@interactive-inc/claude-funnel 0.60.1 → 0.63.0

package/dist/{memory-diagnostic-log-CI60kNfB.js → sqlite-diagnostic-log-DOTPW-tG.js}

@@ -1,9 +1,10 @@
-import { t as gatewayLoopbackUrl } from "./gateway-base-url-Dy4Ykuoh.js";
-import { t as NodeFunnelFileSystem } from "./node-file-system-Blr8pAir.js";
+import { n as gatewayLoopbackUrl, t as loopbackFetch } from "./loopback-fetch-CVNuN3YZ.js";
+import { t as NodeFunnelFileSystem } from "./node-file-system-BOXIHW_Q.js";
 import { t as NodeFunnelProcessRunner } from "./node-process-runner-DxTvycoK.js";
-import { n as FUNNEL_DIR, o as resolveFunnelPort } from "./settings-store-CUKSeTXC.js";
-import { t as ConnectorDiagnosticSqlReader } from "./diagnostic-sql-reader-C9zR-Csp.js";
-import { t as FunnelLogSqliteSink } from "./funnel-log-sqlite-sink-kqJbx2H7.js";
+import { n as FUNNEL_DIR, o as resolveFunnelPort } from "./settings-store-C2QdOH-t.js";
+import { t as FunnelAuthFailedError } from "./funnel-error-0t1MK1R6.js";
+import { t as ConnectorDiagnosticSqlReader } from "./diagnostic-sql-reader-oXZnWFf_.js";
+import { t as FunnelLogSqliteSink } from "./funnel-log-sqlite-sink-DLYkY0pZ.js";
 import { dirname, join } from "node:path";
 import { chmodSync, existsSync, mkdirSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
@@ -24,6 +25,174 @@ function funnelTmpDir() {
 	return join(tmpdir(), "funnel");
 }
 //#endregion
+//#region lib/engine/diagnostic-log/diagnostic-log.ts
+/**
+* Points in the listener's connection lifecycle. The single source of truth
+* for the value set: the `status` column schema, the `ConnectorConnectionStatus`
+* union, and the runtime Set used to narrow on read-back all derive from this
+* array, so adding a status is a one-line change that cannot drift out of sync.
+*
+*   started       start() was called
+*   connected     the socket opened and events can flow
+*   disconnected  the socket was closed by a stop() call (a clean teardown)
+*   auth-failed   the token was rejected before the socket opened
+*   stopped       the listener was fully torn down (always follows a stop(),
+*                 paired with the disconnected/error that preceded it)
+*   error         start/stop threw, or Bolt surfaced an error frame — this is
+*                 also where an unsolicited socket drop shows up when Bolt
+*                 reports it (an `error` with no following `stopped` means the
+*                 supervisor recycled the listener, not a clean stop)
+*
+* A connection row is independent of any single inbound event, so it carries
+* no `eventId`. This is how "no notification arrived because the listener
+* never connected (or dropped, or failed auth)" becomes visible: the
+* raw/processed tables only hold events that *did* arrive.
+*/
+const CONNECTOR_CONNECTION_STATUSES = [
+	"started",
+	"connected",
+	"disconnected",
+	"auth-failed",
+	"stopped",
+	"error"
+];
+/**
+* Rows stored in the diagnostic tables. Connector-agnostic on purpose: `type`
+* carries the listener kind ("slack" | "discord" | "gh" | "schedule") so new
+* connectors land in the same tables without a schema change. `event_id` is
+* the correlation key the listener mints once per inbound event and stamps
+* onto both the raw and processed rows, so the two are joinable even though
+* they live in separate tables with independent `seq` counters.
+*
+* These schemas mirror the stored shape (snake_case columns) the way
+* `FunnelEvent` does for the replay log; they exist for `z.infer` and to
+* document the column set, not as a parse boundary.
+*/
+const connectorRawEventSchema = z.object({
+	event_id: z.string(),
+	type: z.string(),
+	connector_id: z.string().nullable(),
+	channel_id: z.string().nullable(),
+	payload: z.string()
+});
+const connectorProcessedEventSchema = z.object({
+	event_id: z.string(),
+	type: z.string(),
+	connector_id: z.string().nullable(),
+	channel_id: z.string().nullable(),
+	outcome: z.string(),
+	payload: z.string()
+});
+const connectorConnectionEventSchema = z.object({
+	type: z.string(),
+	connector_id: z.string().nullable(),
+	channel_id: z.string().nullable(),
+	status: z.enum(CONNECTOR_CONNECTION_STATUSES),
+	detail: z.string()
+});
+/**
+* Three-table diagnostic log of everything a connector listener does, so
+* "why was there no notification?" is answerable whichever way it failed:
+*   - `raw` — every inbound event, before any filtering, with the listener's
+*     untouched payload (the Slack Bolt event, the GH webhook, …)
+*   - `processed` — the verdict for that event: `outcome` (emitted, or the
+*     reason it was dropped) and, when emitted, the body that was delivered.
+*     Shares an `eventId` with its raw row, so the two join into one story.
+*   - `connection` — the listener's lifecycle (started, connected, dropped,
+*     auth-failed, stopped, errored). This is the half the event tables can't
+*     show: an event that never arrived leaves no raw row, but a listener that
+*     never connected leaves a `connection` trail that says so.
