refactor(dev): address ARV review on dev-server-core

- port: reject non-EADDRINUSE errors instead of treating every failure
  as "port busy" (EACCES on a privileged port no longer masquerades as
  in-use and gets silently walked past)
- dev: delete duplicate core/dev/run.ts; consume io/exec.ts (runProcess)
  so subprocess IO lives only in io/ (boundary of concern)
- codezip: drop nodePackageManager lockfile detection; assume npm
- process: rewrite watch() comment; tighten 128+signal comment

Author: tejaskash

src/core/dev/codezip.test.ts

@@ -5,21 +5,32 @@ import { join } from "node:path";
 import type { ProjectRuntime } from "../../core/project/schema";
 import type { StartDevServerInput, DevServerHandle } from "../../handlers/project/dev/types";
 import { createSilentLogger } from "../../testing";
-import { CodeZipDevRunner, nodePackageManager, parseEntrypoint, serverCommand } from "./codezip";
+import { CodeZipDevRunner, parseEntrypoint, serverCommand } from "./codezip";
+
+/** The schema brands entrypoint/codeLocation as FilePath/DirectoryPath; fixtures
+ *  supply plain strings and cast through the brand in one place. */
+function runtime(spec: {
+  name: string;
+  build: "CodeZip" | "Container";
+  entrypoint: string;
+  codeLocation: string;
+}): ProjectRuntime {
+  return spec as ProjectRuntime;
+}
 
-const pythonRuntime: ProjectRuntime = {
+const pythonRuntime = runtime({
   name: "hello_world",
   build: "CodeZip",
   entrypoint: "main.py",
   codeLocation: "app/hello-world",
-};
+});
 
-const tsRuntime: ProjectRuntime = {
+const tsRuntime = runtime({
   name: "hello_world",
   build: "CodeZip",
   entrypoint: "index.ts",
   codeLocation: "app/hello-world",
-};
+});
 
 /** Accumulates run/spawn calls without executing anything real. */
 function harness() {
@@ -132,14 +143,14 @@ describe("CodeZipDevRunner", () => {
     await projectFile(root, "app/hello-world/.venv/bin", "uvicorn");
 
     await runner.start(
-      startInput(root, h, { ...pythonRuntime, entrypoint: "main.py:application" }),
+      startInput(root, h, runtime({ ...pythonRuntime, entrypoint: "main.py:application" })),
     );
 
     expect(h.spawned[0]).toContain("uvicorn");
     await rm(root, { recursive: true, force: true });
   });
 
-  test("installs node_modules via detected package manager for TypeScript runtime", async () => {
+  test("installs node_modules with npm for TypeScript runtime", async () => {
     const h = harness();
     const runner = new CodeZipDevRunner({
       logger: createSilentLogger(),
@@ -149,11 +160,10 @@ describe("CodeZipDevRunner", () => {
 
     const root = join(tmpdir(), `codezip-test-${Date.now()}`);
     await projectTree(root, "app/hello-world");
-    await projectFile(root, "app/hello-world", "pnpm-lock.yaml");
 
     await runner.start(startInput(root, h, tsRuntime));
 
-    expect(h.commands[0]?.[0]).toContain("pnpm");
+    expect(h.commands[0]?.[0]).toContain("npm");
     await rm(root, { recursive: true, force: true });
   });
 });
@@ -164,26 +174,11 @@ describe("parseEntrypoint", () => {
     ["main.py:application", "main.py", "application", "python"],
     ["index.ts", "index.ts", "app", "typescript"],
     ["src/server.ts:handler", "src/server.ts", "handler", "typescript"],
-  ])("parses %s", (input, file, handler, language) => {
+  ] as const)("parses %s", (input, file, handler, language) => {
     expect(parseEntrypoint(input)).toEqual({ file, handler, language });
   });
 });
 
-describe("nodePackageManager", () => {
-  test.each([
-    ["pnpm-lock.yaml", "pnpm"],
-    ["yarn.lock", "yarn"],
-    ["package-lock.json", "npm"],
-  ])("detects %s as %s", async (lockfile, expected) => {
-    const root = join(tmpdir(), `pm-test-${Date.now()}`);
-    await mkdir(root, { recursive: true });
-    await writeFile(join(root, lockfile), "");
-
-    expect(nodePackageManager(root)).toBe(expected);
-    await rm(root, { recursive: true, force: true });
-  });
-});
-
 describe("serverCommand", () => {
   test("builds uvicorn command for Python", () => {
     const cmd = serverCommand(

src/core/dev/codezip.ts

@@ -1,13 +1,13 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { ValidationError } from "../../errors";
+import { InputValidationError } from "../../errors";
 import type {
   DevRunner,
   DevServerHandle,
   StartDevServerInput,
 } from "../../handlers/project/dev/types";
 import type { Logger } from "../../logging";
-import { runCommand, type CommandRunner } from "./run";
+import { runProcess, type ProcessRunner } from "../../io";
 import { ProcessSupervisor, windowsExecutable, type ProcessCommand } from "./process";
 
