@north-light/crouter 0.3.318 → 0.3.320

package/dist/daemon/api/bridge.js

@@ -1,418 +1,8 @@
-// bridge.ts — crtrd's WebSocket attach bridge (spec §5, especially §5.3).
-//
-// `GET /v1/nodes/{id}/attach` relays one remote WebSocket to one node broker
-// `view.sock`. The bridge never interprets frames: each complete broker frame
-// becomes one WebSocket text message (bounded by `FrameDecoder(CLIENT_READ_CAPS)`),
-// and each WebSocket message becomes one newline-terminated socket line.
-// Teardown is idempotent, and each WebSocket owns one `view.sock` connection;
-// the broker fans out to its clients natively.
-//
-// Attach implies revive, EXCEPT for an exact parked resident, which only
-// `?wakeParked=1` wakes. Before opening WebSocket, the upgrade handler calls
-// `decideAttachRevive(id, { resume: true }, wakeParked)` unless `?revive=0` or
-// `X-Crtr-Attach-Revive: 0` opts out, then waits for `view.sock` to become
-// listenable. A failed revive or an unready socket refuses the upgrade with 409.
-// With revive opted out, a dormant node also refuses with 409. Pre-upgrade
-// refusals send a plain HTTP error and destroy the raw socket; post-upgrade
-// faults use WebSocket close codes (1008/1009/1011).
-//
-// Once open, the bridge only relays sockets. It never touches SessionManager,
-// spawns `pi --session`, or writes a `.jsonl`; the revive boundary is its sole
-// engine launch path. It records a fault only when the broker socket fails.
-import { createConnection } from 'node:net';
-import { WebSocketServer } from 'ws';
-import { isSafeNodeId, viewSocketPath } from '../../core/canvas/paths.js';
-import { getNode } from '../../core/canvas/index.js';
-import { BROKER_READ_CAPS, CLIENT_READ_CAPS, FrameDecoder, FrameOverflowError, } from '../../core/runtime/broker-protocol.js';
-import { classify } from '../../core/fault-classifier.js';
-import { clearFault, recordFault } from '../../core/canvas/recovery.js';
-import { decideAttachRevive } from '../../core/runtime/revive.js';
-import { probeViewSocket, waitForBrokerViewSocket } from '../../core/runtime/view-socket.js';
-/** Our own noServer WS server: A-9 routes matched attach upgrades to
- *  {@link handleAttachUpgrade}, which performs the handshake through this. Bounds
- *  the INBOUND remote→broker path to the broker's OWN read cap (not the generous
- *  client cap) so a remote peer cannot buffer 256MiB before the broker's 24MiB
- *  decoder rejects the message. */
-const wss = new WebSocketServer({ noServer: true, maxPayload: BROKER_READ_CAPS.maxLineBytes });
-/** Keep a RELAYING connection alive across a gap between frames, through common
- * 60s proxy idle limits. A viewer only observes a broker, so a missed heartbeat
- * may close this socket but must never affect the broker or its in-flight work. */
-export const REMOTE_ATTACH_HEARTBEAT_MS = 25_000;
-/** How long after the last relayed frame the heartbeat keeps pinging. Past this,
- * the attach is carrying nothing — no viewer output, no streaming node — and the
- * heartbeat goes silent so the network path underneath can reap the connection.
- *
- * This matters far beyond a socket: on a hosted guest (Blaxel) a connection that
- * is pinged every 25s is never idle, so the host never suspends the sandbox. An
- * unconditional heartbeat held whole fleets awake for 15h at a time. A drop on a
- * quiet attach is a normal close the remote peer re-attaches from, and real work
- * is anchored by its own keep-alive, not by this ping.
- *
- * The clock starts when the attach OPENS, not at its first relayed frame: a
- * never-relaying attach still gets pings until this window elapses. The welcome
- * frame lands in milliseconds, so this only pads the tail of the very first
- * window.
- *
- * ROLLOUT ORDER — this half is only half the answer, and shipping it FIRST is
- * strictly worse than shipping nothing. The host that owns the attach must also
- * let go of a quiet one; Northlight Core does that at its own 60s quiesce
- * (`CROUTER_FOLLOW_QUIESCE_MS`). Against a host that holds the attach forever,
- * going quiet here only moves the drop to the network path, the host reports a
- * detach, its client reconnects, and the box wakes again — the same pin, now
- * with a full re-snapshot every couple of minutes. Ship the host's quiesce
- * first, then roll the guest image. */
-export const REMOTE_ATTACH_QUIET_MS = 60_000;
-export function startRemoteAttachHeartbeat(ws, intervalMs = REMOTE_ATTACH_HEARTBEAT_MS, quietMs = REMOTE_ATTACH_QUIET_MS) {
-    let alive = true;
-    let stopped = false;
-    let lastActivityAt = Date.now();
-    const acknowledge = () => { alive = true; };
-    const stop = () => {
-        if (stopped)
-            return;
-        stopped = true;
-        clearInterval(timer);
-        ws.off('pong', acknowledge);
-    };
-    ws.on('pong', acknowledge);
-    const timer = setInterval(() => {
-        if (Date.now() - lastActivityAt > quietMs) {
-            // Nothing is flowing: send no ping and run no liveness check, so an idle
-            // attach puts zero packets on the wire. A dead peer here is closed by the
-            // network path or by teardown, not by us.