+*
+* The three are physically separate (independent retention and payload-size
+* policy) so a query never crosses them by accident and a huge raw payload
+* never bloats the verdict or lifecycle trails. None flow to WS clients or the
+* MCP channel — this is a separate store from `FunnelEventLog` (replay) and
+* exists solely for debugging.
+*
+* Implementations:
+*   - `SqliteConnectorDiagnosticLog` — the default; survives daemon restarts,
+*     bounded by per-table row/age caps.
+*   - `MemoryConnectorDiagnosticLog` — an in-process double for tests.
+*/
+var ConnectorDiagnosticLog = class {};
+//#endregion
+//#region lib/engine/diagnostic-log/memory-diagnostic-log.ts
+/**
+* In-process `ConnectorDiagnosticLog` backed by one array per table. Used by tests
+* and embedders that do not need durability. Like the SQLite log it keeps
+* `seq` per-table (each array's 1-based position) and returns the most recent
+* `limit` rows oldest-first; unlike it, it never prunes and never offloads
+* oversized payloads — it keeps whatever the caller hands it, which is fine
+* for the bounded volumes a test produces. Payload-validity is therefore a
+* SQLite-only guarantee; do not write a test that leans on this double
+* rejecting a malformed payload.
+*/
+var MemoryConnectorDiagnosticLog = class extends ConnectorDiagnosticLog {
+	raws = [];
+	processeds = [];
+	connections = [];
+	constructor(now = () => Date.now()) {
+		super();
+		this.now = now;
+		Object.freeze(this);
+	}
+	recordRaw(record) {
+		this.raws.push({
+			...record,
+			seq: this.raws.length + 1,
+			ts: this.now()
+		});
+	}
+	recordProcessed(record) {
+		this.processeds.push({
+			...record,
+			seq: this.processeds.length + 1,
+			ts: this.now()
+		});
+	}
+	recordConnection(record) {
+		this.connections.push({
+			...record,
+			seq: this.connections.length + 1,
+			ts: this.now()
+		});
+	}
+	queryRaw(query) {
+		return takeRecent(this.raws.filter((event) => matches(event, query)), query.limit);
+	}
+	queryProcessed(query) {
+		return takeRecent(this.processeds.filter((event) => {
+			if (!matches(event, query)) return false;
+			if (query.outcome !== void 0 && event.outcome !== query.outcome) return false;
+			return true;
+		}), query.limit);
+	}
+	queryConnection(query) {
+		return takeRecent(this.connections.filter((event) => {
+			if (!matches(event, query)) return false;
+			if (query.status !== void 0 && event.status !== query.status) return false;
+			return true;
+		}), query.limit);
+	}
+	clear() {
+		this.raws.length = 0;
+		this.processeds.length = 0;
+		this.connections.length = 0;
+	}
+	close() {}
+};
+const matches = (event, query) => {
+	if (query.type !== void 0 && event.type !== query.type) return false;
+	if (query.connectorId !== void 0 && event.connectorId !== query.connectorId) return false;
+	if (query.channelId !== void 0 && event.channelId !== query.channelId) return false;
+	return true;
+};
+const takeRecent = (events, limit) => {
+	if (limit === void 0) return events;
+	if (limit <= 0) return [];
+	return events.slice(-limit);
+};
+//#endregion
 //#region lib/gateway/publish-schema.ts
 /**
 * Shared schema for `POST /channels/:channel/publish` — used by both the
@@ -67,8 +236,7 @@ var FunnelChannelPublisher = class {
 	async publish(channelName, request) {
 		if (!this.isDaemonRunning()) return OFFLINE;
 		try {
-			const url = `${gatewayLoopbackUrl(this.port)}/channels/${encodeURIComponent(channelName)}/publish`;
-			const res = await fetch(url, {
+			const res = await loopbackFetch(`${gatewayLoopbackUrl(this.port)}/channels/${encodeURIComponent(channelName)}/publish`, {
 				method: "POST",
 				headers: {
 					...this.authHeaders(),
@@ -308,19 +476,35 @@ var FunnelBroadcaster = class {
 				this.droppedSlowClients += 1;
 				continue;
 			}
-			ws.send(payload);
+			try {
+				ws.send(payload);
+			} catch (error) {
+				const err = error instanceof Error ? error : new Error(String(error));
+				const data = this.clients.get(ws);
+				this.logger?.warn("ws.send failed; dropping client", {
+					channel: data?.channel,
+					error: err.message
+				});
+				this.clients.delete(ws);
+			}
 		}
-		for (const handler of this.subscribers) try {
-			handler(event);
-		} catch (error) {
-			const err = error instanceof Error ? error : new Error(String(error));
-			this.logger?.error("broadcast subscriber threw", { error: err.message });
-			this.onError(err, {
-				component: "broadcaster.subscriber",
-				offset: event.offset,
-				connector: event.meta?.connector ?? null,
-				channel: event.meta?.channel ?? null
-			});
+		for (const handler of this.subscribers) {
+			const captureError = (error) => {
