@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.20

package/dist/local-devices/relay.js

@@ -0,0 +1,373 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { randomUUID } from "node:crypto";
+import { DeviceProtocolError, FileSystemGoneError, parseDeviceFrame, parseOpResult, SandboxGoneError, ToolError, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { LockService } from "../infra/lock/lock.service.js";
+import { KERNEL_BUS, KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
+import { deviceNotFound } from "../sandbox/sandbox.service.js";
+import { deviceLeaseKey, deviceReqKey, deviceReqTopic, deviceResKey, deviceResTopic, } from "./keys.js";
+import { DeviceTargets } from "./targets.js";
+/** The device's connected machine is not connected (no replica holds its lease). */
+export const deviceOffline = () => new ApiError("device.offline", "The machine of this local device is offline. Start capybara-device on that machine, or pick another device.");
+/**
+ * The device's machine was disconnected (revoked, signed out): 403 `device.forbidden`
+ * with `details: [{ reason: "machine_revoked" }]`, so the tools tell the model what to ask for.
+ */
+export const machineRevoked = () => new ApiError("device.forbidden", "The machine of this local device was disconnected. Run capybara-device logout, then capybara-device login on it, or pick another device.", [{ reason: "machine_revoked" }]);
+/** The text a machine's `error` result reaches the model with (ruling R28). */
+export const ON_MACHINE_PREFIX = "On the connected machine: ";
+/** The longest one lease check of a waiting caller may take before it counts as "unknown". */
+export const LEASE_CHECK_TIMEOUT_MS = 2000;
+/** How often a waiting caller checks that a replica still holds the machine's connection. */
+export const HOLDER_POLL_MS = 5000;
+/**
+ * How much longer than the caller's wait a queued request lives: giving up must still find an
+ * untaken request on the list (an expired one would look taken and get a needless cancel).
+ */
+export const LIST_TTL_MARGIN_MS = 30_000;
+/**
+ * Appends one frame to the request list and makes sure the list lives at least `ARGV[2]` ms
+ * (never shortens the TTL a request with a longer deadline set). Atomic, so the list never exists
+ * without a TTL.
+ */
+const PUSH_WITH_TTL = `
+redis.call('RPUSH', KEYS[1], ARGV[1])
+if redis.call('PTTL', KEYS[1]) < tonumber(ARGV[2]) then
+  redis.call('PEXPIRE', KEYS[1], ARGV[2])
+end
+return 1
+`;
+/**
+ * Gives up on a request (ruling R15): removes the exact request frame `ARGV[1]` from the list; only
+ * when it is no longer queued (the machine already took it) appends the cancel `ARGV[2]`, with the
+ * TTL rule of {@link PUSH_WITH_TTL}. Returns 1 when a cancel was queued.
+ */
+const GIVE_UP = `
+if redis.call('LREM', KEYS[1], 1, ARGV[1]) > 0 then
+  return 0
+end
+redis.call('RPUSH', KEYS[1], ARGV[2])
+if redis.call('PTTL', KEYS[1]) < tonumber(ARGV[3]) then
+  redis.call('PEXPIRE', KEYS[1], ARGV[3])
+end
+return 1
+`;
+/** Why a call stopped waiting without a result. */
+const ABORTED = Symbol("aborted");
+const GRACE_EXPIRED = Symbol("grace expired");
+const errMsg = (e) => (e instanceof Error ? e.message : String(e));
+/**
+ * The caller side of the device relay (environments spec §13.4). A request goes onto the
+ * device's Redis list (`capk:device-req:<deviceId>`) and is announced on
+ * `device.req.<deviceId>`; whichever gateway replica holds the machine's lease drains the
+ * list and forwards the frames to the machine.
+ *
+ * **The holder's half of the wire** (Task 6 follows it): items on the list are `KernelReq` or
+ * `KernelCancel` frames as JSON text, to be parsed with `parseDeviceFrame(item, "kernel")`; the
+ * nudge's payload is `{ id }`. For each `res` frame the machine sends, the holder writes the frame
+ * (the JSON text as validated by `parseDeviceFrame(…, "device")`) under
+ * `capk:device-res:<requestId>` with a TTL and publishes the same frame object on
+ * `device.res.<requestId>`.