-            alive = true;
-            return;
-        }
-        if (!alive) {
-            stop();
-            ws.terminate();
-            return;
-        }
-        alive = false;
-        try {
-            ws.ping();
-        }
-        catch {
-            stop();
-            ws.terminate();
-        }
-    }, intervalMs);
-    timer.unref();
-    return {
-        stop,
-        // Frames are not liveness evidence: only a pong proves the peer is there.
-        // Marking a relayed frame alive would disable dead-peer detection for
-        // exactly as long as a turn streams — the one stretch it is for.
-        noteActivity: () => {
-            lastActivityAt = Date.now();
-        },
-    };
-}
-/** A WS close reason is capped at 123 UTF-8 bytes by the protocol. */
-function clampReason(reason) {
-    const buf = Buffer.from(reason, 'utf8');
-    return buf.byteLength <= 123 ? reason : buf.subarray(0, 123).toString('utf8');
-}
-/** Refuse an upgrade PRE-handshake: write a plain HTTP error (uniform API
- *  `ErrorBody`, spec §8) to the raw socket and destroy it. Never throws — a
- *  reset peer is swallowed. */
-function refuseUpgrade(socket, status, statusText, code, message) {
-    const body = JSON.stringify({ error: { code, message } });
-    const payload = `HTTP/1.1 ${status} ${statusText}\r\n` +
-        `content-type: application/json; charset=utf-8\r\n` +
-        `content-length: ${Buffer.byteLength(body)}\r\n` +
-        `connection: close\r\n\r\n` +
-        body;
-    // `end(payload)` flushes the full body THEN sends FIN — a bare
-    // `write`+`destroy` can truncate the body for a slow remote peer.
-    try {
-        socket.end(payload);
-    }
-    catch {
-        // peer reset mid-handshake — force it down.
-        try {
-            socket.destroy();
-        }
-        catch {
-            /* already gone */
-        }
-    }
-}
-/** True when the caller opted OUT of attach-implies-revive: `?revive=0` OR header
- *  `X-Crtr-Attach-Revive: 0`. Default (absent/anything-else) = revive. */
-function reviveOptedOut(req) {
-    const url = new URL(req.url ?? '/', 'http://127.0.0.1');
-    if (url.searchParams.get('revive') === '0')
-        return true;
-    const header = req.headers['x-crtr-attach-revive'];
-    const value = Array.isArray(header) ? header[0] : header;
-    return value === '0';
-}
-/** `?wakeParked=1` — this attach is a person deliberately opening a node, so an
- *  exact parked resident should be woken for it, exactly as the LOCAL attach
- *  ensure does for a direct attach. crouter's own remote viewer
- *  (`RelayTransport`) sends it. Without it the caller is a viewport reconnecting
- *  — a product page re-dialling after its socket dropped — and a parked node
- *  stays parked. */
-function wakeParkedRequested(req) {
-    const url = new URL(req.url ?? '/', 'http://127.0.0.1');
-    return url.searchParams.get('wakeParked') === '1';
-}
-/** Relay one remote WS ⇄ one node broker `view.sock`. Opens the socket on
- *  connect; forwards each complete frame socket→WS (bounded decode, one WS
- *  message per frame) and re-frames each WS message WS→socket (trailing
- *  newline). The relay is semantically verbatim — it never INTERPRETS a frame
- *  (it only splits/joins the newline framing). Closes the WS on socket
- *  gone/no-broker, destroys the socket on WS close; idempotent teardown, no
- *  leaks. Validates the node id first (path-safety + existence) as belt-and-
- *  suspenders — the upgrade handler already guarded both. */
-function bridgeConnection(ws, nodeId) {
-    if (!isSafeNodeId(nodeId)) {
-        try {
-            ws.close(1008, clampReason(`invalid node id: ${nodeId}`));
-        }
-        catch {
-            /* ignore */
-        }
-        return;
-    }
-    if (getNode(nodeId) === null) {
-        try {
-            ws.close(1011, clampReason(`no node ${nodeId}`));
-        }
-        catch {
-            /* ignore */
-        }
-        return;
-    }
-    clearFault(nodeId, { link: 'viewer↔crtrd' });
-    const sockPath = viewSocketPath(nodeId);
-    const socket = createConnection(sockPath);
-    const decoder = new FrameDecoder(CLIENT_READ_CAPS);
-    let closed = false;
-    let viewerFaultRecorded = false;
-    let heartbeat;
-    socket.on('connect', () => {
-        clearFault(nodeId, { link: 'relay↔broker' });
-    });
-    const teardown = (wsCode, reason) => {
-        if (closed)
-            return;
-        closed = true;
-        heartbeat?.stop();
-        if (!socket.destroyed) {
-            try {
-                socket.destroy();
-            }
-            catch {
-                /* ignore */
-            }
-        }
-        try {
-            ws.close(wsCode, clampReason(reason));
-        }
-        catch {
-            /* ignore */
-        }
-    };
-    heartbeat = startRemoteAttachHeartbeat(ws);
-    // socket → WS: bounded decode, one WS text message per complete frame.