 /** An entrypoint interpreted exactly once: "main.py:application" is the file
@@ -28,17 +28,10 @@ export function parseEntrypoint(entrypoint: string): Entrypoint {
   };
 }
 
-/** Detects the package manager for a Node project from its lockfile. */
-export function nodePackageManager(directory: string): "npm" | "pnpm" | "yarn" {
-  if (existsSync(join(directory, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync(join(directory, "yarn.lock"))) return "yarn";
-  return "npm";
-}
-
 type CodeZipDevRunnerConfig = {
   logger: Logger;
   /** Injectable process seams so tests never spawn uv or a real server. */
-  run?: CommandRunner;
+  run?: ProcessRunner;
   supervisor?: ProcessSupervisor;
 };
 
@@ -48,19 +41,19 @@ type CodeZipDevRunnerConfig = {
  */
 export class CodeZipDevRunner implements DevRunner {
   private readonly logger: Logger;
-  private readonly run: CommandRunner;
+  private readonly run: ProcessRunner;
   private readonly supervisor: ProcessSupervisor;
 
   constructor(config: CodeZipDevRunnerConfig) {
     this.logger = config.logger;
-    this.run = config.run ?? runCommand;
+    this.run = config.run ?? runProcess;
     this.supervisor = config.supervisor ?? new ProcessSupervisor();
   }
 
   public async start(input: StartDevServerInput): Promise<DevServerHandle> {
     const directory = join(input.projectRoot, input.runtime.codeLocation);
     if (!existsSync(directory)) {
-      throw new ValidationError(`runtime code directory not found: ${directory}`);
+      throw new InputValidationError(`runtime code directory not found: ${directory}`);
     }
 
     const entrypoint = parseEntrypoint(input.runtime.entrypoint);
@@ -89,9 +82,8 @@ export class CodeZipDevRunner implements DevRunner {
   private async ensureNodeModules(directory: string, input: StartDevServerInput): Promise<void> {
     if (existsSync(join(directory, "node_modules"))) return;
 
-    const packageManager = nodePackageManager(directory);
-    input.onLog("system", `Installing Node dependencies with ${packageManager}...`);
-    await this.run([windowsExecutable(packageManager), "install"], {
+    input.onLog("system", "Installing Node dependencies with npm...");
+    await this.run([windowsExecutable("npm"), "install"], {
       cwd: directory,
       onOutput: (chunk) => this.logger.debug(chunk.trim()),
     });

src/core/dev/index.ts

@@ -1,10 +1,3 @@
-export {
-  CodeZipDevRunner,
-  nodePackageManager,
-  parseEntrypoint,
-  serverCommand,
-  type Entrypoint,
-} from "./codezip";
+export { CodeZipDevRunner, parseEntrypoint, serverCommand, type Entrypoint } from "./codezip";
 export { findAvailablePort } from "./port";
 export { ProcessSupervisor, windowsExecutable, type ProcessCommand } from "./process";
-export { runCommand, type CommandRunner } from "./run";

src/core/dev/port.ts

@@ -3,11 +3,16 @@ import { createServer } from "node:net";
 /** How many ports above the requested one to try before giving up. */
 const MAX_PORT_ATTEMPTS = 100;
 
-/** Returns true if `port` can be bound on the loopback interface. */
+/** True if `port` is free on loopback. Only EADDRINUSE counts as taken;
+ *  other errors (e.g. EACCES) reject so the caller isn't misled into
+ *  walking past a real failure. */
 function portFree(port: number): Promise<boolean> {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     const probe = createServer();
-    probe.once("error", () => resolve(false));
+    probe.once("error", (error: NodeJS.ErrnoException) => {
+      if (error.code === "EADDRINUSE") resolve(false);
+      else reject(error);
+    });
     probe.once("listening", () => probe.close(() => resolve(true)));
     probe.listen(port, "127.0.0.1");
   });

src/core/dev/process.ts

@@ -40,7 +40,7 @@ export class ProcessSupervisor {
   };
   private readonly reapAndExit = (signal: NodeJS.Signals) => {
     this.reap();
-    // Re-deliver the default outcome (exit code 128 + signal number).
+    // Exit as if unhandled: POSIX convention is 128 + signal number.
     process.exit(128 + (signal === "SIGTERM" ? 15 : 1));
   };
 
@@ -91,9 +91,10 @@ export class ProcessSupervisor {
   }
 
   private watch(child: ChildProcess): void {
-    // One set of CLI-exit reapers for all children, attached only while any
-    // are alive: 'exit' covers normal exit and uncaught exceptions, the
-    // signal handlers cover terminations that never fire 'exit'.
+    // Attach the reapers once, on the first live child: the 'exit' handler
+    // catches normal exits and uncaught exceptions, while the signal handlers
+    // catch the terminations that never fire 'exit' (see REAP_SIGNALS). Both
+    // exist so no dev server outlives the CLI and squats on its port.
     if (this.children.size === 0) {
       process.once("exit", this.reap);
       for (const signal of REAP_SIGNALS) process.once(signal, this.reapAndExit);