@promptctl/cc-candybar 1.42.1 → 1.43.0

package/src/daemon/fork-bomb-breaker.ts

@@ -1,351 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-
-import { daemonRegistryDir, ensureOwnedPrivateDir } from "./paths";
-import {
-  readStartTime,
-  sameLiveProcess,
-  type ProcessIdentity,
-} from "./process-fingerprint";
-import { pidAlive } from "./parent-watchdog";
-
-// ─── Daemon-side fork-bomb circuit breaker ───────────────────────────────────
-//
-// [FRAMING:representation] The 192-daemon storm (epic brandon-daemon-lifecycle-
-// gad) happened because every existing single-instance guard (atomic bind(),
-// the socket lease, the ownership self-check, the spawn cooldown) keys off ONE
-// socket path — daemons on DIFFERENT sockets (test isolation's per-file
-// CC_CANDYBAR_SOCKET) never arbitrate each other and pile up unboundedly. .1
-// (test/helpers/daemon-pool.ts) bounds that from the SPAWNER side, but the
-// spawner's own cleanup (afterAll, globalTeardown) fails under the exact
-// fork-exhaustion condition it exists to prevent. This module is the
-// load-INDEPENDENT backstop: a daemon refuses to boot past a sibling ceiling
-// using only its own startup-time read of a shared registry — no external
-// cleanup path required for the invariant to hold.
-//
-// [LAW:one-source-of-truth] The registry lives at daemonRegistryDir() (paths.ts)
-// — a fixed, UID-anchored /tmp path that, like socketPath(), deliberately
-// ignores XDG_STATE_HOME, so isolation overrides can't hide a daemon from the
-// count. Every daemon that does NOT explicitly override
-// CC_CANDYBAR_DAEMON_REGISTRY_DIR lands in the same directory.
-//
-// [FRAMING:representation] The production daemon is a different POPULATION
-// than an isolated (test/dev) instance, not a smaller version of the same one:
-// it is already bounded to exactly one by bind()'s kernel-enforced exclusion on
-// the canonical socket path, so no ceiling can ever be its failure mode — only
-// isolation (an explicit CC_CANDYBAR_SOCKET override) creates the "many
-// coexisting instances" population this breaker exists to bound. Classifying by
-// "is CC_CANDYBAR_SOCKET set" keeps the two populations from ever counting
-// against each other: the production daemon is exempt (and so always boots,
-// however many isolated instances are registered), and isolated instances
-// compete only with each other over the shared ceiling.
-//
-// [FRAMING:representation] admitDaemon's count-then-write (read the registry,
-// decide, write our own entry) is NOT a compare-and-swap — the same accepted
-// tradeoff as test/helpers/daemon-pool.ts's tryClaim. Two daemons starting in
-// the same instant can both observe the same below-ceiling count and both
-// admit, so the ceiling is a soft bound (liveCount can briefly overshoot by
-// the number of true simultaneous spawns), not a strict mutex. A real fix
-// needs a cross-process lock (flock, an O_EXCL pre-registration file); skipped
-// as disproportionate here — this is a load-independent BACKSTOP against a
-// 192-daemon storm, not a precision gate, and the ticket's own acceptance
-// criterion is "a small, asserted ceiling", never exact atomicity. The
-// failure mode of the race is a brief, bounded overshoot that the next boot's
-// stale-sweep does not even need to correct (the overshooting daemons are
-// live, not stale) — categorically smaller than the storm this breaker
-// exists to prevent.
-
-export interface BootDecision {
-  allow: boolean;
-  reason: string;
-}
-
-const DEFAULT_CEILING = 16;
-
-// [LAW:no-silent-failure] `Number(...)`, not `parseInt(...)` — parseInt
-// truncates trailing garbage ("16o" reads as 16, silently accepting a typo
-// that likely meant 160) instead of surfacing it. `Number` requires the
-// WHOLE string to be numeric, so a typo becomes NaN and falls through to the
-// default like any other garbage value.