-    socket.on('data', (chunk) => {
-        heartbeat?.noteActivity();
-        let frames;
-        try {
-            frames = decoder.push(chunk);
-        }
-        catch (err) {
-            const msg = err instanceof FrameOverflowError
-                ? `broker sent an oversized frame (${err.message})`
-                : `failed to decode a broker frame for ${nodeId}`;
-            teardown(1009, msg);
-            return;
-        }
-        for (const frame of frames) {
-            if (ws.readyState === ws.OPEN)
-                ws.send(JSON.stringify(frame));
-        }
-    });
-    socket.on('error', (err) => {
-        const classification = classify('relay↔broker', err);
-        recordFault(nodeId, {
-            link: 'relay↔broker',
-            op: 'bridge socket',
-            kind: classification.kind,
-            retry: { disposition: 'manual' },
-            message: err.message,
-        });
-        const reason = err.code === 'ECONNREFUSED' || err.code === 'ENOENT'
-            ? `no running broker for ${nodeId}`
-            : `view socket error for ${nodeId}: ${err.message}`;
-        teardown(1011, reason);
-    });
-    socket.on('close', (hadError) => {
-        if (closed || hadError)
-            return;
-        clearFault(nodeId, { link: 'relay↔broker' });
-        teardown(1000, 'broker socket closed');
-    });
-    ws.on('close', (code, reason) => {
-        const reasonText = reason.toString('utf8');
-        if (closed) {
-            if (code === 1000)
-                clearFault(nodeId, { link: 'viewer↔crtrd' });
-            return;
-        }
-        if (code === 1000) {
-            clearFault(nodeId, { link: 'viewer↔crtrd' });
-        }
-        else if (!viewerFaultRecorded) {
-            viewerFaultRecorded = true;
-            const classification = classify('viewer↔crtrd', { code, reason: reasonText });
-            recordFault(nodeId, {
-                link: 'viewer↔crtrd',
-                op: 'remote attach websocket',
-                kind: classification.kind,
-                retry: { disposition: 'auto' },
-                message: reasonText || `remote attach closed (${code})`,
-            });
-        }
-        teardown(code, reasonText || `remote attach closed (${code})`);
-    });
-    ws.on('error', () => {
-        if (!viewerFaultRecorded) {
-            viewerFaultRecorded = true;
-            const classification = classify('viewer↔crtrd', { code: 1006, reason: 'remote attach websocket error' });
-            recordFault(nodeId, {
-                link: 'viewer↔crtrd',
-                op: 'remote attach websocket',
-                kind: classification.kind,
-                retry: { disposition: 'auto' },
-                message: 'remote attach websocket error',
-            });
-        }
-        teardown(1011, 'remote attach websocket error');
-    });
-    // WS → socket: re-frame each message as one newline-terminated JSON line.
-    // VERBATIM (no parse) — the broker validates and bounds its own reads.
-    ws.on('message', (data) => {
-        if (closed || socket.destroyed)
-            return;
-        heartbeat?.noteActivity();
-        const buf = Array.isArray(data)
-            ? Buffer.concat(data)
-            : Buffer.isBuffer(data)
-                ? data
-                : Buffer.from(new Uint8Array(data));
-        const text = buf.toString('utf8');
-        const line = text.endsWith('\n') ? text : text + '\n';
-        try {
-            socket.write(line);
-        }
-        catch {
-            /* dead socket — its 'close' drives teardown */
-        }
-    });
-}
-/** Handle the HTTP upgrade for `GET /v1/nodes/{id}/attach`. A-9 matches the
- *  route, extracts `{id}`, and calls this with the raw upgrade triplet; this
- *  owns the WS handshake (its own noServer `wss` above) AND the spec §5.3
- *  attach-implies-revive semantics. Never throws — every failure path either
- *  refuses the upgrade (plain HTTP error + socket destroy) or, post-handshake,
- *  closes the WS with a code. So A-9's upgrade router needs no try/catch around
- *  this call beyond its own top-level safety net.
- *
- *  Flow:
- *   1. Guard `isSafeNodeId` (→ 400) and existence (→ 404) BEFORE building any
- *      fs path or reviving — an unsafe id must never reach `viewSocketPath`.
- *   2. Unless revive is opted out (`?revive=0` / `X-Crtr-Attach-Revive: 0`):
- *      `decideAttachRevive(id, { resume:true }, wakeParked)` then
- *      `waitForBrokerViewSocket` (bounded). Revive throw OR socket-not-listenable
- *      → refuse 409, WS never opens. Without `?wakeParked=1` an exact parked
- *      resident is left parked and refused 409 `node_dormant` — see the call site.
