@cordfuse/crosstalk 7.0.0-alpha.16 → 7.0.0-alpha.18

package/src/status.ts

@@ -0,0 +1,84 @@
+// crosstalkd status — transport + dispatcher health at a glance.
+
+import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
+import { resolve, join } from 'path';
+import { discoverChannels } from './transport.js';
+import { stateDir, readCursor, readHeartbeat, countErrors } from './state.js';
+import { loadRegistry } from './models.js';
+
+const transportRoot = resolve(process.cwd());
+
+const versionFile = join(transportRoot, 'CROSSTALK-VERSION');
+const protocolVersion = existsSync(versionFile)
+  ? readFileSync(versionFile, 'utf-8').trim()
+  : '(missing)';
+
+console.log(`Crosstalk transport: ${transportRoot}`);
+console.log(`Protocol version:    ${protocolVersion}`);
+console.log(`Machine state dir:   ${stateDir(transportRoot)}`);
+console.log('');
+
+try {
+  const registry = loadRegistry(transportRoot);
+  console.log(`Models in registry: ${registry.all.size}`);
+  console.log(`Claimed on this machine: ${registry.claimed.size}`);
+  if (registry.claimed.size > 0) {
+    for (const name of registry.claimed.keys()) {
+      console.log(`  - ${name}`);
+    }
+  } else {
+    console.log('  (no model CLIs found on PATH — install one or edit data/crosstalk.yaml)');
+  }
+} catch (err) {
+  console.log(`Models: ERROR — ${(err as Error).message}`);
+}
+
+console.log('');
+
+const hb = readHeartbeat(transportRoot);
+if (hb) {
+  const ageS = Math.floor((Date.now() - new Date(hb.ts).getTime()) / 1000);
+  const label = ageS < 120 ? 'LIVE' : ageS > 300 ? 'STALE' : 'idle';
+  console.log(`Dispatch heartbeat: ${label} (pid ${hb.pid}, last tick ${ageS}s ago, ${hb.version})`);
+} else {
+  console.log('Dispatch heartbeat: never (no dispatch has run on this machine)');
+}
+
+const cursor = readCursor(transportRoot);
+if (cursor) {
+  console.log(`Cursor: ${cursor.slice(0, 12)} (global, machine-local)`);
+} else {
+  console.log('Cursor: (none yet — first tick will seed to HEAD)');
+}
+
+console.log('');
+
+const channels = discoverChannels(transportRoot);
+console.log(`Channels: ${channels.length}`);
+for (const ch of channels) {
+  const channelDir = join(transportRoot, 'data', 'channels', ch);
+  let name = '(no CHANNEL.md)';
+  let parent: string | null = null;
+  const chPath = join(channelDir, 'CHANNEL.md');
+  if (existsSync(chPath)) {
+    const raw = readFileSync(chPath, 'utf-8');
+    const nameMatch = raw.match(/^name:\s*(.+)$/m);
+    if (nameMatch) name = nameMatch[1]!.trim();
+    const parentMatch = raw.match(/^parent:\s*(.+)$/m);
+    if (parentMatch) parent = parentMatch[1]!.trim();
+  }
+  let msgCount = 0;
+  const walk = (d: string): void => {
+    for (const e of readdirSync(d)) {
+      const p = join(d, e);
+      if (statSync(p).isDirectory()) walk(p);
+      else if (e.endsWith('.md') && e !== 'CHANNEL.md') msgCount++;
+    }
+  };
+  try { walk(channelDir); } catch { /* ignore */ }
+  const parentSuffix = parent ? ` [child of ${parent.slice(0, 8)}]` : '';
+  console.log(`  ${ch.slice(0, 8)}... — ${name} (${msgCount} msgs)${parentSuffix}`);
+}
+
+console.log('');
+console.log(`Infrastructure errors logged: ${countErrors(transportRoot)}`);

package/src/stop.ts

@@ -0,0 +1,37 @@
+// crosstalkd stop — send SIGTERM to the running dispatcher and wait for it to exit.