+ *
+ * The caller subscribes to its result topic before pushing and reads the result key once after,
+ * and once more before giving up (the run-abort pattern; a publish lost while the subscriber
+ * reconnects is still found). It waits within its own call for at most `deadlineMs` plus
+ * `devices.local.reconnectGraceSeconds`; when the lease disappears meanwhile (checked every
+ * {@link HOLDER_POLL_MS}) the wait ends at most one grace later. A result produced while the
+ * machine was disconnected arrives after it reconnects. Giving up (grace, abort, a bad result)
+ * removes the request from the list, or queues a `cancel` when the machine already took it
+ * (ruling R15). Nothing is kept in process memory beyond the call.
+ */
+let LocalDeviceRelay = class LocalDeviceRelay {
+    redis;
+    bus;
+    locks;
+    config;
+    log;
+    targets;
+    constructor(redis, bus, locks, config, log, targets) {
+        this.redis = redis;
+        this.bus = bus;
+        this.locks = locks;
+        this.config = config;
+        this.log = log;
+        this.targets = targets;
+    }
+    /** Whether a gateway replica holds the machine's connection now. */
+    async holderLive(deviceId) {
+        return (await this.locks.holderOf(deviceLeaseKey(deviceId))) !== null;
+    }
+    /**
+     * Queues `op` for the machine without waiting for an answer (ruling R14: `stop`). The caller
+     * checks {@link holderLive} first; the frame waits on the list for the grace like any request.
+     */
+    async send(deviceId, op, args, deadlineMs) {
+        const id = randomUUID();
+        const d = Math.max(1, Math.ceil(deadlineMs));
+        const req = { type: "req", id, op, args, deadlineMs: d };
+        await this.push(deviceId, JSON.stringify(req), this.graceMs() + d + LIST_TTL_MARGIN_MS);
+        await this.bus.publish(deviceReqTopic(deviceId), { id });
+    }
+    /**
+     * Runs `op` on the device's machine and returns its validated result. Throws
+     * `device.offline` when no replica holds the machine at send time or when the wait ran
+     * out, but `device.forbidden` ({@link machineRevoked}) when the machine was revoked and
+     * `device.not_found` when the device was deleted (checked whenever the connection is
+     * missing, ruling R27); the machine's failures map to `SandboxGoneError` (`gone`),
+     * `FileSystemGoneError` (`fs_gone`) or a `ToolError` (`policy`, and `error` prefixed
+     * {@link ON_MACHINE_PREFIX}); an invalid answer throws a `DeviceProtocolError`. On abort the
+     * abort reason is thrown.
+     */
+    async call(deviceId, op, args, opts) {
+        const { signal } = opts;
+        signal.throwIfAborted();
+        if (!(await this.holderLive(deviceId))) {
+            throw this.goneError(await this.targetState(deviceId)) ?? deviceOffline();
+        }
+        signal.throwIfAborted();
+        const id = randomUUID();
+        const deadlineMs = Math.max(1, Math.ceil(opts.deadlineMs));
+        const graceMs = this.graceMs();
+        const listTtlMs = graceMs + deadlineMs + LIST_TTL_MARGIN_MS;
+        const reqJson = JSON.stringify({ type: "req", id, op, args, deadlineMs });
+        let settle;
+        const outcome = new Promise((resolve) => {
+            let done = false;
+            settle = (r) => {
+                if (done)
+                    return;
+                done = true;
+                resolve(r);
+            };
+        });
+        const onStored = (raw) => {
+            if (raw !== null)
+                settle(this.parseRes(raw, id));
+        };
+        const onAbort = () => settle({ error: ABORTED });
+        const unsubscribe = await this.bus.subscribe(deviceResTopic(id), (payload) => {
+            onStored(JSON.stringify(payload));
+        });
+        let timer;
+        let stopped = false;
+        try {
+            signal.addEventListener("abort", onAbort, { once: true });
+            // aborted while subscribing: nothing was sent yet
+            signal.throwIfAborted();
+            await this.push(deviceId, reqJson, listTtlMs);
+            this.nudge(deviceId, id);
+            onStored(await this.redis.get(deviceResKey(id)));