- *   3. Revive opted out: a single connect probe. Dormant (socket refuses) →
- *      refuse 409 (spec §5.3 asymmetry: a dead broker can't stream over WS).
- *   4. Only then upgrade and hand the live WS to {@link bridgeConnection}. */
-export async function handleAttachUpgrade(req, socket, head, nodeId) {
-    // A raw upgrade socket with no 'error' listener throws on a write to a reset
-    // peer — attach one defensively so an async gap here can never crash the
-    // daemon (idempotent with any listener A-9 also attached).
-    socket.on('error', () => {
-        /* peer reset mid-handshake — refuseUpgrade/destroy handles the rest */
-    });
-    try {
-        // (1) Path-safety + existence, PRE-revive: never build an fs path from an
-        // unsafe id, and never revive a nonexistent node.
-        if (!isSafeNodeId(nodeId)) {
-            refuseUpgrade(socket, 400, 'Bad Request', 'invalid_node_id', `invalid node id: ${nodeId}`);
-            return;
-        }
-        if (getNode(nodeId) === null) {
-            refuseUpgrade(socket, 404, 'Not Found', 'node_not_found', `no node ${nodeId}`);
-            return;
-        }
-        if (reviveOptedOut(req)) {
-            // (3) Revive opted out: the socket must already be live. A dormant node's
-            // socket can't stream, so refuse 409 rather than open a WS that would
-            // immediately 1011 (spec §5.3 named asymmetry).
-            if (!(await probeViewSocket(viewSocketPath(nodeId), 250))) {
-                refuseUpgrade(socket, 409, 'Conflict', 'node_dormant', `node ${nodeId} is dormant and revive was opted out (?revive=0)`);
-                return;
-            }
-        }
-        else {
-            // (2) Attach implies revive: wake BEFORE opening the socket so it exists
-            // when the bridge connects.
-            // NOTE (deviation from spec §5.3 pseudocode): `wakeReason: 'attach'` does
-            // NOT typecheck — `WakeOrigin` is structured cron-birth provenance, not a
-            // string, and per the runtime contract `wakeReason` is a DAEMON-only
-            // injection seam. An attach-driven revive has no cron provenance, so we
-            // omit it — matching every other
-            // non-daemon caller (`revive-all`, `resume.ts`, the revive command), which
-            // pass only `{ resume }`.
-            let launchExited;
-            try {
-                // The bridge upgrade waits on this node's view socket, which only a
-                // live broker publishes: at the cap, refuse the upgrade with the real
-                // reason instead of freezing and then timing out on a socket that was
-                // never going to appear.
-                //
-                // An unqualified remote attach is a viewport, not a reason to run.
-                // Waking an exact parked resident here restarted its park clock on
-                // every browser reconnect, so a watched conversation churned park →
-                // revive → park. Nothing observes a parked node in the meantime: it has
-                // no engine and appends nothing, so a transcript served from the
-                // offline messages route cannot go stale, and a message sent to the
-                // node still revives it by the ordinary path. A person attaching
-                // deliberately says so with `?wakeParked=1`.
-                const decision = await decideAttachRevive(nodeId, { resume: true, capacity: 'refuse' }, wakeParkedRequested(req));
-                if (decision.parked) {
-                    refuseUpgrade(socket, 409, 'Conflict', 'node_dormant', `node ${nodeId} is parked; attach with ?wakeParked=1 to wake it`);
-                    return;
-                }
-                launchExited = decision.result.launch?.exited;
-            }
-            catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                refuseUpgrade(socket, 409, 'Conflict', 'attach_revive_failed', `attach revive failed: ${message}`);
-                return;
-            }
-            // Bounded wait for `view.sock` to be listenable (broker startup is async);
-            // fails fast on the broker's real exit. Not-ready → refuse 409.
-            if (!(await waitForBrokerViewSocket(nodeId, launchExited))) {
-                refuseUpgrade(socket, 409, 'Conflict', 'broker_not_ready', `broker view socket for ${nodeId} did not become listenable after revive`);
-                return;
-            }
-        }
-        // (4) Ready: complete the WS handshake and relay verbatim. If the raw socket
-        // died during the async revive/wait above, handleUpgrade is a no-op.
-        if (socket.destroyed)
-            return;
-        wss.handleUpgrade(req, socket, head, (ws) => bridgeConnection(ws, nodeId));
-    }
-    catch (err) {
-        // Belt-and-suspenders: nothing above should throw, but never let an
-        // upgrade-handler throw escape and crash the daemon.
