fix(ssh): pairing replaces the remote runner atomically like launch does

packages/ssh/src/tunnel.test.ts

@@ -285,6 +285,59 @@ describe("ssh tunnel scripts", () => {
     }).pipe(Effect.provide(layerProcess));
   });
 
+  it.live.skipIf(HostProcess.Platform.defaultValue() === "win32")(
+    "pairing replaces the runner without rewriting the file a running shell reads",
+    () =>
+      Effect.gen(function* () {
+        const fs = yield* FileSystem.FileSystem;
+        const path = yield* Path.Path;
+        const realSpawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+        const home = yield* fs.makeTempDirectoryScoped({ prefix: "t3-ssh-pairing-test-" });
+        // Runs the remote script in a local sh instead of over ssh.
+        const localShell = ChildProcessSpawner.make((command) =>
+          command._tag === "StandardCommand"
+            ? realSpawner.spawn(
+                ChildProcess.make("sh", ["-s"], {
+                  ...command.options,
+                  env: {
+                    HOME: home,
+                    PATH: `${path.dirname(process.execPath)}:${process.env.PATH}`,
+                  },
+                  extendEnv: false,
+                }),
+              )
+            : Effect.die("unexpected piped command"),
+        );
+        const pair = Effect.fn(function* (name: string) {
+          const nodeScriptPath = path.join(home, `${name}.mjs`);
+          yield* fs.writeFileString(
+            nodeScriptPath,
+            `console.log(JSON.stringify({ credential: "${name}" }));\n`,
+          );
+          const result = yield* SshTunnel.issueRemotePairingToken(
+            { alias: "devbox", hostname: "devbox.example.com", username: "julius", port: 2222 },
+            undefined,
+            { nodeScriptPath },
+          ).pipe(Effect.provideService(ChildProcessSpawner.ChildProcessSpawner, localShell));
+          assert.equal(result.credential, name);
+        });
+
+        yield* pair("first");
+        const launchDir = path.join(home, ".t3", "ssh-launch");
+        const [stateKey] = yield* fs.readDirectory(launchDir);
+        assert.ok(stateKey);
+        const runnerFile = path.join(launchDir, stateKey, "run-t3.sh");
+        const firstRunner = yield* fs.readFileString(runnerFile);
+        const running = yield* fs.open(runnerFile);
+
+        yield* pair("second");
+        const held = new Uint8Array(firstRunner.length + 1024);
+        const heldBytes = yield* running.read(held, { position: 0n });
+        assert.equal(new TextDecoder().decode(held.subarray(0, heldBytes)), firstRunner);
+        assert.include(yield* fs.readFileString(runnerFile), "second.mjs");
+      }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer)), Effect.scoped),
+  );
+
   it.effect("retains a bounded diagnostic tail when the tunnel exits before readiness", () =>
     Effect.gen(function* () {
       const diagnostic = "Connection refused: café";

packages/ssh/src/tunnel.ts

@@ -837,10 +837,13 @@ STATE_DIR="$HOME/.t3/ssh-launch/@@T3_STATE_KEY@@"
 DEFAULT_SERVER_HOME="$HOME/.t3"
 RUNNER_FILE="$STATE_DIR/run-t3.sh"
 mkdir -p "$STATE_DIR"
-cat >"$RUNNER_FILE" <<'SH'
+RUNNER_NEXT="$(mktemp "$STATE_DIR/run-t3.next.XXXXXX")"
+trap 'rm -f "$RUNNER_NEXT"' EXIT
+cat >"$RUNNER_NEXT" <<'SH'
 @@T3_RUNNER_SCRIPT@@
 SH
-chmod 700 "$RUNNER_FILE"
+chmod 700 "$RUNNER_NEXT"
+mv "$RUNNER_NEXT" "$RUNNER_FILE"
 PAIRING_BASE_DIR="$DEFAULT_SERVER_HOME"
 "$RUNNER_FILE" auth pairing create --base-dir "$PAIRING_BASE_DIR" --json
 `;