-export function daemonCeiling(): number {
-  const raw = Number(process.env["CC_CANDYBAR_DAEMON_CEILING"] ?? "");
-  return Number.isInteger(raw) && raw > 0 ? raw : DEFAULT_CEILING;
-}
-
-// [LAW:dataflow-not-control-flow] The whole decision is this one pure fold —
-// full input space:
-//   isolated=false                    → allow, unconditionally (production is
-//                                        already singular via bind(); a
-//                                        ceiling here could only ever refuse
-//                                        the user's one real daemon, which the
-//                                        epic requires never happens)
-//   isolated=true,  count <  ceiling  → allow (below the backstop)
-//   isolated=true,  count >= ceiling  → deny (the fork-bomb condition)
-// [LAW:no-silent-failure] "Fails safe" is achieved by construction here, not by
-// a guard clause: an unreadable/uncountable population reads as count=0 (see
-// countLiveEntries), which always falls in the `allow` branch — the failure
-// direction is never "refuse to boot", it is "undercount and allow".
-export function decideBoot(
-  isolated: boolean,
-  liveSiblingCount: number,
-  ceiling: number,
-): BootDecision {
-  if (!isolated) {
-    return {
-      allow: true,
-      reason:
-        "canonical production socket — exempt (bind() already caps it to one)",
-    };
-  }
-  if (liveSiblingCount >= ceiling) {
-    return {
-      allow: false,
-      reason: `${liveSiblingCount} live isolated daemons registered >= ceiling ${ceiling}`,
-    };
-  }
-  return {
-    allow: true,
-    reason: `${liveSiblingCount} live isolated daemons registered < ceiling ${ceiling}`,
-  };
-}
-
-// A registry entry read, alongside its source path so a stale one can be
-// swept. `null` is every unreadable/corrupt/absent-pid outcome — collapsed
-// early here (unlike readLease's richer enumeration) because the only
-// downstream use is "count it or don't"; there is no distinct action for
-// "unreadable" vs "absent" the way socket-lease arbitration has one.
-export interface RegistryEntry {
-  path: string;
-  identity: ProcessIdentity;
-}
-
-// [LAW:no-silent-failure] Never throws: a directory that doesn't exist yet (no
-// isolated daemon has ever registered) or is transiently unreadable both mean
-// "no known siblings", which is the fail-open direction decideBoot expects.
-export function listRegistryFiles(dir: string): string[] {
-  try {
-    return fs
-      .readdirSync(dir)
-      .filter((f) => f.endsWith(".json"))
-      .map((f) => path.join(dir, f));
-  } catch {
-    return [];
-  }
-}
-
-// Mirrors readSlot (test/helpers/daemon-pool.ts) / readLease's pid validation
-// (socket-lease.ts): a corrupt or unreadable file is excluded from the count
-// rather than treated as a special decision branch — see the module header for
-// why undercounting, never overcounting, is the safe direction here.
-export function readRegistryEntry(filePath: string): ProcessIdentity | null {
-  let raw: string;
-  try {
-    raw = fs.readFileSync(filePath, "utf8");
-  } catch {
-    return null;
-  }
-  try {
-    const parsed = JSON.parse(raw) as Partial<ProcessIdentity> | null;
-    const pid = parsed?.pid;
-    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) {
-      return null;
-    }
-    const startTime =
-      typeof parsed?.startTime === "string" ? parsed.startTime : null;
-    return { pid, startTime };
-  } catch {
-    return null;
-  }
-}
-
-// [LAW:dataflow-not-control-flow] Pure fold over already-read entries + an
-// injected liveness predicate — full branch coverage needs no fs, no real
-// processes: an empty list, an all-dead list, an all-live list, and a mixed
-// list are the entire input space. `sweepStale`, kept in the same pass rather
-// than a second read, is the effect side; the count itself never depends on
-// whether the sweep succeeds.
