@ouro.bot/cli 0.1.0-alpha.263 → 0.1.0-alpha.265

package/changelog.json

@@ -1,6 +1,20 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.265",
+      "changes": [
+        "fix(daemon): bulletproof vitest socket leak + SIGTERM forensics. Hardens the socket-client vitest guard so production daemon socket calls (DEFAULT_DAEMON_SOCKET_PATH = /tmp/ouroboros-daemon.sock) are unconditionally blocked under vitest, regardless of __bypassVitestGuardForTests state. Cross-file leaks via the globalThis bypass flag (process-wide, leaks across concurrent test files in the same vitest worker) can no longer reach the production daemon. Test files that legitimately exercise the real socket-client transport against synthetic test socket paths (/tmp/daemon.sock) continue to work. Background: a daemon outage on 2026-04-08 was traced to a 14-call burst of leaked `inner.wake testagent` errors, signature of vitest test runs hammering the production socket — same pattern as 1,460 historical daemon log entries.",
+        "feat(daemon): SIGTERM/SIGINT tombstone forensics. New writeDaemonTombstone path captures process.ppid, parent command via `ps -p <ppid> -o command=`, and a filtered process snapshot (only node/vitest/ouro/kill lines) at signal-driven death time. Adds a killerHint heuristic: launchd parent reparenting suggests `launchctl bootout`/KeepAlive thrash; vitest worker presence suggests test cleanup; pkill/killall presence is an explicit kill. Forensics field is parsed by readDaemonTombstone and included in the daemon.tombstone_written nerves event meta. Also caps recentCrashes at 100 entries (was 12,265 from a March 31 thrash loop).",
+        "test(daemon): contract test BYPASS_USE_ALLOWLIST flags any new file calling __bypassVitestGuardForTests outside the two known-good test files (socket-client.test.ts and daemon-cli-defaults.test.ts). Prevents future regressions of the cross-file leak vector."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.264",
+      "changes": [
+        "fix(bluebubbles): dedup `updated-message` webhooks BEFORE running repair+hydrate+VLM. BlueBubbles routinely sends a `new-message` webhook for a fresh message, then follows up seconds later with one or more `updated-message` webhooks for delivery/read status. The BB sense's `repairEvent` path promotes updated-message events with recoverable content back to `message` kind, which re-runs the full hydration pipeline \u2014 including a second MiniMax VLM describe call on the same image. Verified live on 2026-04-08T00:58Z: two sequential VLM describes for attachment guid 317E37EB-..., 13.7s + 14.0s each, for the exact same 291KB JPEG, triggered by a `new-message` followed 3s later by an `updated-message` for the same guid. The downstream `handleBlueBubblesNormalizedEvent` dedup check was firing correctly but too late (after the expensive VLM round-trip). Fix: add a pre-repair dedup check in `handleBlueBubblesEvent` that consults the inbound sidecar by messageGuid and short-circuits before calling `client.repairEvent(...)`. New nerves event `senses.bluebubbles_repair_skipped_duplicate` at warn level for observability."
+      ]
+    },
     {
       "version": "0.1.0-alpha.263",
       "changes": [