-        const message = err instanceof Error ? err.message : String(err);
-        refuseUpgrade(socket, 500, 'Internal Server Error', 'internal', `attach upgrade failed: ${message}`);
-    }
-}
+var A=Object.defineProperty;var c=(r,e)=>A(r,"name",{value:e,configurable:!0});import{createConnection as E}from"node:net";import{WebSocketServer as _}from"ws";import{isSafeNodeId as g,viewSocketPath as b}from"../../core/canvas/paths.js";import{getNode as w}from"../../core/canvas/index.js";import{BROKER_READ_CAPS as S,CLIENT_READ_CAPS as $,FrameDecoder as R,FrameOverflowError as T}from"../../core/runtime/broker-protocol.js";import{classify as v}from"../../core/fault-classifier.js";import{clearFault as h,recordFault as p}from"../../core/canvas/recovery.js";import{decideAttachRevive as C}from"../../core/runtime/revive.js";import{probeViewSocket as P,waitForBrokerViewSocket as x}from"../../core/runtime/view-socket.js";const B=new _({noServer:!0,maxPayload:S.maxLineBytes}),N=25e3,O=6e4;function F(r,e=N,s=O){let t=!0,a=!1,n=Date.now();const f=c(()=>{t=!0},"acknowledge"),u=c(()=>{a||(a=!0,clearInterval(m),r.off("pong",f))},"stop");r.on("pong",f);const m=setInterval(()=>{if(Date.now()-n>s){t=!0;return}if(!t){u(),r.terminate();return}t=!1;try{r.ping()}catch{u(),r.terminate()}},e);return m.unref(),{stop:u,noteActivity:c(()=>{n=Date.now()},"noteActivity")}}c(F,"startRemoteAttachHeartbeat");function k(r){const e=Buffer.from(r,"utf8");return e.byteLength<=123?r:e.subarray(0,123).toString("utf8")}c(k,"clampReason");function d(r,e,s,t,a){const n=JSON.stringify({error:{code:t,message:a}}),f=`HTTP/1.1 ${e} ${s}\r
+content-type: application/json; charset=utf-8\r
+content-length: ${Buffer.byteLength(n)}\r
+connection: close\r
+\r
+`+n;try{r.end(f)}catch{try{r.destroy()}catch{}}}c(d,"refuseUpgrade");function U(r){if(new URL(r.url??"/","http://127.0.0.1").searchParams.get("revive")==="0")return!0;const s=r.headers["x-crtr-attach-revive"];return(Array.isArray(s)?s[0]:s)==="0"}c(U,"reviveOptedOut");function D(r){return new URL(r.url??"/","http://127.0.0.1").searchParams.get("wakeParked")==="1"}c(D,"wakeParkedRequested");function L(r,e){if(!g(e)){try{r.close(1008,k(`invalid node id: ${e}`))}catch{}return}if(w(e)===null){try{r.close(1011,k(`no node ${e}`))}catch{}return}h(e,{link:"viewer\u2194crtrd"});const s=b(e),t=E(s),a=new R($);let n=!1,f=!1,u;t.on("connect",()=>{h(e,{link:"relay\u2194broker"})});const m=c((o,l)=>{if(!n){if(n=!0,u?.stop(),!t.destroyed)try{t.destroy()}catch{}try{r.close(o,k(l))}catch{}}},"teardown");u=F(r),t.on("data",o=>{u?.noteActivity();let l;try{l=a.push(o)}catch(i){const y=i instanceof T?`broker sent an oversized frame (${i.message})`:`failed to decode a broker frame for ${e}`;m(1009,y);return}for(const i of l)r.readyState===r.OPEN&&r.send(JSON.stringify(i))}),t.on("error",o=>{const l=v("relay\u2194broker",o);p(e,{link:"relay\u2194broker",op:"bridge socket",kind:l.kind,retry:{disposition:"manual"},message:o.message});const i=o.code==="ECONNREFUSED"||o.code==="ENOENT"?`no running broker for ${e}`:`view socket error for ${e}: ${o.message}`;m(1011,i)}),t.on("close",o=>{n||o||(h(e,{link:"relay\u2194broker"}),m(1e3,"broker socket closed"))}),r.on("close",(o,l)=>{const i=l.toString("utf8");if(n){o===1e3&&h(e,{link:"viewer\u2194crtrd"});return}if(o===1e3)h(e,{link:"viewer\u2194crtrd"});else if(!f){f=!0;const y=v("viewer\u2194crtrd",{code:o,reason:i});p(e,{link:"viewer\u2194crtrd",op:"remote attach websocket",kind:y.kind,retry:{disposition:"auto"},message:i||`remote attach closed (${o})`})}m(o,i||`remote attach closed (${o})`)}),r.on("error",()=>{if(!f){f=!0;const o=v("viewer\u2194crtrd",{code:1006,reason:"remote attach websocket error"});p(e,{link:"viewer\u2194crtrd",op:"remote attach websocket",kind:o.kind,retry:{disposition:"auto"},message:"remote attach websocket error"})}m(1011,"remote attach websocket error")}),r.on("message",o=>{if(n||t.destroyed)return;u?.noteActivity();const i=(Array.isArray(o)?Buffer.concat(o):Buffer.isBuffer(o)?o:Buffer.from(new Uint8Array(o))).toString("utf8"),y=i.endsWith(`