+				const err = error instanceof Error ? error : new Error(String(error));
+				this.logger?.error("broadcast subscriber threw", { error: err.message });
+				this.onError(err, {
+					component: "broadcaster.subscriber",
+					offset: event.offset,
+					connector: event.meta?.connector ?? null,
+					channel: event.meta?.channel ?? null
+				});
+			};
+			try {
+				const result = handler(event);
+				if (result instanceof Promise) result.catch(captureError);
+			} catch (error) {
+				captureError(error);
+			}
 		}
 		return event;
 	}
@@ -384,10 +568,12 @@ var SqliteFunnelEventLog = class extends FunnelEventLog {
 	sink;
 	now;
 	logger;
+	onError;
 	constructor(props) {
 		super();
 		this.now = props.now ?? (() => Date.now());
 		this.logger = props.logger;
+		this.onError = props.onError;
 		this.sink = new FunnelLogSqliteSink({
 			path: props.path,
 			indexes: ["channel_id", "connector_id"],
@@ -420,10 +606,19 @@ var SqliteFunnelEventLog = class extends FunnelEventLog {
 			ts: this.now(),
 			event
 		});
-		if (result instanceof Error) this.logger?.error("event log write failed", {
-			offset: record.offset,
-			error: result.message
-		});
+		if (result instanceof Error) {
+			this.logger?.error("event log write failed", {
+				offset: record.offset,
+				error: result.message
+			});
+			this.onError?.(result, {
+				component: "sqlite-event-log",
+				op: "record",
+				offset: record.offset,
+				channelId: record.channelId,
+				connectorId: record.connectorId
+			});
+		}
 	}
 	/**
 	* Returns events with offset > since. Filtering by channel/connector is
@@ -476,7 +671,7 @@ function truncate(content) {
 	return `${content.slice(0, MAX_CONTENT_CHARS)}...`;
 }
 //#endregion
-//#region lib/gateway/listener-supervisor.ts
+//#region lib/gateway/listener-registry.ts
 const defaultOnError$1 = () => {};
 const DEFAULT_HEALTH_INTERVAL_MS = 3e4;
 const DEFAULT_MAX_BACKOFF_MS = 6e4;
@@ -496,13 +691,14 @@ const defaultSleep$1 = (ms) => new Promise((r) => {
 * dead listeners with exponential backoff (1s, 2s, 4s, ... capped). Resets
 * the backoff counter on successful restart.
 */
-var FunnelListenerSupervisor = class FunnelListenerSupervisor {
+var FunnelListenerRegistry = class FunnelListenerRegistry {
 	channels;
 	notify;
 	logger;
 	onError;
 	running = /* @__PURE__ */ new Map();
 	failureCounts = /* @__PURE__ */ new Map();
+	starting = /* @__PURE__ */ new Set();
 	stats = /* @__PURE__ */ new Map();
 	healthCheckIntervalMs;
 	maxBackoffMs;
@@ -528,7 +724,7 @@ var FunnelListenerSupervisor = class FunnelListenerSupervisor {
 		return `${channelName}/${connectorName}`;
 	}
 	isRunning(channelName, connectorName) {
-		return this.running.has(FunnelListenerSupervisor.keyOf(channelName, connectorName));
+		return this.running.has(FunnelListenerRegistry.keyOf(channelName, connectorName));
 	}
 	list() {
 		return [...this.running.entries()].map(([key, entry]) => {
@@ -547,11 +743,24 @@ var FunnelListenerSupervisor = class FunnelListenerSupervisor {
 		});
 	}
 	async start(channelName, connectorName) {
-		const key = FunnelListenerSupervisor.keyOf(channelName, connectorName);
+		const key = FunnelListenerRegistry.keyOf(channelName, connectorName);
 		if (this.running.has(key)) return {
 			ok: true,
 			reason: "already running"
 		};
+		if (this.starting.has(key)) return {
+			ok: false,
+			reason: "already starting",
+			retriable: true
+		};
+		this.starting.add(key);
+		try {
+			return await this.startLocked(channelName, connectorName, key);
+		} finally {
+			this.starting.delete(key);
+		}
+	}
+	async startLocked(channelName, connectorName, key) {
 		const created = this.channels.createListener(channelName, connectorName);
 		if (!created) return {
 			ok: false,
@@ -585,25 +794,30 @@ var FunnelListenerSupervisor = class FunnelListenerSupervisor {
 			return { ok: true };
 		} catch (error) {
 			const err = error instanceof Error ? error : new Error(String(error));
+			try {
+				await created.listener.stop();
+			} catch {}
 			this.logger?.error(`${created.config.type} listener failed to start`, {
 				channel: channelName,
 				connector: connectorName,
 				error: err.message
 			});
 			this.onError(err, {
-				component: "listener-supervisor.start",
+				component: "listener-registry.start",
 				channel: channelName,
 				connector: connectorName,
 				type: created.config.type
 			});
+			const retriable = !(err instanceof FunnelAuthFailedError);
 			return {
 				ok: false,
-				reason: err.message
+				reason: err.message,
+				retriable
 			};
 		}
 	}
 	async stop(channelName, connectorName) {
-		const key = FunnelListenerSupervisor.keyOf(channelName, connectorName);
+		const key = FunnelListenerRegistry.keyOf(channelName, connectorName);
