@jungjaehoon/mama-os 0.76.0 → 0.78.0

package/dist/cli/commands/daemon.js

@@ -1,13 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OWNER_PRINCIPAL_ID = void 0;
+exports.MESSENGER_SECRETS = exports.BOOT_STAGES = exports.StopDuringBootError = exports.OWNER_PRINCIPAL_ID = void 0;
+exports.pathsOverlap = pathsOverlap;
 exports.validateDeliveryRoutes = validateDeliveryRoutes;
+exports.pathsFor = pathsFor;
 exports.ensureDaemonIsolation = ensureDaemonIsolation;
 exports.loggedOwnerIntake = loggedOwnerIntake;
 exports.bootDaemon = bootDaemon;
 exports.runDaemon = runDaemon;
-exports.daemonStatus = daemonStatus;
-exports.requestDaemonStop = requestDaemonStop;
+exports.installControlPaths = installControlPaths;
+exports.askDaemon = askDaemon;
+exports.launchdService = launchdService;
+exports.bootoutLaunchdService = bootoutLaunchdService;
 const mama_core_1 = require("@jungjaehoon/mama-core");
 const document_toolkit_js_1 = require("../../tools/document-toolkit.js");
 const node_fs_1 = require("node:fs");
@@ -24,6 +28,7 @@ const action_surface_js_1 = require("../../runtime/action-surface.js");
 const connectors_js_1 = require("../../runtime/connectors.js");
 const config_js_1 = require("../../runtime/config.js");
 const model_cache_js_1 = require("../../runtime/model-cache.js");
+const backend_security_js_1 = require("../../runtime/backend-security.js");
 const session_credential_js_1 = require("../../runtime/session-credential.js");
 const action_mcp_config_js_1 = require("../runtime/action-mcp-config.js");
 const index_js_1 = require("../../connectors/index.js");
@@ -38,6 +43,7 @@ const wiki_read_js_1 = require("../../wiki/wiki-read.js");
 const timezone_js_1 = require("../../runtime/timezone.js");
 const security_events_js_1 = require("../../api/security-events.js");
 const egress_proxy_js_1 = require("../../runtime/egress-proxy.js");
+const daemon_control_js_1 = require("../runtime/daemon-control.js");
 exports.OWNER_PRINCIPAL_ID = 'owner';
 const OWNER_AGENT_ID = 'owner-agent';
 const OWNER_MEMORY_SCOPES = (0, action_surface_js_1.ownerMemoryScopes)(exports.OWNER_PRINCIPAL_ID, index_js_1.LOADABLE_CONNECTORS);
@@ -55,9 +61,49 @@ function errorName(error) {
     const name = error.name.trim() !== '' ? error.name : 'Error';
     return `${name}: ${error.message}`;
 }
-function stage(logger, name) {
+class StopDuringBootError extends Error {
+    constructor() {
+        super('Stopped during boot');
+        this.name = 'StopDuringBootError';
+    }
+}
+exports.StopDuringBootError = StopDuringBootError;
+/** Every stage boot logs as `boot stage=<name>`; `mama doctor` reports only these names. */
+exports.BOOT_STAGES = [
+    'config',
+    'isolation',
+    'owner_runtime',
+    'viewer',
+    'replay',
+    'connectors',
+    'messengers',
+    'telegram',
+    'telegram:disabled',
+    'discord',
+    'slack',
+    'report_scheduler',
+    'report_scheduler:route_unavailable',
+    'personal_job_scheduler',
+];
+function stage(logger, name, signal) {
+    if (signal?.aborted)
+        throw new StopDuringBootError();
     logger.info(`boot stage=${name}`);
 }
+/** The auth.env names each messenger needs before it starts; `mama doctor` checks the same. */
+exports.MESSENGER_SECRETS = {
+    telegram: ['MAMA_TELEGRAM_TOKEN'],
+    discord: ['MAMA_DISCORD_TOKEN'],
+    slack: ['MAMA_SLACK_TOKEN', 'MAMA_SLACK_APP_TOKEN'],
+};
+function messengerSecrets(messenger) {
