAY_MODE: wasTray ? "1" : "",
                   ZEVAI_SERVER_MODE: wasTray ? "" : "1",
-                },
+                }),
               });
           child.unref();
           return { child, logFile };
@@ -729,6 +752,22 @@ if (
   process.env.TRAY_MODE = "1";
 }
 
+// New LaunchAgents set an explicit marker. The PID check keeps older, already
+// loaded plists safe until their next reload applies that marker.
+const launchdOwned = process.platform === "darwin" && trayMode && (
+  process.env.ZEVAI_LAUNCHD_JOB === "1"
+  || process.env.XPC_SERVICE_NAME === "com.zevairouter.autostart"
+  || (() => {
+    try {
+      const { isCurrentMacOSLaunchAgent } = require("./src/cli/tray/autostart");
+      return isCurrentMacOSLaunchAgent();
+    } catch {
+      return false;
+    }
+  })()
+);
+if (launchdOwned) process.env.ZEVAI_LAUNCHD_JOB = "1";
+
 // Always use Node.js runtime with absolute path
 const RUNTIME = process.execPath;
 
@@ -951,14 +990,14 @@ function killProxyByPidFile() {
   } catch { }
 }
 
-// Kill a listener only after its version endpoint proves it is ZevaiRouter.
+// Stop a listener through the platform-specific, identity-bound lifecycle.
 function killProcessOnPort(port, checkHost = host) {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     try {
-      killVerifiedRouterOnPort(port, checkHost);
+      freePortHard(port, checkHost);
       setTimeout(() => resolve(), 500);
     } catch (err) {
-      resolve();
+      reject(err);
     }
   });
 }
@@ -1166,7 +1205,8 @@ function getPortOwnerPids(checkPort) {
         .filter((pid) => Number.isInteger(pid) && pid > 0))];
     }
 
-    const output = execSync(`lsof -nP -tiTCP:${numericPort} -sTCP:LISTEN`, {
+    const lsofPath = process.platform === "darwin" ? "/usr/sbin/lsof" : "lsof";
+    const output = execFileSync(lsofPath, ["-nP", `-tiTCP:${numericPort}`, "-sTCP:LISTEN"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 5000,
@@ -1240,9 +1280,6 @@ function stopOwnedRouterParent(runtime, checkPort) {
   if (snapshots.length === 0) return false;
 
   const occupied = isPortOccupied(checkPort);
-  if (occupied && !isZevaiVersionInfo(getLiveVersionInfo(checkPort, 4, runtime?.host))) {
-    throw new Error(`Port ${checkPort} is owned by an unverified service; its parent was not stopped.`);
-  }
   const listenerPids = occupied ? getPortOwnerPids(checkPort) : [];
   if (occupied && listenerPids.length === 0) {
     throw new Error(`Could not prove listener ownership on port ${checkPort}; its parent was not stopped.`);
@@ -1293,28 +1330,114 @@ function stopOwnedRouterParent(runtime, checkPort) {
 }
 
 function killVerifiedRouterOnPort(checkPort, checkHost = DEFAULT_HOST) {
+  // macOS cleanup uses the stronger ancestry/cwd/start-time proofs below.
+  // Linux keeps a healthy detached-orphan fallback, bound to one PID and its
+  // immutable /proc start time. Windows retains the legacy single-PID proof.
+  if (process.platform === "darwin" || !["linux", "win32"].includes(process.platform)) {
+    return false;
+  }
   const live = getLiveVersionInfo(checkPort, 4, checkHost);
   if (!isZevaiVersionInfo(live)) return false;
 
