@north-light/crouter 0.3.167 → 0.3.168

package/dist/core/__tests__/broker-fork-seam.test.js

@@ -34,7 +34,6 @@ import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createAgentSessionServices, createAgentSessionFromServices, SessionManager, VERSION, } from '../runtime/broker-sdk.js';
-import { CANVAS_EXTENSIONS } from '../runtime/launch.js';
 import { buildBrokerSession } from '../runtime/broker.js';
 // M-9 (broker.ts fault-and-die model gate): buildBrokerSession with no cfg.model
 // now calls the REAL SDK's modelRegistry.getAvailable() and faults if it's empty
@@ -83,7 +82,7 @@ test('D2 broker fork branch: buildBrokerSession(cfg.forkFrom) yields a NEW id +
     //    if broker.ts:~1106 reverts to that throw, this rejects and the test goes RED.
     const cfg = {
         cwd: dir,
-        extensionPaths: [...CANVAS_EXTENSIONS, C3_EXT],
+        extensionPaths: [C3_EXT],
         forkFrom: srcFile,
         model: 'c3prov/c3model',
     };

package/dist/core/__tests__/broker-sdk-wiring.test.js

@@ -84,7 +84,7 @@ function cfg(cwd, extra = {}) {
 test('C3 — services path registers an extension model provider; the broker session gets it', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c3-'));
     try {
-        const { session, services } = await buildBrokerSession(realEngine, cfg(cwd, { model: 'c3prov/c3model' }));
+        const { session, services } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT], model: 'c3prov/c3model' }));
         try {
             // The extension's provider was registered into the SERVICES model runtime (this
             // is the registerProvider step plain createAgentSession skips).
@@ -107,7 +107,7 @@ test('C3 — services path registers an extension model provider; the broker ses
 test('C3b — broker splits model thinking suffix before SDK registry lookup', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c3b-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { model: 'c3prov/c3model:high' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT], model: 'c3prov/c3model:high' }));
         try {
             assert.equal(session.model?.id, 'c3model', 'C3b: suffixed model specs resolve by model id instead of falling back to SDK default');
         }
@@ -420,7 +420,7 @@ test('C5 — isLeadingEngineCommand against a REAL session (registered extension
     // proven against a plain object shaped like the real accessors.
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-c5-cmd-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [...brokerExts(), C5_EXT], model: 'c3prov/c3model' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT, C5_EXT], model: 'c3prov/c3model' }));
         try {
             assert.equal(isLeadingEngineCommand('/devcmd', session), true, 'a real registered extension command matches');
             assert.equal(isLeadingEngineCommand('/devcmd extra args', session), true, 'space-separated still matches against a real session');
@@ -744,7 +744,7 @@ test('Major 6 (broker half) — engineLeadingCommandTokens degrades to empty per
 test('Major 6 (broker half) — engineLeadingCommandTokens against a REAL session enumerates the real registered extension command', async () => {
     const cwd = mkdtempSync(join(tmpdir(), 'crtr-m6-cmd-'));
     try {
-        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [...brokerExts(), C5_EXT], model: 'c3prov/c3model' }));
+        const { session } = await buildBrokerSession(realEngine, cfg(cwd, { extensionPaths: [C3_EXT, C5_EXT], model: 'c3prov/c3model' }));
         try {
             const tokens = engineLeadingCommandTokens(session);
             assert.ok(tokens.includes('devcmd'), 'the real registered extension command name is present in the enumeration');

package/dist/core/canvas/pid.d.ts

@@ -1,17 +1,8 @@
-/** True if a process with `pid` is currently alive (signal-0 probe) AND not a
- *  zombie. `kill(pid, 0)` throws ESRCH when the process is gone; EPERM means
- *  it exists but isn't ours — still alive (a foreign process is never OUR
- *  zombie, so the `isZombie` check is skipped for that branch — see below). A
- *  null/undefined pid (legacy / never-booted) reads dead.
- *
- *  The zombie check matters because EVERY broker this module supervises is
- *  spawned `detached: true` by crtr itself (`headlessBrokerHost.launch`) — a
- *  dead broker whose spawning process hasn't reaped it yet is a zombie, and
- *  `kill(pid, 0)` alone reports it as alive, wedging the daemon's revive guard
- *  (`isPidAlive(pi_pid)`, `revive.ts`) forever: the daemon never revives an
- *  already-live-looking row, so a refreshed/crashed node whose broker zombied
- *  out under a long-lived spawning process (see `isZombie`'s doc) never comes
- *  back on its own. */
+/** True if a process with `pid` is currently alive. `kill(pid, 0)` provides the
+ *  initial existence check; EPERM means the foreign process exists. For our
+ *  processes, the later `ps` read is authoritative because it also distinguishes
+ *  zombies and processes reaped between the two probes. Only an unavailable
+ *  `ps` probe fails open to alive. A null/undefined pid reads dead. */
 export declare function isPidAlive(pid: number | null | undefined): boolean;
 /** THE single precision-aware identity compare, used EVERYWHERE two
  *  `composeIdentity` fingerprints are compared (this module's own