+    return exports.MESSENGER_SECRETS[messenger].map((name) => {
+        const value = process.env[name];
+        if (!value?.trim())
+            throw new Error(`${name} is required`);
+        return value;
+    });
+}
 function stageFailed(logger, name, error) {
     logger.error(`boot stage=${name} failed error=${errorName(error)}`);
 }
@@ -70,9 +116,10 @@ function stimulusFailed(logger, kind, id, error, modelRunId = null) {
 function stimulusDelivered(logger, row, modelRunId) {
     logger.info(`stimulus delivered kind=${row.kind ?? 'unknown'} id=${row.stimulusId} model_run_id=${modelRunId}`);
 }
+/** Physical paths: a symlinked workspace must not reach the directories it is kept apart from. */
 function pathsOverlap(left, right) {
     const inside = (parent, child) => {
-        const local = (0, node_path_1.relative)((0, node_path_1.resolve)(parent), (0, node_path_1.resolve)(child));
+        const local = (0, node_path_1.relative)((0, backend_security_js_1.physicalReadPath)(parent), (0, backend_security_js_1.physicalReadPath)(child));
         return local === '' || (local !== '..' && !local.startsWith(`..${node_path_1.sep}`) && !(0, node_path_1.isAbsolute)(local));
     };
     return inside(left, right) || inside(right, left);
@@ -122,6 +169,16 @@ function pathsFor(configPath, config) {
     if (pathsOverlap(workspaceDir, connectorsRoot)) {
         throw new Error(`agent.codex_cwd must not contain or sit inside ${connectorsRoot}`);
     }
+    // The runtime directory holds the session credential and the running turn's web fetch mode;
+    // an agent that could write there could open web fetch for a turn with no person in it.
+    if (pathsOverlap(workspaceDir, runtimeRoot)) {
+        throw new Error(`agent.codex_cwd must not contain or sit inside ${runtimeRoot}`);
+    }
+    // Backups are denied to the agents; a workspace there could not be read by its own agent.
+    const backupsRoot = (0, node_path_1.join)(mamaRoot, 'backups');
+    if (pathsOverlap(workspaceDir, backupsRoot)) {
+        throw new Error(`agent.codex_cwd must not contain or sit inside ${backupsRoot}`);
+    }
     return {
         mamaRoot,
         runtimeRoot,
@@ -189,7 +246,15 @@ async function stopOne(logger, name, stop, errors) {
 }
 /** Open the W1 owner subject, then activate producers in their dependency order. */
 async function bootDaemon(options = {}) {
-    const logger = options.logger ?? defaultLogger;
+    const baseLogger = options.logger ?? defaultLogger;
+    let lastError = null;
+    const logger = {
+        info: (line) => baseLogger.info(line),
+        error: (line) => {
+            lastError = { at: Date.now(), line: line.slice(0, 500) };
+            baseLogger.error(line);
+        },
+    };
     const dependencies = options.dependencies ?? {};
     const configPath = options.configPath ?? (0, config_js_1.defaultConfigPath)(options.home ?? (0, node_os_1.homedir)());
     let config;
@@ -206,10 +271,49 @@ async function bootDaemon(options = {}) {
     let deliveryReady = options.mode === 'replay';
     const startedAt = Date.now();
     let currentStage = 'config';
-    const stopResources = async () => {
+    let booted = false;
+    const command = options.command ?? (options.mode === 'replay' ? 'replay' : 'daemon');
+    // The install's one process: taken before anything opens the database or rewrites settings.
