mirror of
https://github.com/stablyai/orca.git
synced 2026-10-21 08:03:33 +00:00
* Fix crash-isolated file watcher process pool for orca-serve SIGSEGV afte Replace the worker-thread runtime file watcher with a forked, crash-isolated @parcel/watcher child process pool so a native FSEvents fault can no longer take down the main/serve process, and add bounded event batching, delivery backpressure, and quarantine-based recovery for faulty watch roots. * Fix crash-isolated file watcher teardown and shutdown leaks - Fault harness could throw before mkdtemp/realpath completed, skipping cleanup; now tracks each temp path independently and races an async watcher-callback error so it can't escape the try/finally unhandled. - In-process fallback swallowed unsubscribe failures via a bare rejection handler that could still throw; use .catch() instead. - Watcher process entry's cancel-subscribe handler now reuses the async unsubscribe path when a crawl already finished, releasing the native handle instead of leaking it (blocks worktree unlock on Windows). - Runtime watcher process pool exposed no real dispose(); shutdown now kills pooled children so they don't outlive the main process. * Fix disposeSlot double-iteration bug in file watcher pool teardown Remove the unnecessary array snapshot in dispose(): disposeSlot mutates allSlots by deleting the slot being visited, and deleting the in-progress element during Set iteration is well-defined, so the spread copy was dead weight left over from prior debugging. * Fix pending file watcher installs not aborting on unsubscribe - Local/WSL watcher installs and SSH fs.watch setup now honor the in-flight AbortSignal, so the last unwatch cancels a slow native subscribe or remote setup instead of waiting for it to finish. - Thread signal through IFilesystemProvider.watch and SSH-backed file explorer watches for the same early-cancel behavior. * Fix crash-resubscribe hangs and SSH watch teardown races in file watcher - Add a bounded deadline for post-crash resubscription crawls so one stuck root quarantines instead of pinning its whole shard forever. - Report FSEvents overflow as recoverable so delivery continues after a dropped-events error instead of surfacing as terminal. - Make WSL watcher abort errors real DOMException instances so AbortSignal-based cancellation checks recognize them. - Rework SSH watch registration so ownership of the shared setup request (not just the first caller) decides teardown, preventing one caller's abort from cancelling another's shared watch and guaranteeing exactly one fs.unwatch per registration. - Reformat reliability-gates.jsonc arrays and refresh WSL/SSH coverage entries and evidence runs to match the above. * Add CI gate to run the file-watcher SIGSEGV fault harness under Electron - The reliability gate and release workflows (mac, Linux) previously only exercised the crash-isolation harness under vanilla Node, which doesn't catch runtime differences in the actual Electron binary that ships to users. - Adds an `ELECTRON_RUN_AS_NODE=1 pnpm exec electron ...` run of the same harness alongside the existing Node run, so #8212's SIGSEGV-survival contract is proven against both runtimes before packaging. * Add CI gate blocking Linux/macOS release packaging on watcher fault reco Adds a contract test asserting release-cut.yml and release-mac-build.yml run the runtime-file-watcher-fault-harness after building and before publishing artifacts, so a regression in watcher process fault recovery fails release packaging instead of shipping silently. * Fix use-after-clear crash in failAllWatcherSubscriptions Snapshot the records map before iterating, since onTerminalError hooks can dispose the supervisor and clear `records` mid-loop, causing a crash. Also update the matching test to assert against the shared buildParcelWatcherIgnoreOptions helper instead of a loose arrayContaining match. * Fix use-after-clear crash in failAllWatcherSubscriptions Snapshot watcher records with Array.from instead of spread, since spread syntax over an iterator that's mutated mid-loop by onTerminalError hooks can produce inconsistent results.
252 lines
7.8 KiB
TypeScript
252 lines
7.8 KiB
TypeScript
import { isWatcherProcessFailure, WatcherProcessFailure } from './parcel-watcher-process-failure'
|
|
import { WatcherProcessSupervisor } from './parcel-watcher-process-supervisor'
|
|
import type { WatcherProcessSubscribeOptions } from './parcel-watcher-process-protocol'
|
|
import type {
|
|
WatcherProcessCallback,
|
|
WatcherProcessHooks,
|
|
WatcherProcessSubscription
|
|
} from './parcel-watcher-process-subscription'
|
|
|
|
const DEFAULT_MAX_SHARED_SUPERVISORS = 4
|
|
const DEFAULT_MAX_QUARANTINE_SUPERVISORS = 4
|
|
|
|
type WatcherSupervisor = Pick<WatcherProcessSupervisor, 'dispose' | 'subscribe'>
|
|
|
|
type RuntimeWatcherPoolSlot = {
|
|
supervisor: WatcherSupervisor
|
|
roots: Set<string>
|
|
isolated: boolean
|
|
retired: boolean
|
|
disposed: boolean
|
|
}
|
|
|
|
type RuntimeWatcherPoolAssignment = {
|
|
slot: RuntimeWatcherPoolSlot
|
|
leases: number
|
|
}
|
|
|
|
export type RuntimeWatcherProcessPoolOptions = {
|
|
maxSharedSupervisors?: number
|
|
maxQuarantineSupervisors?: number
|
|
createSupervisor?: () => WatcherSupervisor
|
|
}
|
|
|
|
/**
|
|
* Share a bounded set of watcher children while healthy, then move roots from
|
|
* a failed shard into a separate bounded quarantine pool.