 		const entry = this.running.get(key);
 		if (!entry) return {
 			ok: true,
@@ -624,7 +838,7 @@ var FunnelListenerSupervisor = class FunnelListenerSupervisor {
 				error: err.message
 			});
 			this.onError(err, {
-				component: "listener-supervisor.stop",
+				component: "listener-registry.stop",
 				channel: channelName,
 				connector: connectorName,
 				type: entry.config.type
@@ -649,8 +863,17 @@ var FunnelListenerSupervisor = class FunnelListenerSupervisor {
 		for (let i = 0; i < results.length; i++) {
 			const result = results[i];
 			const view = all[i];
-			if (result.status === "rejected" || result.status === "fulfilled" && !result.value.ok) {
-				const key = FunnelListenerSupervisor.keyOf(view.channelName, view.name);
+			if (result.status === "rejected") {
+				const key = FunnelListenerRegistry.keyOf(view.channelName, view.name);
+				this.pendingRetry.set(key, {
+					channelName: view.channelName,
+					connectorName: view.name
+				});
+				continue;
+			}
+			if (result.status === "fulfilled" && !result.value.ok) {
+				if (result.value.retriable === false) continue;
+				const key = FunnelListenerRegistry.keyOf(view.channelName, view.name);
 				this.pendingRetry.set(key, {
 					channelName: view.channelName,
 					connectorName: view.name
@@ -687,7 +910,11 @@ var FunnelListenerSupervisor = class FunnelListenerSupervisor {
 	startHealthCheck() {
 		if (this.healthCheckTimer) return;
 		this.healthCheckTimer = setInterval(() => {
-			this.runHealthCheck();
+			this.runHealthCheck().catch((error) => {
+				const err = error instanceof Error ? error : new Error(String(error));
+				this.logger?.error("health check pass failed", { error: err.message });
+				this.onError(err, { component: "listener-registry.health-check" });
+			});
 		}, this.healthCheckIntervalMs);
 		this.healthCheckTimer.unref();
 	}
@@ -704,36 +931,64 @@ var FunnelListenerSupervisor = class FunnelListenerSupervisor {
 		if (this.healthCheckInFlight) return;
 		this.healthCheckInFlight = true;
 		try {
+			const dead = [];
 			for (const [key, entry] of [...this.running.entries()]) {
 				if (entry.listener.isAlive()) {
 					this.failureCounts.delete(key);
 					continue;
 				}
-				await this.recoverDead(entry.channelName, entry.config.name, entry.config.type);
+				dead.push({
+					channelName: entry.channelName,
+					connectorName: entry.config.name,
+					type: entry.config.type
+				});
 			}
+			await Promise.all(dead.map((target) => this.recoverDead(target.channelName, target.connectorName, target.type)));
+			const retries = [];
 			for (const [key, pending] of [...this.pendingRetry.entries()]) {
 				if (this.running.has(key)) {
 					this.pendingRetry.delete(key);
 					continue;
 				}
-				this.logger?.info("retrying failed listener", {
-					channel: pending.channelName,
-					connector: pending.connectorName
+				retries.push({
+					key,
+					channelName: pending.channelName,
+					connectorName: pending.connectorName
 				});
-				const failureCount = this.failureCounts.get(key) ?? 0;
-				const backoffMs = Math.min(1e3 * 2 ** failureCount, this.maxBackoffMs);
-				await this.sleep(backoffMs);
-				if ((await this.start(pending.channelName, pending.connectorName)).ok) {
-					this.pendingRetry.delete(key);
-					this.failureCounts.delete(key);
-				} else this.failureCounts.set(key, failureCount + 1);
 			}
+			await Promise.all(retries.map((retry) => this.attemptRetry(retry)));
 		} finally {
 			this.healthCheckInFlight = false;
 		}
 	}
+	async attemptRetry(retry) {
+		this.logger?.info("retrying failed listener", {
+			channel: retry.channelName,
+			connector: retry.connectorName
+		});
+		const failureCount = this.failureCounts.get(retry.key) ?? 0;
+		const backoffMs = Math.min(1e3 * 2 ** failureCount, this.maxBackoffMs);
+		await this.sleep(backoffMs);
+		const result = await this.start(retry.channelName, retry.connectorName);
+		if (result.ok) {
+			this.pendingRetry.delete(retry.key);
+			this.failureCounts.delete(retry.key);
+			return;
+		}
+		if (result.retriable === false) {
+			this.pendingRetry.delete(retry.key);
+			this.failureCounts.delete(retry.key);
+			this.logger?.warn("dropping listener from retry queue (non-retriable)", {
+				channel: retry.channelName,
+				connector: retry.connectorName,
+				reason: result.reason
+			});
+			return;
+		}
+		this.failureCounts.set(retry.key, failureCount + 1);
+	}
 	async recoverDead(channelName, connectorName, type) {
-		const key = FunnelListenerSupervisor.keyOf(channelName, connectorName);
+		const key = FunnelListenerRegistry.keyOf(channelName, connectorName);
 		const failureCount = this.failureCounts.get(key) ?? 0;