+    const control = (0, daemon_control_js_1.daemonControlPaths)((0, node_path_1.dirname)(configPath));
+    const lock = (0, daemon_control_js_1.acquireInstallLock)(control, command);
+    let controlServer = null;
+    const statusReport = async () => {
+        const report = {
+            pid: process.pid,
+            command,
+            version: (0, package_version_js_1.resolvePackageVersion)(),
+            startedAt,
+            stage: stopped ? 'stopping' : booted ? 'running' : currentStage,
+            lastError,
+        };
+        // Stores close during a stop; what it reports then is that it is stopping.
         if (stopped)
-            return;
-        stopped = true;
+            return report;
+        if (owner) {
+            const adapter = owner.database.adapter;
+            report.runningTurns = adapter
+                .prepare(`SELECT COALESCE(json_extract(input_refs_json, '$.sessionKey'), 'unknown') AS session,
+                  COUNT(*) AS count
+             FROM model_runs WHERE status = 'running' AND created_at >= ? GROUP BY 1 ORDER BY 1`)
+                .all(startedAt);
+            report.inputs = adapter
+                .prepare(`SELECT status, COUNT(*) AS count FROM mailbox_inputs
+            WHERE status IN ('pending', 'claimed') GROUP BY status ORDER BY status`)
+                .all();
+        }
+        if (connectors) {
+            const connectorRuntime = connectors;
+            const health = await connectorRuntime.registry.healthCheckAll();
+            report.connectors = connectorRuntime.enabledConnectorNames.map((name) => ({
+                name,
+                healthy: health[name]?.healthy === true,
+                lastPoll: health[name]?.lastPollTime?.toISOString() ?? null,
+                error: health[name]?.error ?? null,
+            }));
+        }
+        return report;
+    };
+    const stopOwned = async () => {
         const errors = [];
         owner?.beginStop?.();
         // Quiesce every producer before awaiting any one of them. Transports and the database
@@ -236,22 +340,50 @@ async function bootDaemon(options = {}) {
         if (errors.length > 0)
             throw new AggregateError(errors, 'Daemon shutdown failed');
     };
+    const stopResources = async () => {
+        if (stopped)
+            return;
+        stopped = true;
+        let closed = false;
+        try {
+            await stopOwned();
+            closed = true;
+        }
+        finally {
+            if (controlServer) {
+                await controlServer
+                    .close()
+                    .catch((error) => logger.error(`shutdown stage=control failed error=${errorName(error)}`));
+            }
+            // Released only once every store closed: after a failed stop something may still run, so
+            // the install stays held until this process ends and the operating system lets it go.
+            if (closed)
+                lock.release();
+        }
+    };
     try {
         currentStage = 'config';
-        stage(logger, 'config');
+        // A half-switched install is neither the old one nor the restored one.
+        (0, daemon_control_js_1.refuseWhileRestoring)((0, node_path_1.dirname)(configPath));
+        controlServer = await (0, daemon_control_js_1.startDaemonControl)(control, {
+            status: statusReport,
+            stop: () => {
+                if (!options.requestStop)
+                    throw new Error(`${command} stops when it finishes`);
+                options.requestStop();
+            },
+        });
+        if (options.signal?.aborted)
+            throw new StopDuringBootError();
         config = options.config ?? (0, config_js_1.loadConfig)({ path: configPath, home: options.home });
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(config.logging.file), { recursive: true });
+        // The service manager redirects only what comes before this point, to the crash log. From here
+        // on the daemon's own log holds everything, from the first boot stage on.
+        options.captureOutput?.(config.logging.file);
+        stage(logger, 'config', options.signal);
         logger.info(`document toolkit: ${(0, document_toolkit_js_1.readDocumentToolkit)(config.tools_root, (error) => logger.error(error.message)) ? 'present' : 'absent (run mama tools install)'}`);
         const timeZone = (0, timezone_js_1.createTimeZoneSetting)(config.timezone);
         validateDeliveryRoutes(config);
-        // launchd may have created the redirected log already; preserve its contents and tighten it.