+`)?i:i+`
+`;try{t.write(y)}catch{}})}c(L,"bridgeConnection");async function X(r,e,s,t){e.on("error",()=>{});try{if(!g(t)){d(e,400,"Bad Request","invalid_node_id",`invalid node id: ${t}`);return}if(w(t)===null){d(e,404,"Not Found","node_not_found",`no node ${t}`);return}if(U(r)){if(!await P(b(t),250)){d(e,409,"Conflict","node_dormant",`node ${t} is dormant and revive was opted out (?revive=0)`);return}}else{let a;try{const n=await C(t,{resume:!0,capacity:"refuse"},D(r));if(n.parked){d(e,409,"Conflict","node_dormant",`node ${t} is parked; attach with ?wakeParked=1 to wake it`);return}a=n.result.launch?.exited}catch(n){const f=n instanceof Error?n.message:String(n);d(e,409,"Conflict","attach_revive_failed",`attach revive failed: ${f}`);return}if(!await x(t,a)){d(e,409,"Conflict","broker_not_ready",`broker view socket for ${t} did not become listenable after revive`);return}}if(e.destroyed)return;B.handleUpgrade(r,e,s,a=>L(a,t))}catch(a){const n=a instanceof Error?a.message:String(a);d(e,500,"Internal Server Error","internal",`attach upgrade failed: ${n}`)}}c(X,"handleAttachUpgrade");export{N as REMOTE_ATTACH_HEARTBEAT_MS,O as REMOTE_ATTACH_QUIET_MS,X as handleAttachUpgrade,F as startRemoteAttachHeartbeat};

package/dist/daemon/api/handlers/attach.js

@@ -1,65 +1 @@
-// Attach handler (spec §5.1). `POST /v1/nodes/{id}/attach` is the LOCAL ensure:
-// crtrd revives the node (unless opted out) and returns the host-local path to
-// its broker `view.sock`, which the local viewer then connects to directly with
-// the existing `ViewSocketClient`. The REMOTE `GET .../attach` websocket upgrade
-// is bridge.ts's (A-8) — NOT routed here.
-//
-// `{id}` is the target node being attached to.
-import { getNode } from '../../../core/canvas/canvas.js';
-import { decideAttachRevive } from '../../../core/runtime/revive.js';
-import { viewSocketPath } from '../../../core/canvas/paths.js';
-import { waitForBrokerViewSocket } from '../../../core/runtime/placement-tmux.js';
-import { notFound, usage } from '../../../core/errors.js';
-/** Validate + narrow the attach-ensure body (all fields optional, default true). */
-function parseAttachBody(body) {
-    if (body === undefined || body === null)
-        return { resume: true, revive: true, wakeParked: true };
-    if (typeof body !== 'object') {
-        throw usage('attach body must be a JSON object { resume?, revive?, wakeParked? }');
-    }
-    const resume = body.resume;
-    const revive = body.revive;
-    const wakeParked = body.wakeParked;
-    if (resume !== undefined && typeof resume !== 'boolean')
-        throw usage('resume must be a boolean');
-    if (revive !== undefined && typeof revive !== 'boolean')
-        throw usage('revive must be a boolean');
-    if (wakeParked !== undefined && typeof wakeParked !== 'boolean')
-        throw usage('wakeParked must be a boolean');
-    return { resume: resume ?? true, revive: revive ?? true, wakeParked: wakeParked ?? true };
-}
-async function handleAttach(ctx) {
-    const id = ctx.params['id'];
-    if (getNode(id) === null)
-        throw notFound(`unknown node: ${id}`, { received: id });
-    const { resume, revive, wakeParked } = parseAttachBody(ctx.body);
-    let revived = false;
-    let resumed = false;
-    let parked = false;
-    if (revive) {
-        // This decision and reviveNode's fleet claim share one launch boundary.
-        // Focus may stop at an exact parked resident; ordinary/direct attach keeps
-        // wakeParked=true and preserves attach-implies-revive.
-        const decision = await decideAttachRevive(id, { resume, capacity: 'refuse' }, wakeParked);
-        parked = decision.parked;
-        if (!decision.parked) {
-            revived = decision.result.launch !== undefined;
-            resumed = decision.result.resumed;
-            // If we launched, let the broker publish its view socket so the local
-            // viewer's immediate connect finds it (bounded wait; best-effort).
