mirror of
https://github.com/stablyai/orca.git
synced 2026-10-31 00:57:45 +00:00
NeilandJesse Sanford
0008e0cdf5
* fix(orcad): add --reclaim-stale-lock for a lock no start may judge On a Linux host with no machine id whose ~/.orca is on a network or FUSE home, a lock left by the host's own previous boot names a PID that is evidence only on the machine that issued it, so every start after a reboot refused it, and the only way out was deleting orcad.lock by hand. Starts still refuse it: losing contact is not proof of exit, and a home other machines may share must never be taken over automatically. Now: - `orca serve --reclaim-stale-lock` (and `orcad --reclaim-stale-lock`) checks that the lock was written on this host, in an earlier boot, at least 2 minutes ago, and that nothing answers at its holder's endpoints. It prints the pid, host, boot and age and warns about other machines sharing the home, and clears the lock only with --yes, through the normal race-safe reclaim of that exact record. - Lock records now name their host, as evidence for that command. - The refusal has its own code, orcad_instance_lock_holder_unverifiable, names the command, and exits 3, so `orca serve --supervise` waits on it instead of giving up, and the desktop refuses on it like a held lock. - orcad advertises orcad.stale-lock-reclaim.v1 so a client can offer the command on hosts that have it. Fixes #32177 Co-authored-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com> * fix(orcad): let --reclaim-stale-lock clear a reclaimer cut short by the reboot, and probe IPv6 A reclaimer from the same earlier boot on this host that the reboot cut short left a recovery owner the command could never judge, so --yes always failed. The confirmation now covers such an owner too, and only one from this host's earlier boot. An IPv6 WebSocket endpoint is probed by its bare address. Co-authored-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com> * fix(cli): ship the stale-lock reclaim module with packaged builds, and refuse an unreachable lock The CLI loads main modules from out/main after the main build replaces it, so the reclaim module becomes a stable plain-Node entry and is unpacked from the asar. A lock that cannot be stat'ed for any reason other than absence (a permission error, say) is now a refusal, not "nothing to reclaim". Co-authored-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com> * fix(orcad): make --reclaim-stale-lock name the real data root and report a status - The refusal prints a runnable command for the data root it refused: an orcad names its own runtime and entry plus `--data-root <dir>`, since managed hosts have neither `orca` nor `orcad` on PATH and their data root is not the default. The hint is Linux-only. - Both entry points take `--data-root` and `--json` and report one of none, eligible, refused or reclaimed, each with its own exit code (4, 2, 1, 0), so a missing lock never reads as a recovery. - The evidence says nothing answers on this machine, and that the host name and boot checks cannot rule out another machine with the same name; --yes stays the gate. - wss endpoints default to port 443, a same-boot branch that could never run is gone, and the supervisor's standby line points at the command. Co-authored-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com> * fix(orcad): point the eligible message at the same command plus --yes Co-authored-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com> * fix(orcad): refuse an empty --data-root, and name the right program in reclaim hints - `--data-root` with no usable value (a trailing flag, an empty or blank string) prints usage and exits 1 on both entry points, never falling back to the default profile. - A refusal raised while the reclaim command itself runs names `orca serve --reclaim-stale-lock`, not the binary the CLI runs under; an orcad still names its own runtime and entry. - The supervisor's standby hint includes this profile's --data-root. - The unreadable-lock test is skipped when running as root. Co-authored-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com> * test(cli): reuse the existing client stub for the --data-root refusal test Co-authored-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com> --------- Co-authored-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com>
39 lines
2.3 KiB
TypeScript
39 lines
2.3 KiB
TypeScript
// Why: older hosts answer orcad.terminalCensus with method-not-found, so a client asks only when
|
|
// this is advertised and otherwise treats the census as unverifiable, never as zero.
|
|
export const ORCAD_TERMINAL_CENSUS_RUNTIME_CAPABILITY = 'orcad.terminal-census.v1' as const
|
|
|
|
// Why: an older host answers orcad.migration.* with method-not-found; a client stages, commits or
|
|
// reads a catalog only on a host advertising this, and treats its absence as a refusal.
|
|
export const ORCAD_MIGRATION_CATALOG_RUNTIME_CAPABILITY = 'orcad.migration-catalog.v1' as const
|
|
|
|
// Why: older hosts have no orcad.migration.abortCatalogByReference. A source fenced on a manifest
|
|
// no request can carry (before #30836 refused one) can be released only through it.
|
|
export const ORCAD_MIGRATION_CATALOG_ABORT_BY_REFERENCE_RUNTIME_CAPABILITY =
|
|
'orcad.migration-catalog-abort-by-reference.v1' as const
|
|
|
|
// Why per kind: an older destination drops `source.kind` and cannot tell a WSL source from an SSH
|
|
// one, so a client sends a non-SSH manifest only to a host advertising that kind. Not advertised
|
|
// until a destination parses `source.kind: 'local-wsl'`.
|
|
export const ORCAD_MIGRATION_LOCAL_WSL_SOURCE_RUNTIME_CAPABILITY =
|
|
'orcad.migration-source.local-wsl.v1' as const
|
|
|
|
// Why: older hosts have no orcad.migration.stageBlobChunk. The channel alone carries nothing: each
|
|
// blob kind also needs its own `orcad.migration-blob.<kind>.v1`, advertised once installed.
|
|
export const ORCAD_MIGRATION_BLOB_CHANNEL_RUNTIME_CAPABILITY = 'orcad.migration-blob.v1' as const
|
|
|
|
// Why: older hosts have no `accounts.setHostLaunchEnv`; a desktop that owns a host's accounts (a
|
|
// WSL host's) pushes them only to a host advertising this.
|
|
export const HOST_ACCOUNT_LAUNCH_ENV_RUNTIME_CAPABILITY = 'accounts.host-launch-env.v1' as const
|
|
|
|
// Why: older orcads reject `--reclaim-stale-lock` as an unknown argument; a client offers to run it
|
|
// on a host only when this is advertised, and otherwise shows the manual instruction.
|
|
export const ORCAD_STALE_LOCK_RECLAIM_RUNTIME_CAPABILITY = 'orcad.stale-lock-reclaim.v1' as const
|
|
|
|
export const ORCAD_RUNTIME_CAPABILITIES = [
|
|
ORCAD_STALE_LOCK_RECLAIM_RUNTIME_CAPABILITY,
|
|
ORCAD_TERMINAL_CENSUS_RUNTIME_CAPABILITY,
|
|
ORCAD_MIGRATION_CATALOG_RUNTIME_CAPABILITY,
|
|
ORCAD_MIGRATION_CATALOG_ABORT_BY_REFERENCE_RUNTIME_CAPABILITY,
|
|
HOST_ACCOUNT_LAUNCH_ENV_RUNTIME_CAPABILITY
|
|
] as const
|