Harden UI lease updates against transient file loss

Author: fjh1997

src/service.rs

@@ -731,25 +731,36 @@ fn spawn_ui_lease_watchdog(
             return;
         }
         let stale_after = Duration::from_secs(8);
+        let mut missing_since: Option<u64> = None;
         loop {
             tokio::time::sleep(Duration::from_secs(2)).await;
 
+            let now = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .map(|duration| duration.as_secs())
+                .unwrap_or(0);
             let Some(lease) = state::read_ui_lease(&paths).ok().flatten() else {
+                let first_missing_at = *missing_since.get_or_insert(now);
+                let missing_for = now.saturating_sub(first_missing_at);
+                if missing_for < stale_after.as_secs() {
+                    continue;
+                }
                 ui_managed_shutdown.store(true, Ordering::SeqCst);
                 let _ = runtime_log::append(
                     &paths,
                     "WARN",
                     "ui-watchdog",
-                    "ui lease missing while daemon is ui-managed; requesting shutdown",
+                    &format!(
+                        "ui lease missing for {}s while daemon is ui-managed; requesting shutdown",
+                        missing_for
+                    ),
                 );
                 let _ = shutdown_tx.send(true);
                 break;
             };
+            missing_since = None;
 
-            let now = SystemTime::now()
-                .duration_since(UNIX_EPOCH)
-                .map(|duration| duration.as_secs())
-                .unwrap_or(lease.updated_at);
+            let now = now.max(lease.updated_at);
             let stale = now.saturating_sub(lease.updated_at) >= stale_after.as_secs();
             let owner_dead = !is_process_running(lease.owner_pid);
             if stale || owner_dead {

src/state.rs

@@ -1,4 +1,6 @@
 use std::fs;
+#[cfg(target_os = "windows")]
+use std::os::windows::ffi::OsStrExt;
 use std::path::Path;
 use std::time::{SystemTime, UNIX_EPOCH};
 
@@ -8,6 +10,8 @@ use serde::{Deserialize, Serialize};
 use crate::paths::AppPaths;
 use crate::platform::is_process_running;
 use crate::platform::sync_user_ownership;
+#[cfg(target_os = "windows")]
+use windows_sys::Win32::Storage::FileSystem::{MOVEFILE_REPLACE_EXISTING, MoveFileExW};
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ServiceState {
@@ -229,18 +233,24 @@ fn replace_file(path: &Path, content: &[u8]) -> Result<()> {
     fs::write(&tmp_path, content)
         .with_context(|| format!("failed to write {}", tmp_path.display()))?;
 
-    if path.exists() {
-        match fs::remove_file(path) {
-            Ok(()) => {}
-            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
-            Err(error) => {
-                let _ = fs::remove_file(&tmp_path);
-                return Err(error).with_context(|| format!("failed to replace {}", path.display()));
-            }
-        }
-    }
+    move_file_replace(&tmp_path, path).with_context(|| {
+        format!("failed to move {} to {}", tmp_path.display(), path.display())
+    })?;
+    Ok(())
+}
 
-    fs::rename(&tmp_path, path)
-        .with_context(|| format!("failed to move {} to {}", tmp_path.display(), path.display()))?;
+#[cfg(target_os = "windows")]
+fn move_file_replace(src: &Path, dst: &Path) -> Result<()> {
+    let src_wide: Vec<u16> = src.as_os_str().encode_wide().chain(Some(0)).collect();
+    let dst_wide: Vec<u16> = dst.as_os_str().encode_wide().chain(Some(0)).collect();
+    let ok = unsafe { MoveFileExW(src_wide.as_ptr(), dst_wide.as_ptr(), MOVEFILE_REPLACE_EXISTING) };
+    if ok == 0 {
+        return Err(std::io::Error::last_os_error()).context("MoveFileExW failed");
+    }
     Ok(())
 }
+
+#[cfg(not(target_os = "windows"))]
+fn move_file_replace(src: &Path, dst: &Path) -> Result<()> {
+    fs::rename(src, dst).context("rename failed")
+}