package/dist/heart/daemon/daemon-tombstone.js

@@ -33,14 +33,19 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECENT_CRASHES_MAX = void 0;
 exports.getTombstonePath = getTombstonePath;
 exports.setTombstonePath = setTombstonePath;
+exports.captureDeathForensics = captureDeathForensics;
 exports.writeDaemonTombstone = writeDaemonTombstone;
 exports.readDaemonTombstone = readDaemonTombstone;
+const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
+/** Maximum number of historical crash timestamps to retain in the tombstone. */
+exports.RECENT_CRASHES_MAX = 100;
 let _tombstonePath = null;
 function getTombstonePath() {
     if (!_tombstonePath) {
@@ -52,7 +57,84 @@ function getTombstonePath() {
 function setTombstonePath(p) {
     _tombstonePath = p;
 }
-function writeDaemonTombstone(reason, error) {
+/* v8 ignore start -- shells out to ps; covered via injected runPs in unit tests @preserve */
+function defaultRunPs(args) {
+    try {
+        return (0, child_process_1.execSync)(`ps ${args.join(" ")}`, { encoding: "utf-8", timeout: 2000 });
+    }
+    catch {
+        return null;
+    }
+}
+/* v8 ignore stop */
+const DEFAULT_FORENSICS_DEPS = {
+    /* v8 ignore next -- defensive: process.ppid always exists in node @preserve */
+    ppid: () => (typeof process !== "undefined" && typeof process.ppid === "number" ? process.ppid : 0),
+    runPs: defaultRunPs,
+};
+/**
+ * Capture forensic data about who is likely to have killed the daemon.
+ * Synchronous and best-effort: never throws, always returns a structured
+ * record (with nulls if anything failed). Called from inside SIGTERM/SIGINT
+ * handlers, so it must be fast and have no async dependencies.
+ */
+function captureDeathForensics(deps = DEFAULT_FORENSICS_DEPS) {
+    const parentPid = (() => {
+        try {
+            const p = deps.ppid();
+            return typeof p === "number" && p > 0 ? p : null;
+        }
+        catch {
+            return null;
+        }
+    })();
+    let parentCommand = null;
+    if (parentPid !== null) {
+        const psParent = deps.runPs(["-p", String(parentPid), "-o", "command="]);
+        if (psParent !== null) {
+            const trimmed = psParent.trim();
+            parentCommand = trimmed.length > 0 ? trimmed : null;
+        }
+    }
+    const processSnapshot = (() => {
+        const psAll = deps.runPs(["-eo", "pid,ppid,command"]);
+        if (psAll === null)
+            return null;
+        const lines = psAll.split("\n");
+        // Filter for relevant processes only — node, vitest, ouro, kill commands.
+        // Keeps the snapshot small and human-scannable.
+        const relevant = lines.filter((line) => {
+            const lower = line.toLowerCase();
+            return (lower.includes("node")
+                || lower.includes("vitest")
+                || lower.includes("ouro")
+                || lower.includes("/kill ")
+                || lower.includes("pkill")
+                || lower.includes("killall"));
+        });
+        if (relevant.length === 0)
+            return null;
+        return relevant.join("\n");
+    })();
+    const killerHint = deriveKillerHint(parentCommand, processSnapshot);
+    return { parentPid, parentCommand, processSnapshot, killerHint };
+}
+function deriveKillerHint(parentCommand, snapshot) {
+    if (parentCommand !== null && parentCommand.toLowerCase().includes("launchd")) {
+        return "process was reparented to launchd — likely killed by launchctl bootout, KeepAlive thrash, or memory pressure";
+    }
+    if (snapshot !== null) {
+        const lower = snapshot.toLowerCase();
+        if (lower.includes("vitest")) {
+            return "vitest worker is running — possible test cleanup killing detached processes";
+        }
+        if (lower.includes("pkill") || lower.includes("killall")) {
+            return "saw pkill/killall in process list — explicit kill command";
+        }
+    }
+    return null;
+}
+function writeDaemonTombstone(reason, error, forensicsDeps) {
     const now = new Date().toISOString();
     const filePath = getTombstonePath();
     // Read existing recentCrashes from previous tombstone (best-effort)
@@ -67,6 +149,17 @@ function writeDaemonTombstone(reason, error) {
     catch {
         // No existing tombstone or unreadable — start fresh
     }
+    // Append the new crash and cap at the most recent RECENT_CRASHES_MAX entries
+    // so the tombstone doesn't grow without bound (we saw it hit 12,265 entries
+    // after a March 31 crash-restart thrash loop).
+    const recentCrashes = [...existingCrashes, now].slice(-exports.RECENT_CRASHES_MAX);
+    // Forensics: only meaningful for signal-driven deaths (sigterm/sigint).
+    // For uncaughtException etc. we skip the snapshot to keep tombstone writes
+    // fast on the unhappy path.
+    const shouldCaptureForensics = reason === "sigterm" || reason === "sigint";
+    const forensics = shouldCaptureForensics
+        ? captureDeathForensics(forensicsDeps)
+        : undefined;
     const tombstone = {
         reason,
         message: error?.message ?? reason,
@@ -74,7 +167,8 @@ function writeDaemonTombstone(reason, error) {
         timestamp: now,
         pid: process.pid,
         uptimeSeconds: Math.floor(process.uptime()),
-        recentCrashes: [...existingCrashes, now],
+        recentCrashes,
+        ...(forensics ? { forensics } : {}),
     };
     try {
         fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -88,7 +182,13 @@ function writeDaemonTombstone(reason, error) {
         component: "daemon",
         event: "daemon.tombstone_written",
         message: `daemon tombstone written: ${reason}`,
-        meta: { reason, errorMessage: error?.message ?? null, filePath },
+        meta: {
+            reason,
+            errorMessage: error?.message ?? null,
+            filePath,
+            parentPid: forensics?.parentPid ?? null,
+            killerHint: forensics?.killerHint ?? null,
+        },
     });
 }
 function readDaemonTombstone() {
@@ -105,6 +205,7 @@ function readDaemonTombstone() {
             message: "read daemon tombstone",
             meta: { filePath },
         });
+        const forensics = parseForensics(parsed.forensics);
         return {
             reason: parsed.reason,
             message: typeof parsed.message === "string" ? parsed.message : String(parsed.reason),
@@ -115,9 +216,21 @@ function readDaemonTombstone() {
             recentCrashes: Array.isArray(parsed.recentCrashes)
                 ? parsed.recentCrashes.filter((e) => typeof e === "string")
                 : [],
+            ...(forensics ? { forensics } : {}),
         };
     }
     catch {
         return null;
     }
 }
+function parseForensics(value) {
+    if (value === null || typeof value !== "object")
+        return null;
+    const v = value;
+    return {
+        parentPid: typeof v.parentPid === "number" ? v.parentPid : null,
+        parentCommand: typeof v.parentCommand === "string" ? v.parentCommand : null,
+        processSnapshot: typeof v.processSnapshot === "string" ? v.processSnapshot : null,
+        killerHint: typeof v.killerHint === "string" ? v.killerHint : null,
+    };
+}

