@ouro.bot/cli 0.1.0-alpha.259 → 0.1.0-alpha.260

package/changelog.json

@@ -1,6 +1,15 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.260",
+      "changes": [
+        "fix(daemon): MCP bridge empty-response bug for long-running commands. `sendDaemonCommand` and `checkDaemonSocketAlive` were calling `client.end()` immediately after writing, which half-closed the TCP connection. The daemon server's `net.createServer()` uses the default `allowHalfOpen: false`, so when it saw the client's FIN it auto-closed its own writable side — and any response the server tried to write after processing a long-running command (like `agent.senseTurn`, which runs a full LLM turn) was dropped on the floor. Verified via direct socket repro: with `client.end()`, `agent.senseTurn` returned empty in ~149ms; without it, the same call returned a real response in ~5.8s. This was a silent regression of the fix in #303 (commit `253e4b1f` titled \"socket half-close fix\" actually *added* the half-close back). Fix: drop the `client.end()` calls from both sites AND set `allowHalfOpen: true` on the daemon's `net.createServer(...)` as defense-in-depth so future clients calling `end()` don't silently break again.",
+        "fix(daemon): tighten pidfile trust — `killOrphanProcesses` now verifies each pidfile PID is an actual orphan (PPID reparented to init/PID 1) before SIGTERMing it. Previously a polluted pidfile (written by a crashed daemon whose PIDs have since been reused by the OS for unrelated processes) could cause mass-kill of unrelated apps. New exported helper `filterPidfilePidsToActualOrphans` provides direct unit coverage.",
+        "fix(daemon, repertoire): rename six `_stop` nerves events to `_end` so they pair correctly with their `_start` counterparts under the nerves audit's start/end pairing rule. Affected: `daemon.thoughts_follow_stop`, `daemon.server_stop`, `daemon.update_checker_stop`, `daemon.mcp_server_stop`, `daemon.habit_scheduler_stop`, `mcp.manager_stop`. The naming was semantically fine (`stop` pairs with `start`), but the audit specifically looks for `_end`/`_error` suffixes. Was producing intermittent audit failures whenever any test run exercised these teardown paths (seen today as flakes on `daemon-socket-errors.test.ts` and `MarkdownStreamer` tests).",
+        "fix(providers): drop the harness-imposed MiniMax VLM timeout entirely. Previously the module defaulted to a 60-second AbortSignal; E2E validation of the BB image fix hit a real VLM request that took >60s to return (same bytes returned in 9.5s on the immediate retry). Raising to 120s would have been arbitrary too \u2014 the correct answer, per the same reasoning as PR #322 for LLM providers, is to not impose a harness ceiling at all. When `timeoutMs` isn't provided, `fetch()` now runs without an AbortSignal and undici's own defaults (headersTimeout + bodyTimeout, both 5 minutes) are the ceiling. Callers that want a tighter bound can still pass an explicit `timeoutMs`. The AbortError path is kept for that case, and the error message adapts to say \"underlying stack default\" when there was no harness-set value."
+      ]
+    },
     {
       "version": "0.1.0-alpha.259",
       "changes": [

