@murmurv2/cli 2.11.0

package/runtime/scripts/daemon-observation.mjs

@@ -0,0 +1,48 @@
+import path from "node:path";
+import { realpath } from "node:fs/promises";
+import { writePrivateJson } from "./secure-state.mjs";
+
+/** Non-secret, PID/store-bound liveness evidence for the read-only setup CLI. */
+export function createDaemonObservation({ dataDir, storePath, agentId, wake, log = () => {} }) {
+  const startedAt = new Date().toISOString();
+  const snapshot = { schema: "murmur.runtime/1", agentId, pid: process.pid, startedAt,
+    storePath: null, measuredAt: null, wake: { ...wake, lastFault: null, lastFaultAt: null },
+    broker: { state: "unknown", connectedAt: null, lastError: null, lastErrorAt: null } };
+  let writing = false;
+  let timer;
+  const write = async () => {
+    if (writing) return;
+    writing = true;
+    try {
+      snapshot.storePath = await realpath(storePath);
+      snapshot.measuredAt = new Date().toISOString();
+      await writePrivateJson(path.join(dataDir, "daemon-observation.json"), snapshot);
+    } catch { log("warn", "Daemon observation write failed", { reason: "runtime.observation-write-failed" }); }
+    finally { writing = false; }
+  };
+  return {
+    async start() { await write(); timer = setInterval(() => { void write(); }, 5000); timer.unref(); },
+    async connected() { snapshot.broker.state = "connected"; snapshot.broker.connectedAt = new Date().toISOString(); await write(); },
+    onStatus(event) {
+      if (event.type === "disconnect") {
+        snapshot.broker.state = "disconnected";
+        snapshot.broker.lastError = "broker.disconnected";
+        snapshot.broker.lastErrorAt = new Date().toISOString();
+      } else if (event.type === "reconnect") {
+        snapshot.broker.state = "connected";
+        snapshot.broker.connectedAt = new Date().toISOString();
+      }
+      void write();
+    },
+    observeLog(level, message, data) {
+      // Preserve a monitor crash even when SQLite could not record the failed wake.
+      // Never persist hook commands, stdout, message text or arbitrary error strings.
+      if ((level === "error" || level === "fatal") && message.startsWith("WakeMonitor")) {
+        snapshot.wake.lastFault = data?.error === "database is locked" ? "wake.database-locked" : "wake.runtime-fault";
+        snapshot.wake.lastFaultAt = new Date().toISOString();
+        return write();
+      }
+    },
+    stop() { if (timer) clearInterval(timer); },
+  };
+}

package/runtime/scripts/doctor-protocol.mjs

@@ -0,0 +1,96 @@
+// Machine-only roundtrip protocol. Call only after peer signature verification,
+// decryption and channel authorization. This proves transport, never AI wake.
+import { createHash } from "node:crypto";
+import { resolveMessageSubject, stableEnvelopePayload } from "@murmurv2/core";
+import { decryptPayload, encryptPayload, signEnvelope } from "@murmurv2/security";
+
+const PREFIX = "murmur:doctor:";
+const CONVERSATION = /^murmur:doctor:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const REQUEST = /^Murmur diagnostic roundtrip\. Reply in this same conversation with exactly this line: MURMUR-DOCTOR-REPLY ([0-9a-f]{48})$/;
+const REPLY = /^MURMUR-DOCTOR-REPLY ([0-9a-f]{48})$/;
+const WINDOW_MS = 60_000;
+
+export function classifyVerifiedDoctorMessage(config, envelope, text, now = Date.now()) {
+  if (!envelope.conversationId.startsWith(PREFIX)) return null;
+  const invalid = { kind: "ignored" };
+  const peer = config.peers[envelope.senderAgentId];
+  const at = Date.parse(envelope.createdAt);
+  if (!peer || envelope.senderAgentId === config.agentId
+      || !CONVERSATION.test(envelope.conversationId) || envelope.conversationId.includes("\n")
+      || envelope.recipients.length !== 1 || envelope.recipients[0] !== config.agentId
+      || !Number.isFinite(at) || at < now - WINDOW_MS || at > now + 5000
+      || envelope.channelId !== peer.channelId
+      || envelope.senderMemberId !== peer.memberId
+      || envelope.addresseeMemberId !== config.memberId) return invalid;
+  const request = REQUEST.exec(text);
+  if (request?.[0] === text) return { kind: "request", nonce: request[1] };
+  const reply = REPLY.exec(text);
+  return reply?.[0] === text ? { kind: "reply" } : invalid;
+}
+
+export function doctorReplyId(agentId, envelope) {
+  const hex = createHash("sha256").update(JSON.stringify([
+    "murmur-doctor-reply/1", agentId, envelope.senderAgentId, envelope.msgId,
+  ])).digest("hex");
+  // Stable UUID: a redelivery after a crash can finish enqueueing, but cannot
+  // resurrect a settled reply or create another message.