+            // wait until the result, the abort, or `giveUpAt`. The lease is checked every poll: its loss
+            // caps `giveUpAt` at one grace from then (never extending it); a reconnect within that grace
+            // restores the full wait, so a long command whose machine blipped keeps its deadline
+            const fullGiveUpAt = Date.now() + deadlineMs + graceMs;
+            let giveUpAt = fullGiveUpAt;
+            let capped = false;
+            const tick = async () => {
+                if (stopped)
+                    return;
+                try {
+                    // a stalled Redis must not hold the give-up back: no answer in time means "unknown"
+                    const live = await this.leaseCheck(deviceId);
+                    if (live === true && capped) {
+                        capped = false;
+                        giveUpAt = fullGiveUpAt;
+                    }
+                    else if (live === false && !capped) {
+                        capped = true;
+                        giveUpAt = Math.min(giveUpAt, Date.now() + graceMs);
+                    }
+                    if (live === false) {
+                        // a revoked machine or a deleted device never comes back: fail at once
+                        const gone = this.goneError(await this.targetState(deviceId));
+                        if (gone) {
+                            settle({ error: gone });
+                            return;
+                        }
+                    }
+                }
+                catch (e) {
+                    this.log.warn("device relay lease check failed", { deviceId, error: errMsg(e) });
+                }
+                if (stopped)
+                    return;
+                if (Date.now() >= giveUpAt) {
+                    // a last look at the key: the publish may have been lost while the subscriber reconnected
+                    this.redis.get(deviceResKey(id)).then((raw) => (raw !== null ? onStored(raw) : settle({ error: GRACE_EXPIRED })), () => settle({ error: GRACE_EXPIRED }));
+                    return;
+                }
+                schedule();
+            };
+            const schedule = () => {
+                if (stopped)
+                    return;
+                const wait = Math.max(0, Math.min(HOLDER_POLL_MS, giveUpAt - Date.now()));
+                timer = setTimeout(() => void tick(), wait);
+            };
+            schedule();
+            const r = await outcome;
+            stopped = true;
+            clearTimeout(timer);
+            if ("res" in r) {
+                await this.quietly("delete the result", deviceId, () => this.redis.del(deviceResKey(id)));
+                return this.resultOf(op, r.res);
+            }
+            if (r.error instanceof Error) {
+                // a bad answer: drop it, give the request up, report the protocol error
+                await this.quietly("delete the result", deviceId, () => this.redis.del(deviceResKey(id)));
+            }
+            await this.giveUp(deviceId, id, reqJson, listTtlMs);
+            if (r.error === ABORTED)
+                throw signal.reason;
+            if (r.error === GRACE_EXPIRED)
+                throw deviceOffline();
+            throw r.error;
+        }
+        finally {
+            stopped = true;
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            await this.quietly("unsubscribe", deviceId, unsubscribe);
+        }
+    }
+    /** {@link holderLive}, or undefined when it takes longer than {@link LEASE_CHECK_TIMEOUT_MS}. */
+    async leaseCheck(deviceId) {
+        let timer;
+        const check = this.holderLive(deviceId);
+        check.catch(() => { }); // a late failure after the timeout is not unhandled
+        try {
+            return await Promise.race([
+                check,
+                new Promise((resolve) => {
+                    timer = setTimeout(() => resolve(undefined), LEASE_CHECK_TIMEOUT_MS);
+                }),
+            ]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * The device's state ({@link DeviceTargets}), or undefined when it cannot be read within
+     * {@link LEASE_CHECK_TIMEOUT_MS} (a failure only logs: the caller keeps its other rules).