package/dist/heart/daemon/daemon.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OuroDaemon = void 0;
 exports.parseOrphanPidsFromPs = parseOrphanPidsFromPs;
+exports.filterPidfilePidsToActualOrphans = filterPidfilePidsToActualOrphans;
 exports.killOrphanProcesses = killOrphanProcesses;
 exports.writePidfile = writePidfile;
 exports.handleAgentSenseTurn = handleAgentSenseTurn;
@@ -104,11 +105,65 @@ function parseOrphanPidsFromPs(psOutput, selfPid) {
     }
     return orphans;
 }
+/**
+ * Given a list of PIDs from the pidfile, return only those that are actual
+ * orphans (PPID reparented to init/PID 1). Protects against a polluted
+ * pidfile killing a PID that the OS has reassigned to an unrelated process.
+ *
+ * Implementation: shells out to `ps -p <csv> -o pid,ppid` for a batch lookup.
+ * Returns the empty list if ps fails — safer to skip cleanup than to
+ * wildcard-kill on a bad read.
+ *
+ * Exported for direct unit coverage.
+ */
+function filterPidfilePidsToActualOrphans(candidatePids, psRunner = runPsCheck) {
+    if (candidatePids.length === 0)
+        return [];
+    const psOutput = psRunner(candidatePids);
+    if (psOutput === null)
+        return [];
+    const survivingOrphans = [];
+    // `ps -p x,y,z -o pid,ppid` emits a header line then one row per found PID.
+    // PIDs not found (already exited) are silently omitted — which is the
+    // correct behavior for us: we only want to kill live orphans.
+    for (const line of psOutput.split("\n")) {
+        const match = line.trim().match(/^(\d+)\s+(\d+)$/);
+        if (!match)
+            continue;
+        const pid = parseInt(match[1], 10);
+        const ppid = parseInt(match[2], 10);
+        if (ppid !== 1)
+            continue;
+        if (!candidatePids.includes(pid))
+            continue;
+        survivingOrphans.push(pid);
+    }
+    return survivingOrphans;
+}
+/* v8 ignore start -- shells out to ps; covered by filterPidfilePidsToActualOrphans unit tests via injected runner @preserve */
+function runPsCheck(pids) {
+    try {
+        const csv = pids.join(",");
+        return (0, child_process_1.execSync)(`ps -p ${csv} -o pid=,ppid=`, { encoding: "utf-8", timeout: 5000 });
+    }
+    catch {
+        // ps returns non-zero when none of the requested PIDs exist. Treat as
+        // "no survivors" rather than an error.
+        return "";
+    }
+}
+/* v8 ignore stop */
 /**
  * Kill all ouro processes from the previous daemon instance using the pidfile.
  * On startup, reads PIDs from ~/.ouro-cli/daemon.pids, kills them all, then
  * deletes the file. The new daemon writes its own PIDs after spawning.
  *
+ * Safety: pidfile contents are verified before being killed — each PID must
+ * be an actual orphan (PPID reparented to init/PID 1) via
+ * `filterPidfilePidsToActualOrphans`. Otherwise a polluted pidfile (written
+ * by a test, or a crashed daemon whose PIDs have since been reused by the
+ * OS) could SIGTERM unrelated processes.
+ *
  * Falls back to ps-based scanning scoped to true orphans (PPID=1) if the
  * pidfile doesn't exist (first run, previous daemon crashed before writing,
  * manual cleanup). The scope is narrow on purpose — see parseOrphanPidsFromPs.
@@ -120,7 +175,12 @@ function killOrphanProcesses() {
         // Primary: read pidfile from previous daemon
         try {
             const raw = fs.readFileSync(PIDFILE_PATH, "utf-8");
-            pidsToKill = raw.split("\n").map((s) => parseInt(s.trim(), 10)).filter((n) => !isNaN(n) && n !== process.pid);
+            const candidates = raw.split("\n")
+                .map((s) => parseInt(s.trim(), 10))
+                .filter((n) => !isNaN(n) && n !== process.pid);
+            // Verify each candidate is an actual live orphan before killing. See
+            // docstring above for why this matters.
+            pidsToKill = filterPidfilePidsToActualOrphans(candidates);
             fs.unlinkSync(PIDFILE_PATH);
         }
         catch {
@@ -421,7 +481,15 @@ class OuroDaemon {
         if (fs.existsSync(this.socketPath)) {
             fs.unlinkSync(this.socketPath);
         }
-        this.server = net.createServer((connection) => {
+        // allowHalfOpen: true lets the server keep its writable side open after
+        // the client sends FIN. Without this, when a client calls `client.end()`
+        // after writing a command, node closes the server's writable side
+        // automatically — so a long-running response (like an agent.senseTurn
+        // LLM turn that takes 5+ seconds) never reaches the client. The
+        // socket-client fix in #303/#334 also removed client.end() on the
+        // sending side, but this option is defense in depth: even if a future
+        // caller half-closes, the server still writes its response correctly.
+        this.server = net.createServer({ allowHalfOpen: true }, (connection) => {
             let raw = "";
             let responded = false;
             /* v8 ignore start — connection error handler requires real socket error @preserve */
@@ -620,9 +688,12 @@ class OuroDaemon {
         }
     }
     async stop() {
+        // Must be named `_end` (not `_stop`) to satisfy the nerves audit's
+        // start/end pairing rule — see src/nerves/coverage/audit-rules.ts.
+        // This is the counterpart to `daemon.server_start` emitted at line 480.
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
-            event: "daemon.server_stop",
+            event: "daemon.server_end",
             message: "stopping daemon server",
             meta: { socketPath: this.socketPath },
         });

