@agfpd/iapeer 0.4.7 → 0.4.9

package/src/lifecycle/index.ts

@@ -26,7 +26,7 @@ import {
 } from '../core/constants.ts'
 import { buildProcessAddress, buildSocketPath, parseSessionName } from '../core/socket.ts'
 import { err, ok, type Result } from '../core/errors.ts'
-import { capCmdLogs, capPaneLogs, cmdLogDirFor } from '../launch/cmdlog.ts'
+import { capPaneLogs } from '../launch/cmdlog.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { readPeerProfile, resolveIdentity } from '../identity/index.ts'
 import {
@@ -47,8 +47,7 @@ import {
   type LaunchSpec,
 } from '../launch/index.ts'
 import { composeSystemPrompt, gatherPromptInput } from '../launch/composeSystemPrompt.ts'
-import { dismissCanary, ensureServerCanary, signalCanaryClean } from '../launch/canary.ts'
-import { hostSessionAlive, killPtyHost, ptyHostEnabled } from '../launch/ptyHost.ts'
+import { hostSessionAlive, killPtyHost } from '../launch/ptyHost.ts'
 import { appendLifecycleEvent, superviseLogVerbose } from './eventlog.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -494,18 +493,6 @@ export function purgeIdentityState(cfg: LifecycleConfig, identity: string): stri
       /* best-effort — a locked/vanished entry must not fail the remove */
     }
   }
-  // tmux command-log dir (0.2.40 observability) — identity-keyed like the state
-  // markers above, so it must die with the registry record too (the leak class
-  // noted at the 0.2.40 acceptance: a removed peer left its cmdlog dir forever).
-  try {
-    const cmdDir = cmdLogDirFor(cfg.eventLogDir, identity)
-    if (existsSync(cmdDir)) {
-      rmSync(cmdDir, { recursive: true, force: true })
-      removed.push(`tmux-cmdlog/${identity}`)
-    }
-  } catch {
-    /* best-effort */
-  }
   return removed
 }
 
@@ -724,52 +711,23 @@ export async function withWakeLock<T>(
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
-// tmux helpers
+// liveness
 // ─────────────────────────────────────────────────────────────────────────────
 