|
|
*/
|
|
export class RuntimeWatcherProcessPool {
|
|
private readonly maxSharedSupervisors: number
|
|
private readonly maxQuarantineSupervisors: number
|
|
private readonly createSupervisor: () => WatcherSupervisor
|
|
private readonly activeSlots = new Set<RuntimeWatcherPoolSlot>()
|
|
private readonly allSlots = new Set<RuntimeWatcherPoolSlot>()
|
|
private readonly assignments = new Map<string, RuntimeWatcherPoolAssignment>()
|
|
private readonly isolatedRoots = new Set<string>()
|
|
private readonly failedQuarantineRoots = new Set<string>()
|
|
|
|
constructor(options: RuntimeWatcherProcessPoolOptions = {}) {
|
|
this.maxSharedSupervisors = Math.max(
|
|
1,
|
|
options.maxSharedSupervisors ?? DEFAULT_MAX_SHARED_SUPERVISORS
|
|
)
|
|
this.maxQuarantineSupervisors = Math.max(
|
|
1,
|
|
options.maxQuarantineSupervisors ?? DEFAULT_MAX_QUARANTINE_SUPERVISORS
|
|
)
|
|
this.createSupervisor = options.createSupervisor ?? (() => new WatcherProcessSupervisor())
|
|
}
|
|
|
|
async subscribe(
|
|
dir: string,
|
|
callback: WatcherProcessCallback,
|
|
opts: WatcherProcessSubscribeOptions,
|
|
hooks: WatcherProcessHooks = {}
|
|
): Promise<WatcherProcessSubscription> {
|
|
const assignment = this.assignmentForRoot(dir)
|
|
const { slot } = assignment
|
|
let assignmentReleased = false
|
|
const releaseAssignment = (): void => {
|
|
if (assignmentReleased) {
|
|
return
|
|
}
|
|
assignmentReleased = true
|
|
this.releaseRoot(assignment, dir)
|
|
}
|
|
const onTerminalError = (error: Error): void => {
|
|
if (isWatcherProcessFailure(error) && error.scope === 'supervisor') {
|
|
this.retireSlot(slot)
|
|
} else {
|
|
releaseAssignment()
|
|
if (isWatcherProcessFailure(error) && error.code === 'subscribe_timeout') {
|
|
this.isolatedRoots.add(dir)
|
|
}
|
|
}
|
|
hooks.onTerminalError?.(error)
|
|
}
|
|
let subscription: WatcherProcessSubscription
|
|
try {
|
|
subscription = await slot.supervisor.subscribe(dir, callback, opts, {
|
|
...hooks,
|
|
onTerminalError
|
|
})
|
|
} catch (error) {
|
|
if (isWatcherProcessFailure(error) && error.scope === 'supervisor') {
|
|
this.retireSlot(slot)
|
|
} else {
|
|
releaseAssignment()
|
|
if (isWatcherProcessFailure(error) && error.code === 'subscribe_timeout') {
|
|
this.isolatedRoots.add(dir)
|
|
}
|
|
}
|
|
throw error
|
|
}
|
|
|
|
let unsubscribePromise: Promise<void> | undefined
|
|
return {
|
|
unsubscribe: (): Promise<void> => {
|
|
unsubscribePromise ??= subscription.unsubscribe().finally(() => {
|
|
releaseAssignment()
|
|
})
|
|
return unsubscribePromise
|
|
}
|
|
}
|
|
}
|
|
|
|
/** Kill every pooled watcher child (production shutdown or test reset). */
|
|
dispose(): void {
|
|
// disposeSlot deletes the current slot from allSlots; deleting the
|
|
// in-progress element during Set iteration is safe, so no snapshot needed.
|
|
for (const slot of this.allSlots) {
|
|
this.disposeSlot(slot)
|
|
}
|
|
this.activeSlots.clear()
|
|
this.allSlots.clear()
|
|
this.assignments.clear()
|
|
this.isolatedRoots.clear()
|
|
this.failedQuarantineRoots.clear()
|
|
}
|
|
|
|
resetForTest(): void {
|
|
this.dispose()
|
|
}
|
|
|
|
forgetRoot(dir: string): void {
|
|
// Physical subscriptions release their assignment through unsubscribe or
|
|
// terminal callbacks. This clears fault history after setup gives up.