+     */
+    async targetState(deviceId) {
+        let timer;
+        const read = this.targets.state(deviceId);
+        read.catch(() => { });
+        try {
+            return await Promise.race([
+                read,
+                new Promise((resolve) => {
+                    timer = setTimeout(() => resolve(undefined), LEASE_CHECK_TIMEOUT_MS);
+                }),
+            ]);
+        }
+        catch (e) {
+            this.log.warn("device relay could not read the device state", {
+                deviceId,
+                error: errMsg(e),
+            });
+            return undefined;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /** The error of a state that never comes back; undefined for `active` or unknown. */
+    goneError(state) {
+        if (state === "deleted")
+            return deviceNotFound();
+        if (state === "revoked")
+            return machineRevoked();
+        return undefined;
+    }
+    graceMs() {
+        return this.config.get().devices.local.reconnectGraceSeconds * 1000;
+    }
+    async push(deviceId, frame, ttlMs) {
+        await this.redis.eval(PUSH_WITH_TTL, 1, deviceReqKey(deviceId), frame, String(ttlMs));
+    }
+    /** Announces new frames to the holder; a lost nudge is picked up on the holder's next drain. */
+    nudge(deviceId, id) {
+        this.bus.publish(deviceReqTopic(deviceId), { id }).catch((e) => {
+            this.log.warn("device relay nudge failed", { deviceId, error: errMsg(e) });
+        });
+    }
+    /** Removes the request from the list, or queues a cancel when the machine took it (R15). */
+    async giveUp(deviceId, id, reqJson, ttlMs) {
+        const cancel = JSON.stringify({ type: "cancel", id });
+        await this.quietly("give the request up", deviceId, async () => {
+            const queued = await this.redis.eval(GIVE_UP, 1, deviceReqKey(deviceId), reqJson, cancel, String(ttlMs));
+            if (queued === 1)
+                this.nudge(deviceId, id);
+        });
+    }
+    /** Runs a side step whose failure must not replace the call's outcome: logged, swallowed. */
+    async quietly(what, deviceId, fn) {
+        try {
+            await fn();
+        }
+        catch (e) {
+            this.log.warn(`device relay could not ${what}`, { deviceId, error: errMsg(e) });
+        }
+    }
+    /** A stored / published `res` frame for request `id`, or the protocol error it carries. */
+    parseRes(raw, id) {
+        try {
+            const f = parseDeviceFrame(raw, "device");
+            if (f.type !== "res" || f.id !== id) {
+                return { error: new DeviceProtocolError("the connected machine sent an unexpected frame") };
+            }
+            return { res: f };
+        }
+        catch (e) {
+            return {
+                error: e instanceof DeviceProtocolError
+                    ? e
+                    : new DeviceProtocolError(`the connected machine sent an invalid frame: ${errMsg(e)}`),
+            };
+        }
+    }
+    resultOf(op, res) {
+        if (res.ok) {
+            try {
+                return parseOpResult(op, res.result);
+            }
+            catch (e) {
+                throw new DeviceProtocolError(`The connected machine sent an invalid ${op} result: ${errMsg(e)}`);
+            }
+        }
+        const { kind, message } = res.error;
+        switch (kind) {
+            case "gone":
+                throw new SandboxGoneError(message);
+            case "fs_gone":
+                throw new FileSystemGoneError(message);
+            case "policy":
+                throw new ToolError(`Refused by the machine's local policy: ${message}`);
+            default:
+                throw new ToolError(`${ON_MACHINE_PREFIX}${message}`);
+        }
+    }
+};
+LocalDeviceRelay = __decorate([
+    Injectable(),
+    __param(0, Inject(REDIS)),
+    __param(1, Inject(KERNEL_BUS)),
+    __param(2, Inject(LockService)),
+    __param(3, Inject(KernelConfigService)),
+    __param(4, Inject(KERNEL_LOGGER)),
+    __param(5, Inject(DeviceTargets))
+], LocalDeviceRelay);
+export { LocalDeviceRelay };

package/dist/local-devices/targets.d.ts

@@ -0,0 +1,28 @@
+import type { SandboxRoots } from "@capybara-hq/plugin-sdk";
+import { KernelDb } from "../infra/database/kernel-db.js";
+/**
+ * Whether a local device can still be served: `active` (live and an unrevoked machine),
+ * `revoked` (live, no active machine: disconnected or signed out) or `deleted` (missing or
+ * deleted, or its org deleted).