+
+import { resolve } from 'path';
+import { spawnSync } from 'child_process';
+import { readPidfile, removePidfile } from './state.js';
+
+const transportRoot = resolve(process.cwd());
+
+function processRunning(pid: number): boolean {
+  try { process.kill(pid, 0); return true; } catch { return false; }
+}
+
+const pid = readPidfile(transportRoot);
+if (pid === null) {
+  console.error('crosstalkd stop: no dispatcher.pid found — is dispatch running?');
+  process.exit(1);
+}
+
+if (!processRunning(pid)) {
+  console.error(`crosstalkd stop: pid ${pid} is not running — removing stale pidfile`);
+  removePidfile(transportRoot);
+  process.exit(1);
+}
+
+process.kill(pid, 'SIGTERM');
+
+const deadline = Date.now() + 5_000;
+while (Date.now() < deadline) {
+  if (!processRunning(pid)) {
+    console.log(`crosstalkd stop: dispatcher (pid ${pid}) stopped`);
+    process.exit(0);
+  }
+  spawnSync('sleep', ['0.1']);
+}
+
+console.error(`crosstalkd stop: pid ${pid} did not exit within 5s — try: kill -9 ${pid}`);
+process.exit(1);

package/src/transport.ts

@@ -0,0 +1,243 @@
+// Git transport layer. The dispatcher's commits contain ONLY data/ —
+// machine-local state lives in the state dir (state.ts), so there is
+// nothing to exclude, untrack, or heal. Push rejection means another
+// machine won the race: pull --rebase and retry at the call site.
+
+import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
+import { join } from 'path';
+import { spawnSync } from 'child_process';
+import { parseFrontmatter } from './frontmatter.js';
+import { logError } from './state.js';
+
+export interface ChannelMessage {
+  relPath: string;
+  fullPath: string;
+  data: Record<string, unknown>;
+  body: string;
+}
+
+export interface GitResult {
+  ok: boolean;
+  error?: string;
+}
+
+export interface GitPushResult {
+  ok: boolean;
+  committed: boolean;
+  pushed: boolean;
+  error?: string;
+}
+
+function captureGit(cwd: string, args: string[]): { status: number; stdout: string; stderr: string } {
+  const r = spawnSync('git', args, { cwd, encoding: 'utf-8' });
+  return { status: r.status ?? 1, stdout: r.stdout ?? '', stderr: r.stderr ?? '' };
+}
+
+// Detect and abort an interrupted rebase/merge left by a killed process.
+// Returns true if recovery was performed.
+export function recoverInterruptedGit(transportRoot: string): boolean {
+  const halfStates: { dir: string; abortArgs: string[] }[] = [
+    { dir: '.git/rebase-merge', abortArgs: ['rebase', '--abort'] },
+    { dir: '.git/rebase-apply', abortArgs: ['rebase', '--abort'] },
+    { dir: '.git/MERGE_HEAD', abortArgs: ['merge', '--abort'] },
+    { dir: '.git/CHERRY_PICK_HEAD', abortArgs: ['cherry-pick', '--abort'] },
+  ];
+  for (const { dir, abortArgs } of halfStates) {
+    if (existsSync(join(transportRoot, dir))) {
+      const r = captureGit(transportRoot, abortArgs);
+      logError(
+        transportRoot,
+        `recovered from interrupted git state at ${dir} via 'git ${abortArgs.join(' ')}' (exit=${r.status})`,
+      );
+      return true;
+    }
+  }
+  return false;
+}
+
+// The commit cursors anchor to. Use local HEAD: gitPull (called first
+// in dispatchTick) already rebased origin commits into HEAD, so HEAD
+// includes both remote and local-unpushed work. Using origin/HEAD
+// would have stranded the dispatcher whenever push broke (commits
+// pile up on HEAD past stale origin/HEAD; cursor never advances past
+// origin/HEAD; activation pass thinks nothing's new). Caught
+// 2026-06-22 — push failed silently due to missing ssh key, workflows
+// got stuck in FANOUT forever.