package/dist/heart/daemon/socket-client.js

@@ -60,6 +60,23 @@ exports.DEFAULT_DAEMON_SOCKET_PATH = "/tmp/ouroboros-daemon.sock";
  * test socket) call `__bypassVitestGuardForTests(true)` to opt out of the
  * guard. We persist that flag on globalThis so it survives `vi.resetModules`
  * (which clears the module cache between tests).
+ *
+ * HARDENING (cross-file leak protection): the bypass flag lives on globalThis
+ * and is process-wide. With vitest's default `fileParallelism: true`,
+ * concurrently-running test files in the same worker can have the bypass on
+ * even though they didn't ask for it — and any test that uses
+ * `name: "testagent"` and exercises a code path through this module will
+ * leak `inner.wake testagent` to the production daemon socket. We saw this
+ * cause a real outage on 2026-04-08 (daemon SIGTERMed mid-validation).
+ *
+ * Defense: even when the bypass flag is set, we ALWAYS hard-block calls that
+ * target the production daemon socket path. Test files that legitimately
+ * exercise the real socket-client code paths use a synthetic socket path like
+ * `/tmp/daemon.sock` or `/tmp/some-real-daemon.sock` — those keep working.
+ * Calls to `/tmp/ouroboros-daemon.sock` (DEFAULT_DAEMON_SOCKET_PATH) under
+ * vitest are unconditionally blocked, regardless of bypass state. This makes
+ * the cross-file leak vector impossible without restricting legitimate
+ * socket-client unit tests.
  */
 const BYPASS_KEY = "__ouro_socket_client_bypass_vitest_guard__";
 /** ONLY for socket-client.test.ts. Do not call from any other test or production code. */
@@ -67,22 +84,36 @@ function __bypassVitestGuardForTests(bypass) {
     ;
     globalThis[BYPASS_KEY] = bypass;
 }
-function isUnderVitest() {
-    if (globalThis[BYPASS_KEY] === true)
-        return false;
+function isVitestProcess() {
     /* v8 ignore next -- defensive: process and process.argv always exist in node @preserve */
     if (typeof process === "undefined" || !Array.isArray(process.argv))
         return false;
     return process.argv.some((arg) => typeof arg === "string" && arg.includes("vitest"));
 }
+function isProductionDaemonSocket(socketPath) {
+    return socketPath === exports.DEFAULT_DAEMON_SOCKET_PATH;
+}
+/**
+ * Returns true when this socket call should be converted into a safe no-op
+ * because we're under vitest and the call would otherwise leak into a real
+ * daemon. The bypass flag short-circuits the guard for non-production socket
+ * paths only — production socket paths are ALWAYS blocked under vitest.
+ */
+function shouldSuppressSocketCall(socketPath) {
+    if (!isVitestProcess())
+        return false;
+    if (isProductionDaemonSocket(socketPath))
+        return true;
+    return globalThis[BYPASS_KEY] !== true;
+}
 function sendDaemonCommand(socketPath, command) {
-    if (isUnderVitest()) {
+    if (shouldSuppressSocketCall(socketPath)) {
         (0, runtime_1.emitNervesEvent)({
             level: "warn",
             component: "daemon",
             event: "daemon.socket_command_test_blocked",
             message: "blocked socket command from leaking into real daemon under vitest",
-            meta: { socketPath, kind: command.kind },
+            meta: { socketPath, kind: command.kind, isProductionSocket: isProductionDaemonSocket(socketPath) },
         });
         return Promise.resolve({ ok: true, message: "test mode: socket call suppressed" });
     }
@@ -191,7 +222,7 @@ function sendDaemonCommand(socketPath, command) {
     });
 }
 function checkDaemonSocketAlive(socketPath) {
-    if (isUnderVitest()) {
+    if (shouldSuppressSocketCall(socketPath)) {
         return Promise.resolve(false);
     }
     (0, runtime_1.emitNervesEvent)({
@@ -248,13 +279,13 @@ function checkDaemonSocketAlive(socketPath) {
     });
 }
 async function requestInnerWake(agent, socketPath = exports.DEFAULT_DAEMON_SOCKET_PATH) {
-    if (isUnderVitest()) {
+    if (shouldSuppressSocketCall(socketPath)) {
         (0, runtime_1.emitNervesEvent)({
             level: "warn",
             component: "daemon",
             event: "daemon.inner_wake_test_blocked",
             message: "blocked inner wake from leaking into real daemon under vitest",
-            meta: { agent, socketPath },
+            meta: { agent, socketPath, isProductionSocket: isProductionDaemonSocket(socketPath) },
         });
         return null;
     }