-export function countLiveEntries(
-  entries: readonly RegistryEntry[],
-  isSameLiveProcess: (pid: number, startTime: string | null) => boolean,
-  sweepStale: (filePath: string) => void,
-): number {
-  let count = 0;
-  for (const entry of entries) {
-    if (isSameLiveProcess(entry.identity.pid, entry.identity.startTime)) {
-      count++;
-    } else {
-      sweepStale(entry.path);
-    }
-  }
-  return count;
-}
-
-export interface BreakerDeps {
-  isolated: boolean;
-  registryDir: string;
-  ceiling: number;
-  pid: number;
-  startTime: string | null;
-  isSameLiveProcess: (pid: number, startTime: string | null) => boolean;
-  listFiles: (dir: string) => string[];
-  readEntry: (filePath: string) => ProcessIdentity | null;
-  removeFile: (filePath: string) => void;
-  writeEntry: (filePath: string, identity: ProcessIdentity) => void;
-  ensureDirSafe: (dir: string) => void;
-}
-
-export interface BreakerResult {
-  decision: BootDecision;
-  // The path this daemon registered at, or null when exempt/refused. Callers
-  // that boot successfully thread this into their shutdown cleanup so the slot
-  // is released promptly instead of waiting for the next boot's stale-sweep.
-  registryPath: string | null;
-}
-
-// [LAW:effects-at-boundaries] The one place that turns the pure fold into a
-// boot/refuse decision by reading + writing the real registry. Exempt
-// (production) daemons never touch the registry at all — not even to read
-// it — so a corrupt or unreadable registry can never affect the one instance
-// the epic requires to always boot.
-export function admitDaemon(deps: BreakerDeps): BreakerResult {
-  if (!deps.isolated) {
-    return { decision: decideBoot(false, 0, deps.ceiling), registryPath: null };
-  }
-  // [LAW:single-enforcer] `ensureDirSafe` — not a bare `ensureOwnedPrivateDir`
-  // call — because the safety boundary differs by registry: the default,
-  // UID-anchored registry sits under the same shared /tmp root the socket
-  // does and needs the two-level check `realBreakerDeps` builds for it (see
-  // its comment); an overridden registry (tests) is the caller's own
-  // directory and needs only the one-level leaf check. `admitDaemon` stays
-  // agnostic to which — it just asks the injected dependency to prove the
-  // directory is safe to use.
-  deps.ensureDirSafe(deps.registryDir);
-  const entries: RegistryEntry[] = [];
-  for (const filePath of deps.listFiles(deps.registryDir)) {
-    const identity = deps.readEntry(filePath);
-    // [LAW:no-silent-failure] Exclude any entry named with OUR OWN pid,
-    // unconditionally — no other currently-live process can ever share it
-    // (the kernel guarantees pid uniqueness among live processes), so such an
-    // entry is always either a stale pid-recycled ghost from a past
-    // incarnation, or moot (we haven't written our own entry yet). This
-    // matters specifically when `ps` is unavailable: `isSameLiveProcess`'s
-    // fallback (bare `pidAlive`) would read OUR OWN pid as alive and
-    // misclassify the ghost as a live sibling, consuming a ceiling slot and
-    // risking a spurious refusal of the one daemon that pid actually names.
-    // Excluding it here means it never reaches that ambiguous check at all.
-    if (identity !== null && identity.pid !== deps.pid) {
-      entries.push({ path: filePath, identity });
-    }
-  }
-  const liveCount = countLiveEntries(
-    entries,
-    deps.isSameLiveProcess,
-    deps.removeFile,
-  );
-  const decision = decideBoot(true, liveCount, deps.ceiling);
-  if (!decision.allow) {
-    return { decision, registryPath: null };
-  }
-  const registryPath = path.join(deps.registryDir, `pid-${deps.pid}.json`);
-  deps.writeEntry(registryPath, { pid: deps.pid, startTime: deps.startTime });
-  return { decision, registryPath };
-}
-
-// Best-effort self-cleanup on shutdown — mirrors removeLeaseIfOwned
-// (socket-lease.ts): only remove the entry if it still names us, so a
-// displaced/superseded record from a different process is never deleted.
-export function releaseRegistration(
-  registryPath: string,
-  myPid: number,
-  readEntry: (filePath: string) => ProcessIdentity | null,
-  removeFile: (filePath: string) => void,
-): void {
-  const entry = readEntry(registryPath);
-  if (entry !== null && entry.pid === myPid) {
-    try {
-      removeFile(registryPath);
-    } catch {
-      // Best-effort; a leftover entry naming a dead pid is harmless — the
-      // next boot's sweep reclaims it.