package/dist/core/canvas/pid.js

@@ -10,46 +10,31 @@
 import { spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { readKernelBootId } from './boot-id.js';
-/** Is `pid` a ZOMBIE (exited, awaiting reap by its parent)? `kill(pid, 0)`
- *  reports a zombie as a perfectly normal alive process — its PID is still
- *  occupied in the process table — so callers relying on that signal-0 probe
- *  alone (see `isPidAlive`) misread a dead broker as alive forever whenever
- *  its spawning process never reaps it (crouton-labs zombie-broker bug: the
- *  front door's foreground attach session parks its OWN event loop for the
- *  whole session — see `bootRoot` in runtime/boot-root.ts — so it can't process
- *  the SIGCHLD that would otherwise reap its detached broker child in real
- *  time). `ps -o stat=` reports a leading `Z` for a zombie on BOTH BSD ps
- *  (macOS) and procps-ng (Linux), so one portable probe covers both platforms
- *  without a Linux-only `/proc` special case. Best-effort: any probe failure
- *  (spawn error, no matching row, non-zero exit) reads as NOT a zombie —
- *  fail-open, matching this module's other guards; a probe failure must never
- *  be misread as proof of death (a live pid IS alive; only a positive `Z`
- *  read says otherwise). */
-function isZombie(pid) {
+/** Classify the current `ps` row for a pid. BSD ps and procps-ng both report a
+ *  leading `Z` for zombies and exit silently with empty output when no process
+ *  matches. Only a probe that could not run is unknown; that is the sole
+ *  fail-open result. */
+function psProcessState(pid) {
     try {
         const r = spawnSync('ps', ['-o', 'stat=', '-p', String(pid)], { encoding: 'utf8', timeout: 2000 });
-        if (r.status !== 0 || typeof r.stdout !== 'string')
-            return false;
-        return r.stdout.trim().charAt(0) === 'Z';
+        if (r.error != null || r.signal != null || typeof r.stdout !== 'string')
+            return 'unknown';
+        if (typeof r.stderr === 'string' && r.stderr.trim() !== '')
+            return 'unknown';
+        const stat = r.stdout.trim();
+        if (stat === '')
+            return 'gone';
+        return stat.charAt(0) === 'Z' ? 'zombie' : 'live';
     }
     catch {
-        return false;
+        return 'unknown';
     }
 }
-/** True if a process with `pid` is currently alive (signal-0 probe) AND not a
- *  zombie. `kill(pid, 0)` throws ESRCH when the process is gone; EPERM means
- *  it exists but isn't ours — still alive (a foreign process is never OUR
- *  zombie, so the `isZombie` check is skipped for that branch — see below). A
- *  null/undefined pid (legacy / never-booted) reads dead.
- *
- *  The zombie check matters because EVERY broker this module supervises is
- *  spawned `detached: true` by crtr itself (`headlessBrokerHost.launch`) — a
- *  dead broker whose spawning process hasn't reaped it yet is a zombie, and
- *  `kill(pid, 0)` alone reports it as alive, wedging the daemon's revive guard
- *  (`isPidAlive(pi_pid)`, `revive.ts`) forever: the daemon never revives an
- *  already-live-looking row, so a refreshed/crashed node whose broker zombied
- *  out under a long-lived spawning process (see `isZombie`'s doc) never comes
- *  back on its own. */
+/** True if a process with `pid` is currently alive. `kill(pid, 0)` provides the
+ *  initial existence check; EPERM means the foreign process exists. For our
+ *  processes, the later `ps` read is authoritative because it also distinguishes
+ *  zombies and processes reaped between the two probes. Only an unavailable
+ *  `ps` probe fails open to alive. A null/undefined pid reads dead. */
 export function isPidAlive(pid) {
     if (pid == null)
         return false;
@@ -59,7 +44,8 @@ export function isPidAlive(pid) {
     catch (e) {
         return e.code === 'EPERM';
     }
-    return !isZombie(pid);
+    const state = psProcessState(pid);
+    return state !== 'zombie' && state !== 'gone';
 }
 /** Matches the kernel `boot_id` UUID shape (`/proc/sys/kernel/random/boot_id`),
  *  used to tell a NEW-format identity base (a per-boot UUID) apart from a