@promptctl/cc-candybar 1.41.1 → 1.41.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptctl/cc-candybar",
-  "version": "1.41.1",
+  "version": "1.41.3",
   "description": "Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -85,15 +85,15 @@
     "tsdown": "^0.21.4",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "@promptctl/go-template-js": "^0.7.0",
+    "@promptctl/go-template-js": "^0.8.0",
     "@promptctl/rich-js": "^0.7.0",
     "json5": "^2.2.3",
     "mobx": "^6.15.0"
   },
   "optionalDependencies": {
-    "@promptctl/cc-candybar-darwin-arm64": "1.41.1",
-    "@promptctl/cc-candybar-darwin-x64": "1.41.1",
-    "@promptctl/cc-candybar-linux-x64": "1.41.1",
-    "@promptctl/cc-candybar-linux-arm64": "1.41.1"
+    "@promptctl/cc-candybar-darwin-arm64": "1.41.3",
+    "@promptctl/cc-candybar-darwin-x64": "1.41.3",
+    "@promptctl/cc-candybar-linux-x64": "1.41.3",
+    "@promptctl/cc-candybar-linux-arm64": "1.41.3"
   }
 }

package/src/config/dsl-types.ts

@@ -181,9 +181,9 @@ export interface RawDslConfig {
   // per session exactly like theme/style (session key `look`).
   readonly looks?: Readonly<Record<string, ThemeKey>>;
   // [LAW:single-enforcer] Config-level shared helper templates: name → Go-template
-  // body. Each compiles to one `{{ define "name" }}body{{ end }}` block, and the
-  // whole set into a single output-neutral preamble prepended to every template
-  // this config parses — so a formatter (`{{ template "formatCost" .x }}`) is
+  // body. Each compiles to one `{{ define "name" }}body{{ end }}` unit, and the
+  // whole set into one shared define set every template this config parses
+  // inherits — so a formatter (`{{ template "formatCost" .x }}`) is
   // defined ONCE and callable from any segment/predicate, never re-inlined per
   // segment. Absent ≡ no helpers; merges by-name (user overrides a helper).
   readonly helpers?: Readonly<Record<string, string>>;
@@ -240,7 +240,7 @@ export interface DslConfig {
   // [LAW:dataflow-not-control-flow].
   readonly editGlobals: Partial<Globals>;
   // [LAW:single-enforcer] The effective helper set: a name → template-body map
-  // compiled to a defines-preamble at registerDslConfig. Empty when no config
+  // compiled to one shared define set at registerDslConfig. Empty when no config
   // declares helpers — an absent `helpers` key merges to `{}` (same cascade as
   // actions). The single definition site for each formatter/transform a template
   // calls via `{{ template "name" .arg }}`.

package/src/config/loader/helpers.ts

@@ -2,7 +2,7 @@
 // record of name → template-body STRING. Each value is a Go-template source the
 // renderer compiles into a `{{ define }}` block; whether the body PARSES (and
 // whether a `{{ template "name" }}` reference resolves) is a render-time concern
-// (registerDslConfig parses the preamble and throws a per-helper diagnostic).
+// (registerDslConfig parses each helper and throws a per-helper diagnostic).
 // This file changes only if the helper authoring shape changes.
 
 import { findKeyLine } from "./diagnostics.js";

package/src/daemon/cache/render.ts

@@ -61,6 +61,45 @@ export interface RenderDeps {
   watchers: WatcherRegistry;
 }
 