-    }
-  }
-}
-
-// `myStartTime` is threaded in rather than recomputed here so callers (only
-// server.ts today) fingerprint themselves exactly once at startup and reuse
-// that same read for both the registry entry and the socket lease — two
-// independent `ps` calls could theoretically observe different processes if
-// this pid were somehow recycled between them.
-export function realBreakerDeps(
-  myStartTime: string | null,
-  overrides: Partial<BreakerDeps> = {},
-): BreakerDeps {
-  return {
-    isolated: Boolean(process.env["CC_CANDYBAR_SOCKET"]),
-    registryDir: daemonRegistryDir(),
-    ceiling: daemonCeiling(),
-    pid: process.pid,
-    startTime: myStartTime,
-    isSameLiveProcess: (pid, startTime) =>
-      sameLiveProcess(pid, startTime, { readStartTime, pidAlive }),
-    listFiles: listRegistryFiles,
-    readEntry: readRegistryEntry,
-    removeFile: (filePath) => {
-      try {
-        fs.unlinkSync(filePath);
-      } catch {
-        // best-effort
-      }
-    },
-    // [LAW:one-source-of-truth] Same write-tmp-then-rename shape as
-    // socket-lease.ts's writeLease, so it gets the same cleanup: if
-    // writeFileSync succeeds but renameSync fails, best-effort unlink the tmp
-    // file (tolerating ENOENT — writeFileSync itself may have been what
-    // failed) before rethrowing, so a write failure never leaves an orphaned
-    // `.tmp` file behind (listRegistryFiles only collects `*.json`, so a
-    // stray `.tmp` would never be swept).
-    writeEntry: (filePath, identity) => {
-      const tmp = `${filePath}.${identity.pid}.tmp`;
-      try {
-        fs.writeFileSync(tmp, JSON.stringify(identity), { mode: 0o600 });
-        fs.renameSync(tmp, filePath);
-      } catch (e) {
-        try {
-          fs.unlinkSync(tmp);
-        } catch (cleanupErr) {
-          if ((cleanupErr as NodeJS.ErrnoException).code !== "ENOENT") {
-            // Best-effort cleanup failed for a reason other than "never
-            // created" — the original error is still the one that matters,
-            // so it is not swallowed; a leaked tmp file here is a secondary
-            // symptom the next admission's stale-sweep does not reclaim
-            // (only *.json is collected), but it is not this daemon's job to
-            // retry a failing filesystem.
-          }
-        }
-        throw e;
-      }
-    },
-    // [LAW:single-enforcer] Two levels, mirroring ensureSocketParentSafe's own
-    // shape, but ONLY for the default (unoverridden) registry path: its
-    // parent is the shared UID-anchored /tmp root an attacker could pre-plant
-    // as a symlink before any daemon has ever run, and `lstatSync` only
-    // inspects a path's FINAL component — verifying the leaf alone lets a
-    // symlinked parent be silently followed by `mkdirSync({recursive:true})`,
-    // after which the freshly-created leaf looks perfectly clean (owned by
-    // us, 0700) despite living inside attacker-controlled storage. An
-    // OVERRIDDEN registry dir (CC_CANDYBAR_DAEMON_REGISTRY_DIR, tests only)
-    // has no such shared root by construction — its parent is whatever
-    // directory the caller happened to put it under (a system tmpdir on some
-    // platforms), which is not a boundary this breaker owns or should assert
-    // on; there the one-level leaf check alone is the correct, portable
-    // parity with how ensureSocketParentSafe treats an overridden
-    // CC_CANDYBAR_SOCKET (exactly one level, whatever that parent is).
-    ensureDirSafe: process.env["CC_CANDYBAR_DAEMON_REGISTRY_DIR"]
-      ? ensureOwnedPrivateDir
-      : (dir: string): void => {
-          ensureOwnedPrivateDir(path.dirname(dir));
-          ensureOwnedPrivateDir(dir);
-        },
-    ...overrides,
-  };
-}

package/src/daemon/limits.ts

@@ -1,211 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import v8 from "node:v8";
-import { daemonDir } from "./paths";
-import { dlog, type DaemonLogger } from "./log";
-
-// [LAW:single-enforcer] One module owns "when does the daemon plan to die".