+ */
+export type DeviceTargetState = "active" | "revoked" | "deleted";
+/** Whether two sets of roots name the same three directories. */
+export declare const sameRoots: (a: SandboxRoots, b: SandboxRoots) => boolean;
+/**
+ * Reads a local device and its machine from PG for the relay and the `@local` provider.
+ * The relay asks {@link state} when a machine has no connection, so a revoked machine or a deleted
+ * device fails a waiting call at once instead of after the reconnect grace (ruling R27).
+ * Kept apart from `MachinesService` (which depends on the relay) so there is no dependency cycle.
+ */
+export declare class DeviceTargets {
+    private readonly db;
+    constructor(db: KernelDb);
+    state(deviceId: string): Promise<DeviceTargetState>;
+    /** The org of a live device, or null (missing or deleted). */
+    orgOf(deviceId: string): Promise<string | null>;
+    /**
+     * The roots the device's active machine last reported in its hello frame, or null (no
+     * active machine, or none reported yet).
+     */
+    machineRoots(deviceId: string): Promise<SandboxRoots | null>;
+}

package/dist/local-devices/targets.js

@@ -0,0 +1,73 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { KernelDb } from "../infra/database/kernel-db.js";
+const ROOT_KEYS = ["workspace", "skills", "tmp"];
+/** Whether two sets of roots name the same three directories. */
+export const sameRoots = (a, b) => ROOT_KEYS.every((k) => a[k] === b[k]);
+/**
+ * Reads a local device and its machine from PG for the relay and the `@local` provider.
+ * The relay asks {@link state} when a machine has no connection, so a revoked machine or a deleted
+ * device fails a waiting call at once instead of after the reconnect grace (ruling R27).
+ * Kept apart from `MachinesService` (which depends on the relay) so there is no dependency cycle.
+ */
+let DeviceTargets = class DeviceTargets {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async state(deviceId) {
+        const row = await this.db
+            .selectFrom("devices as e")
+            .innerJoin("orgs as o", "o.id", "e.org_id")
+            .leftJoin("device_machines as m", (j) => j.onRef("m.device_id", "=", "e.id").on("m.revoked_at", "is", null))
+            .select(["e.id", "m.id as machine_id"])
+            .where("e.id", "=", deviceId)
+            .where("e.deleted_at", "is", null)
+            .where("o.deleted_at", "is", null)
+            .executeTakeFirst();
+        if (!row)
+            return "deleted";
+        return row.machine_id === null ? "revoked" : "active";
+    }
+    /** The org of a live device, or null (missing or deleted). */
+    async orgOf(deviceId) {
+        const row = await this.db
+            .selectFrom("devices")
+            .select("org_id")
+            .where("id", "=", deviceId)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        return row?.org_id ?? null;
+    }
+    /**
+     * The roots the device's active machine last reported in its hello frame, or null (no
+     * active machine, or none reported yet).
+     */
+    async machineRoots(deviceId) {
+        const row = await this.db
+            .selectFrom("device_machines")
+            .select("roots")
+            .where("device_id", "=", deviceId)
+            .where("revoked_at", "is", null)
+            .executeTakeFirst();
+        const r = row?.roots;
+        if (!r || typeof r !== "object")
+            return null;
+        if (!ROOT_KEYS.every((k) => typeof r[k] === "string"))
+            return null;
+        return r;
+    }
+};
+DeviceTargets = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb))
+], DeviceTargets);
+export { DeviceTargets };

package/dist/log.d.ts

@@ -30,6 +30,11 @@ export interface KernelLogger extends Logger {
     redact(text: string): string;
     /** Waits until buffered records reached every output (Loki); never rejects. Call before exit. */
     flush(): Promise<void>;
+    /**
+     * A logger that adds `fields` to every record (e.g. `{ context: "RunWorker" }`); call fields cannot
+     * overwrite them. It shares everything else with this logger: level, secrets, outputs.