+//
+// origin/* fallback only kicks in when local HEAD doesn't resolve
+// (truly empty repo, no branch checked out — defensive only).
+export function cursorBaseline(transportRoot: string): string | null {
+  for (const ref of ['HEAD', 'origin/HEAD', 'origin/main']) {
+    const r = captureGit(transportRoot, ['rev-parse', ref]);
+    if (r.status === 0) return r.stdout.trim();
+  }
+  return null;
+}
+
+// Repo-relative paths of message files added between `sinceCommit` and
+// HEAD. Returns null when the commit is unknown to this clone (state dir
+// copied across transports, history rewritten) — caller falls back to a
+// full channel scan.
+export function newFilesSince(transportRoot: string, sinceCommit: string): string[] | null {
+  const r = captureGit(transportRoot, [
+    'diff', '--name-only', '--diff-filter=A', `${sinceCommit}..HEAD`, '--', 'data/channels/',
+  ]);
+  if (r.status !== 0) return null;
+  return r.stdout.split('\n').filter(Boolean);
+}
+
+export function gitPull(transportRoot: string): GitResult {
+  recoverInterruptedGit(transportRoot);
+  const fetch = captureGit(transportRoot, ['fetch', 'origin', '--quiet']);
+  if (fetch.status !== 0) {
+    // No origin remote configured → not an error. Single-machine and
+    // local-only transports are valid; the dispatcher just operates on
+    // local commits.
+    const stderr = fetch.stderr.trim();
+    if (stderr.includes("does not appear to be a git repository") ||
+        stderr.includes("Could not read from remote") ||
+        stderr.includes("origin") && stderr.includes("does not appear")) {
+      return { ok: true };
+    }
+    return { ok: false, error: (fetch.stderr || fetch.stdout).trim().slice(0, 500) };
+  }
+  const rebase = captureGit(transportRoot, ['rebase', 'origin/main']);
+  if (rebase.status !== 0) {
+    // No origin/main (single-machine, no remote) → not an error.
+    if (rebase.stderr.includes('unknown revision') || rebase.stderr.includes('not a valid object name')) {
+      return { ok: true };
+    }
+    return { ok: false, error: (rebase.stderr || rebase.stdout).trim().slice(0, 500) };
+  }
+  return { ok: true };
+}
+
+// Stage data/ only, commit, push. On push rejection, one pull --rebase +
+// re-push — collision-free filenames make the rebase trivially clean.
+// In single-machine transports with no remote, the push step is a no-op
+// (gracefully — git push fails fast on "No configured push destination",
+// which we treat as success since the commit is already local).
+export function gitCommitAndPush(transportRoot: string, message: string): GitPushResult {
+  const status = captureGit(transportRoot, ['status', '--porcelain', '--', 'data/']);
+  if (status.status !== 0) {
+    return { ok: false, committed: false, pushed: false, error: status.stderr.trim().slice(0, 500) };
+  }
+  if (!status.stdout.trim()) {
+    return { ok: true, committed: false, pushed: false };
+  }
+
+  const add = captureGit(transportRoot, ['add', '--', 'data/']);
+  if (add.status !== 0) {
+    return { ok: false, committed: false, pushed: false, error: add.stderr.trim().slice(0, 500) };
+  }
+
+  const commit = captureGit(transportRoot, ['commit', '-m', message, '--', 'data/']);
+  if (commit.status !== 0) {
+    const noop = commit.stdout.includes('nothing to commit') ||
+                 commit.stderr.includes('nothing to commit');
+    if (noop) return { ok: true, committed: false, pushed: false };
+    return { ok: false, committed: false, pushed: false, error: commit.stderr.trim().slice(0, 500) };
+  }
+
+  // Push rejection is NORMAL under concurrent writers — git is the
+  // arbiter and collision-free filenames make every rebase clean. Retry
+  // with jitter; many writers racing one origin converge within a few
+  // rounds. v6 used turnq as an advisory lock to reduce churn; v7 dropped
+  // it — rebase-retry is the correctness mechanism, turnq was overhead.
