@ouro.bot/cli 0.1.0-alpha.265 → 0.1.0-alpha.266

package/changelog.json

@@ -1,6 +1,12 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.266",
+      "changes": [
+        "fix(daemon): vitest guard for production pidfile (~/.ouro-cli/daemon.pids). The pidfile path is hardcoded with no DI seam, so when a test creates a real OuroDaemon instance and calls start(), the daemon's killOrphanProcesses() reads the REAL pidfile, ps-verifies the PIDs, and SIGTERMs the production daemon's PIDs. Verified live: alpha.265 daemon (PID 64988) was killed 93s after startup by `npx vitest run` invoking daemon.start() in 6 different test files. SIGTERM forensics added in alpha.265 captured the death (parentPid=1, parentCommand=/sbin/launchd) but the killer hint was misleading — the real culprit was the production-pidfile leak. Fix: killOrphanProcesses() and writePidfile() now short-circuit under vitest with warn-level nerves events. Tests that need to verify these functions' behavior continue to use the extracted pure helpers (parseOrphanPidsFromPs, filterPidfilePidsToActualOrphans). New unit tests verify the pidfile is unchanged after no-op calls. Same defense-in-depth pattern as the alpha.265 socket-client hardening — production-side state being touched from tests is now physically impossible from a vitest worker."
+      ]
+    },
     {
       "version": "0.1.0-alpha.265",
       "changes": [

package/dist/heart/daemon/daemon.js

@@ -64,6 +64,26 @@ const outlook_types_1 = require("../outlook/outlook-types");
 const outlook_read_1 = require("../outlook/outlook-read");
 const outlook_view_1 = require("../outlook/outlook-view");
 const PIDFILE_PATH = path.join(os.homedir(), ".ouro-cli", "daemon.pids");
+/**
+ * Defense-in-depth: detect if we're running under vitest. The pidfile lives
+ * at a hardcoded path under the user's real ~/.ouro-cli/ — there's no DI
+ * seam to redirect it. So when a test creates a real OuroDaemon and calls
+ * start(), the daemon's killOrphanProcesses() reads the REAL pidfile,
+ * ps-verifies the PIDs, and SIGTERMs the production daemon. We saw this
+ * cause an outage on 2026-04-08 (alpha.265 daemon killed 93s after startup
+ * by a vitest test that called daemon.start()).
+ *
+ * Both killOrphanProcesses() and writePidfile() short-circuit under vitest
+ * to make the production pidfile sacred. Tests that need to verify these
+ * functions' behavior should use the extracted pure helpers
+ * (parseOrphanPidsFromPs, filterPidfilePidsToActualOrphans).
+ */
+function isVitestProcess() {
+    /* v8 ignore next -- defensive: process and process.argv always exist in node @preserve */
+    if (typeof process === "undefined" || !Array.isArray(process.argv))
+        return false;
+    return process.argv.some((arg) => typeof arg === "string" && arg.includes("vitest"));
+}
 /**
  * Scan `ps -eo pid,ppid,command` output for daemon-owned entry points whose
  * parent has died (PPID reparented to init/PID 1). Returns the list of PIDs
@@ -170,6 +190,16 @@ function runPsCheck(pids) {
  */
 /* v8 ignore start -- process lifecycle: uses kill/ps, tested via deployment @preserve */
 function killOrphanProcesses() {
+    if (isVitestProcess()) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.orphan_cleanup_test_blocked",
+            message: "blocked killOrphanProcesses from touching real pidfile under vitest",
+            meta: { pidfilePath: PIDFILE_PATH },
+        });
+        return;
+    }
     try {
         let pidsToKill = [];
         // Primary: read pidfile from previous daemon
@@ -223,6 +253,16 @@ function killOrphanProcesses() {
  * Called after all agents and senses are spawned.
  */
 function writePidfile(extraPids = []) {
+    if (isVitestProcess()) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "daemon",
+            event: "daemon.write_pidfile_test_blocked",
+            message: "blocked writePidfile from clobbering real pidfile under vitest",
+            meta: { pidfilePath: PIDFILE_PATH, attemptedPids: extraPids.length },
+        });
+        return;
+    }
     try {
         const pids = [process.pid, ...extraPids].filter(Boolean);
         fs.mkdirSync(path.dirname(PIDFILE_PATH), { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.265",
+  "version": "0.1.0-alpha.266",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",