   const pids = getPortOwnerPids(checkPort).filter((pid) => pid !== process.pid);
-  for (const pid of pids) {
+  if (pids.length !== 1) return false;
+  let linuxStartToken = null;
+  if (process.platform === "linux") {
     try {
-      if (process.platform === "win32") {
-        execSync(`taskkill /F /T /PID ${pid} 2>nul`, {
-          stdio: "ignore",
-          shell: true,
-          windowsHide: true,
-          timeout: 5000,
-        });
-      } else {
-        try { process.kill(pid, "SIGTERM"); } catch {}
-        if (!waitForExit(pid, 2000)) {
-          try { process.kill(pid, "SIGKILL"); } catch {}
-        }
-      }
-    } catch {}
+      const { parseLinuxProcStatStartToken } = require("./src/cli/routerProcessLifecycle");
+      linuxStartToken = parseLinuxProcStatStartToken(
+        fs.readFileSync(`/proc/${pids[0]}/stat`, "utf8"),
+        pids[0],
+      );
+    } catch {
+      return false;
+    }
+    if (!linuxStartToken) return false;
+  }
+  if (!isZevaiVersionInfo(getLiveVersionInfo(checkPort, 4, checkHost))) return false;
+  const confirmedPids = getPortOwnerPids(checkPort).filter((pid) => pid !== process.pid);
+  if (confirmedPids.length !== 1 || confirmedPids[0] !== pids[0]) return false;
+  if (process.platform === "linux") {
+    try {
+      const { parseLinuxProcStatStartToken } = require("./src/cli/routerProcessLifecycle");
+      const confirmedStartToken = parseLinuxProcStatStartToken(
+        fs.readFileSync(`/proc/${pids[0]}/stat`, "utf8"),
+        pids[0],
+      );
+      if (confirmedStartToken !== linuxStartToken) return false;
+    } catch {
+      return false;
+    }
+  }
+  try {
+    if (process.platform === "win32") {
+      execSync(`taskkill /F /T /PID ${pids[0]} 2>nul`, {
+        stdio: "ignore",
+        shell: true,
+        windowsHide: true,
+        timeout: 5000,
+      });
+      return true;
+    }
+    process.kill(pids[0], "SIGTERM");
+    if (waitForExit(pids[0], 2000)) return true;
+    const beforeKillPids = getPortOwnerPids(checkPort).filter((pid) => pid !== process.pid);
+    if (beforeKillPids.length !== 1 || beforeKillPids[0] !== pids[0]) return false;
+    const { parseLinuxProcStatStartToken } = require("./src/cli/routerProcessLifecycle");
+    const beforeKillStartToken = parseLinuxProcStatStartToken(
+      fs.readFileSync(`/proc/${pids[0]}/stat`, "utf8"),
+      pids[0],
+    );
+    if (beforeKillStartToken !== linuxStartToken) return false;
+    process.kill(pids[0], "SIGKILL");
+    return waitForExit(pids[0], 1000);
+  } catch {
+    return false;
+  }
+}
+
+function stopOwnedMacOsOrphanOnPort(checkPort) {
+  if (process.platform !== "darwin") return false;
+  let signaledOwnedProcess = false;
+  try {
+    const {
+      createMacOsProcessLifecycleDependencies,
+      stopOwnedMacOsOrphanListeners,
+    } = require("./src/cli/routerProcessLifecycle");
+    const lexicalGlobalRoot = path.dirname(path.dirname(__dirname));
+    let globalRoot = lexicalGlobalRoot;
+    try { globalRoot = fs.realpathSync.native(lexicalGlobalRoot); } catch {}
+    const dependencies = createMacOsProcessLifecycleDependencies();
+    const sendSignal = dependencies.sendSignal;
+    dependencies.sendSignal = (pid, signal) => {
+      sendSignal(pid, signal);
+      signaledOwnedProcess = true;
+    };
+    const result = stopOwnedMacOsOrphanListeners({
+      port: Number(checkPort),
+      globalRoot,
+      dependencies,
+    });
+    return result.stopped === true;
+  } catch (error) {
+    // Once an exact owned process has been signaled, a partial cleanup is a
+    // hard startup failure even if TERM already made the port look free.
+    if (signaledOwnedProcess) throw error;
+    return false;
+  }
+}
+
+function stopCurrentOwnedRouterParent(checkPort, checkHost = DEFAULT_HOST) {
+  if (process.platform === "win32") return false;
+  try {
+    const current = readOwnedProcessState();
+    return stopOwnedRouterParent({
+      runningProcesses: current.runningProcesses,
+      host: checkHost,
+    }, checkPort);
+  } catch {
+    return false;
   }
-  return pids.length > 0;
 }
 
 /**
@@ -1334,8 +1457,13 @@ function isStaleRouterOnPort(checkPort, checkHost = DEFAULT_HOST) {
   return false;
 }
 
-/** Free a verified ZevaiRouter listener without touching unrelated services. */
+/** Free a proven ZevaiRouter listener without touching unrelated services. */
 function freePortHard(checkPort, checkHost = DEFAULT_HOST) {
+  if (process.platform === "win32") {
+    return killVerifiedRouterOnPort(checkPort, checkHost);
+  }
+  if (stopCurrentOwnedRouterParent(checkPort, checkHost)) return true;
+  if (process.platform === "darwin") return stopOwnedMacOsOrphanOnPort(checkPort);
   return killVerifiedRouterOnPort(checkPort, checkHost);
 }
 
