fix(server): desktop backend now exits when its launcher dies (#20277)

Author: bompus

apps/server/src/cli/server.ts

@@ -7,6 +7,7 @@ import { Command, GlobalFlag } from "effect/cli";
 import * as CliError from "effect/cli/CliError";
 
 import * as ServerConfig from "../config.ts";
+import { awaitLauncherLoss } from "../launcherWatch.ts";
 import { runServer } from "../server.ts";
 import { type CliServerFlags, resolveServerConfig, sharedServerCommandFlags } from "./config.ts";
 
@@ -23,7 +24,15 @@ const runServerCommand = (
   Effect.gen(function* () {
     const logLevel = yield* GlobalFlag.LogLevel;
     const config = yield* resolveServerConfig(flags, logLevel, options);
-    return yield* runServer.pipe(Effect.provideService(ServerConfig.ServerConfig, config));
+    const run = runServer.pipe(Effect.provideService(ServerConfig.ServerConfig, config));
+    if (config.mode !== "desktop" || config.desktopBootstrapToken === undefined) return yield* run;
+    return yield* Effect.raceFirst(
+      run,
+      awaitLauncherLoss().pipe(
+        // End like SIGTERM does (interrupt-only exit, so the runtime forces process exit).
+        Effect.andThen(Effect.interrupt),
+      ),
+    );
   });
 
 export const runDefaultServerCommand = (flags: CliServerFlags) =>

apps/server/src/launcherWatch.test.ts

@@ -0,0 +1,65 @@
+import { assert, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
+import * as TestClock from "effect/testing/TestClock";
+import * as HostProcess from "@t3tools/shared/HostProcess";
+
+import { awaitLauncherLoss } from "./launcherWatch.ts";
+
+const launcherPid = 4100;
+// Orphans are adopted by init or a subreaper, so the new parent is not always 1.
+const subreaperPid = 1800;
+
+const watch = (getParentPid: () => number, platform: NodeJS.Platform, startPid = launcherPid) =>
+  awaitLauncherLoss({ launcherPid: startPid, getParentPid }).pipe(
+    Effect.provideService(HostProcess.Platform, platform),
+  );
+
+it.effect("completes when the parent changes, including to a subreaper", () =>
+  Effect.gen(function* () {
+    let parentPid = launcherPid;
+    const fiber = yield* Effect.forkChild(watch(() => parentPid, "linux"));
+    yield* Effect.yieldNow;
+
+    yield* TestClock.adjust("10 seconds");
+    assert.isUndefined(fiber.pollUnsafe(), "still watching while the launcher is alive");
+
+    parentPid = subreaperPid;
+    yield* TestClock.adjust("2 seconds");
+    yield* Fiber.join(fiber);
+  }),
+);
+
+it.effect("notices a launcher that was already gone when the watch began", () =>
+  Effect.gen(function* () {
+    const fiber = yield* Effect.forkChild(watch(() => subreaperPid, "linux"));
+    yield* Effect.yieldNow;
+    yield* Fiber.join(fiber);
+  }),
+);
+
+it.effect("does not watch a backend that already starts under init", () =>
+  Effect.gen(function* () {
+    let parentPid = 1;
+    const fiber = yield* Effect.forkChild(watch(() => parentPid, "linux", 1));
+    yield* Effect.yieldNow;
+
+    parentPid = subreaperPid;
+    yield* TestClock.adjust("1 minute");
+    assert.isUndefined(fiber.pollUnsafe());
+    yield* Fiber.interrupt(fiber);
+  }),
+);
+
+it.effect("does not watch on Windows, where the original parent id outlives the parent", () =>
+  Effect.gen(function* () {
+    let parentPid = launcherPid;
+    const fiber = yield* Effect.forkChild(watch(() => parentPid, "win32"));
+    yield* Effect.yieldNow;
+
+    parentPid = subreaperPid;
+    yield* TestClock.adjust("1 minute");
+    assert.isUndefined(fiber.pollUnsafe());
+    yield* Fiber.interrupt(fiber);
+  }),
+);

apps/server/src/launcherWatch.ts

@@ -0,0 +1,45 @@
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as HostProcess from "@t3tools/shared/HostProcess";
+
+const DEFAULT_POLL_INTERVAL = Duration.seconds(2);
+
+// Sampled when this module loads, before config resolution and the bootstrap
+// read, so a launcher that dies during startup is still noticed.
+const startupParentPid = process.ppid;
+
+/**
+ * Completes when the process that launched this backend is gone.
+ *
+ * A desktop-launched backend reads its bootstrap envelope once and never looks
+ * at its launcher again. When the launcher dies without a graceful stop (a WSL
+ * relay killed during an app update, for instance), the backend would keep
+ * serving and holding its ownership lock while no desktop can reach it, and
+ * every replacement launch is refused. An orphan is adopted by init or, on
+ * Linux, by a subreaper, so any change of parent counts rather than only a
+ * move to pid 1. A backend that already starts under init has no launcher to
+ * lose, and Windows keeps the original parent id after the parent exits, so
+ * neither is watched.
+ */
+export const awaitLauncherLoss = (options?: {
+  readonly launcherPid?: number;
+  readonly getParentPid?: () => number;
+  readonly interval?: Duration.Input;
+}): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    const platform = yield* HostProcess.Platform;
+    const launcherPid = options?.launcherPid ?? startupParentPid;
+    const getParentPid = options?.getParentPid ?? (() => process.ppid);
+    const interval = options?.interval ?? DEFAULT_POLL_INTERVAL;
+    if (platform === "win32" || launcherPid <= 1) return yield* Effect.never;
+    const poll: Effect.Effect<void> = Effect.suspend(() => {
+      const parentPid = getParentPid();
+      return parentPid === launcherPid
+        ? Effect.flatMap(Effect.sleep(interval), () => poll)
+        : Effect.logWarning("desktop launcher is gone; shutting down the backend", {
+            launcherPid,
+            parentPid,
+          });
+    });
+    return yield* poll;
+  });