@ouro.bot/cli 0.1.0-alpha.258 → 0.1.0-alpha.259

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.259",
+      "changes": [
+        "fix(daemon): SIGINT and SIGTERM now ALWAYS write a tombstone before exiting, instead of silently skipping when `_gracefulShutdown` was set. The previous behavior made signal-driven shutdowns invisible in `~/.ouro-cli/daemon-death.json` \u2014 launchd policy decisions, the OOM killer, manual `kill`, and `killOrphanProcesses` from a sibling daemon all looked identical to a clean exit. After a real outage where the user's daemon kept dying with a tombstone from a week earlier, this restores observability: every signal-driven exit now records `reason: \"sigint\"` or `reason: \"sigterm\"` with timestamp + recentCrashes accumulator. The catch-all `process.on('exit')` handler also no longer short-circuits on graceful shutdown."
+      ]
+    },
     {
       "version": "0.1.0-alpha.258",
       "changes": [

package/dist/heart/daemon/daemon-entry.js

@@ -195,7 +195,15 @@ void daemon.start().then(() => {
     process.exit(1);
 });
 process.on("SIGINT", () => {
-    _gracefulShutdown = true;
+    // ALWAYS write a tombstone, even on signal-driven shutdown. The previous
+    // behavior was to set _gracefulShutdown=true and skip the tombstone, which
+    // meant ANY external SIGINT/SIGTERM (launchd policy, OOM killer, manual
+    // kill, killOrphanProcesses from a sibling daemon) silently disappeared
+    // from the death log. The user lost weeks of visibility into why their
+    // daemon kept dying. Tombstones are informational — having a "sigint"
+    // tombstone is strictly better than silence.
+    _tombstoneWritten = true;
+    (0, daemon_tombstone_1.writeDaemonTombstone)("sigint", new Error("daemon received SIGINT"));
     for (const s of habitSchedulers) {
         s.stopWatching();
         s.stop();
@@ -204,7 +212,8 @@ process.on("SIGINT", () => {
     void daemon.stop().then(() => process.exit(0));
 });
 process.on("SIGTERM", () => {
-    _gracefulShutdown = true;
+    _tombstoneWritten = true;
+    (0, daemon_tombstone_1.writeDaemonTombstone)("sigterm", new Error("daemon received SIGTERM"));
     for (const s of habitSchedulers) {
         s.stopWatching();
         s.stop();
@@ -221,7 +230,6 @@ process.stderr?.on?.("error", () => { });
 /* v8 ignore start -- global exception handlers: genuinely untestable in vitest; exercised by real daemon crashes @preserve */
 let _uncaughtCount = 0;
 let _tombstoneWritten = false;
-let _gracefulShutdown = false;
 let _lastKnownCause = null;
 const CIRCUIT_BREAKER_WINDOW_MS = 60_000;
 const CIRCUIT_BREAKER_MAX = 10;
@@ -270,8 +278,14 @@ process.on("unhandledRejection", (reason) => {
 });
 // Catch-all: write tombstone on any exit where we didn't already record the cause.
 // process.on('exit') is synchronous-only — writeDaemonTombstone uses writeFileSync, so it works.
+//
+// Previously this skipped writing if `_gracefulShutdown` was true, which made
+// SIGINT/SIGTERM-driven exits invisible in the death log. The signal handlers
+// above now always write their own tombstone before exiting, so this catch-all
+// only runs for exits the signal handlers didn't reach (e.g. process.exit
+// called from somewhere unexpected).
 process.on("exit", (code) => {
-    if (_tombstoneWritten || _gracefulShutdown)
+    if (_tombstoneWritten)
         return;
     const reason = code === 0 ? "unexpectedCleanExit" : "unexpectedExit";
     const error = _lastKnownCause ?? new Error(`daemon exited with code ${code} (no specific cause captured)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.258",
+  "version": "0.1.0-alpha.259",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",