-        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(config.logging.file), { recursive: true });
-        const logDescriptor = (0, node_fs_1.openSync)(config.logging.file, 'a', 0o600);
-        try {
-            (0, node_fs_1.fchmodSync)(logDescriptor, 0o600);
-        }
-        finally {
-            (0, node_fs_1.closeSync)(logDescriptor);
-        }
         (0, model_cache_js_1.declareModelCache)();
         paths = pathsFor(configPath, config);
         currentStage = 'isolation';
@@ -261,7 +393,7 @@ async function bootDaemon(options = {}) {
             paths,
             ...(options.mcpServerPath ? { mcpServerPath: options.mcpServerPath } : {}),
         });
-        stage(logger, 'isolation');
+        stage(logger, 'isolation', options.signal);
         currentStage = 'owner_runtime';
         const ownerPolicyProvider = (0, owner_policy_js_1.createOwnerPolicyProvider)(paths.mamaRoot);
         const ownerPolicy = ownerPolicyProvider();
@@ -381,6 +513,7 @@ async function bootDaemon(options = {}) {
             connectors: index_js_1.LOADABLE_CONNECTORS,
             rawPath: paths.connectorsRoot,
             effort: config.agent.effort,
+            autonomousWebFetch: config.agent.autonomous_web_fetch ?? [],
             maxTurns: config.agent.max_turns,
             timeout: config.agent.timeout,
             maxTurnMs: config.agent.max_turn_ms,
@@ -486,7 +619,7 @@ async function bootDaemon(options = {}) {
             onStimulusDelivered: (row, modelRunId) => stimulusDelivered(logger, row, modelRunId),
             onStimulusFailed: (row, reason, modelRunId) => stimulusFailed(logger, row.kind ?? 'unknown', row.stimulusId, reason, modelRunId),
         });
-        stage(logger, 'owner_runtime');
+        stage(logger, 'owner_runtime', options.signal);
         currentStage = 'viewer';
         const viewerFactory = dependencies.createViewerServer ?? viewer_server_js_1.createViewerServer;
         viewer = viewerFactory({
@@ -537,14 +670,14 @@ async function bootDaemon(options = {}) {
         });
         await viewer.start();
         logger.info(`viewer server listening on port=${String(viewer.port)}`);
-        stage(logger, 'viewer');
+        stage(logger, 'viewer', options.signal);
         if (options.mode === 'replay') {
             logger.info('replay collectors: disabled');
             currentStage = 'replay';
             if (!options.replay)
                 throw new Error('Replay mode requires a replay feeder');
             await options.replay({ config, paths, owner, logger, timeZone });
-            stage(logger, 'replay');
+            stage(logger, 'replay', options.signal);
             return {
                 config,
                 paths,
@@ -581,16 +714,14 @@ async function bootDaemon(options = {}) {
             coreAdapter: owner.database?.adapter,
             acceptSourceDelta,
         });
-        stage(logger, 'connectors');
+        stage(logger, 'connectors', options.signal);
         currentStage = 'messengers';
         const intake = loggedOwnerIntake(owner.intake, logger);
         const ledgerPath = paths.ownerMessageLedgerPath;
         messageLedger = new telegram_message_ledger_js_1.OwnerMessageLedger(ledgerPath, { log: (line) => logger.info(line) });
         const filesRoot = (0, node_path_1.join)(paths.workspaceDir, 'files');
         if (config.telegram.enabled) {
-            const token = process.env.MAMA_TELEGRAM_TOKEN;
-            if (!token?.trim())
-                throw new Error('MAMA_TELEGRAM_TOKEN is required');
+            const [token] = messengerSecrets('telegram');
             const factory = dependencies.createTelegramGateway ?? ((options) => new telegram_js_1.TelegramGateway(options));
             gateway = factory({
                 token,
@@ -625,14 +756,12 @@ async function bootDaemon(options = {}) {
             });
             gateways.set('telegram', gateway);
             await gateway.start();
-            stage(logger, 'telegram');
+            stage(logger, 'telegram', options.signal);
         }
         else
-            stage(logger, 'telegram:disabled');
+            stage(logger, 'telegram:disabled', options.signal);
         if (config.discord?.enabled) {
-            const token = process.env.MAMA_DISCORD_TOKEN;
-            if (!token?.trim())