@@ -1436,13 +1564,25 @@ function attachToRunningRouter(latestVersion) {
 // Check for updates FIRST, then start server (or attach if already healthy)
 checkForUpdate().then((latestVersion) => {
   const underSystemd = Boolean(process.env.INVOCATION_ID) || process.env.ZEVAI_SERVER_MODE === "1";
-  const occupied = isPortOccupied(port);
-  const live = occupied ? getLiveVersionInfo(port, 4, host) : null;
+  const underManagedSupervisor = underSystemd || launchdOwned;
+  let occupied = isPortOccupied(port);
+  let live = occupied ? getLiveVersionInfo(port, 4, host) : null;
   if (occupied && !isZevaiVersionInfo(live)) {
-    console.error(`Port :${port} is already in use by an unverified process.`);
-    console.error("ZevaiRouter will not terminate unrelated services. Free the port or choose --port <port>.");
-    process.exitCode = 1;
-    return;
+    let recovered = stopCurrentOwnedRouterParent(port, host);
+    if (isPortOccupied(port)) {
+      recovered = stopOwnedMacOsOrphanOnPort(port) || recovered;
+    }
+    occupied = isPortOccupied(port);
+    if (occupied) {
+      console.error(`Port :${port} is already in use by an unverified process.`);
+      console.error("ZevaiRouter will not terminate unrelated services. Free the port or choose --port <port>.");
+      process.exitCode = 1;
+      return;
+    }
+    if (recovered) {
+      console.log(`Recovered an unresponsive ZevaiRouter process on :${port}.`);
+    }
+    live = null;
   }
   const stale = isStaleRouterOnPort(port, host);
   const healthy = isRouterHealthy(port, host);
@@ -1450,7 +1590,7 @@ checkForUpdate().then((latestVersion) => {
   // Bare `zevai` while a *matching* server already serves :1997 → attach.
   // If the listener is an OLD orphan next-server (buildVersion lag), take over.
   // Never attach when launched by systemd / server mode — parent must stay alive.
-  if (!forceRestart && !underSystemd && healthy && !stale) {
+  if (!forceRestart && !underManagedSupervisor && healthy && !stale) {
     attachToRunningRouter(latestVersion);
     return;
   }
@@ -1469,15 +1609,22 @@ checkForUpdate().then((latestVersion) => {
     }
   }
 
-  killAllAppProcesses(port)
+  return killAllAppProcesses(port)
     .then(() => killProcessOnPort(port, host))
     .then(() => {
       freePortHard(port, host);
       return new Promise((r) => setTimeout(r, 400));
     })
     .then(() => {
+      if (isPortOccupied(port)) {
+        throw new Error(`Port :${port} is still occupied after safe cleanup.`);
+      }
       startServer(latestVersion);
     });
+}).catch((error) => {
+  console.error(`ZevaiRouter startup aborted: ${error.message}`);
+  console.error("An owned router process could not be cleaned up completely.");
+  process.exitCode = 1;
 });
 
 // Show interface selection menu
@@ -1536,7 +1683,60 @@ function startServer(latestVersion) {
   let serverStartTime = Date.now();
 
   const CRASH_LOG_LINES = 50;
+  const CRASH_LOG_BYTES = 64 * 1024;
+  const SERVER_LOG_MAX_BYTES = 4 * 1024 * 1024;
+  const SERVER_LOG_CHECK_MS = 30 * 1000;
+  const serverLogPath = path.join(getAppDataDir(), "logs", "router-server.log");
+  const noFollowFlag = fs.constants.O_NOFOLLOW || 0;
+  const serverLogReadFlags = fs.constants.O_RDONLY | noFollowFlag;
+  const serverLogWriteFlags = fs.constants.O_WRONLY
+    | fs.constants.O_CREAT
+    | fs.constants.O_APPEND
+    | noFollowFlag;
+  const serverDetached = !launchdOwned;
   let crashLog = [];
+  let serverLogOffset = null;
+  let serverLogMaintenance = null;
+
+  function readServerCrashLog() {
+    if (serverLogOffset == null) return [];
+    let fd;
+    try {
+      fd = fs.openSync(serverLogPath, serverLogReadFlags);
+      const stat = fs.fstatSync(fd);
+      if (!stat.isFile()) return [];
+      const size = stat.size;
+      const start = Math.max(serverLogOffset, size - CRASH_LOG_BYTES, 0);
+      const length = Math.max(0, size - start);
+      if (length === 0) return [];
+      const buffer = Buffer.alloc(length);
+      fs.readSync(fd, buffer, 0, length, start);
+      return buffer.toString("utf8").split("\n").filter(Boolean).slice(-CRASH_LOG_LINES);
+    } catch {
+      return [];
+    } finally {
+      if (fd != null) {
+        try { fs.closeSync(fd); } catch {}
+      }
+    }
+  }
+
+  function enforceServerLogLimit() {
+    let fd;
+    try {
+      fd = fs.openSync(serverLogPath, serverLogWriteFlags, 0o600);
+      const stat = fs.fstatSync(fd);
+      if (!stat.isFile() || stat.size <= SERVER_LOG_MAX_BYTES) return;
+      fs.ftruncateSync(fd, 0);
+      serverLogOffset = 0;
+    } catch {
+      // Hidden logging is best-effort and must never take down the router.
+    } finally {
+      if (fd != null) {
+        try { fs.closeSync(fd); } catch {}
+      }
+    }
+  }
 