-            if (revived)
-                await waitForBrokerViewSocket(id);
-        }
-    }
-    const body = {
-        node_id: id,
-        socket_path: viewSocketPath(id),
-        revived,
-        resumed,
-        parked,
-    };
-    return { status: 200, body };
-}
-export const attachRoutes = [
-    { method: 'POST', pattern: '/v1/nodes/:id/attach', handler: handleAttach },
-];
+var c=Object.defineProperty;var u=(t,e)=>c(t,"name",{value:e,configurable:!0});import{getNode as m}from"../../../core/canvas/canvas.js";import{decideAttachRevive as k}from"../../../core/runtime/revive.js";import{viewSocketPath as l}from"../../../core/canvas/paths.js";import{waitForBrokerViewSocket as v}from"../../../core/runtime/placement-tmux.js";import{notFound as p,usage as n}from"../../../core/errors.js";function w(t){if(t==null)return{resume:!0,revive:!0,wakeParked:!0};if(typeof t!="object")throw n("attach body must be a JSON object { resume?, revive?, wakeParked? }");const e=t.resume,r=t.revive,o=t.wakeParked;if(e!==void 0&&typeof e!="boolean")throw n("resume must be a boolean");if(r!==void 0&&typeof r!="boolean")throw n("revive must be a boolean");if(o!==void 0&&typeof o!="boolean")throw n("wakeParked must be a boolean");return{resume:e??!0,revive:r??!0,wakeParked:o??!0}}u(w,"parseAttachBody");async function h(t){const e=t.params.id;if(m(e)===null)throw p(`unknown node: ${e}`,{received:e});const{resume:r,revive:o,wakeParked:f}=w(t.body);let i=!1,d=!1,s=!1;if(o){const a=await k(e,{resume:r,capacity:"refuse"},f);s=a.parked,a.parked||(i=a.result.launch!==void 0,d=a.result.resumed,i&&await v(e))}return{status:200,body:{node_id:e,socket_path:l(e),revived:i,resumed:d,parked:s}}}u(h,"handleAttach");const B=[{method:"POST",pattern:"/v1/nodes/:id/attach",handler:h}];export{B as attachRoutes};

package/dist/daemon/api/handlers/bash-jobs.js

@@ -1,91 +1,2 @@
-// Daemon-owned read and stop surfaces for one node's file-backed background
-// bash jobs. The attach roster continues to read the same directory directly;
-// these routes exist for remote presenters that cannot see the node host.
-import { enqueueNodeMail } from '../../../core/feed/messages.js';
-import { contextDir, isSafeNodeId } from '../../../core/canvas/paths.js';
-import { getNode } from '../../../core/canvas/canvas.js';
-import { isBrokerLive } from '../../../core/runtime/model-swap.js';
-import { assertNotFinalized } from '../../../core/runtime/reopen.js';
-import { reviveNode } from '../../../core/runtime/revive.js';
-import { activeBackgroundBashJobs, bashJobPaths, isBashJobProcessGroupAlive, readJobPgid, isSafeBashJobId as isSafeCoreBashJobId, stopBackgroundBashJob, } from '../../../core/bash-jobs.js';
-import { ApiError } from '../../../api/index.js';
-import { notFound } from '../../../core/errors.js';
-function requireTarget(ctx) {
-    const nodeId = ctx.params['id'];
-    if (nodeId === undefined || !isSafeNodeId(nodeId)) {
-        throw new ApiError(400, 'invalid_node_id', `invalid node id: ${JSON.stringify(nodeId)}`);
-    }
-    const node = getNode(nodeId);
-    if (node === null)
-        throw notFound(`unknown node: ${nodeId}`, { received: nodeId });
-    const rawJobId = ctx.params['jobId'];
-    if (rawJobId !== undefined) {
-        if (!isSafeCoreBashJobId(rawJobId)) {
-            throw new ApiError(400, 'invalid_job_id', `invalid background job id: ${JSON.stringify(rawJobId)}`);
-        }
-        return { nodeId, jobId: rawJobId, dir: contextDir(nodeId) };
-    }
-    return { nodeId, dir: contextDir(nodeId) };
-}
-function handleList(ctx) {
-    const { nodeId, dir } = requireTarget(ctx);
-    const now = Date.now();
-    const body = activeBackgroundBashJobs(dir).map((job) => {
-        const pgid = readJobPgid(dir, job.jobId) ?? null;
-        return {
-            job_id: job.jobId,
-            command: job.command,
-            purpose: job.purpose,
-            started_at: new Date(job.startedAtMs).toISOString(),
-            elapsed_ms: Math.max(0, now - job.startedAtMs),
-            pgid,
-            pgid_alive: pgid !== null && isBashJobProcessGroupAlive(pgid),
-        };
-    });
-    return { status: 200, body };
-}
-async function handleStop(ctx) {
-    const { nodeId, jobId, dir } = requireTarget(ctx);
-    if (jobId === undefined)
-        throw new ApiError(400, 'invalid_request', 'a job id is required');
-    const stopped = await stopBackgroundBashJob(dir, jobId);
-    if (stopped.kind === 'missing') {
-        throw new ApiError(404, 'job_not_found', `no background job ${jobId} for ${nodeId}`);
-    }
-    // A presenter's roster can be a snapshot; a row whose job has since finished
-    // (or was already stopped) is gone, not stoppable.