+     */
+    child(fields: Record<string, string>): KernelLogger;
 }
 /**
  * 用与 logger 相同的匹配器打码任意文本（工具结果等不经过日志的内容用）：展开规则同 `addOrgSecrets`
@@ -37,13 +42,15 @@ export interface KernelLogger extends Logger {
  * 不得小于匹配器的分桶前缀长度 4）。没有可用的值时原样返回。
  */
 export declare function createRedactor(values: readonly unknown[], minLength?: number): (s: string) => string;
-/** Console format: `pretty` (pino-pretty, one line per record), `json`, or `auto` (pretty on a TTY). */
+/** Console format: `pretty` (pino-pretty), `json`, or `auto` (pretty on a TTY). */
 export declare const LOG_FORMATS: readonly ["auto", "pretty", "json"];
 /** Console format. */
 export type LogFormat = (typeof LOG_FORMATS)[number];
 /** A minimal writable the console output goes to (`process.stdout` by default). */
 export interface LogOutput {
     write(chunk: string): unknown;
+    /** A stream's `error` event (EPIPE when its reader is gone). */
+    on?(event: "error", listener: (err: unknown) => void): unknown;
 }
 /** Options of {@link createLogger}. */
 export interface LoggerOptions {
@@ -58,6 +65,11 @@ export interface LoggerOptions {
     out?: LogOutput;
     /** Whether the console is a terminal (picks `auto` and colors); default `process.stdout.isTTY`. */
     isTTY?: boolean;
+    /**
+     * Pretty output in colors; default: `FORCE_COLOR` (set and not `0`) turns them on, `NO_COLOR` off,
+     * else a TTY. `pnpm dev:kernel` forces them, since its output goes through `tee`.
+     */
+    colors?: boolean;
     /** Also push every record to Loki. */
     loki?: LokiOptions;
     /** Fields on every record (e.g. `role`); log calls cannot overwrite them. */

package/dist/log.js

@@ -105,15 +105,16 @@ function expandSecret(value) {
     }
     return out;
 }
-/** Console format: `pretty` (pino-pretty, one line per record), `json`, or `auto` (pretty on a TTY). */
+/** Console format: `pretty` (pino-pretty), `json`, or `auto` (pretty on a TTY). */
 export const LOG_FORMATS = ["auto", "pretty", "json"];
-/** Fields shown in the pretty prefix instead of the trailing object, in this order. */
-const PREFIX_FIELDS = ["reqId", "traceId", "jobId", "runId", "plugin"];
-/** pino-pretty's message format: `[role] [reqId=…] [plugin=…] msg`, each part only when present. */
+/** Fields shown in the pretty prefix instead of the lines below, in this order. */
+const PREFIX_FIELDS = ["traceId", "reqId", "queue", "jobId", "runId", "context", "plugin"];
+/**
+ * pino-pretty's message format, the octok layout:
+ * `[pid=…] - [traceId=…] [reqId=…] [context=…] msg`, each bracket only when present.
+ */
 function prettyMessage(log, messageKey) {
-    const parts = [];
-    if (typeof log.role === "string")
-        parts.push(`[${log.role}]`);
+    const parts = [`[pid=${process.pid}] -`];
     for (const k of PREFIX_FIELDS) {
         const v = log[k];
         if (typeof v === "string" || typeof v === "number")
@@ -122,6 +123,24 @@ function prettyMessage(log, messageKey) {
     parts.push(String(log[messageKey] ?? ""));
     return parts.join(" ");
 }
+/** The HTTP access record (`http/app.ts`) as one sentence: method, path, status and duration. */
+function foldAccessLine(log) {
+    if (log.msg !== "request" || typeof log.method !== "string" || typeof log.url !== "string") {
+        return log;
+    }
+    const { method, url, status, ms, ...rest } = log;
+    return { ...rest, msg: `${method} ${url} ${status} ${ms}ms` };
+}
+function colorsOn(opts, isTTY) {
+    if (opts.colors !== undefined)
+        return opts.colors;
+    const force = process.env.FORCE_COLOR;
+    if (force !== undefined && force !== "0")
+        return true;
+    if (process.env.NO_COLOR)
+        return false;
+    return isTTY;
+}
 function consoleStream(opts) {
     if (opts.write) {
         const write = opts.write;
@@ -132,23 +151,50 @@ function consoleStream(opts) {
     if (!LOG_FORMATS.includes(format)) {
         throw new Error(`invalid log.format "${format}" (expected ${LOG_FORMATS.join(", ")})`);
     }
-    const out = opts.out ?? process.stdout;
+    const target = opts.out ?? process.stdout;
+    // A console whose reader is gone (the `tee` of `pnpm dev:kernel` stopped by Ctrl-C, a closed
+    // pipe) fails every write with EPIPE. Unhandled, each failure is an uncaught exception the
+    // process guard logs, which writes again: an endless chain that starves the event loop. So the
+    // first stream error ends console output for good (Loki, when configured, still gets records).