-function tmux(sock: string, ...args: string[]): { ok: boolean; out: string; err: string } {
-  const r = spawnSync('tmux', ['-S', sock, ...args], { encoding: 'utf8' })
-  return { ok: r.status === 0, out: r.stdout ?? '', err: r.stderr ?? '' }
-}
-function sessionAlive(sock: string, identity: string): boolean {
-  // RUNTIME-STATE host detection (spawn-flip Ф0b), NOT the `.pty-host` marker: a peer with a LIVE
-  // supervisor session is hosted-and-alive; otherwise fall to tmux has-session. Routing liveness on
-  // the live supervisor session (not the spawn-intent marker) makes a marker rollback safe on a
-  // still-running hosted session — rm-marker only changes the NEXT spawn, never the running routing.
-  // Non-hosted peers: hostSessionAlive is a cheap pid-file miss → identical result to today (tmux).
-  return hostSessionAlive(identity) || tmux(sock, 'has-session', '-t', identity).ok
-}
-
-/** Death-class tag for a gone session (live case: the WHOLE tmux server died by
- *  SIGKILL-class and exits.log stayed empty, because the pane-died hook needs a
- *  living tmux event loop). Two distinguishable classes:
- *  - `session-gone` — the server on the socket still ANSWERS but the session is not
- *    there: a pane died inside a living server → the pane-died hook had its chance,
- *    exits.log should carry the cause.
- *  - `server-dead` — the server itself is gone: the socket file is missing, or it
- *    exists but nothing serves it (stale socket — the SIGKILL/OOM class). pane-died
- *    could never fire; the server-death canary (launch/canary.ts) is the recorder
- *    for this class (`ev=server-exit` + forensics), this line is the backstop.
- *  `hosted=true` (pty-supervisor peer) reframes ONLY the absent-socket reason: a hosted peer
- *  has NO tmux socket, so that branch would otherwise misattribute its death to a tmux server
- *  that never existed. Its real cause lives in the supervisor exits.log. A socket that EXISTS
- *  is a genuine tmux server, so `hosted` never overrides the session-gone / stale-socket arm. */
-export function classifyGoneSession(sock: string, hosted = false): { death: 'server-dead' | 'session-gone'; reason: string } {
-  if (!existsSync(sock)) {
-    // No socket file. For a pty-supervisor-hosted peer this is EXPECTED — it never had a tmux
-    // socket; its death is the supervisor session ending (cause in the supervisor exits.log
-    // death-EVENT), NOT a tmux server vanishing. For a tmux peer it IS a dead tmux server.
-    // The check is gated on the absent socket on purpose: a socket that EXISTS (below) means a
-    // real tmux server, so `hosted` (pty-enabled-by-default) must not override genuine tmux.
-    return hosted
-      ? { death: 'server-dead', reason: 'pty host session ended (supervisor) — cause in exits.log (death-EVENT)' }
-      : { death: 'server-dead', reason: 'tmux server gone (socket file missing)' }
-  }
-  // Ask the SERVER, not the session: any server-level command answering (exit 0)
-  // proves the server is alive and merely lost this session.
-  return tmux(sock, 'list-sessions').ok
-    ? { death: 'session-gone', reason: 'session gone, tmux server alive (exit cause should be in exits.log)' }
-    : { death: 'server-dead', reason: 'tmux server dead — stale socket (SIGKILL class — OOM only if a matching JetsamEvent report exists; check exits.log ev=server-exit canary record)' }
+function sessionAlive(_sock: string, identity: string): boolean {
+  // pty-only: a peer is alive iff its supervisor session is live (a cheap pid-file check). Routing
+  // liveness on the live session (not the `.pty-host` spawn-intent marker) keeps a marker rollback safe
+  // on a still-running session. (`_sock` retained for call-site compatibility; no tmux sockets exist.)
+  return hostSessionAlive(identity)
+}
+
+/** Death-class tag for a gone session (pty-only). A gone peer is a supervisor session that ended; its
+ *  real cause lives in the supervisor exits.log (death-EVENT). There is no tmux server to distinguish
+ *  `session-gone` (pane died, server alive) from `server-dead` (server gone). This tag is
+ *  observability-only (lifecycle.log trace) and drives no decision. The `death`/`hosted` shape is kept
+ *  for the trace schema + call-site compatibility. */
+export function classifyGoneSession(_sock: string, _hosted = false): { death: 'server-dead' | 'session-gone'; reason: string } {
+  return { death: 'server-dead', reason: 'pty host session ended (supervisor) — cause in exits.log (death-EVENT)' }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -1149,26 +1107,11 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
 // Reap — kill a session (used by idle-reap / supervise; H4-guarded by callers)
 // ─────────────────────────────────────────────────────────────────────────────
 
