Session Kit v0.1.6 (Public Beta)
Pre-release
A patch release for one problem: shpool 0.11.0 can deadlock on detach and take
every managed session down at once. If you run Session Kit on stock shpool
0.11.0, you are exposed to this.
The failure
Every managed session becomes unreachable. The daemon is alive and still
accepting connections, but every list, attach, and detach blocks forever. It
does not recover on its own.
Upstream handle_detach holds the global session-table lock across an unbounded
send and receive on two rendezvous channels. A client whose socket has stopped
draining leaves its shell-to-client thread blocked in write() rather than in
its select loop, so the handshake never completes and the global lock is parked
indefinitely. One stalled SSH window is enough to take down every session.
The fix
New optional patch 0004 restructures handle_detach into resolve-under-lock,
drop the lock, bounded handshake, then a brief re-lock for bookkeeping. That is
the pattern upstream already uses for the session-message detach in the same
file; handle_detach was the only call site on that channel that was neither
scoped nor bounded.
It applies cleanly to pristine v0.11.0 and is independent of 0001-0003.
See the patch notes
before deciding what to run.
Also in this release
The write-up for patch 0001 has been corrected. It addresses heartbeat
acknowledgement timeouts and would not have prevented this deadlock; the notes
now say so and point at 0004 first.
The watchdog now tells an unset notifier apart from a broken one. With
SESSION_KIT_WATCHDOG_NOTIFY unset it logged that the empty string was not
executable, which reads like a misconfigured path rather than absent
configuration. The watchdog raises no alert anywhere until you configure a
notifier — it detects and logs either way, but with nothing wired up the only
record is the owner-only watchdog log. This is now documented under
Watchdog alerts.
Upgrading
session-kit update does not restart, stop, signal, attach to, or detach from
shpool, and running commands finish on the release they started with. Applying
the shpool patch is a separate, manual step: it rebuilds the shpool binary, and
nothing in this release does that for you.
Session Kit is a public beta, published as a GitHub prerelease. Release assets
are named by source commit rather than by version.