-// Only the RSS trigger remains — idle and age limits were removed because they
-// interrupted active sessions. The RSS limit is a true anomaly backstop; normal
-// operation should never approach it now that transcript parsing is pruned.
-//
-// [LAW:one-source-of-truth] The daemon's memory budget is ONE number, read from
-// ONE place. Two limits derive from it and their ORDER is the whole point:
-//
-//   RSS backstop (this module)   — graceful: heap snapshot, logged shutdown,
-//                                  clean restart on the next tick.
-//   V8 old-space cap (spawners)  — hard: V8 aborts with SIGABRT below every JS
-//                                  handler, so no log line, no snapshot, and
-//                                  the next daemon finds only a stale socket.
-//
-// The cap sits at HEAP_CAP_OVER_RSS × the backstop, a margin wide enough that
-// the graceful path fires first under any growth the 60 s poll can see (a
-// burst that doubles RSS inside one poll window can still reach the hard cap).
-// Before this the two were unrelated literals (400 MB heap in each spawner,
-// 512 MB RSS here), and the 2026-09-03 outage found the gap: a daemon holding
-// twenty configs' worth of duplicated helper-template ASTs (since fixed in
-// src/dsl/render.ts compileHelpers) blew the heap in seconds, aborted
-// silently, and crash-looped on every render tick while the backstop — a 60 s
-// poll — never got a turn. Raising the env override raises BOTH, because both
-// spawners derive the cap through heapCapMb below. The Rust client mirrors
-// RSS_LIMIT_ENV, DEFAULT_RSS_LIMIT_MB, and HEAP_CAP_OVER_RSS as literals
-// (rust-client/src/launch.rs); scripts/check-protocol.mjs fails the build on
-// drift.
-export const RSS_LIMIT_ENV = "CC_CANDYBAR_RSS_LIMIT_MB";
-export const DEFAULT_RSS_LIMIT_MB = 512;
-export const HEAP_CAP_OVER_RSS = 2;
-
-// [LAW:parse-dont-validate] Absent → default; a positive integer → that; present
-// but malformed → throw. Only an operator ever sets this variable, so garbage
-// is an operator error, and `|| default` would silently run at a budget they
-// did not ask for. [LAW:no-silent-failure]
-//
-// [LAW:one-source-of-truth] The grammar is ONE rule both runtimes apply
-// verbatim — ASCII digits only, > 0, within the safe-integer range —
-// so the spawner and the daemon it spawns accept and reject the same values
-// (rust-client/src/launch.rs heap_cap_mb). A grammar that differed by so much
-// as a leading `+` would let a client spawn a daemon that refuses to boot.
-export function rssLimitMb(env: NodeJS.ProcessEnv): number {
-  const raw = env[RSS_LIMIT_ENV];
-  if (raw === undefined) return DEFAULT_RSS_LIMIT_MB;
-  const mb = /^\d+$/.test(raw) ? Number(raw) : NaN;
-  if (!Number.isSafeInteger(mb) || mb <= 0) {
-    throw new Error(
-      `${RSS_LIMIT_ENV} must be a positive integer (MB), got ${JSON.stringify(raw)}`,
-    );
-  }
-  return mb;
-}
-
-// The `--max-old-space-size` value a spawner hands node for the daemon.
-export function heapCapMb(env: NodeJS.ProcessEnv): number {
-  return rssLimitMb(env) * HEAP_CAP_OVER_RSS;
-}
-
-const BYTES_PER_MB = 1024 * 1024;
-
-// The budget in the unit `process.memoryUsage().rss` reports.
-export function rssLimitBytes(env: NodeJS.ProcessEnv): number {
-  return rssLimitMb(env) * BYTES_PER_MB;
-}
-
-const DEFAULT_CHECK_INTERVAL = 60 * 1000;
-const HEAP_SNAPSHOT_KEEP = 3;
-
-export interface LimitsDeps {
-  now: () => number;
-  // [LAW:locality-or-seam] The snapshot directory, the log sink, and the
-  // writer's identity are injected, not reached for ambiently. Without these,
-  // unit tests of checkRss compute filenames against the real daemonDir() and
-  // emit real dlog lines into the user's production daemon.log — the seam must
-  // cover every dependency or it isn't a seam.