 		const backoffMs = Math.min(1e3 * 2 ** failureCount, this.maxBackoffMs);
 		this.logger?.warn(`${type} listener unhealthy, restarting`, {
@@ -744,12 +999,20 @@ var FunnelListenerSupervisor = class FunnelListenerSupervisor {
 		});
 		await this.stop(channelName, connectorName);
 		await this.sleep(backoffMs);
-		if ((await this.start(channelName, connectorName)).ok) {
+		const result = await this.start(channelName, connectorName);
+		if (result.ok) {
 			this.failureCounts.delete(key);
 			this.logger?.info(`${type} listener recovered`, {
 				channel: channelName,
 				connector: connectorName
 			});
+		} else if (result.retriable === false) {
+			this.failureCounts.delete(key);
+			this.logger?.warn(`${type} listener cannot recover (non-retriable)`, {
+				channel: channelName,
+				connector: connectorName,
+				reason: result.reason
+			});
 		} else this.failureCounts.set(key, failureCount + 1);
 	}
 };
@@ -859,7 +1122,12 @@ const channelsConnectorsCallHandler = factory.createHandlers(zParam(z.object({
 	connector: z.string().min(1)
 })), async (c) => {
 	const param = c.req.valid("param");
-	const raw = await c.req.json().catch(() => null);
+	let raw = null;
+	try {
+		raw = await c.req.json();
+	} catch {
+		raw = null;
+	}
 	const parsed = bodySchema.safeParse(raw);
 	if (!parsed.success) throw new HTTPException(400, { message: parsed.error.issues[0]?.message ?? "invalid body" });
 	const result = await c.var.deps.channels.call(param.channel, param.connector, {
@@ -971,7 +1239,7 @@ const debugHandler = factory.createHandlers(async (c) => {
 	const channelFilter = c.req.query("channel") ?? null;
 	const allChannels = deps.channels.list();
 	const targetChannels = channelFilter ? allChannels.filter((ch) => ch.name === channelFilter || ch.id === channelFilter) : allChannels;
-	const gatewayListeners = deps.supervisor.list();
+	const gatewayListeners = deps.registry.list();
 	const gatewayClients = deps.broadcaster.listChannels();
 	const metrics = deps.broadcaster.getMetrics();
 	const tmpDir = funnelTmpDir();
@@ -1074,14 +1342,14 @@ const healthHandler = factory.createHandlers((c) => {
 		pid: deps.selfPid,
 		funnelDir: deps.dir,
 		clients: deps.broadcaster.getClientCount(),
-		listeners: deps.supervisor.list()
+		listeners: deps.registry.list()
 	});
 });
 //#endregion
 //#region lib/gateway/routes/listeners.list.ts
 /** GET /listeners — running connector listeners with alive/dead status. */
 const listenersListHandler = factory.createHandlers((c) => {
-	return c.json({ listeners: c.var.deps.supervisor.list() });
+	return c.json({ listeners: c.var.deps.registry.list() });
 });
 //#endregion
 //#region lib/gateway/routes/listeners.restart.ts
@@ -1091,7 +1359,7 @@ const listenersRestartHandler = factory.createHandlers(zParam(z.object({
 	connector: z.string().min(1)
 })), async (c) => {
 	const param = c.req.valid("param");
-	const result = await c.var.deps.supervisor.restart(param.channel, param.connector);
+	const result = await c.var.deps.registry.restart(param.channel, param.connector);
 	return c.json(result, result.ok ? 200 : 400);
 });
 //#endregion
@@ -1102,7 +1370,7 @@ const listenersStartHandler = factory.createHandlers(zParam(z.object({
 	connector: z.string().min(1)
 })), async (c) => {
 	const param = c.req.valid("param");
-	const result = await c.var.deps.supervisor.start(param.channel, param.connector);
+	const result = await c.var.deps.registry.start(param.channel, param.connector);
 	return c.json(result, result.ok ? 200 : 400);
 });
 //#endregion
@@ -1113,7 +1381,7 @@ const listenersStopHandler = factory.createHandlers(zParam(z.object({
 	connector: z.string().min(1)
 })), async (c) => {
 	const param = c.req.valid("param");
-	const result = await c.var.deps.supervisor.stop(param.channel, param.connector);
+	const result = await c.var.deps.registry.stop(param.channel, param.connector);
 	return c.json(result, result.ok ? 200 : 400);
 });
 //#endregion
@@ -1127,7 +1395,7 @@ const statusHandler = factory.createHandlers((c) => {
 		funnelDir: deps.dir,
 		uptimeMs: deps.uptimeMs(),
 		clients: deps.broadcaster.listChannels(),
-		listeners: deps.supervisor.list(),
+		listeners: deps.registry.list(),
 		broadcaster: deps.broadcaster.getMetrics()
 	});
 });
@@ -1154,7 +1422,7 @@ const defaultDbPath = () => join(funnelTmpDir(), "events.db");
 const defaultOnError = () => {};
 /**
 * In-process gateway: runs `Bun.serve` (HTTP + WebSocket /ws), boots connector
-* listeners through `FunnelListenerSupervisor`, fans events out via
+* listeners through `FunnelListenerRegistry`, fans events out via
 * `FunnelBroadcaster`, and persists them via a `FunnelEventLog` (SQLite by default).