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-8${hex.slice(13, 16)}-a${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
+}
+
+export function createDoctorResponder({ config, outbox, messages, now = Date.now }) {
+  let recent = [];
+  const inFlight = new Map();
+  const reply = async (request, nonce) => {
+    const msgId = doctorReplyId(config.agentId, request);
+    const existing = await outbox.getOutboxRecord(msgId);
+    let envelope = existing?.envelope;
+    const text = `MURMUR-DOCTOR-REPLY ${nonce}`;
+    const peer = config.peers[request.senderAgentId];
+    if (envelope) {
+      const storedText = await decryptPayload({ ciphertext: envelope.payloadCiphertext,
+        nonce: envelope.payloadNonce, senderPublicKey: peer.encryption.publicKey }, config.keys.encryption.privateKey);
+      if (envelope.conversationId !== request.conversationId || storedText !== text) {
+        throw new Error("doctor.request-conflict");
+      }
+    }
+    if (!envelope) {
+      const at = now();
+      recent = recent.filter(entry => entry.at > at - WINDOW_MS);
+      // At most 60 retained entries: no unbounded peer map. Diagnostic floods
+      // from a configured peer cannot create unbounded response work.
+      if (recent.length >= 60 || recent.filter(entry => entry.peer === request.senderAgentId).length >= 6) {
+        return { state: "rate-limited" };
+      }
+      recent.push({ at, peer: request.senderAgentId });
+      const encrypted = await encryptPayload(text, peer.encryption.publicKey, config.keys.encryption.privateKey);
+      envelope = {
+        schemaVersion: "1.0", msgId, conversationId: request.conversationId,
+        senderAgentId: config.agentId, recipients: [request.senderAgentId], createdAt: new Date(at).toISOString(),
+        payloadCiphertext: encrypted.ciphertext, payloadNonce: encrypted.nonce, signature: "",
+        ...(peer.channelId ? { channelId: peer.channelId } : {}),
+        ...(config.memberId ? { senderMemberId: config.memberId } : {}),
+        ...(peer.memberId ? { addresseeMemberId: peer.memberId } : {}),
+      };
+      envelope.signature = await signEnvelope(stableEnvelopePayload(envelope), config.keys.signing.privateKey);
+      await outbox.enqueue(resolveMessageSubject(peer, peer.channelId), envelope);
+    }
+    // Repair the history half if a crash followed the durable outbox enqueue.
+    await messages.append({
+      msgId, conversationId: envelope.conversationId, direction: "outbound", sender: config.agentId,
+      text, createdAt: envelope.createdAt, transport: "nats", channelId: envelope.channelId,
+      senderMemberId: envelope.senderMemberId, addresseeMemberId: envelope.addresseeMemberId,
+    });
+    return { state: existing ? "already-queued" : "queued", msgId };
+  };
+  return {
+    respond(envelope, plaintext) {
+      const diagnostic = classifyVerifiedDoctorMessage(config, envelope, plaintext, now());
+      if (diagnostic?.kind !== "request") return Promise.resolve({ state: "ignored" });
+      const id = doctorReplyId(config.agentId, envelope);
+      if (inFlight.has(id)) return inFlight.get(id);
+      const pending = reply(envelope, diagnostic.nonce).finally(() => inFlight.delete(id));
+      inFlight.set(id, pending);
+      return pending;
+    },
+  };
+}

package/runtime/scripts/lease.mjs

@@ -0,0 +1,193 @@
+// Murmur Scoped Channels — session-ownership lease (spike #80, S0.2).
+// Atomic CAS claim + heartbeat + per-turn fencing token over a dedicated SQLite file
+// (separate WAL from local_messages, per review). Contract: packages/core/lease-schema.sql.
+// Cross-runtime sibling: a Python wrapper over the SAME SQL is built by codex coldstart (#83).
+import { DatabaseSync } from "node:sqlite";
+import { dirname } from "node:path";
+import { mkdirSync } from "node:fs";
+
+const DDL = `
+  PRAGMA journal_mode=WAL;
+  PRAGMA busy_timeout=10000;
+  CREATE TABLE IF NOT EXISTS channel_owner (
+    conversation_id   TEXT    NOT NULL,
+    member_slot       TEXT    NOT NULL,
+    owner_session_id  TEXT    NOT NULL,
+    token             INTEGER NOT NULL,
+    epoch             INTEGER NOT NULL,
+    heartbeat_at      INTEGER NOT NULL,
+    ttl_ms            INTEGER NOT NULL,
+    PRIMARY KEY (conversation_id, member_slot)
+  );
+  CREATE TABLE IF NOT EXISTS session_presence (
+    session_id    TEXT    PRIMARY KEY,
+    agent_id      TEXT    NOT NULL,
+    thread_id     TEXT,
+    pid           INTEGER,
+    mode          TEXT    NOT NULL,
+    heartbeat_at  INTEGER NOT NULL,
+    started_at    INTEGER NOT NULL
+  );
+  CREATE INDEX IF NOT EXISTS idx_session_presence_agent ON session_presence(agent_id, mode);
+`;
+
+// Single-statement atomic compare-and-swap. WHERE on DO UPDATE makes a live, non-stale
+// foreign owner a no-op (no RETURNING row) — that is the "skip" branch.