-  pid: number;
-  snapshotDir: string;
-  log: DaemonLogger;
-  rssBytes: () => number;
-  writeHeapSnapshot: (filePath: string) => string;
-  listSnapshots: () => string[];
-  removeFile: (filePath: string) => void;
-  shutdown: (code: number) => void;
-  startedAtMs: number;
-  rssLimitBytes?: number;
-  snapshotsKeep?: number;
-}
-
-export interface LimitsHandle {
-  checkRss(): boolean;
-  describeNextRestart(): string | null;
-  arm(intervalMs?: number): { disarm(): void };
-}
-
-export function makeLimits(deps: LimitsDeps): LimitsHandle {
-  const rssLimit = deps.rssLimitBytes ?? DEFAULT_RSS_LIMIT_MB * BYTES_PER_MB;
-  const keep = deps.snapshotsKeep ?? HEAP_SNAPSHOT_KEEP;
-  let triggered = false;
-
-  function checkRss(): boolean {
-    if (triggered) return true;
-    const rss = deps.rssBytes();
-    if (rss <= rssLimit) return false;
-    triggered = true;
-    deps.log(
-      "warn",
-      `RSS ${rss} > limit ${rssLimit}; writing heap snapshot then shutting down`,
-    );
-    try {
-      // [LAW:types-are-the-program] Uniqueness is by construction (the writer's
-      // pid), not by trusting the clock to be real and sub-ms-distinct. Two
-      // overlapping daemons hitting the wall in the same millisecond — or a
-      // frozen `now` — still produce distinct files; the timestamp stays the
-      // leading component so rotateSnapshots' newest-first ordering holds.
-      const stamp = new Date(deps.now()).toISOString().replace(/[:.]/g, "-");
-      const file = path.join(
-        deps.snapshotDir,
-        `heap-${stamp}-${deps.pid}.heapsnapshot`,
-      );
-      const written = deps.writeHeapSnapshot(file);
-      deps.log("info", `heap snapshot written: ${written}`);
-      rotateSnapshots(deps.listSnapshots(), keep, deps.removeFile);
-    } catch (e) {
-      deps.log("warn", `heap snapshot failed: ${(e as Error).message}`);
-    }
-    deps.shutdown(0);
-    return true;
-  }
-
-  function describeNextRestart(): string | null {
-    const rss = deps.rssBytes();
-    if (rss > rssLimit * 0.75) {
-      return `rss ${rss} approaching limit ${rssLimit}`;
-    }
-    return null;
-  }
-
-  function arm(intervalMs: number = DEFAULT_CHECK_INTERVAL): {
-    disarm(): void;
-  } {
-    const timer = setInterval(() => {
-      checkRss();
-    }, intervalMs);
-    timer.unref();
-    return {
-      disarm: () => clearInterval(timer),
-    };
-  }
-
-  return { checkRss, describeNextRestart, arm };
-}
-
-function rotateSnapshots(
-  files: string[],
-  keep: number,
-  remove: (p: string) => void,
-): void {
-  // Newest-first by basename (the leading ISO timestamp is lexically ordered;
-  // the trailing -<pid> only tiebreaks same-instant writes). Sort by basename
-  // so paths with different parent dirs still order correctly when the test
-  // mock and production use different prefixes.
-  const sorted = [...files].sort((a, b) => {
-    const aBase = a.slice(a.lastIndexOf("/") + 1);
-    const bBase = b.slice(b.lastIndexOf("/") + 1);
-    return bBase.localeCompare(aBase);
-  });
-  for (const f of sorted.slice(keep)) {
-    try {
-      remove(f);
-    } catch {}
-  }
-}
-
-// Default real-fs deps for the daemon. Test code constructs its own.
-export function realLimitsDeps(
-  startedAtMs: number,
-  shutdown: (code: number) => void,
-  overrides: Partial<LimitsDeps> = {},
-): LimitsDeps {
-  // [LAW:one-source-of-truth] One captured dir backs both the new-snapshot path
-  // and the listing used for rotation, so they can never read different dirs.