-    if (stopped.kind === 'retired') {
-        throw new ApiError(404, 'job_not_found', `background job ${jobId} for ${nodeId} is no longer running`, { log_path: stopped.logPath });
-    }
-    if (stopped.kind === 'not-stoppable') {
-        throw new ApiError(409, 'job_not_stoppable', `job ${jobId} recorded no trusted process identity`, { log_path: stopped.logPath });
-    }
-    // Match `crtr node bash kill`: retire the job, then send an urgent durable
-    // notice to the owning node. The terminal path sends that notice through the
-    // message endpoint, whose finalized-node gate runs before append; preserve
-    // that same fail-loud behavior here after the job control-plane mutation.
-    assertNotFinalized(nodeId);
-    const paths = bashJobPaths(dir, jobId);
-    const body = `Background bash job ${jobId} was stopped by the user before it finished. Log: ${paths.jobLog}  Command: ${paths.cmdSh}`;
-    enqueueNodeMail(nodeId, {
-        senderNodeId: null,
-        urgency: 'urgent',
-        wake: 1,
-        kind: 'message',
-        label: body.split('\n')[0].slice(0, 120),
-        bodyJson: { body },
-    });
-    const node = getNode(nodeId);
-    if (node !== null && !isBrokerLive(node)) {
-        try {
-            await reviveNode(nodeId, { resume: true, capacity: 'freeze' });
-        }
-        catch { /* the notice remains durable */ }
-    }
-    const result = { node_id: nodeId, job_id: jobId, signaled: stopped.signaled };
-    return { status: 200, body: result };
-}
-export const bashJobRoutes = [
-    { method: 'GET', pattern: '/v1/nodes/:id/jobs', handler: handleList },
-    { method: 'DELETE', pattern: '/v1/nodes/:id/jobs/:jobId', handler: handleStop },
-];
+var c=Object.defineProperty;var a=(d,o)=>c(d,"name",{value:o,configurable:!0});import{enqueueNodeMail as f}from"../../../core/feed/messages.js";import{contextDir as b,isSafeNodeId as m}from"../../../core/canvas/paths.js";import{getNode as p}from"../../../core/canvas/canvas.js";import{isBrokerLive as h}from"../../../core/runtime/model-swap.js";import{assertNotFinalized as g}from"../../../core/runtime/reopen.js";import{reviveNode as w}from"../../../core/runtime/revive.js";import{activeBackgroundBashJobs as _,bashJobPaths as j,isBashJobProcessGroupAlive as I,readJobPgid as v,isSafeBashJobId as k,stopBackgroundBashJob as y}from"../../../core/bash-jobs.js";import{ApiError as s}from"../../../api/index.js";import{notFound as J}from"../../../core/errors.js";function l(d){const o=d.params.id;if(o===void 0||!m(o))throw new s(400,"invalid_node_id",`invalid node id: ${JSON.stringify(o)}`);if(p(o)===null)throw J(`unknown node: ${o}`,{received:o});const n=d.params.jobId;if(n!==void 0){if(!k(n))throw new s(400,"invalid_job_id",`invalid background job id: ${JSON.stringify(n)}`);return{nodeId:o,jobId:n,dir:b(o)}}return{nodeId:o,dir:b(o)}}a(l,"requireTarget");function $(d){const{nodeId:o,dir:e}=l(d),n=Date.now();return{status:200,body:_(e).map(t=>{const i=v(e,t.jobId)??null;return{job_id:t.jobId,command:t.command,purpose:t.purpose,started_at:new Date(t.startedAtMs).toISOString(),elapsed_ms:Math.max(0,n-t.startedAtMs),pgid:i,pgid_alive:i!==null&&I(i)}})}}a($,"handleList");async function B(d){const{nodeId:o,jobId:e,dir:n}=l(d);if(e===void 0)throw new s(400,"invalid_request","a job id is required");const r=await y(n,e);if(r.kind==="missing")throw new s(404,"job_not_found",`no background job ${e} for ${o}`);if(r.kind==="retired")throw new s(404,"job_not_found",`background job ${e} for ${o} is no longer running`,{log_path:r.logPath});if(r.kind==="not-stoppable")throw new s(409,"job_not_stoppable",`job ${e} recorded no trusted process identity`,{log_path:r.logPath});g(o);const t=j(n,e),i=`Background bash job ${e} was stopped by the user before it finished. Log: ${t.jobLog}  Command: ${t.cmdSh}`;f(o,{senderNodeId:null,urgency:"urgent",wake:1,kind:"message",label:i.split(`
+`)[0].slice(0,120),bodyJson:{body:i}});const u=p(o);if(u!==null&&!h(u))try{await w(o,{resume:!0,capacity:"freeze"})}catch{}return{status:200,body:{node_id:o,job_id:e,signaled:r.signaled}}}a(B,"handleStop");const x=[{method:"GET",pattern:"/v1/nodes/:id/jobs",handler:$},{method:"DELETE",pattern:"/v1/nodes/:id/jobs/:jobId",handler:B}];export{x as bashJobRoutes};