package/dist/heart/daemon/socket-client.js

@@ -96,8 +96,23 @@ function sendDaemonCommand(socketPath, command) {
         const client = net.createConnection(socketPath);
         let raw = "";
         client.on("connect", () => {
+            // Write the command + newline delimiter. DO NOT call client.end()
+            // afterwards — the server closes the connection once it has written
+            // its response, which triggers our on("end") handler with the full
+            // response in `raw`.
+            //
+            // Calling client.end() here half-closes the TCP connection. The
+            // daemon server uses net.createServer() with the default
+            // allowHalfOpen: false, so when the server sees the client's FIN it
+            // auto-closes its own writable side — and any response the server
+            // tries to write after processing a long-running command (like
+            // agent.senseTurn, which runs a full LLM turn) gets dropped on the
+            // floor. Verified via repro: with client.end(), agent.senseTurn
+            // returns empty in ~149ms; without it, the same call returns the real
+            // response in ~5.8s. This is a regression of the fix in #303 that
+            // was silently reverted by 253e4b1f (commit titled "socket half-close
+            // fix" but actually *added* the half-close back).
             client.write(JSON.stringify(command) + "\n");
-            client.end();
         });
         client.on("data", (chunk) => {
             raw += chunk.toString("utf-8");
@@ -208,8 +223,10 @@ function checkDaemonSocketAlive(socketPath) {
             });
         }
         client.on("connect", () => {
-            client.write(JSON.stringify({ kind: "daemon.status" }));
-            client.end();
+            // Same half-close rationale as sendDaemonCommand: do NOT call
+            // client.end() here. The server closes after responding and that
+            // triggers the on("end") handler below.
+            client.write(JSON.stringify({ kind: "daemon.status" }) + "\n");
         });
         client.on("data", (chunk) => {
             raw += chunk.toString("utf-8");

package/dist/heart/daemon/thoughts.js

@@ -497,9 +497,12 @@ function followThoughts(sessionPath, onNewTurns, pollIntervalMs = 1000) {
     });
     return () => {
         fs.unwatchFile(sessionPath);
+        // Must be named `_end` (not `_stop`) to satisfy the nerves audit's
+        // start/end pairing rule — see src/nerves/coverage/audit-rules.ts which
+        // pairs `<prefix>_start` with `<prefix>_end` or `<prefix>_error`.
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
-            event: "daemon.thoughts_follow_stop",
+            event: "daemon.thoughts_follow_end",
             message: "stopped following inner dialog session",
             meta: { sessionPath, totalTurns: displayedCount },
         });

package/dist/heart/habits/habit-scheduler.js

@@ -124,9 +124,11 @@ class HabitScheduler {
         }
     }
     stop() {
+        // `_end` (not `_stop`) to pair with `daemon.habit_scheduler_start`
+        // under the nerves audit start/end pairing rule.
         (0, runtime_1.emitNervesEvent)({
             component: "daemon",
-            event: "daemon.habit_scheduler_stop",
+            event: "daemon.habit_scheduler_end",
             message: "habit scheduler stopping",
             meta: { agent: this.agent },
         });

package/dist/heart/mcp/mcp-server.js

@@ -479,9 +479,11 @@ function createMcpServer(options) {
                 return;
             running = false;
             stdin.removeListener("data", onData);
+            // `_end` (not `_stop`) to satisfy the nerves audit's start/end
+            // pairing rule — counterpart to `daemon.mcp_server_start`.
             (0, runtime_1.emitNervesEvent)({
                 component: "daemon",
-                event: "daemon.mcp_server_stop",
+                event: "daemon.mcp_server_end",
                 message: "MCP server stopped",
                 meta: { agent, friendId },
             });