+// The optional `extraWhere` lets a real session preempt a low-priority fallback owner
+// (e.g. a foreground chat preempting a `native:` cold-wake owner) even when not stale.
+const buildClaimSql = (extraWhere) => `
+  INSERT INTO channel_owner
+    (conversation_id, member_slot, owner_session_id, token, epoch, heartbeat_at, ttl_ms)
+    VALUES (?, ?, ?, 1, 1, ?, ?)
+  ON CONFLICT(conversation_id, member_slot) DO UPDATE SET
+    owner_session_id = excluded.owner_session_id,
+    token            = channel_owner.token + 1,
+    epoch            = channel_owner.epoch + (CASE WHEN channel_owner.owner_session_id <> excluded.owner_session_id THEN 1 ELSE 0 END),
+    heartbeat_at     = excluded.heartbeat_at,
+    ttl_ms           = excluded.ttl_ms
+  WHERE channel_owner.owner_session_id = excluded.owner_session_id
+     OR (excluded.heartbeat_at - channel_owner.heartbeat_at) > channel_owner.ttl_ms${extraWhere}
+  RETURNING owner_session_id AS ownerSessionId, token, epoch
+`;
+
+const CLAIM_SQL = buildClaimSql("");
+const CLAIM_PREEMPT_SQL = buildClaimSql("\n     OR channel_owner.owner_session_id LIKE ?");
+
+// Reserved session-id namespace for the daemon's cold-wake fallback owner. Interactive
+// session ids (foreground / mcp-channel / coldstart) MUST NOT start with this prefix, so that
+// a `preemptPrefix` of NATIVE_SESSION_PREFIX only ever reclaims the channel from the fallback,
+// never from a legitimate live session (review note, Stas 2026-06-23).
+export const NATIVE_SESSION_PREFIX = "native:";
+
+export class SessionLeaseStore {
+  constructor(dbPath = ".data/lease.db") {
+    mkdirSync(dirname(dbPath), { recursive: true });
+    this.db = new DatabaseSync(dbPath);
+    this.db.exec(DDL);
+    this._claim = this.db.prepare(CLAIM_SQL);
+    this._claimPreempt = this.db.prepare(CLAIM_PREEMPT_SQL);
+  }
+
+  // S0.0 session registry. Upsert a live session's presence row.
+  registerSession({ sessionId, agentId, threadId = null, pid = null, mode, now = Date.now() }) {
+    this.db
+      .prepare(
+        `INSERT INTO session_presence (session_id, agent_id, thread_id, pid, mode, heartbeat_at, started_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(session_id) DO UPDATE SET
+           thread_id = excluded.thread_id, pid = excluded.pid,
+           mode = excluded.mode, heartbeat_at = excluded.heartbeat_at`,
+      )
+      .run(sessionId, agentId, threadId, pid, mode, now, now);
+  }
+
+  sessionHeartbeat(sessionId, now = Date.now()) {
+    return this.db
+      .prepare(`UPDATE session_presence SET heartbeat_at = ? WHERE session_id = ?`)
+      .run(now, sessionId).changes;
+  }
+
+  // Is there a live (non-stale) interactive session for this agent? The native fallback wake
+  // defers to it (so it never spawns a competing thread while a chat window is attended).
+  hasLiveInteractiveSession(agentId, ttlMs, now = Date.now(), modes = ["foreground", "mcp-channel"]) {
+    const placeholders = modes.map(() => "?").join(",");
+    const row = this.db
+      .prepare(
+        `SELECT COUNT(*) AS n FROM session_presence
+         WHERE agent_id = ? AND mode IN (${placeholders}) AND (? - heartbeat_at) <= ?`,
+      )
+      .get(agentId, ...modes, now, ttlMs);
+    return Number(row?.n ?? 0) > 0;
+  }
+
+  // Atomic claim. Call BEFORE any side-effect. Returns { won, token, ownerSessionId }.
+  // `preemptPrefix` (optional): take over a current owner whose session id starts with it,
+  //   even when that owner is still live — used so real chat sessions beat `native:` fallbacks.
+  //   Pass `NATIVE_SESSION_PREFIX`; interactive session ids must never start with that prefix,
+  //   so preemption can only reclaim from the daemon fallback, never from a real owner.