-                throw new Error('MAMA_DISCORD_TOKEN is required');
+            const [token] = messengerSecrets('discord');
             const factory = dependencies.createDiscordGateway ?? ((options) => new discord_js_1.DiscordGateway(options));
             const active = factory({
                 token,
@@ -654,15 +783,10 @@ async function bootDaemon(options = {}) {
             });
             gateways.set('discord', active);
             await active.start();
-            stage(logger, 'discord');
+            stage(logger, 'discord', options.signal);
         }
         if (config.slack?.enabled) {
-            const token = process.env.MAMA_SLACK_TOKEN;
-            const appToken = process.env.MAMA_SLACK_APP_TOKEN;
-            if (!token?.trim())
-                throw new Error('MAMA_SLACK_TOKEN is required');
-            if (!appToken?.trim())
-                throw new Error('MAMA_SLACK_APP_TOKEN is required');
+            const [token, appToken] = messengerSecrets('slack');
             const factory = dependencies.createSlackGateway ?? ((options) => new slack_js_1.SlackGateway(options));
             const active = factory({
                 token,
@@ -685,7 +809,7 @@ async function bootDaemon(options = {}) {
             });
             gateways.set('slack', active);
             await active.start();
-            stage(logger, 'slack');
+            stage(logger, 'slack', options.signal);
         }
         const reportRoute = config.delivery?.reports ?? 'telegram';
         if (gateways.has(reportRoute)) {
@@ -716,18 +840,19 @@ async function bootDaemon(options = {}) {
                 onError: (error) => logger.error(`report scheduler failed reason=${(0, stimulus_delivery_js_1.stimulusFailureReason)(error)}`),
             });
             reportScheduler.start();
-            stage(logger, 'report_scheduler');
+            stage(logger, 'report_scheduler', options.signal);
         }
         else
-            stage(logger, 'report_scheduler:route_unavailable');
+            stage(logger, 'report_scheduler:route_unavailable', options.signal);
         if (gateway?.sendMemberText) {
             owner.personalJobs.start();
             await owner.personalJobs
                 .tick()
                 .catch((error) => logger.error(`personal job scheduler failed reason=${(0, stimulus_delivery_js_1.stimulusFailureReason)(error)}`));
-            stage(logger, 'personal_job_scheduler');
+            stage(logger, 'personal_job_scheduler', options.signal);
         }
         deliveryReady = true;
+        booted = true;
         return {
             config,
             paths,
@@ -740,7 +865,16 @@ async function bootDaemon(options = {}) {
         };
     }
     catch (error) {
-        stageFailed(logger, currentStage, error);
+        if (error instanceof StopDuringBootError) {
+            logger.info(`boot stopped before stage=${currentStage}`);
+        }
+        else {
+            stageFailed(logger, currentStage, error);
+            // A frozen error keeps its own shape; the stage is still in the log line above.
+            if (error !== null && typeof error === 'object' && Object.isExtensible(error)) {
+                Object.defineProperty(error, 'bootStage', { value: currentStage, enumerable: false });
+            }
+        }
         try {
             await stopResources();
         }
@@ -750,48 +884,92 @@ async function bootDaemon(options = {}) {
         throw error;
     }
 }
-/** Foreground launchd entry: wait until SIGTERM/SIGINT, then close reverse-order stages. */
+/**
+ * Foreground entry for launchd, systemd, Docker or a terminal. Signals are taken before boot, so a
+ * stop during boot unwinds what has started; `mama stop` asks through the control socket.
+ */
 async function runDaemon(options = {}) {
-    const daemon = await bootDaemon(options);
-    await new Promise((resolve, reject) => {
-        let finished = false;
-        const finish = async () => {
-            if (finished)
+    const controller = new AbortController();
+    // A stop asked for through `mama stop` exits 0; one by a signal exits 128 + its number, as an
+    // unhandled signal would, so a service that restarts only after a failure brings back a daemon
+    // that was killed (a service manager's own stop does not restart it whatever the code).