package/dist/heart/providers/minimax-vlm.js

@@ -3,7 +3,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.minimaxVlmDescribe = minimaxVlmDescribe;
 const runtime_1 = require("../../nerves/runtime");
 const error_classification_1 = require("./error-classification");
-const DEFAULT_TIMEOUT_MS = 60_000;
+// No default timeout — if the caller doesn't pass `timeoutMs`, we don't
+// layer an AbortSignal on top of fetch, which means undici's own defaults
+// (headersTimeout and bodyTimeout, both 5 minutes in the current Node) are
+// the ceiling. That's the right ceiling: long enough to tolerate any
+// legitimate MiniMax VLM slow window, short enough to eventually give up on
+// a dead endpoint, and — unlike a number we picked — it's the stack's
+// actual default rather than a harness-imposed fiction.
+//
+// Tests that want to exercise the timeout branch pass an explicit
+// `timeoutMs`; production callers omit it and get undici's behavior.
+//
+// Same reasoning as PR #322 (dropped the 30s SDK timeout from the LLM
+// providers): the harness shouldn't impose artificially tight request
+// ceilings when the underlying stack already has correct defaults.
 const MODEL_NAME = "minimax-vlm";
 const SUPPORTED_DATA_URL_PATTERN = /^data:image\/(png|jpeg|webp);base64,/i;
 function buildVlmUrl(baseURL) {
@@ -90,31 +103,40 @@ async function minimaxVlmDescribe(params) {
         throw new Error(msg);
     }
     const fetchImpl = params.fetchImpl ?? fetch;
-    const timeoutMs = params.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const url = buildVlmUrl(params.baseURL);
     emitStart(params);
     const startTs = Date.now();
+    // Only layer an AbortSignal if the caller explicitly asked for one.
+    // Omitting it lets undici's defaults (headersTimeout + bodyTimeout = 5min
+    // each in current Node) act as the ceiling — see the long comment on
+    // DEFAULT_TIMEOUT_MS above for the rationale.
+    const fetchOptions = {
+        method: "POST",
+        headers: {
+            "Authorization": `Bearer ${params.apiKey}`,
+            "Content-Type": "application/json",
+            "MM-API-Source": "Ouroboros",
+        },
+        body: JSON.stringify({
+            prompt: params.prompt,
+            image_url: params.imageDataUrl,
+        }),
+    };
+    if (typeof params.timeoutMs === "number" && params.timeoutMs > 0) {
+        fetchOptions.signal = AbortSignal.timeout(params.timeoutMs);
+    }
     let response;
     try {
-        response = await fetchImpl(url, {
-            method: "POST",
-            headers: {
-                "Authorization": `Bearer ${params.apiKey}`,
-                "Content-Type": "application/json",
-                "MM-API-Source": "Ouroboros",
-            },
-            body: JSON.stringify({
-                prompt: params.prompt,
-                image_url: params.imageDataUrl,
-            }),
-            signal: AbortSignal.timeout(timeoutMs),
-        });
+        response = await fetchImpl(url, fetchOptions);
     }
     catch (error) {
         const err = (error instanceof Error ? error : new Error(String(error)));
         if (err.name === "AbortError" || err.name === "TimeoutError") {
-            const seconds = Math.round(timeoutMs / 1000);
-            throwAndEmit(params, `minimax VLM: request timed out after ${seconds}s — retry or ask the user to resend the image`);
+            const seconds = typeof params.timeoutMs === "number" ? Math.round(params.timeoutMs / 1000) : null;
+            const hint = seconds !== null
+                ? `request timed out after ${seconds}s — retry or ask the user to resend the image`
+                : `request timed out (underlying stack default) — retry or ask the user to resend the image`;
+            throwAndEmit(params, `minimax VLM: ${hint}`);
         }
         if ((0, error_classification_1.isNetworkError)(err)) {
             throwAndEmit(params, `minimax VLM: network error talking to the vlm endpoint (${err.message}) — retry in a moment`);

package/dist/heart/versioning/update-checker.js

@@ -102,9 +102,11 @@ function stopUpdateChecker() {
         clearInterval(_intervalId);
         _intervalId = null;
     }
+    // `_end` (not `_stop`) to satisfy the nerves audit's start/end pairing
+    // rule — counterpart to `daemon.update_checker_start` above.
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
-        event: "daemon.update_checker_stop",
+        event: "daemon.update_checker_end",
         message: "stopping update checker",
         meta: {},
     });

package/dist/repertoire/mcp-manager.js

@@ -91,8 +91,10 @@ class McpManager {
     /* v8 ignore stop */
     shutdown() {
         this.shuttingDown = true;
+        // `_end` (not `_stop`) to pair with `mcp.manager_start` under the
+        // nerves audit start/end pairing rule.
         (0, runtime_1.emitNervesEvent)({
-            event: "mcp.manager_stop",
+            event: "mcp.manager_end",
             component: "repertoire",
             message: "shutting down MCP manager",
             meta: { serverCount: this.servers.size },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.259",
+  "version": "0.1.0-alpha.260",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",