+    let broken = false;
+    target.on?.("error", () => {
+        broken = true;
+    });
+    const out = {
+        write: (s) => {
+            if (!broken)
+                target.write(s);
+        },
+    };
     const isTTY = opts.isTTY ?? process.stdout.isTTY === true;
     const pretty = format === "pretty" || (format === "auto" && isTTY);
     if (!pretty)
         return { write: (s) => out.write(s) };
-    // In process (no worker thread): pino-pretty formats each line synchronously.
+    const colors = colorsOn(opts, isTTY);
+    // In process (no worker thread): pino-pretty formats each record synchronously. The layout follows
+    // octok's buildPinoPrettyOptions: full local time, colored level, the bracket prefix, and
+    // the remaining fields as indented `key: value` lines below the message (errors with their stack).
     const format_ = prettyFactory({
-        colorize: isTTY,
-        colorizeObjects: isTTY,
-        singleLine: true,
-        // errors stay inside the one-line object instead of a multi-line stack block
-        errorLikeObjectKeys: [],
-        translateTime: "SYS:HH:MM:ss.l",
+        colorize: colors,
+        colorizeObjects: colors,
+        singleLine: false,
+        translateTime: "SYS:standard",
         ignore: ["pid", "hostname", "role", "spanId", ...PREFIX_FIELDS].join(","),
         messageFormat: (log, messageKey) => prettyMessage(log, messageKey),
     });
-    return { write: (s) => out.write(format_(s)) };
+    return {
+        write: (s) => {
+            let record;
+            try {
+                record = JSON.parse(s);
+            }
+            catch {
+                out.write(s);
+                return;
+            }
+            out.write(format_(foldAccessLine(record)));
+        },
+    };
 }
 /**
  * Creates the kernel logger on pino. Each record is `{ time, level, msg, ...base, ...fields }` with
@@ -254,7 +300,7 @@ export function createLogger(level = "info", opts = {}) {
         }
         sink[lvl](obj, redactMsg(msg));
     };
-    return {
+    const root = {
         debug: (msg, fields) => emit("debug", msg, fields),
         info: (msg, fields) => emit("info", msg, fields),
         warn: (msg, fields) => emit("warn", msg, fields),
@@ -299,5 +345,35 @@ export function createLogger(level = "info", opts = {}) {
                 }
             }
         },
+        // a method, so a wrapper of this logger (a test proxy) is the parent its children forward to
+        child(fields) {
+            return childLogger(this, fields);
+        },
+    };
+    return root;
+}
+/**
+ * A logger that adds `bound` to every record and forwards it to `parent`'s public methods (so a spy
+ * on the parent sees its children's records); call fields cannot overwrite the bound ones.
+ */
+function childLogger(parent, bound) {
+    const merged = (fields) => ({ ...fields, ...bound });
+    const child = {
+        debug: (msg, fields) => parent.debug(msg, merged(fields)),
+        info: (msg, fields) => parent.info(msg, merged(fields)),
+        warn: (msg, fields) => parent.warn(msg, merged(fields)),
+        error: (msg, fields) => parent.error(msg, merged(fields)),
+        get level() {
+            return parent.level;
+        },
+        setLevel: (level) => parent.setLevel(level),
+        addSecrets: (values) => parent.addSecrets(values),
+        addOrgSecrets: (values) => parent.addOrgSecrets(values),
+        redact: (text) => parent.redact(text),
+        flush: () => parent.flush(),
+        child(fields) {
+            return childLogger(this, fields);
+        },
     };
+    return child;
 }