+    let signalExit;
+    const requestStop = () => controller.abort();
+    const onSigterm = () => {
+        signalExit = 143;
+        controller.abort();
+    };
+    const onSigint = () => {
+        signalExit = 130;
+        controller.abort();
+    };
+    // Once each: a second signal falls to Node's default and ends the process at once, a force stop;
+    // the operating system releases the install lock with it.
+    process.once('SIGTERM', onSigterm);
+    process.once('SIGINT', onSigint);
+    try {
+        let daemon;
+        try {
+            daemon = await bootDaemon({ ...options, signal: controller.signal, requestStop });
+        }
+        catch (error) {
+            if (error instanceof StopDuringBootError) {
+                if (signalExit !== undefined)
+                    process.exitCode = signalExit;
                 return;
-            finished = true;
-            try {
-                await daemon.stop();
-                resolve();
-            }
-            catch (error) {
-                reject(error);
             }
-        };
-        process.once('SIGTERM', () => void finish());
-        process.once('SIGINT', () => void finish());
-    });
+            throw error;
+        }
+        if (!controller.signal.aborted) {
+            await new Promise((resolve) => controller.signal.addEventListener('abort', () => resolve(), { once: true }));
+        }
+        await daemon.stop();
+        if (signalExit !== undefined)
+            process.exitCode = signalExit;
+    }
+    finally {
+        process.off('SIGTERM', onSigterm);
+        process.off('SIGINT', onSigint);
+    }
+}
+/** The install's control paths from its config path, as boot derives them. */
+function installControlPaths(options = {}) {
+    const configPath = options.configPath ?? (0, config_js_1.defaultConfigPath)(options.home ?? (0, node_os_1.homedir)());
+    return (0, daemon_control_js_1.daemonControlPaths)((0, node_path_1.dirname)(configPath));
+}
+async function askDaemon(op, options = {}) {
+    return await (0, daemon_control_js_1.requestDaemonControl)(installControlPaths(options), op);
 }
-function launchdService(command) {
-    const result = (0, node_child_process_1.spawnSync)('launchctl', [command, `gui/${process.getuid()}/com.mama.server`], {
+/** macOS only: this user's LaunchAgent (`launchctl print` exits 113 when it is not loaded). */
+function launchdService() {
+    if (process.platform !== 'darwin')
+        return { loaded: false, pid: null };
+    const result = (0, node_child_process_1.spawnSync)('launchctl', ['print', `gui/${process.getuid()}/com.mama.server`], {
         encoding: 'utf8',
     });
     if (result.error)
         throw result.error;
-    // launchctl print exits 113 when this user's service is not registered.
-    if (result.status !== 0 && !(command === 'print' && result.status === 113)) {
-        throw Object.assign(new Error(`launchctl ${command} failed`), {
+    if (result.status === 113)
+        return { loaded: false, pid: null };
+    if (result.status !== 0) {
+        throw Object.assign(new Error('launchctl print failed'), {
             code: `LAUNCHCTL_${result.status ?? result.signal ?? 'UNKNOWN'}`,
         });
     }
-    return result;
+    const pid = /^\s*pid = (\d+)\s*$/m.exec(result.stdout)?.[1];
+    return { loaded: true, pid: pid === undefined ? null : Number(pid) };
 }
-function daemonStatus() {
-    const result = launchdService('print');
-    return result.status === 0 && /^\s*state = running\s*$/m.test(result.stdout)
-        ? 'running'
-        : 'stopped';
-}
-function requestDaemonStop() {
-    launchdService('bootout');
+/** Unload the LaunchAgent so KeepAlive cannot restart it; launchd sends the stop signal. */
+function bootoutLaunchdService() {
+    const result = (0, node_child_process_1.spawnSync)('launchctl', ['bootout', `gui/${process.getuid()}/com.mama.server`], {
+        encoding: 'utf8',
+    });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        throw Object.assign(new Error('launchctl bootout failed'), {
+            code: `LAUNCHCTL_${result.status ?? result.signal ?? 'UNKNOWN'}`,
+        });
+    }
 }
 //# sourceMappingURL=daemon.js.map