+// [LAW:no-ambient-temporal-coupling] The cache's outward lifecycle signal. A
+// reload is the one event the cache alone knows the completion of — it runs
+// from a debounced fs watcher, on the cache's own schedule — so anything that
+// must run AFTER a reload (an operator log of its outcome, a test asserting
+// on the state it wrote) needs the cache to say so, or it is left betting on
+// a clock. The same named-bag idiom as renderDsl's RenderObservers
+// [LAW:locality-or-seam]: a caller states what it passes by name, and a new
+// observer is one field here, not a constructor signature every caller
+// re-counts.
+export interface RenderCacheObservers {
+  // Fires once per completed reload of an entry — the initial population in
+  // getOrCreate and every watcher-driven reload alike, success (a fresh
+  // `state`) and failure (`lastError` set, prior state preserved) alike —
+  // after the entry's fields and watcher are settled. The entry is handed
+  // over as ReloadedEntry so the observer reads the outcome from the one
+  // place it lives and the type, not this comment, keeps it from writing
+  // there. Trusted non-throwing (the same contract as onSegmentError): an
+  // observer that throws is a caller bug surfaced loudly, never absorbed here.
+  readonly onReload?: (entry: ReloadedEntry) => void;
+}
+
+// [LAW:types-are-the-program] The observer's view of an entry: an ALLOW-LIST
+// of the load's outcome. Nothing that owns a resource — the watcher handle,
+// the SourceRegistry, the validator disposers, the render-cell sink — crosses
+// this seam, so a handle added to either type later is closed by
+// construction, not by remembering to omit it (`Readonly` alone would not:
+// it cannot stop a method call such as `dispose()`).
+export type ReloadedEntry = Readonly<
+  Pick<
+    CacheEntry,
+    | "projectDir"
+    | "cwd"
+    | "configFile"
+    | "configFilePath"
+    | "lastError"
+    | "lastWarning"
+  >
+> & { readonly state: Readonly<Pick<DslRenderState, "config">> | null };
+
 // [LAW:types-are-the-program] The DSL render state for an entry is one
 // optionally-null bundle, not five independently-optional fields. Either
 // every field is populated (a render is possible) or all are null (parse
@@ -154,10 +193,15 @@ export class RenderCache {
   private readonly entries = new Map<string, CacheEntry>();
   private readonly deps: RenderDeps;
   private readonly maxEntries: number;
+  private readonly observers: RenderCacheObservers;
 
-  constructor(deps: RenderDeps, opts: { maxEntries?: number } = {}) {
+  constructor(
+    deps: RenderDeps,
+    opts: { maxEntries?: number; observers?: RenderCacheObservers } = {},
+  ) {
     this.deps = deps;
     this.maxEntries = opts.maxEntries ?? MAX_ENTRIES;
+    this.observers = opts.observers ?? {};
   }
 
   // [LAW:dataflow-not-control-flow] One uniform shape: every entry has the
@@ -188,9 +232,15 @@ export class RenderCache {
       state: null,
       watcher: null,
     };
-    this.reloadInto(entry);
+    // [LAW:single-enforcer] Insert, bound, then load — in that order. From the
+    // moment the entry owns live handles it is reachable for eviction and
+    // dispose, so a throwing observer cannot strand a registry outside the
+    // map, and a reentrant getOrCreate for this key finds the entry under
+    // construction rather than building a duplicate. The bound runs before
+    // the load because it is a fact about the MAP, complete at insertion:
+    // nothing the load does (including an observer throwing) can skip it.
+    // [LAW:dataflow-not-control-flow]
     this.entries.set(key, entry);
-
     if (this.entries.size > this.maxEntries) {
       const oldest = this.entries.keys().next().value;
       if (oldest !== undefined) {
@@ -205,6 +255,7 @@ export class RenderCache {
         this.entries.delete(oldest);
       }
     }
+    this.reloadInto(entry);
 
     return entry;
   }
@@ -220,7 +271,17 @@ export class RenderCache {
   // new DslConfig disposes the old SourceRegistry before constructing a new
   // one. The registry owns timers, watchers, MobX reactions, and git
   // subscriptions — dropping it without dispose leaks every handle.
+  //
+  // [LAW:single-enforcer] One publish point for "this reload completed":
+  // loadFromDisk owns the outcome (it returns through more than one arm),
+  // and this wrapper is the only caller, so the signal structurally cannot
+  // be skipped by whichever arm a reload takes — or by an arm added later.
   private reloadInto(entry: CacheEntry): void {
+    this.loadFromDisk(entry);
+    this.observers.onReload?.(entry);
+  }
+
+  private loadFromDisk(entry: CacheEntry): void {
     const resolvedPath = resolveDslConfigPath(
       entry.projectDir,
       entry.cwd,
@@ -286,7 +347,7 @@ export class RenderCache {
   // store, registry, compiled segments, palette — as one transaction. Any
   // failure inside disposes the partially-built registry so we don't leak
   // timers/watchers from a half-constructed reload, then rethrows so the
-  // caller (reloadInto) preserves the prior `entry.state` unchanged.
+  // caller (loadFromDisk) preserves the prior `entry.state` unchanged.
   private buildState(
     entry: CacheEntry,
     resolvedPath: string | null,
@@ -396,7 +457,7 @@ export class RenderCache {
     // key) are part of the same construction transaction as the registry: any
     // failure (registration, a duplicate-key throw) disposes every handle built
     // so far — registry AND already-installed validators — before rethrowing, so
-    // reloadInto preserves the prior last-known-good with nothing half-installed.
+    // loadFromDisk preserves the prior last-known-good with nothing half-installed.
     const validatorDisposers: Array<() => void> = [];
     try {
       // [LAW:one-source-of-truth] The action runtime reads session.id + current