+  let push = captureGit(transportRoot, ['push', '--quiet']);
+  if (push.status !== 0) {
+    // No remote configured → push fails with "No configured push destination".
+    // Treat as success: commits stay local, which is the intended state
+    // for single-machine transports.
+    if (push.stderr.includes('No configured push destination') ||
+        push.stderr.includes("does not appear to be a git repository")) {
+      return { ok: true, committed: true, pushed: false };
+    }
+  }
+  for (let attempt = 0; push.status !== 0 && attempt < 5; attempt++) {
+    spawnSync('sleep', [(0.05 + Math.random() * 0.3 * (attempt + 1)).toFixed(2)]);
+    const pull = gitPull(transportRoot);
+    if (!pull.ok) continue;
+    push = captureGit(transportRoot, ['push', '--quiet']);
+  }
+  if (push.status !== 0) {
+    return {
+      ok: false,
+      committed: true,
+      pushed: false,
+      error: (push.stderr || push.stdout).trim().slice(0, 500),
+    };
+  }
+  return { ok: true, committed: true, pushed: true };
+}
+
+export function discoverChannels(transportRoot: string): string[] {
+  const channelsDir = join(transportRoot, 'data', 'channels');
+  if (!existsSync(channelsDir)) return [];
+  let entries: string[];
+  try {
+    entries = readdirSync(channelsDir);
+  } catch (err) {
+    logError(transportRoot, `discoverChannels readdir failed on ${channelsDir}: ${(err as Error).message}`);
+    return [];
+  }
+  return entries.filter((name) => {
+    try {
+      return statSync(join(channelsDir, name)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+}
+
+// v7 frontmatter contract (see transport/CROSSTALK.md §Messages):
+//   required: from (string), to (string), timestamp (string)
+//   optional: re, as, type ('workflow' only), failed, error, child_channel
+// v6 required `type: text` on every message; v7 omits `type:` on regular
+// messages. Readers must ignore UNKNOWN fields, but known fields with
+// invalid values are protocol violations and rejected at parse time.
+// This catches LLM models that revert to v6 muscle memory (writing
+// `type: text` in hand-crafted frontmatter) — a real failure mode
+// surfaced by the S10 fan-out workflow test.
+function isValidMessageFrontmatter(data: Record<string, unknown>): boolean {
+  if (typeof data['from'] !== 'string') return false;
+  if (typeof data['to'] !== 'string' && !Array.isArray(data['to'])) return false;
+  if (typeof data['timestamp'] !== 'string') return false;
+  // `type:` is optional; only 'workflow' is valid in v7. Reject v6's
+  // `type: text` and any other invalid value.
+  if (data['type'] !== undefined && data['type'] !== 'workflow') return false;
+  return true;
+}
+
+export function listChannelMessages(transportRoot: string, channelUuid: string): ChannelMessage[] {
+  const channelDir = join(transportRoot, 'data', 'channels', channelUuid);
+  if (!existsSync(channelDir)) return [];
+  const results: ChannelMessage[] = [];
+  const walk = (dir: string, prefix: string): void => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry);
+      const rel = prefix ? `${prefix}/${entry}` : entry;
+      let stat;
+      try { stat = statSync(full); } catch { continue; }
+      if (stat.isDirectory()) {
+        walk(full, rel);
+      } else if (entry.endsWith('.md') && entry !== 'CHANNEL.md') {
+        const raw = readFileSync(full, 'utf-8');
+        let parsed;
+        try {
+          parsed = parseFrontmatter(raw);
+        } catch (err) {
+          logError(transportRoot, `frontmatter parse failed in ${channelUuid}/${rel}: ${(err as Error).message}`, 'warn');
+          continue;
+        }
+        if (!isValidMessageFrontmatter(parsed.data)) {
+          logError(transportRoot, `invalid message frontmatter in ${channelUuid}/${rel}: missing required field(s) (from, to, timestamp)`, 'warn');
+          continue;
+        }
+        results.push({ relPath: rel, fullPath: full, data: parsed.data, body: parsed.body });
+      }
+    }
+  };
+  walk(channelDir, '');
+  return results.sort((a, b) => a.relPath.localeCompare(b.relPath));
+}

package/src/web/auth-pages.ts

@@ -0,0 +1,160 @@
+// Setup + login web pages for crosstalk's v8 auth.