-export function killSession(sock: string, identity: string): void {
-  // Hosted peer (spawn-flip Ф0b): SIGTERM the supervisor daemon — its shutdown SIGKILLs the child and
-  // removes the sock/pid/serve-spec. The tmux teardown below is then a harmless no-op (no tmux session
-  // on this sock); for a non-hosted peer it is the real reap, byte-identical to today.
-  if (hostSessionAlive(identity)) killPtyHost(identity)
-  tmux(sock, 'kill-session', '-t', identity)
-  const sessions = tmux(sock, 'list-sessions', '-F', '#{session_name}').out
-  if (!sessions.trim()) {
-    // Deliberate server teardown → silence the canary EXPLICITLY first: signal
-    // the channel (client exits 0) AND dismiss the sh recorder (canary v2 no
-    // longer reads a signaled client alone as deliberate — see canary.ts).
-    signalCanaryClean(sock, identity)
-    dismissCanary(identity)
-    tmux(sock, 'kill-server')
-    try {
-      rmSync(sock, { force: true })
-    } catch {
-      /* best-effort */
-    }
-  }
+export function killSession(_sock: string, identity: string): void {
+  // pty-only: SIGTERM the supervisor daemon — its shutdown SIGKILLs the child and removes the
+  // sock/pid/serve-spec/markers. Idempotent if the session is already gone. (`_sock` retained for
+  // call-site compatibility; no tmux sockets exist.)
+  killPtyHost(identity)
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -1212,11 +1155,6 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
   const activityMtime = deps.newestActivityMtime ?? ((rt: string, c: string) => getAdapter(rt as Runtime).newestActivityMtime(c))
   const isAlive = deps.sessionAlive ?? sessionAlive
   const verbose = superviseLogVerbose(env)
-  // tmux command-log volume cap (killer-hunt socket-command layer, launch/cmdlog.ts):
-  // a -v server log under a busy TUI grows ~7 KB/s, so each tick tail-keeps any log
-  // over the cap. Best-effort by construction; the killer's command is the LAST
-  // line of a dying log, so capping a LIVE peer's log never costs the death tail.
-  capCmdLogs(cfg.eventLogDir)
   // Pane-log volume cap (launch/cmdlog.ts capPaneLogs): the per-identity pane-log
   // (<logDir>/<identity>.log) is the RAW TUI byte stream pipe-pane/the supervisor
   // append for a session's whole life — it had NO bound and grew to hundreds of MB
@@ -1283,7 +1221,7 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
       // distinguishable in lifecycle.log: `session-gone` (pane died, server alive →
       // exits.log should have the cause) vs `server-dead` (whole tmux server died →
       // exits.log structurally empty; this line is the only durable trace).
-      const gone = classifyGoneSession(sock, ptyHostEnabled(cfg.logDir, s.identity))
+      const gone = classifyGoneSession(sock)
       out.push({ identity: s.identity, action: 'reaped-gone', reason: gone.reason })
       trace({ identity: s.identity, action: 'reaped-gone', death: gone.death, reason: gone.reason, outcome: 'fresh-next-msg' })
       continue
@@ -1366,22 +1304,8 @@ export function superviseTick(cfg: LifecycleConfig, deps: SuperviseDeps = {}): S
       // every ALIVE daemon-owned server — covers a fleet launched by older code
       // within one tick of a deploy, no session restarts. Idempotent (pgrep on
       // the per-identity wait-for channel), best-effort, pure observability.
-      // A non-'already' state IS a decision-grade event (not verbose-gated):
-      // post-0.2.22 every launch arms a canary, so a retrofit 'spawned' on an
-      // alive server means the previous canary VANISHED mid-watch (the death-#4
-      // blind spot was exactly this churn being invisible); 'failed' means the
-      // server is currently UNWATCHED. At most one line per loss, not per tick.
-      // SPAWN-FLIP Ф0b-3: the tmux server-death canary is meaningless for a supervisor-HOSTED session
-      // (no tmux server — the retrofit arms a watcher that immediately fires a spurious
-      // `server-vanished`). A hosted death is recorded by the supervisor's exits.log (host=supervisor,
-      // resilience-b), so skip the canary retrofit for hosted peers (mirror of the observer .pty-host
-      // skip — tmux-assuming infra must not run against a hosted session).
-      if (!hostSessionAlive(s.identity)) {
-        const canaryState = ensureServerCanary({ identity: s.identity, sock, exitLogDir: cfg.eventLogDir, env })
-        if (canaryState !== 'already') {
-          trace({ identity: s.identity, action: 'canary', state: canaryState, origin: 'retrofit' })
-        }
-      }
+      // pty-only: no tmux server-death canary — a hosted death is recorded by the supervisor's
+      // exits.log (host=supervisor, resilience-b), classified by classifyGoneSession on the next sweep.
       out.push({ identity: s.identity, action: 'alive' })
       if (verbose) trace({ identity: s.identity, action: 'alive', age: `${ageSecs}s` })
     }

package/src/supervisor/daemon.ts

@@ -12,7 +12,7 @@
 // @xterm/headless bundles under `bun build --compile` (pure JS; the Bun-native pty has no native addon).
 import { Terminal } from '@xterm/headless'
 import { SerializeAddon } from '@xterm/addon-serialize'
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, unlinkSync, writeFileSync, writeSync } from 'node:fs'
+import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, statSync, unlinkSync, writeFileSync, writeSync } from 'node:fs'
 import { dirname } from 'node:path'
 import {
   BackpressureWriter,
@@ -26,7 +26,7 @@ import {
 } from './protocol.ts'
 import { attachedPath, geometryPath, pidPath, servePath, sockPath, writeGeometry } from './paths.ts'
 import { nextBootAction, type BootPredicates } from './boot.ts'
-import { modelToPlainText } from '../shadow/render.ts'
+import { modelToPlainText } from './render.ts'
 import { codexAdapter } from '../launch/adapters/codex.ts'
 import { claudeAdapter } from '../launch/adapters/claude.ts'
 
@@ -157,14 +157,43 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   // corrupts multibyte glyphs like ❯/›; the canonical latin1/Buffer grabli). Parent dir 0700, matching
   // launch's mkdir before pipe-pane. Unset paneLogPath → no log (throwaway/tick).
   let paneLogFd = -1
-  if (opts.paneLogPath) {
+  let paneLogIno = -1 // inode the fd points at — to detect an out-from-under-us unlink/replace
+  let paneLogCheckedMs = 0
+  const PANELOG_HEAL_MS = 1000 // throttle the path-existence re-check to ≤1/sec regardless of output volume
+  const openPaneLog = (): void => {
+    if (!opts.paneLogPath) return
     try {
       mkdirSync(dirname(opts.paneLogPath), { recursive: true, mode: 0o700 })
+      if (paneLogFd >= 0) try { closeSync(paneLogFd) } catch { /* */ }
       paneLogFd = openSync(opts.paneLogPath, 'a')
+      paneLogIno = fstatSync(paneLogFd).ino
     } catch {
       paneLogFd = -1 // best-effort: a log open hiccup never blocks serving the session
+      paneLogIno = -1
     }
   }
+  // SELF-HEAL (Defect 2): the pane-log path can be unlinked out from under a live session (observed on
+  // the fleet: long-lived sessions' lifecycle pane-logs vanished while the supervisor ran). The fd then
+  // keeps writing to a now-unlinked inode — the path stays gone and every occupancy reader of
+  // `<logDir>/<identity>.log` goes blind: composer-busy delivery detection AND telegram-runtime's
+  // mtime-based typing/activity indicator (shared file). Throttled re-check before a write: if the path
+  // vanished or now maps to a DIFFERENT inode than the fd, reopen 'a'. capPaneLogs truncates IN PLACE
+  // (same inode) so a normal cap never triggers a spurious reopen. Tied to output (no idle wakeups) —
+  // exactly when the log matters.
+  const healPaneLog = (): void => {
+    if (!opts.paneLogPath || paneLogFd < 0) return
+    const now = Date.now()
+    if (now - paneLogCheckedMs < PANELOG_HEAL_MS) return
+    paneLogCheckedMs = now
+    let ino = -1
+    try {
+      ino = statSync(opts.paneLogPath).ino
+    } catch {
+      ino = -1 // path gone
+    }
+    if (ino !== paneLogIno) openPaneLog()
+  }
+  openPaneLog()
 
   const clients = new Set<unknown>()
   const writers = new WeakMap<object, BackpressureWriter>()
@@ -234,12 +263,14 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
         const buf = Buffer.isBuffer(d) ? d : typeof d === 'string' ? Buffer.from(d, 'utf8') : Buffer.from(d)
         // PANE-LOG: the RAW child bytes, exactly as pipe-pane writes them (before any query-stripping
         // for clients) — written as a Buffer, never a string. The `s` below is for query DETECTION only.
-        if (paneLogFd >= 0)
+        if (paneLogFd >= 0) {
+          healPaneLog() // reopen if the path was unlinked/replaced out from under us (Defect 2)
           try {
             writeSync(paneLogFd, buf)
           } catch {
             /* best-effort */
           }
+        }
         const s = buf.toString('latin1')
         writeSeq++ // a new write arrived (lets the attach drain detect bytes that land mid-await)
         writeChain = new Promise<void>(resolve => xterm.write(buf, () => resolve())) // authoritative model (+ parse barrier)

package/src/{shadow → supervisor}/render.ts

@@ -1,7 +1,8 @@
-// Leaf render helper: @xterm model → plain text. Extracted from shadow/index.ts so consumers
-// (the shadow observer, the Ф1 ready-gate flip, and the Block-2 supervisor boot-driver) share ONE
-// definition without importing the observer's transport/launch graph. Type-only @xterm import →
-// no runtime dependency beyond the Terminal instance the caller already holds; hermetically testable.
+// Leaf render helper: @xterm model → plain text + composer-occupancy verdict. A shared LIVE leaf used
+// by the Ф1 ready-gate flip (launch/readyGateModel) and the supervisor pane model. Type-only @xterm
+// import → no runtime dependency beyond the Terminal instance the caller already holds; hermetically
+// testable. (Formerly src/shadow/render.ts — kept after the tmux→pty cutover retired the shadow
+// burn-in observer; only the observer modules were removed, this leaf survives.)
 import type { Terminal } from '@xterm/headless'
 
 /**
@@ -10,7 +11,7 @@ import type { Terminal } from '@xterm/headless'
  * whitespace per line is trimmed (capture-pane does the same), cells coalesced left-to-right.
  *
  * 0-divergence-validated vs capture-pane on READY screens by the ready-gate burn-in; the supervisor
- * boot-driver additionally validates it on BOOT-DIALOG screens (a different screen state the
+ * boot-driver additionally validated it on BOOT-DIALOG screens (a different screen state the
  * ready-gate observation never saw).
  */
 export function modelToPlainText(term: Terminal, cols: number, rows: number): string {
@@ -40,11 +41,10 @@ const promptGlyph = (rt: string): string => (rt === 'claude' ? '❯' : '›')
 /**
  * PTY composer-occupancy verdict: getCell on the model's viewport composer row (the row whose first
  * visible cell is the prompt glyph); human input = a non-ghost (non-dim, non-grey246) visible cell
- * after it. Mirrors composerCaptureHasHumanInput — validated 0-divergence vs it by the burn-in. Lives
- * in this leaf (type-only @xterm) so the spawn-flip hosted occupancy guard can reuse it WITHOUT
- * pulling the @xterm-loading observer graph into the warm-deliver path; the Terminal instance is
- * built by the caller (paneLogComposerOccupied dynamic-imports @xterm). Re-exported from
- * shadow/index.ts so the observer's existing importers keep resolving.
+ * after it. Mirrors the prior tmux capture-pane occupancy check (validated 0-divergence vs it by the
+ * burn-in). Lives in this leaf (type-only @xterm) so the warm-deliver hosted occupancy guard can reuse
+ * it WITHOUT pulling an @xterm-loading graph into the warm-deliver path; the Terminal instance is built
+ * by the caller (paneLogComposerOccupied dynamic-imports @xterm).
  */
 export function composerOccupancyFromModel(term: Terminal, cols: number, rows: number, runtime: string): boolean {
   const b = term.buffer.active, top = b.baseY, bot = b.baseY + rows, g = promptGlyph(runtime)