package/src/daemon/limits.ts

@@ -21,17 +21,18 @@ import { dlog, type DaemonLogger } from "./log";
 // The cap sits at HEAP_CAP_OVER_RSS × the backstop, a margin wide enough that
 // the graceful path fires first under any growth the 60 s poll can see (a
 // burst that doubles RSS inside one poll window can still reach the hard cap).
-// Before this the two were unrelated literals (400 MB heap in
-// each spawner, 512 MB RSS here): a cold daemon seeding a large transcript tree
-// for a dozen sessions blew the heap in seconds, aborted silently, and crash-
-// looped on every render tick while the backstop — a 60 s poll — never got a
-// turn. Raising the env override raises BOTH, because both spawners derive the
-// cap through heapCapMb below. The Rust client mirrors RSS_LIMIT_ENV,
-// DEFAULT_RSS_LIMIT_MB, and HEAP_CAP_OVER_RSS as literals
+// Before this the two were unrelated literals (400 MB heap in each spawner,
+// 512 MB RSS here), and the 2026-09-03 outage found the gap: a daemon holding
+// twenty configs' worth of duplicated helper-template ASTs (since fixed in
+// src/dsl/render.ts compileHelpers) blew the heap in seconds, aborted
+// silently, and crash-looped on every render tick while the backstop — a 60 s
+// poll — never got a turn. Raising the env override raises BOTH, because both
+// spawners derive the cap through heapCapMb below. The Rust client mirrors
+// RSS_LIMIT_ENV, DEFAULT_RSS_LIMIT_MB, and HEAP_CAP_OVER_RSS as literals
 // (rust-client/src/launch.rs); scripts/check-protocol.mjs fails the build on
 // drift.
 export const RSS_LIMIT_ENV = "CC_CANDYBAR_RSS_LIMIT_MB";
-export const DEFAULT_RSS_LIMIT_MB = 2048;
+export const DEFAULT_RSS_LIMIT_MB = 512;
 export const HEAP_CAP_OVER_RSS = 2;
 
 // [LAW:parse-dont-validate] Absent → default; a positive integer → that; present

package/src/daemon/server.ts

@@ -131,11 +131,27 @@ const sessionState = new SessionState();
 const contextProvider = new ContextProvider();
 const metricsProvider = new MetricsProvider();
 const tmuxService = new TmuxService();
-const renderCache = new RenderCache({
-  gitService,
-  sessionState,
-  watchers: watcherRegistry,
-});
+const renderCache = new RenderCache(
+  {
+    gitService,
+    sessionState,
+    watchers: watcherRegistry,
+  },
+  {
+    observers: {
+      // [LAW:no-silent-failure] Every config (re)load's outcome lands in
+      // daemon.log beside the "config change detected" line that preceded it
+      // — the operator's only record of whether a save was picked up cleanly,
+      // kept rendering last-known-good behind an error, or resolved to a
+      // different file. Same info level as the detection line.
+      onReload: (entry) =>
+        dlog(
+          "info",
+          `config loaded projectDir=${entry.projectDir} cwd=${entry.cwd} file=${entry.configFilePath ?? "<bundled default>"} error=${entry.lastError === null ? "none" : JSON.stringify(entry.lastError)} warning=${entry.lastWarning === null ? "none" : JSON.stringify(entry.lastWarning)}`,
+        ),
+    },
+  },
+);
 
 const REQUEST_TIMEOUT_MS = 200;
 const BIN_CHECK_INTERVAL_MS = 60 * 1000;

package/src/dsl/render.ts

@@ -13,7 +13,7 @@
 
 import type { RichText, Palette, ThemeKey } from "@promptctl/rich-js";
 import { ColorSpec, Style, lighten, IDENTITY } from "@promptctl/rich-js";
-import type { Engine, Template } from "@promptctl/go-template-js";
+import { Defines, type Engine, type Template } from "@promptctl/go-template-js";
 import type {
   ValidatedConfig,
   VariableDecl,
@@ -213,38 +213,40 @@ function declareOne(
   }
 }
 