+//
+// Visual consistency with the rest of the web UI (page() in layout.ts).
+// Ported from @cordfuse/llmux v2/web/setup.ts + login.ts with the chrome
+// adapted to crosstalk's layout helper.
+
+import { page, escapeHtml, TOAST_HELPER } from './layout.js';
+
+export interface SetupPageData {
+  setupToken: string;
+  host: string;
+  alias: string;
+}
+
+export function setupPage(d: SetupPageData): string {
+  return page({
+    title: `crosstalk on ${d.host} · First-run setup`,
+    host: d.host,
+    alias: d.alias,
+    pageTitle: 'First-run setup',
+    extraCss: `
+  .centered-card{max-width:480px;margin:24px auto 0}
+  .footer-note{margin-top:18px;color:#7a7f87;font-size:11px;text-align:center;line-height:1.6}
+  .footer-note code{color:#c9d1d9;background:#0b0c10;border:1px solid #1f2329;padding:1px 6px;border-radius:3px}
+  .field .help{font-size:11px;color:#7a7f87;line-height:1.4}
+  .field .err{font-size:11px;color:#f85149;line-height:1.4}
+    `,
+    body: `
+<div class="centered-card">
+  <div class="card">
+    <h3>Set the operator passphrase</h3>
+    <p class="sub">This account becomes the engine admin. Pick a passphrase you'll remember — there's no email recovery.</p>
+    <form id="setup-form" autocomplete="off" novalidate>
+      <input type="hidden" name="setupToken" value="${escapeHtml(d.setupToken)}">
+      <div class="field">
+        <label for="su-name">Display name</label>
+        <input id="su-name" name="name" type="text" autocomplete="name" required>
+      </div>
+      <div class="field">
+        <label for="su-username">Username</label>
+        <input id="su-username" name="username" type="text" pattern="[a-z0-9_-]+" maxlength="32" required>
+        <span class="help">Lowercase letters, digits, dashes, underscores. Application-layer only — no OS user required.</span>
+      </div>
+      <div class="field">
+        <label for="su-passphrase">Passphrase</label>
+        <input id="su-passphrase" name="passphrase" type="password" minlength="8" autocomplete="new-password" required>
+        <span class="help">Minimum 8 characters.</span>
+      </div>
+      <div class="field">
+        <label for="su-passphrase2">Confirm passphrase</label>
+        <input id="su-passphrase2" name="passphrase2" type="password" minlength="8" autocomplete="new-password" required>
+        <span class="err" id="su-pp-err" hidden>Passphrases don't match.</span>
+      </div>
+      <div class="actions">
+        <button type="submit" class="primary" id="su-submit">Create admin account</button>
+      </div>
+    </form>
+  </div>
+  <p class="footer-note">The engine's HTTP API stays open on localhost without auth (matches the v7 model — operators on the host are trusted). Only the web UI gates non-public pages behind this account.</p>
+</div>`,
+    inlineScript: `${TOAST_HELPER}
+(() => {
+  const form = document.getElementById('setup-form');
+  const pp = document.getElementById('su-passphrase');
+  const pp2 = document.getElementById('su-passphrase2');
+  const err = document.getElementById('su-pp-err');
+  const submit = document.getElementById('su-submit');
+  pp2.addEventListener('input', () => { err.hidden = !pp2.value || pp.value === pp2.value; });
+  form.addEventListener('submit', async (ev) => {
+    ev.preventDefault();
+    if (pp.value !== pp2.value) { err.hidden = false; pp2.focus(); return; }
+    submit.disabled = true;
+    const fd = new FormData(form);