 * System events (gateway lifecycle, connect/disconnect) flow to `FunnelLogger`
 * instead — keeping the SQLite seq space exclusive to broadcaster traffic so
@@ -1177,11 +1445,13 @@ var FunnelGatewayServer = class {
 	allowInsecureHost;
 	broadcaster;
 	eventLog;
-	supervisor;
+	registry;
 	nowMs;
 	extraRoutes;
+	ownsEventLog;
 	startedAt = null;
 	server = null;
+	disposed = false;
 	constructor(deps) {
 		this.channels = deps.channels;
 		this.configuredPort = deps.port ?? resolveFunnelPort();
@@ -1198,15 +1468,19 @@ var FunnelGatewayServer = class {
 		this.extraRoutes = deps.extraRoutes ?? null;
 		const clock = deps.clock;
 		this.nowMs = clock ? () => clock.millis() : () => Date.now();
-		if (deps.eventLog) this.eventLog = deps.eventLog;
-		else {
+		if (deps.eventLog) {
+			this.eventLog = deps.eventLog;
+			this.ownsEventLog = false;
+		} else {
 			const dbDir = dirname(this.dbPath);
 			if (!existsSync(dbDir)) mkdirSync(dbDir, { recursive: true });
 			this.eventLog = new SqliteFunnelEventLog({
 				path: this.dbPath,
 				now: this.nowMs,
-				logger: this.logger
+				logger: this.logger,
+				onError: this.onError
 			});
+			this.ownsEventLog = true;
 		}
 		this.broadcaster = new FunnelBroadcaster({
 			logger: this.logger,
@@ -1215,7 +1489,7 @@ var FunnelGatewayServer = class {
 			persistentReplay: this.eventLog
 		});
 		this.broadcaster.seedLatestOffset(this.eventLog.findMaxOffset());
-		this.supervisor = new FunnelListenerSupervisor({
+		this.registry = new FunnelListenerRegistry({
 			channels: this.channels,
 			logger: this.logger,
 			onError: this.onError,
@@ -1242,6 +1516,7 @@ var FunnelGatewayServer = class {
 		return this.server?.hostname ?? this.configuredHostname;
 	}
 	async start() {
+		if (this.disposed) throw new Error("FunnelGatewayServer is single-use: construct a new instance to start again");
 		if (this.server) return;
 		if (!this.token && !LOOPBACK_HOSTS.has(this.configuredHostname) && !this.allowInsecureHost) throw new Error(`refusing to start gateway: hostname "${this.configuredHostname}" is reachable off-box but no token is set. Set a token, bind to loopback (127.0.0.1), or pass allowInsecureHost: true.`);
 		const app = this.buildApp();
@@ -1259,14 +1534,22 @@ var FunnelGatewayServer = class {
 			}
 		});
 		this.logServerStarted();
-		await this.bootListeners();
+		try {
+			await this.bootListeners();
+		} catch (error) {
+			this.server.stop();
+			this.server = null;
+			throw error;
+		}
 	}
 	async stop() {
-		await this.supervisor.stopAll();
+		await this.registry.stopAll();
 		if (this.server) {
 			this.server.stop();
 			this.server = null;
 		}
+		if (this.ownsEventLog) this.eventLog.close();
+		this.disposed = true;
 	}
 	getStatus() {
 		return {
@@ -1277,8 +1560,8 @@ var FunnelGatewayServer = class {
 	getBroadcaster() {
 		return this.broadcaster;
 	}
-	getSupervisor() {
-		return this.supervisor;
+	getRegistry() {
+		return this.registry;
 	}
 	getEventLog() {
 		return this.eventLog;
@@ -1323,7 +1606,14 @@ var FunnelGatewayServer = class {
 	handleWsOpen(ws) {
 		if (typeof ws.data.since === "number") {
 			const replay = this.broadcaster.replaySince(ws.data.since, ws.data);
-			for (const event of replay) ws.send(JSON.stringify(event));
+			try {
+				for (const event of replay) ws.send(JSON.stringify(event));
+			} catch (error) {
+				const err = error instanceof Error ? error : new Error(String(error));
+				this.logger?.warn("replay send failed during ws.open", { error: err.message });
+				this.onError(err, { component: "gateway-server.replay" });
+				return;
+			}
 		}
 		this.broadcaster.addClient(ws, ws.data);
 		this.logger?.info("channel connected", {
@@ -1365,7 +1655,7 @@ var FunnelGatewayServer = class {
 				selfPid: this.selfPid,
 				dir: this.dir,
 				broadcaster: this.broadcaster,
-				supervisor: this.supervisor,
+				registry: this.registry,
 				channels: this.channels,
 				uptimeMs: () => this.startedAt ? this.nowMs() - this.startedAt : 0,
 				emit: (input) => this.emit(input)
@@ -1419,8 +1709,8 @@ var FunnelGatewayServer = class {
 		});
 	}
 	async bootListeners() {
-		await this.supervisor.startAll();
-		for (const entry of this.supervisor.list()) this.logger?.info(`${entry.type} listener started: ${entry.name}`, {
+		await this.registry.startAll();
+		for (const entry of this.registry.list()) this.logger?.info(`${entry.type} listener started: ${entry.name}`, {
 			event_type: "system",
 			action: `${entry.type}_connect`,
 			channel: entry.channelName,
@@ -1501,20 +1791,22 @@ var FunnelGatewayToken = class {
 		return value.length > 0 ? value : null;
 	}
 	/**
-	* Returns the existing token or, if missing, generates one and writes it with mode 0600.
