mirror of
https://github.com/stablyai/orca.git
synced 2026-10-23 08:03:39 +00:00
Jinwoo-H
f0ae0837dd
When `--connect` to an existing detached relay failed, deploy removed the socket and launched a fresh relay over the same path. On Unix, unlinking a socket path does not close a listening socket the owner already holds: the old relay stayed alive, kept its PTYs and every shell/agent inside them, and became permanently unreachable. With the shipped `--grace-time 0` a relay holding a PTY arms no grace timer, so nothing ever reaped it. The relay already refuses this displacement itself — a fresh daemon that hits EADDRINUSE probe-connects the path and declines to steal it from a live owner. The unconditional `rm -f` destroyed exactly that evidence. Remove the socket only on positive proof that nothing is listening (a connect probe answered ECONNREFUSED/ENOENT). A live or unverifiable owner leaves the socket alone and fails the deploy with an actionable error, per the rule in docs/reference/ssh-execution-boundary.md that loss of contact is never evidence of process death. Stale sockets from a crashed relay still get cleaned up. Covered at three levels: the owner probe and its verdicts, the deploy wiring (no rm -f and no fresh launch unless the owner is proven gone), and a live oracle that runs real relay daemons holding a real PTY — including a control case that reproduces the orphan when the socket is unlinked first.