-// ─── Helper preamble ─────────────────────────────────────────────────────────
+// ─── Helpers ─────────────────────────────────────────────────────────────────
 
 // [LAW:single-enforcer] Compile the config's shared helper templates into ONE
-// output-neutral preamble: each name→body becomes a `{{ define "name" }}body{{ end }}`
-// block, concatenated with no interstitial text so the preamble emits nothing.
-// Prepended to every template this config parses, the defines resolve a
-// `{{ template "name" .arg }}` call locally — go-template-js scopes defines to a
-// single parse unit, so the define and the call MUST share one parse.
-// [LAW:no-silent-fallbacks] Each body is parsed in ISOLATION first, so a malformed
-// helper surfaces a per-helper diagnostic rather than a confusing error blamed on
-// the first segment that happens to call it.
-// [LAW:dataflow-not-control-flow] Empty helpers ⇒ "" ⇒ `engine.parse("" + src)`
-// is byte-identical to `engine.parse(src)`: existing configs are unaffected with
-// no special-case branch.
-function compileHelperPreamble(
+// define set: each name→body is parsed as its own `{{ define "name" }}body{{ end }}`
+// unit, chained onto the previous helpers' set, so the result is one `Defines`
+// every template this config parses inherits (`engine.parse(src, helpers)`).
+// [LAW:one-source-of-truth] Inherited by link, never by copy. The previous
+// shape — the defines' SOURCE prepended to every parse — re-parsed the whole
+// helper block into every template: ~100 KB of AST per parse for the 2 KB
+// stdlib block, ~287 parses per config, ~30 MB per config, and a daemon
+// holding twenty configs sat at 600 MB of nothing but duplicated helper ASTs
+// (the 2026-09-02 RSS-breach snapshot and the 2026-09-03 crash-loop).
+// [LAW:no-silent-fallbacks] Each body is parsed in ISOLATION, so a malformed
+// helper surfaces a per-helper diagnostic rather than a confusing error blamed
+// on the first segment that happens to call it; the redefinition check the
+// parser applies against the inherited set is what makes helper names unique.
+function compileHelpers(
   engine: Engine<RichText>,
   helpers: Readonly<Record<string, string>>,
-): string {
-  let preamble = "";
+): Defines {
+  let defines = Defines.EMPTY;
   for (const [name, body] of Object.entries(helpers)) {
-    const define = `{{ define "${name}" }}${body}{{ end }}`;
     try {
-      engine.parse(define);
+      defines = engine
+        .parse(`{{ define "${name}" }}${body}{{ end }}`, defines)
+        .defines();
     } catch (e) {
       throw new Error(
         `Template parse error in helpers.${name}: ${(e as Error).message}`,
         { cause: e },
       );
     }
-    preamble += define;
   }
-  return preamble;
+  return defines;
 }
 
 // ─── registerDslConfig ────────────────────────────────────────────────────────
@@ -379,16 +381,14 @@ export function registerDslConfig(
     },
     opts?.clock,
   );
-  // [LAW:single-enforcer] THE one parse path for this config: prepend the helper
-  // preamble so every template — segment template/when/bg/fg, node `when`, and
-  // action copy/open — resolves `{{ template "name" }}` calls against the same
-  // shared helpers. One closure, not raw engine.parse scattered across sites, so
-  // there is exactly one boundary where helpers come into scope (and one place a
-  // helper could fail to be visible). The preamble is compiled ONCE here, not per
-  // parse, and is "" when no helpers are declared.
-  const helperPreamble = compileHelperPreamble(engine, config.helpers);
-  const parse = (src: string): Template<RichText> =>
-    engine.parse(helperPreamble + src);
+  // [LAW:single-enforcer] THE one parse path for this config: every template —
+  // segment template/when/bg/fg, node `when`, and action copy/open — inherits
+  // the same helper define set, so `{{ template "name" }}` resolves against one
+  // shared AST. One closure, not raw engine.parse scattered across sites, so
+  // there is exactly one boundary where helpers come into scope (and one place
+  // a helper could fail to be visible). The helpers are parsed ONCE here.
+  const helpers = compileHelpers(engine, config.helpers);
+  const parse = (src: string): Template<RichText> => engine.parse(src, helpers);
   // [LAW:one-source-of-truth] Map each SessionState key → the variable that
   // reads it, so an option picker marks its current selection by reading the
   // SAME value the templates read — independent of whether the config named the