-	*
-	* NOTE: not atomic — two concurrent `ensure()` calls (e.g., `fnl gateway start` racing
-	* itself before the PID lock is acquired) could each generate independent tokens. The
-	* gateway PID file makes this practically a non-issue; if you need stronger guarantees,
-	* take a file lock around this call externally.
+	* Returns the existing token or, if missing, generates one and writes it
+	* with mode 0600. Read+write runs inside an exclusive lock so two
+	* concurrent `ensure()` calls (a daemon spawn racing a CLI helper that
+	* reads the token before the gateway PID lock is acquired) cannot each
+	* persist a different token and leave one side authenticating against a
+	* value the other never sees.
 	*/
 	ensure() {
-		const existing = this.read();
-		if (existing) return existing;
-		const token = this.generate();
 		this.fs.mkdirSync(dirname(this.path), { recursive: true });
-		this.fs.writeSecretFileSync(this.path, `${token}\n`);
-		return token;
+		return this.fs.withFileLock(`${this.path}.lock`, () => {
+			const existing = this.read();
+			if (existing) return existing;
+			const token = this.generate();
+			this.fs.writeSecretFileSync(this.path, `${token}\n`);
+			return token;
+		});
 	}
 	getPath() {
 		return this.path;
@@ -1586,97 +1878,6 @@ var MemoryFunnelEventLog = class extends FunnelEventLog {
 	close() {}
 };
 //#endregion
-//#region lib/engine/diagnostic-log/diagnostic-log.ts
-/**
-* Points in the listener's connection lifecycle. The single source of truth
-* for the value set: the `status` column schema, the `ConnectorConnectionStatus`
-* union, and the runtime Set used to narrow on read-back all derive from this
-* array, so adding a status is a one-line change that cannot drift out of sync.
-*
-*   started       start() was called
-*   connected     the socket opened and events can flow
-*   disconnected  the socket was closed by a stop() call (a clean teardown)
-*   auth-failed   the token was rejected before the socket opened
-*   stopped       the listener was fully torn down (always follows a stop(),
-*                 paired with the disconnected/error that preceded it)
-*   error         start/stop threw, or Bolt surfaced an error frame — this is
-*                 also where an unsolicited socket drop shows up when Bolt
-*                 reports it (an `error` with no following `stopped` means the
-*                 supervisor recycled the listener, not a clean stop)
-*
-* A connection row is independent of any single inbound event, so it carries
-* no `eventId`. This is how "no notification arrived because the listener
-* never connected (or dropped, or failed auth)" becomes visible: the
-* raw/processed tables only hold events that *did* arrive.
-*/
-const CONNECTOR_CONNECTION_STATUSES = [
-	"started",
-	"connected",
-	"disconnected",
-	"auth-failed",
-	"stopped",
-	"error"
-];
-/**
-* Rows stored in the diagnostic tables. Connector-agnostic on purpose: `type`
-* carries the listener kind ("slack" | "discord" | "gh" | "schedule") so new
-* connectors land in the same tables without a schema change. `event_id` is
-* the correlation key the listener mints once per inbound event and stamps
-* onto both the raw and processed rows, so the two are joinable even though
-* they live in separate tables with independent `seq` counters.
-*
-* These schemas mirror the stored shape (snake_case columns) the way
-* `FunnelEvent` does for the replay log; they exist for `z.infer` and to
-* document the column set, not as a parse boundary.
-*/
-const connectorRawEventSchema = z.object({
-	event_id: z.string(),
-	type: z.string(),
-	connector_id: z.string().nullable(),
-	channel_id: z.string().nullable(),
-	payload: z.string()
-});
-const connectorProcessedEventSchema = z.object({
-	event_id: z.string(),
-	type: z.string(),
-	connector_id: z.string().nullable(),
-	channel_id: z.string().nullable(),
-	outcome: z.string(),
-	payload: z.string()
-});
-const connectorConnectionEventSchema = z.object({
-	type: z.string(),
-	connector_id: z.string().nullable(),
-	channel_id: z.string().nullable(),
-	status: z.enum(CONNECTOR_CONNECTION_STATUSES),
-	detail: z.string()
-});
-/**
-* Three-table diagnostic log of everything a connector listener does, so
-* "why was there no notification?" is answerable whichever way it failed:
-*   - `raw` — every inbound event, before any filtering, with the listener's
-*     untouched payload (the Slack Bolt event, the GH webhook, …)
-*   - `processed` — the verdict for that event: `outcome` (emitted, or the
-*     reason it was dropped) and, when emitted, the body that was delivered.
-*     Shares an `eventId` with its raw row, so the two join into one story.
-*   - `connection` — the listener's lifecycle (started, connected, dropped,
-*     auth-failed, stopped, errored). This is the half the event tables can't
-*     show: an event that never arrived leaves no raw row, but a listener that
-*     never connected leaves a `connection` trail that says so.
