@ouro.bot/cli 0.1.0-alpha.252 → 0.1.0-alpha.254

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.254",
+      "changes": [
+        "fix(daemon): orphan-cleanup fallback no longer kills processes from sibling harness instances. On startup, `killOrphanProcesses` scans `ps` for harness entry points (`agent-entry.js`, `daemon-entry.js`, `bluebubbles/entry.js`, `teams-entry.js`) and SIGTERMs them when the pidfile is missing. Previously any matching process was fair game, so a vitest-driven harness run from a sibling worktree (or a parallel Claude Code session running the coverage gate) would terminate the production daemon's children, triggering cascading graceful shutdowns and making production slugger unavailable for seconds-to-minutes at a time. Now the fallback only flags true orphans \u2014 processes whose PPID has been reparented to init (PID 1). Sibling daemons' live-parented children are left alone. New exported helper `parseOrphanPidsFromPs` isolates the filter for direct unit coverage. Complements the test-isolation guard shipped in alpha.253 (#333): that PR stopped tests from SENDING `inner.wake testagent` commands into the production socket; this PR stops the production daemon from SIGTERMing test-spawned child processes during its own startup."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.253",
+      "changes": [
+        "fix(daemon): test-isolation guard \u2014 stop tests from leaking real `inner.wake` commands into the running daemon. A pattern in 36+ test files mocks `getAgentName` to the literal `\"testagent\"` but does NOT mock `socket-client`, so any code path through pondering / rest / coding feedback fires a real socket connection at /tmp/ouroboros-daemon.sock with `inner.wake testagent`. The daemon errored on every command (`Unknown managed agent 'testagent'`) and at flood volumes that contributed to a real outage on the developer's machine. The fix is in `socket-client.ts` itself: detect vitest via `process.argv` (no env vars) and convert all socket operations into safe no-ops. Tests that legitimately exercise the real transport (socket-client.test.ts, daemon-cli-defaults.test.ts) opt out of the guard via a new `__bypassVitestGuardForTests()` setter that lives on globalThis to survive `vi.resetModules()`. New nerves events: `daemon.socket_command_test_blocked`, `daemon.inner_wake_test_blocked`.",
+        "test(contract): new test-isolation contract test ratchets two anti-patterns: (1) test files using `name: \"testagent\"` without mocking socket-client, and (2) test files constructing write paths under the real `~/AgentBundles` via `os.homedir()`. Existing offenders are grandfathered in two allowlists; new offenders fail the build. Follow-up PRs shrink the allowlists toward zero."
+      ]
+    },
     {
       "version": "0.1.0-alpha.252",
       "changes": [

package/dist/heart/daemon/daemon.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OuroDaemon = void 0;
+exports.parseOrphanPidsFromPs = parseOrphanPidsFromPs;
 exports.killOrphanProcesses = killOrphanProcesses;
 exports.writePidfile = writePidfile;
 exports.handleAgentSenseTurn = handleAgentSenseTurn;
@@ -62,13 +63,55 @@ const outlook_types_1 = require("../outlook/outlook-types");
 const outlook_read_1 = require("../outlook/outlook-read");
 const outlook_view_1 = require("../outlook/outlook-view");
 const PIDFILE_PATH = path.join(os.homedir(), ".ouro-cli", "daemon.pids");
+/**
+ * Scan `ps -eo pid,ppid,command` output for daemon-owned entry points whose
+ * parent has died (PPID reparented to init/PID 1). Returns the list of PIDs
+ * that are safe to SIGTERM — true orphans, not children of live sibling
+ * daemons running from worktrees, test suites, or other users of the harness.
+ *
+ * Exported so unit tests can exercise the filter without shelling out.
+ */
+function parseOrphanPidsFromPs(psOutput, selfPid) {
+    const orphans = [];
+    for (const line of psOutput.split("\n")) {
+        // Explicitly exclude MCP server processes — they share a harness entry
+        // point but are not daemon children and must never be killed.
+        if (line.includes("mcp-serve") || line.includes("mcp serve"))
+            continue;
+        // Match only daemon-owned JS entry points.
+        if (!line.includes("agent-entry.js")
+            && !line.includes("daemon-entry.js")
+            && !line.includes("bluebubbles/entry.js")
+            && !line.includes("teams-entry.js"))
+            continue;
+        // Parse `<pid> <ppid> <command...>`. ps pads these with leading spaces.
+        // Regex guarantees both groups are \d+ so parseInt can't produce NaN.
+        const match = line.trim().match(/^(\d+)\s+(\d+)\s/);
+        if (!match)
+            continue;
+        const pid = parseInt(match[1], 10);
+        const ppid = parseInt(match[2], 10);
+        if (pid === selfPid)
+            continue;
+        // CRITICAL: only kill processes whose parent is init (PID 1). A live
+        // PPID means the process belongs to another daemon instance (parallel
+        // test run, sibling worktree, another user of /tmp/ouroboros-daemon.sock).
+        // Killing those will crash unrelated harnesses — we saw this in B6
+        // when a vitest worker's daemon killed slugger's production children.
+        if (ppid !== 1)
+            continue;
+        orphans.push(pid);
+    }
+    return orphans;
+}
 /**
  * Kill all ouro processes from the previous daemon instance using the pidfile.
  * On startup, reads PIDs from ~/.ouro-cli/daemon.pids, kills them all, then
  * deletes the file. The new daemon writes its own PIDs after spawning.
  *
- * Falls back to ps-based scanning if the pidfile doesn't exist (first run
- * or manual cleanup).
+ * Falls back to ps-based scanning scoped to true orphans (PPID=1) if the
+ * pidfile doesn't exist (first run, previous daemon crashed before writing,
+ * manual cleanup). The scope is narrow on purpose — see parseOrphanPidsFromPs.
  */
 /* v8 ignore start -- process lifecycle: uses kill/ps, tested via deployment @preserve */
 function killOrphanProcesses() {
@@ -81,22 +124,12 @@ function killOrphanProcesses() {
             fs.unlinkSync(PIDFILE_PATH);
         }
         catch {
-            // No pidfile — fall back to ps scan
+            // No pidfile — fall back to ps scan (scoped to orphans with PPID=1).
         }
-        // Fallback: scan ps for daemon-owned processes only (not MCP servers or external tools)
         if (pidsToKill.length === 0) {
             try {
-                const result = (0, child_process_1.execSync)("ps -eo pid,command", { encoding: "utf-8", timeout: 5000 });
-                for (const line of result.split("\n")) {
-                    // Only match daemon-owned entry points, NOT mcp-serve or other external processes
-                    if (line.includes("mcp-serve") || line.includes("mcp serve"))
-                        continue;
-                    if (!line.includes("agent-entry.js") && !line.includes("daemon-entry.js") && !line.includes("bluebubbles/entry.js") && !line.includes("teams-entry.js"))
-                        continue;
-                    const pid = parseInt(line.trim(), 10);
-                    if (!isNaN(pid) && pid !== process.pid)
-                        pidsToKill.push(pid);
-                }
+                const result = (0, child_process_1.execSync)("ps -eo pid,ppid,command", { encoding: "utf-8", timeout: 5000 });
+                pidsToKill = parseOrphanPidsFromPs(result, process.pid);
             }
             catch { /* ps failed — best effort */ }
         }