+  claimOrSkip(conversationId, memberSlot, sessionId, ttlMs, now = Date.now(), preemptPrefix = null) {
+    const row = preemptPrefix
+      ? this._claimPreempt.get(conversationId, memberSlot, sessionId, now, ttlMs, `${preemptPrefix}%`)
+      : this._claim.get(conversationId, memberSlot, sessionId, now, ttlMs);
+    if (row && row.ownerSessionId === sessionId) {
+      return { won: true, token: Number(row.token), ownerSessionId: sessionId };
+    }
+    const cur = this.getOwner(conversationId, memberSlot);
+    return { won: false, token: cur?.token ?? null, ownerSessionId: cur?.ownerSessionId ?? null };
+  }
+
+  // Keep the lease alive without bumping the token. Returns 0 if ownership was lost.
+  heartbeat(conversationId, memberSlot, sessionId, now = Date.now()) {
+    return this.db
+      .prepare(
+        `UPDATE channel_owner SET heartbeat_at = ?
+         WHERE conversation_id = ? AND member_slot = ? AND owner_session_id = ?`,
+      )
+      .run(now, conversationId, memberSlot, sessionId).changes;
+  }
+
+  // Outbound fence: is `token` still the current owner token for this channel?
+  // INVARIANT: `token` is strictly monotonic per (conversation_id, member_slot) and is bumped on
+  // every successful claim, so `token === current` uniquely identifies the live claim epoch — a
+  // superseded or stale owner necessarily holds an older token. Fencing on the token alone is
+  // therefore sufficient; owner_session_id is implied by the token and need not be re-checked here.
+  isCurrentToken(conversationId, memberSlot, token) {
+    const row = this.db
+      .prepare(`SELECT token FROM channel_owner WHERE conversation_id = ? AND member_slot = ?`)
+      .get(conversationId, memberSlot);
+    return !!row && Number(row.token) === token;
+  }
+
+  getOwner(conversationId, memberSlot) {
+    const row = this.db
+      .prepare(
+        `SELECT owner_session_id AS ownerSessionId, token, epoch, heartbeat_at AS heartbeatAt, ttl_ms AS ttlMs
+         FROM channel_owner WHERE conversation_id = ? AND member_slot = ?`,
+      )
+      .get(conversationId, memberSlot);
+    if (!row) return null;
+    return { ownerSessionId: row.ownerSessionId, token: Number(row.token), epoch: Number(row.epoch), heartbeatAt: Number(row.heartbeatAt), ttlMs: Number(row.ttlMs) };
+  }
+
+  release(conversationId, memberSlot, sessionId) {
+    return this.db
+      .prepare(
+        `DELETE FROM channel_owner WHERE conversation_id = ? AND member_slot = ? AND owner_session_id = ?`,
+      )
+      .run(conversationId, memberSlot, sessionId).changes;
+  }
+
+  close() {
+    this.db.close();
+  }
+}
+
+// Native-daemon wake is a FALLBACK owner (#82): it must NOT spawn a competing thread while a
+// chat window is attended. Returns a leaseGate(payload, peer) for WakeMonitor that:
+//   1. defers (mute) if a live interactive session_presence row exists for the agent
+//      (foreground / mcp-channel sessions register+heartbeat presence, #83) — no race;
+//   2. otherwise claims the channel as `native:<agentId>` and allows the wake (cold fallback);
+//   3. mutes if some other live owner already holds the channel.
+// Interactive sessions claim with preemptPrefix="native:" so they reclaim instantly should the
+// native fallback have won during a presence gap.
+export function createNativeLeaseGate({ store, agentId, ttlMs = 20000, memberSlot, presenceTtlMs, now = () => Date.now(), log = () => {} }) {
+  const sessionId = `${NATIVE_SESSION_PREFIX}${agentId}`;
+  const slot = memberSlot || agentId;
+  const pTtl = presenceTtlMs || ttlMs;
+  return async (payload) => {
+    const conversationId = payload?.conversationId;
+    if (!conversationId) return { allow: true, token: null, reason: "no-conversation" };
+    const ts = now();
+    if (store.hasLiveInteractiveSession(agentId, pTtl, ts)) {
+      log("info", "native lease defer (live interactive session)", { conversationId });
+      return { allow: false, token: null, reason: "live-interactive-session" };
+    }
+    const res = store.claimOrSkip(conversationId, slot, sessionId, ttlMs, ts);
+    if (res.won) {
+      log("info", "native lease claimed (fallback wake)", { conversationId, token: res.token, ownerSessionId: sessionId });
+      return { allow: true, token: res.token, ownerSessionId: sessionId };
+    }
+    log("info", "native lease skip (live owner holds channel)", { conversationId, ownerSessionId: res.ownerSessionId });
+    return { allow: false, token: null, ownerSessionId: res.ownerSessionId, reason: "live-owner" };
+  };
+}