-*
-* The three are physically separate (independent retention and payload-size
-* policy) so a query never crosses them by accident and a huge raw payload
-* never bloats the verdict or lifecycle trails. None flow to WS clients or the
-* MCP channel — this is a separate store from `FunnelEventLog` (replay) and
-* exists solely for debugging.
-*
-* Implementations:
-*   - `SqliteConnectorDiagnosticLog` — the default; survives daemon restarts,
-*     bounded by per-table row/age caps.
-*   - `MemoryConnectorDiagnosticLog` — an in-process double for tests.
-*/
-var ConnectorDiagnosticLog = class {};
-//#endregion
 //#region lib/engine/diagnostic-log/sqlite-diagnostic-log.ts
 /**
 * Cap on a raw payload kept verbatim. The point of the raw table is to see
@@ -1933,81 +2134,4 @@ const headFields = (payload) => {
 	}
 };
 //#endregion
-//#region lib/engine/diagnostic-log/memory-diagnostic-log.ts
-/**
-* In-process `ConnectorDiagnosticLog` backed by one array per table. Used by tests
-* and embedders that do not need durability. Like the SQLite log it keeps
-* `seq` per-table (each array's 1-based position) and returns the most recent
-* `limit` rows oldest-first; unlike it, it never prunes and never offloads
-* oversized payloads — it keeps whatever the caller hands it, which is fine
-* for the bounded volumes a test produces. Payload-validity is therefore a
-* SQLite-only guarantee; do not write a test that leans on this double
-* rejecting a malformed payload.
-*/
-var MemoryConnectorDiagnosticLog = class extends ConnectorDiagnosticLog {
-	raws = [];
-	processeds = [];
-	connections = [];
-	constructor(now = () => Date.now()) {
-		super();
-		this.now = now;
-		Object.freeze(this);
-	}
-	recordRaw(record) {
-		this.raws.push({
-			...record,
-			seq: this.raws.length + 1,
-			ts: this.now()
-		});
-	}
-	recordProcessed(record) {
-		this.processeds.push({
-			...record,
-			seq: this.processeds.length + 1,
-			ts: this.now()
-		});
-	}
-	recordConnection(record) {
-		this.connections.push({
-			...record,
-			seq: this.connections.length + 1,
-			ts: this.now()
-		});
-	}
-	queryRaw(query) {
-		return takeRecent(this.raws.filter((event) => matches(event, query)), query.limit);
-	}
-	queryProcessed(query) {
-		return takeRecent(this.processeds.filter((event) => {
-			if (!matches(event, query)) return false;
-			if (query.outcome !== void 0 && event.outcome !== query.outcome) return false;
-			return true;
-		}), query.limit);
-	}
-	queryConnection(query) {
-		return takeRecent(this.connections.filter((event) => {
-			if (!matches(event, query)) return false;
-			if (query.status !== void 0 && event.status !== query.status) return false;
-			return true;
-		}), query.limit);
-	}
-	clear() {
-		this.raws.length = 0;
-		this.processeds.length = 0;
-		this.connections.length = 0;
-	}
-	close() {}
-};
-const matches = (event, query) => {
-	if (query.type !== void 0 && event.type !== query.type) return false;
-	if (query.connectorId !== void 0 && event.connectorId !== query.connectorId) return false;
-	if (query.channelId !== void 0 && event.channelId !== query.channelId) return false;
-	return true;
-};
-const takeRecent = (events, limit) => {
-	if (limit === void 0) return events;
-	if (limit <= 0) return [];
-	return events.slice(-limit);
-};
-//#endregion
-export { funnelTmpDir as C, publishResponseSchema as S, funnelEventSchema as _, connectorConnectionEventSchema as a, FunnelChannelPublisher as b, MemoryFunnelEventLog as c, DEFAULT_GATEWAY_TOKEN_PATH as d, FunnelGatewayToken as f, FunnelEventLog as g, SqliteFunnelEventLog as h, ConnectorDiagnosticLog as i, channelWsProtocols as l, FunnelListenerSupervisor as m, SqliteConnectorDiagnosticLog as n, connectorProcessedEventSchema as o, FunnelGatewayServer as p, CONNECTOR_CONNECTION_STATUSES as r, connectorRawEventSchema as s, MemoryConnectorDiagnosticLog as t, channelWsUrl as u, FunnelBroadcaster as v, publishRequestSchema as x, requireBearerToken as y };
+export { funnelTmpDir as C, connectorRawEventSchema as S, MemoryConnectorDiagnosticLog as _, DEFAULT_GATEWAY_TOKEN_PATH as a, connectorConnectionEventSchema as b, FunnelListenerRegistry as c, funnelEventSchema as d, FunnelBroadcaster as f, publishResponseSchema as g, publishRequestSchema as h, channelWsUrl as i, SqliteFunnelEventLog as l, FunnelChannelPublisher as m, MemoryFunnelEventLog as n, FunnelGatewayToken as o, requireBearerToken as p, channelWsProtocols as r, FunnelGatewayServer as s, SqliteConnectorDiagnosticLog as t, FunnelEventLog as u, CONNECTOR_CONNECTION_STATUSES as v, connectorProcessedEventSchema as x, ConnectorDiagnosticLog as y };