|
|
if (!this.assignments.has(dir)) {
|
|
this.isolatedRoots.delete(dir)
|
|
this.failedQuarantineRoots.delete(dir)
|
|
}
|
|
}
|
|
|
|
private assignmentForRoot(dir: string): RuntimeWatcherPoolAssignment {
|
|
if (this.failedQuarantineRoots.has(dir)) {
|
|
throw new WatcherProcessFailure(
|
|
'file watcher process failed again in quarantine',
|
|
'supervisor',
|
|
'supervisor_crash_fuse'
|
|
)
|
|
}
|
|
const assigned = this.assignments.get(dir)
|
|
if (assigned && !assigned.slot.retired) {
|
|
assigned.leases++
|
|
return assigned
|
|
}
|
|
const slot = this.isolatedRoots.has(dir) ? this.quarantineSlot() : this.sharedSlot()
|
|
const assignment = { slot, leases: 1 }
|
|
slot.roots.add(dir)
|
|
this.assignments.set(dir, assignment)
|
|
return assignment
|
|
}
|
|
|
|
private sharedSlot(): RuntimeWatcherPoolSlot {
|
|
const sharedSlots = Array.from(this.activeSlots).filter(
|
|
(slot) => !slot.isolated && !slot.retired
|
|
)
|
|
if (sharedSlots.length < this.maxSharedSupervisors) {
|
|
return this.createSlot(false)
|
|
}
|
|
return sharedSlots.reduce((leastLoaded, candidate) =>
|
|
candidate.roots.size < leastLoaded.roots.size ? candidate : leastLoaded
|
|
)
|
|
}
|
|
|
|
private quarantineSlot(): RuntimeWatcherPoolSlot {
|
|
const quarantineSlots = Array.from(this.activeSlots).filter(
|
|
(slot) => slot.isolated && !slot.retired
|
|
)
|
|
if (quarantineSlots.length < this.maxQuarantineSupervisors) {
|
|
return this.createSlot(true)
|
|
}
|
|
return quarantineSlots.reduce((leastLoaded, candidate) =>
|
|
candidate.roots.size < leastLoaded.roots.size ? candidate : leastLoaded
|
|
)
|
|
}
|
|
|
|
private createSlot(isolated: boolean): RuntimeWatcherPoolSlot {
|
|
const slot: RuntimeWatcherPoolSlot = {
|
|
supervisor: this.createSupervisor(),
|
|
roots: new Set(),
|
|
isolated,
|
|
retired: false,
|
|
disposed: false
|
|
}
|
|
this.activeSlots.add(slot)
|
|
this.allSlots.add(slot)
|
|
return slot
|
|
}
|
|
|
|
private retireSlot(slot: RuntimeWatcherPoolSlot): void {
|
|
if (slot.retired) {
|
|
return
|
|
}
|
|
slot.retired = true
|
|
this.activeSlots.delete(slot)
|
|
for (const root of slot.roots) {
|
|
if (this.assignments.get(root)?.slot === slot) {
|
|
this.assignments.delete(root)
|
|
}
|
|
if (slot.isolated) {
|
|
// Why: one bounded quarantine attempt is the recovery budget for a
|
|
// watch lifetime; repeated fused replacements would recreate churn.
|
|
this.isolatedRoots.delete(root)
|
|
this.failedQuarantineRoots.add(root)
|
|
} else {
|
|
this.isolatedRoots.add(root)
|
|
}
|
|
}
|
|
slot.roots.clear()
|
|
// Why: failAllSubscriptions is still iterating callbacks; defer disposal
|
|
// so every logical root receives the supervisor failure first.
|
|
queueMicrotask(() => this.disposeSlot(slot))
|
|
}
|
|
|
|
private releaseRoot(assignment: RuntimeWatcherPoolAssignment, dir: string): void {
|
|
if (this.assignments.get(dir) !== assignment) {
|
|
return
|
|
}
|
|
assignment.leases--
|
|
if (assignment.leases > 0) {
|
|
return
|
|
}
|
|
const { slot } = assignment
|
|
this.assignments.delete(dir)
|
|
slot.roots.delete(dir)
|
|
this.isolatedRoots.delete(dir)
|
|
if (slot.isolated && slot.roots.size === 0 && !slot.retired) {
|
|
this.activeSlots.delete(slot)
|
|
this.disposeSlot(slot)
|
|
}
|
|
}
|
|
|
|
private disposeSlot(slot: RuntimeWatcherPoolSlot): void {
|
|
if (slot.disposed) {
|
|
return
|
|
}
|
|
slot.disposed = true
|
|
slot.supervisor.dispose()
|
|
this.allSlots.delete(slot)
|
|
}
|
|
}
|