Recover local Sendico session after BFF network restarts (#57)

infra/local/sendico/compose.yml

@@ -12,10 +12,13 @@ services:
     restart: unless-stopped
     # Keep the adapter's loopback-only HTTP rule; forward to the public stand API.
     network_mode: service:bff
+    depends_on:
+      bff: {condition: service_started, restart: true}
     entrypoint: [/bin/sh, /etc/sendico/session.sh]
     env_file: ./.local/dev/sendico/settings.env
     volumes:
       - ./infra/local/sendico/session.sh:/etc/sendico/session.sh:ro
+      - ./infra/local/sendico/network.sh:/etc/sendico/network.sh:ro
       - ./infra/local/sendico/check.sh:/etc/sendico/check.sh:ro
       - ./.local/dev/agents/sendico:/etc/agent:ro
       - sendico-session:/run/sendico

infra/local/sendico/network.sh

@@ -0,0 +1,20 @@
+# Restarting the network-owning BFF can strand this sidecar in its old namespace.
+# Exiting the session process lets Docker rejoin the BFF's current namespace.
+watch_network() {
+ network_parent=$1
+ case "$network_parent" in ''|*[!0-9]*) return 1;; esac
+ [ "$network_parent" -gt 0 ] || return 1
+ network_failures=0
+ while sleep 10; do
+  if timeout 5 getent hosts vault >/dev/null 2>&1; then
+   network_failures=0
+   continue
+  fi
+  network_failures=$((network_failures+1))
+  if [ "$network_failures" -ge 3 ]; then
+   echo 'Local Sendico network DNS unavailable; restarting session container to reattach BFF network.' >&2
+   kill -TERM "$network_parent" 2>/dev/null || true
+   return
+  fi
+ done
+}

infra/local/sendico/session.sh

@@ -1,13 +1,24 @@
 #!/bin/sh
 set -eu
 umask 077
+# shellcheck source=infra/local/sendico/network.sh
+. /etc/sendico/network.sh
 mkdir -p /private /run/sendico
 chmod 755 /run/sendico
 cd /private
+bridge=''; monitor=''; delay=''
+cleanup() {
+ for child in "$bridge" "$monitor" "$delay"; do
+  if [ -n "$child" ]; then kill "$child" 2>/dev/null || true; fi
+ done
+}
+trap cleanup EXIT
+trap 'exit 0' INT TERM
 socat TCP4-LISTEN:18081,bind=127.0.0.1,reuseaddr,fork TCP4:host.docker.internal:8080 &
 bridge=$!
-trap 'kill "$bridge" 2>/dev/null || true' EXIT
-trap 'exit 0' INT TERM
+session_pid=$$
+(trap - EXIT INT TERM; watch_network "$session_pid") &
+monitor=$!
 
 session() {
  jq -n --rawfile role /etc/agent/role-id --rawfile secret /etc/agent/secret-id \
@@ -36,10 +47,10 @@ session() {
 while :; do
  if session; then
   echo 'Local Sendico session ready; next renewal in 20 minutes.'
-  sleep 1200 & wait $!
+  sleep 1200 & delay=$!; wait "$delay"
  else
   echo 'Local Sendico session unavailable; check stand health and integration credentials. Retrying in 5 minutes.' >&2
   rm -f request.json response.json token vault.header vault.json credentials.json login.json
-  sleep 300 & wait $!
+  sleep 300 & delay=$!; wait "$delay"
  fi
 done