package/dist/heart/daemon/socket-client.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_DAEMON_SOCKET_PATH = void 0;
+exports.__bypassVitestGuardForTests = __bypassVitestGuardForTests;
 exports.sendDaemonCommand = sendDaemonCommand;
 exports.checkDaemonSocketAlive = checkDaemonSocketAlive;
 exports.requestInnerWake = requestInnerWake;
@@ -41,7 +42,50 @@ const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
 const runtime_1 = require("../../nerves/runtime");
 exports.DEFAULT_DAEMON_SOCKET_PATH = "/tmp/ouroboros-daemon.sock";
+/**
+ * Defense-in-depth: detect if we're running under vitest. Tests that forget
+ * to `vi.mock("../../heart/daemon/socket-client")` would otherwise leak real
+ * `inner.wake` commands (with whatever literal agent name the test uses,
+ * commonly "testagent") into whichever real daemon happens to be running on
+ * the developer's machine. That has caused real outages when test loops
+ * flooded the production-on-localhost daemon.
+ *
+ * We detect vitest via `process.argv` (not env vars — the project bans those)
+ * and convert all socket operations into safe no-ops. Individual tests are
+ * still expected to vi.mock this module so they can assert on call counts,
+ * but this guard guarantees that "I forgot to mock" can never again take
+ * down the daemon.
+ *
+ * The socket-client's OWN tests (which exercise the real functions against a
+ * test socket) call `__bypassVitestGuardForTests(true)` to opt out of the
+ * guard. We persist that flag on globalThis so it survives `vi.resetModules`
+ * (which clears the module cache between tests).
+ */
+const BYPASS_KEY = "__ouro_socket_client_bypass_vitest_guard__";
+/** ONLY for socket-client.test.ts. Do not call from any other test or production code. */
+function __bypassVitestGuardForTests(bypass) {
+    ;
+    globalThis[BYPASS_KEY] = bypass;
+}
+function isUnderVitest() {
+    if (globalThis[BYPASS_KEY] === true)
+        return false;
+    /* v8 ignore next -- defensive: process and process.argv always exist in node @preserve */
+    if (typeof process === "undefined" || !Array.isArray(process.argv))
+        return false;
+    return process.argv.some((arg) => typeof arg === "string" && arg.includes("vitest"));
+}
 function sendDaemonCommand(socketPath, command) {
+    if (isUnderVitest()) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.socket_command_test_blocked",
+            message: "blocked socket command from leaking into real daemon under vitest",
+            meta: { socketPath, kind: command.kind },
+        });
+        return Promise.resolve({ ok: true, message: "test mode: socket call suppressed" });
+    }
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.socket_command_start",
@@ -132,6 +176,9 @@ function sendDaemonCommand(socketPath, command) {
     });
 }
 function checkDaemonSocketAlive(socketPath) {
+    if (isUnderVitest()) {
+        return Promise.resolve(false);
+    }
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.socket_alive_check_start",
@@ -184,6 +231,16 @@ function checkDaemonSocketAlive(socketPath) {
     });
 }
 async function requestInnerWake(agent, socketPath = exports.DEFAULT_DAEMON_SOCKET_PATH) {
+    if (isUnderVitest()) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.inner_wake_test_blocked",
+            message: "blocked inner wake from leaking into real daemon under vitest",
+            meta: { agent, socketPath },
+        });
+        return null;
+    }
     const socketAvailable = fs.existsSync(socketPath);
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.252",
+  "version": "0.1.0-alpha.254",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",