package/dist/senses/bluebubbles/index.js

@@ -859,7 +859,43 @@ async function handleBlueBubblesNormalizedEvent(event, resolvedDeps, source) {
 async function handleBlueBubblesEvent(payload, deps = {}) {
     const resolvedDeps = { ...defaultDeps, ...deps };
     const client = resolvedDeps.createClient();
-    const event = await client.repairEvent((0, model_1.normalizeBlueBubblesEvent)(payload));
+    const normalized = (0, model_1.normalizeBlueBubblesEvent)(payload);
+    // Pre-repair dedup: if we've already processed this messageGuid, skip the
+    // repair+hydrate path entirely. Applies to BOTH `kind: "message"` AND
+    // `kind: "mutation"` events — BlueBubbles often sends a `new-message`
+    // webhook for a fresh message AND one or more follow-up `updated-message`
+    // webhooks for delivery/read status. The mutation path (inside repairEvent)
+    // can promote an updated-message back to a message if it has recoverable
+    // content, which then re-runs the full VLM-describe pipeline on the same
+    // attachment.
+    //
+    // Without this early check, we paid DOUBLE latency and double tokens on
+    // every image-bearing message. Verified live on 2026-04-08T00:58Z: two
+    // sequential VLM describes for attachment guid 317E37EB-..., 13.7s +
+    // 14.0s each, for the exact same 291KB JPEG — triggered by a sequence of
+    // `new-message` followed ~3s later by `updated-message` for the same guid.
+    //
+    // We still route the skip through `handleBlueBubblesNormalizedEvent` so
+    // the downstream `already_processed` path fires its observability events
+    // and the caller sees a consistent return shape.
+    const agentName = resolvedDeps.getAgentName();
+    if (normalized.messageGuid
+        && (0, inbound_log_1.hasRecordedBlueBubblesInbound)(agentName, normalized.chat.sessionKey, normalized.messageGuid)) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "senses",
+            event: "senses.bluebubbles_repair_skipped_duplicate",
+            message: "skipped repair+hydrate for already-processed bluebubbles messageGuid",
+            meta: {
+                messageGuid: normalized.messageGuid,
+                sessionKey: normalized.chat.sessionKey,
+                eventType: normalized.eventType,
+                normalizedKind: normalized.kind,
+            },
+        });
+        return handleBlueBubblesNormalizedEvent(normalized, resolvedDeps, "webhook");
+    }
+    const event = await client.repairEvent(normalized);
     return handleBlueBubblesNormalizedEvent(event, resolvedDeps, "webhook");
 }
 function countPendingRecoveryCandidates(agentName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.263",
+  "version": "0.1.0-alpha.265",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",