-  const dir = daemonDir();
-  return {
-    now: () => Date.now(),
-    pid: process.pid,
-    snapshotDir: dir,
-    log: dlog,
-    rssBytes: () => process.memoryUsage().rss,
-    writeHeapSnapshot: (file) => v8.writeHeapSnapshot(file),
-    listSnapshots: () => {
-      try {
-        return fs
-          .readdirSync(dir)
-          .filter((f) => f.startsWith("heap-") && f.endsWith(".heapsnapshot"))
-          .map((f) => path.join(dir, f));
-      } catch {
-        return [];
-      }
-    },
-    removeFile: (file) => fs.unlinkSync(file),
-    shutdown,
-    startedAtMs,
-    ...overrides,
-  };
-}

package/src/daemon/log.ts

@@ -1,81 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { logPath } from "./paths";
-
-export const MAX_BYTES = 5 * 1024 * 1024;
-const KEEP_GENERATIONS = 3;
-
-// [LAW:no-ambient-temporal-coupling] Every line is a synchronous append, so a
-// line is on disk the moment the call returns — including the death line each
-// shutdown path writes last, which an async stream dropped whenever
-// `process.exit` outran its flush. The daemon writes a handful of short lines
-// per second; a sync append is microseconds. No stream means nothing to flush,
-// nothing to close, and no window in which a late writer can reopen a sink
-// that nobody waits for. [LAW:polishing-by-subtraction]
-let bytesWritten: number | null = null;
-
-// Pre-load size once so rotation triggers correctly across daemon restarts.
-function currentBytes(filePath: string): number {
-  if (bytesWritten !== null) return bytesWritten;
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  try {
-    bytesWritten = fs.statSync(filePath).size;
-  } catch {
-    bytesWritten = 0;
-  }
-  return bytesWritten;
-}
-
-// Self-rotation: when daemon.log exceeds MAX_BYTES, shift .1→.2, .2→.3, drop
-// the oldest, and start fresh. Daemon-internal so we don't depend on any
-// external rotator. Cheap because rotation only runs at the rollover boundary.
-function rotate(filePath: string): void {
-  for (let i = KEEP_GENERATIONS - 1; i >= 1; i--) {
-    const src = `${filePath}.${i}`;
-    const dst = `${filePath}.${i + 1}`;
-    try {
-      fs.renameSync(src, dst);
-    } catch {}
-  }
-  try {
-    fs.renameSync(filePath, `${filePath}.1`);
-  } catch {}
-  bytesWritten = 0;
-}
-
-export type LogLevel = "info" | "warn" | "error";
-
-// [LAW:locality-or-seam] The logging capability daemon components depend on.
-// `dlog` is the daemon's implementation (writes to daemon.log); consumers that
-// inject a different impl (a quiet default in tests) take this shape.
-export type DaemonLogger = (level: LogLevel, msg: string) => void;
-
-export function dlog(level: LogLevel, msg: string): void {
-  const line = `${new Date().toISOString()} [${level}] ${msg}\n`;
-  try {
-    // [LAW:single-enforcer] Path resolution reaches os.homedir(); it lives
-    // inside the one boundary that makes dlog total.
-    const filePath = logPath();
-    const before = currentBytes(filePath);
-    fs.appendFileSync(filePath, line);
-    bytesWritten = before + Buffer.byteLength(line, "utf8");
-    if (bytesWritten >= MAX_BYTES) rotate(filePath);
-  } catch (e) {
-    // [LAW:no-silent-failure] exception: the failure IS the log sink, so it
-    // cannot be reported through the log sink. A throw here would escape the
-    // crash handlers that call dlog first (uncaughtException → dlog →
-    // shutdown), taking the clean-death path down with it. stderr carries the
-    // line and the reason — the terminal when the daemon runs by hand, and
-    // /dev/null under a detached spawn; the daemon keeps serving either way.
-    // Nulling the counter re-runs the lazy init on the next call, so a state
-    // dir removed out from under the daemon is recreated for the next line.
-    bytesWritten = null;
-    try {
-      process.stderr.write(
-        `${line}cc-candybar: daemon.log unwritable: ${(e as Error).message}\n`,
-      );
-    } catch {
-      // stderr was the last channel.
-    }
-  }
-}