   function spawnServer() {
     serverStartTime = Date.now();
@@ -1547,28 +1747,49 @@ function startServer(latestVersion) {
     const maxOldSpace = String(
       parseInt(process.env.ZEVAI_MAX_OLD_SPACE_SIZE || "1536", 10) || 1536
     );
-    const child = spawn(RUNTIME, [`--max-old-space-size=${maxOldSpace}`, serverPath], {
-      cwd: standaloneDir,
-      stdio: showLog ? "inherit" : ["ignore", "ignore", "pipe"],
-      detached: true,
-      windowsHide: true,
-      env: {
-        ...buildEnvWithRuntime(process.env),
-        PORT: port.toString(),
-        HOSTNAME: host
+    let logFd = null;
+    let stdio = "inherit";
+    if (!showLog) {
+      try {
+        fs.mkdirSync(path.dirname(serverLogPath), { recursive: true, mode: 0o700 });
+        logFd = fs.openSync(serverLogPath, serverLogWriteFlags, 0o600);
+        const logStat = fs.fstatSync(logFd);
+        if (!logStat.isFile()) throw new Error("router server log is not a regular file");
+        if (logStat.size > SERVER_LOG_MAX_BYTES) fs.ftruncateSync(logFd, 0);
+        serverLogOffset = fs.fstatSync(logFd).size;
+        if (process.platform !== "win32") fs.fchmodSync(logFd, 0o600);
+        stdio = ["ignore", "ignore", logFd];
+      } catch {
+        serverLogOffset = null;
+        stdio = ["ignore", "ignore", "ignore"];
       }
-    });
-    if (!showLog && child.stderr) {
-      child.stderr.on("data", (data) => {
-        const lines = data.toString().split("\n").filter(Boolean);
-        crashLog.push(...lines);
-        if (crashLog.length > CRASH_LOG_LINES) crashLog = crashLog.slice(-CRASH_LOG_LINES);
+    } else {
+      serverLogOffset = null;
+    }
+    try {
+      return spawn(RUNTIME, [`--max-old-space-size=${maxOldSpace}`, serverPath], {
+        cwd: standaloneDir,
+        stdio,
+        detached: serverDetached,
+        windowsHide: true,
+        env: {
+          ...buildEnvWithRuntime(serverDetached ? buildDetachedProcessEnv() : process.env),
+          PORT: port.toString(),
+          HOSTNAME: host
+        }
       });
+    } finally {
+      if (logFd != null) {
+        try { fs.closeSync(logFd); } catch {}
+      }
     }
-    return child;
   }
 
   let server = spawnServer();
+  if (!showLog) {
+    serverLogMaintenance = setInterval(enforceServerLogLimit, SERVER_LOG_CHECK_MS);
+    serverLogMaintenance.unref?.();
+  }
 
   // Cleanup function - force kill server process
   let isCleaningUp = false;
@@ -1585,12 +1806,17 @@ function startServer(latestVersion) {
       killProxyByPidFile();
       // Kill cloudflared/tailscale via PID file (only this app's tunnel)
       killTunnelByPidFile();
+      if (serverLogMaintenance) {
+        clearInterval(serverLogMaintenance);
+        serverLogMaintenance = null;
+      }
       // Kill server process directly
       if (server.pid) {
-        process.kill(server.pid, "SIGKILL");
+        try { process.kill(server.pid, "SIGKILL"); } catch {}
+        if (serverDetached) {
+          try { process.kill(-server.pid, "SIGKILL"); } catch {}
+        }
       }
-      // Also try to kill process group
-      process.kill(-server.pid, "SIGKILL");
     } catch (e) { }
   }
 
@@ -1719,7 +1945,7 @@ function startServer(latestVersion) {
             const child = spawn(process.execPath, [process.argv[1], "--skip-update", ...process.argv.slice(2).filter((a) => a !== "--skip-update")], {
               detached: true,
               stdio: "ignore",
-              env: process.env,
+              env: buildDetachedProcessEnv(),
             });
             child.unref();
           } catch {
@@ -1769,7 +1995,7 @@ function startServer(latestVersion) {
             detached: true,
             stdio: "ignore",
             windowsHide: true,
-            env: { ...process.env }
+            env: buildDetachedProcessEnv()
           });
           bgProcess.unref();
 
@@ -1836,6 +2062,7 @@ function startServer(latestVersion) {
 
     restartCount++;
     const delay = Math.min(1000 * restartCount, 10000);
+    crashLog = readServerCrashLog();
     console.error(`\n⚠️  Server exited (code=${code ?? "unknown"}). Restarting in ${delay / 1000}s... (${restartCount}/${MAX_RESTARTS})`);
     if (crashLog.length) {
       console.error("\n--- Server crash log ---");

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.172",
+  "version": "1.0.174",
   "private": true,
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {