@brutalsystems/muster 3.0.0 → 3.0.2

package/dist/hosts/tmux.js

@@ -102,6 +102,19 @@ export function titleOptions(session, title) {
  * TERM Ghostty, iTerm2 and Terminal.app report; a terminal that does not
  * support the request ignores it.
  *
+ * `progressbar` lets tmux pass a pane's progress (OSC 9;4, which Claude Code
+ * sends while it works) to the attached terminal, and it has to be declared
+ * here rather than left to tmux. Muster starts the agent before any terminal
+ * attaches, so its first turn has usually set progress by then; tmux learns
+ * Ghostty's `progressbar` only from the XTVERSION reply after attaching, and
+ * does not then send the progress it is already holding, so the pane shows no
+ * busy state for the whole of that turn. Declared up front, the held state is
+ * replayed on attach. It matches any client whose TERM is `xterm-ghostty`
+ * (what Ghostty and Scotty set), whether or not that client ever answers
+ * XTVERSION, rather than `xterm*`: Terminal.app has no progress bar and iTerm2
+ * has read OSC 9 as a notification. It reaches clients that attach after the
+ * next launch on a server, not clients already attached.
+ *
  * `-q` because these name options newer than some tmux still installed
  * (`extended-keys-format` arrived in 3.5, `terminal-features` in 3.2), and an
  * unknown option is an error that would abort the whole command list and with
@@ -113,6 +126,7 @@ export const SERVER_OPTIONS = [
     ["-s", "extended-keys", "always"],
     ["-s", "extended-keys-format", "csi-u"],
     ["-s", "terminal-features[90]", "xterm*:extkeys"],
+    ["-s", "terminal-features[91]", "xterm-ghostty:progressbar"],
 ];
 /** `SERVER_OPTIONS` as `;`-terminated `set-option` commands, to lead a
  *  command list. */

package/dist/muster.js

@@ -51,6 +51,15 @@ function identitiesHuman(view, color) {
     return lines.join("\n") + "\n";
 }
 async function main() {
+    // A reader that leaves early (`muster list | head -1`) makes the rest of a
+    // large write fail with EPIPE. Unhandled, that error exits Node on the spot —
+    // inside whatever registry transaction `close()` is running, which strands
+    // the lock. Nobody is left to read the output, so dropping it is correct.
+    for (const stream of [process.stdout, process.stderr])
+        stream.on("error", (e) => {
+            if (e.code !== "EPIPE")
+                throw e;
+        });
     const argv = process.argv.slice(2);
     if (argv[0] === "--help" || argv[0] === "-h") {
         process.stdout.write(topLevelHelp());

package/dist/registry.js

@@ -1,6 +1,8 @@
-import { mkdir, readFile, writeFile, rename, rm } from "node:fs/promises";
+import { mkdir, readFile, writeFile, rename, rm, stat } from "node:fs/promises";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 import { processRef, isSame, delay, groupAlive, } from "./identity/processes.js";
 import { LOCAL, requesterKey } from "./requester.js";
 /**
@@ -22,15 +24,26 @@ export class IdempotencyKeyReuse extends Error {
         this.name = "IdempotencyKeyReuse";
     }
 }
+/**
+ * A lock directory with no owner file is presumed live for this long. Long
+ * enough that no transaction comes near it, and the holder writes its owner
+ * file immediately after taking the lock, so in practice only a lock left by a
+ * version that wrote none (an empty directory) ever reaches it.
+ */
+const UNOWNED_LOCK_MS = 60_000;
+let self;
 export class Registry {
     home;
-    constructor(home) {
+    lockWait;
+    /** `lockWait` is how long to wait for a live holder; tests shorten it. */
+    constructor(home, lockWait = 5000) {
         this.home = home;
+        this.lockWait = lockWait;
     }
     async transaction(fn) {
         await mkdir(this.home, { recursive: true, mode: 0o700 });
         const lock = join(this.home, "registry.lock");
-        const deadline = Date.now() + 5000;
+        const deadline = Date.now() + this.lockWait;
         while (true) {
             try {
                 await mkdir(lock);
@@ -39,12 +52,27 @@ export class Registry {
             catch (e) {
                 if (e.code !== "EEXIST")
                     throw e;
-                if (Date.now() > deadline)
-                    throw new Error("Registry locked; verify no Muster operation is running before removing registry.lock");
+                if (await this.breakStale(lock))
+                    continue;
+                if (Date.now() > deadline) {
+                    const owner = await lockOwner(lock);
+                    throw new Error(owner
+                        ? `Registry locked, held by pid ${owner.pid}; verify no Muster operation is running before removing registry.lock`
+                        : "Registry locked; verify no Muster operation is running before removing registry.lock");
+                }
                 await delay(20);
             }
         }
         try {
+            // The lock is released only by this process's `finally`, which does not
+            // run if the process dies first: an unhandled EPIPE, or a SIGKILL from a
+            // client stopping its MCP server. The owner file is what lets the next
+            // process see that and take the lock over instead of waiting forever.
+            // Cached only once known: a `ps` that failed once must not leave every
+            // later transaction of a long-lived server unowned.
+            const ref = (self ??= await lockRef(process.pid));
+            if (ref)
+                await writeFile(join(lock, "owner.json"), JSON.stringify(ref));
             let entries = [];
             try {
                 const value = JSON.parse(await readFile(join(this.home, "registry.json"), "utf8"));
@@ -101,6 +129,42 @@ export class Registry {
             await rm(lock, { recursive: true });
         }
     }
+    /**
+     * Removes the lock if its holder is provably gone: its recorded process is
+     * not running, or it recorded none and is older than any transaction.
+     *
+     * Breaking is serialized by a second directory and the verdict re-checked
+     * inside it. Without that, two waiters could both judge the same dead lock,
+     * one break it and take a new lock, and the other then remove that live one.
+     */
+    async breakStale(lock) {
+        const breaker = `${lock}.break`;
+        try {
+            await mkdir(breaker);
+        }
+        catch (e) {
+            if (e.code !== "EEXIST")
+                throw e;
+            // A breaker holds this for milliseconds; one this old died holding it.
+            const age = await ageMs(breaker);
+            if (age !== undefined && age > UNOWNED_LOCK_MS)
+                await rm(breaker, { recursive: true, force: true });
+            return false;
+        }
+        try {
+            const owner = await lockOwner(lock);
+            const stale = owner
+                ? await holderGone(owner)
+                : ((await ageMs(lock)) ?? 0) > UNOWNED_LOCK_MS;
+            if (!stale)
+                return false;
+            await rm(lock, { recursive: true, force: true });
+            return true;
+        }
+        finally {
+            await rm(breaker, { recursive: true, force: true });
+        }
+    }
     async all() {
         return this.transaction(async (entries) => structuredClone(entries));
     }
@@ -172,3 +236,57 @@ export class Registry {
         });
     }
 }
+async function lockOwner(lock) {
+    try {
+        const value = JSON.parse(await readFile(join(lock, "owner.json"), "utf8"));
+        return typeof value.pid === "number" && typeof value.start === "string"
+            ? { pid: value.pid, start: value.start }
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The holder's identity as written into the lock. `ps` prints the start time in
+ * the caller's timezone and language, and the holder and a waiter need not
+ * share either (an MCP client's environment, a terminal's). Fixing both here
+ * makes the two readings comparable; `processRef`, whose strings are already
+ * stored in registry.json, is left as it is.
+ */
+async function lockRef(pid) {
+    try {
+        const { stdout } = await promisify(execFile)("ps", ["-p", String(pid), "-o", "lstart=,stat="], { timeout: 1000, env: { ...process.env, TZ: "UTC", LC_ALL: "C" } });
+        const out = stdout.trim();
+        if (!out || /\bZ\S*$/.test(out))
+            return;
+        return { pid, start: out.slice(0, 24) };
+    }
+    catch {
+        return;
+    }
+}
+/**
+ * Gone only on positive evidence. `processRef` answers undefined for any `ps`
+ * failure, a timeout under load included, and breaking a live lock on that
+ * would let two transactions interleave their writes.
+ */
+async function holderGone(owner) {
+    try {
+        process.kill(owner.pid, 0);
+    }
+    catch (e) {
+        return e.code === "ESRCH";
+    }
+    // The pid is in use; it is the holder unless it started at another time.
+    const now = await lockRef(owner.pid);
+    return now !== undefined && now.start !== owner.start;
+}
+async function ageMs(path) {
+    try {
+        return Date.now() - (await stat(path)).mtimeMs;
+    }
+    catch {
+        return undefined;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/muster",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Launch instructed, reachable local agent sessions",
   "type": "module",
   "engines": {