+    const body = { setupToken: fd.get('setupToken'), name: fd.get('name'), username: fd.get('username'), passphrase: fd.get('passphrase') };
+    try {
+      const r = await fetch('/api/setup', { method:'POST', headers:{'content-type':'application/json'}, body: JSON.stringify(body) });
+      const data = await r.json().catch(() => ({}));
+      if (r.ok && data.ok) {
+        window.showToast('Setup complete — redirecting.', 'ok');
+        setTimeout(() => location.assign('/'), 600);
+      } else {
+        window.showToast(data.error || ('setup failed (' + r.status + ')'), 'err');
+        submit.disabled = false;
+      }
+    } catch (e) {
+      window.showToast('network error: ' + e.message, 'err');
+      submit.disabled = false;
+    }
+  });
+})();`,
+  });
+}
+
+export interface LoginPageData {
+  host: string;
+  alias: string;
+  returnTo?: string;
+}
+
+export function loginPage(d: LoginPageData): string {
+  const returnToSafe = d.returnTo ? escapeHtml(d.returnTo) : '/';
+  return page({
+    title: `crosstalk on ${d.host} · Sign in`,
+    host: d.host,
+    alias: d.alias,
+    pageTitle: 'Sign in',
+    extraCss: `
+  .centered-card{max-width:420px;margin:48px auto 0}
+  .footer-note{margin-top:18px;color:#7a7f87;font-size:11px;text-align:center;line-height:1.6}
+  .footer-note code{color:#c9d1d9;background:#0b0c10;border:1px solid #1f2329;padding:1px 6px;border-radius:3px}
+    `,
+    body: `
+<div class="centered-card">
+  <div class="card">
+    <h3>Sign in</h3>
+    <form id="login-form" autocomplete="on" novalidate>
+      <input type="hidden" name="returnTo" value="${returnToSafe}">
+      <div class="field">
+        <label for="li-username">Username</label>
+        <input id="li-username" name="username" type="text" autocomplete="username" pattern="[a-z0-9_-]+" required autofocus>
+      </div>
+      <div class="field">
+        <label for="li-passphrase">Passphrase</label>
+        <input id="li-passphrase" name="passphrase" type="password" autocomplete="current-password" minlength="8" required>
+      </div>
+      <div class="actions">
+        <button type="submit" class="primary" id="li-submit">Sign in</button>
+      </div>
+    </form>
+  </div>
+  <p class="footer-note">Forgot your passphrase? Delete <code>users.json</code> from the transport state dir and re-run setup. (Yes, that wipes the operator account; no email recovery on this tier.)</p>
+</div>`,
+    inlineScript: `${TOAST_HELPER}
+(() => {
+  const form = document.getElementById('login-form');
+  const submit = document.getElementById('li-submit');
+  form.addEventListener('submit', async (ev) => {
+    ev.preventDefault();
+    submit.disabled = true;
+    const fd = new FormData(form);
+    const body = { username: fd.get('username'), passphrase: fd.get('passphrase') };
+    try {
+      const r = await fetch('/api/auth/login', { method:'POST', headers:{'content-type':'application/json'}, body: JSON.stringify(body) });
+      const data = await r.json().catch(() => ({}));
+      if (r.ok && data.token) {
+        window.showToast('Signed in — redirecting.', 'ok');
+        const dest = fd.get('returnTo') || '/';
+        setTimeout(() => location.assign(dest), 400);
+      } else {
+        window.showToast(data.error || ('sign-in failed (' + r.status + ')'), 'err');
+        submit.disabled = false;
+      }
+    } catch (e) {
+      window.showToast('network error: ' + e.message, 'err');
+      submit.disabled = false;
+    }
+  });
+})();`,
+  });
+}