@rallycry/conveyor-agent 10.13.17 → 10.13.50

package/dist/{boot-NMXFM4GK.js → boot-I353EAK6.js}

@@ -7,22 +7,26 @@ import {
   defaultGit,
   ensureDir,
   readAgentVersion,
-  redactToken
-} from "./chunk-UZTJJD7Y.js";
+  redactToken,
+  reportBootMilestone
+} from "./chunk-KCB7CSWJ.js";
 import {
   workbenchPort
 } from "./chunk-4VUQ2NPF.js";
 import {
   startWorkbenchServer
-} from "./chunk-5UYMDSAE.js";
-import "./chunk-JG54UJ6V.js";
+} from "./chunk-3Z4YQNJV.js";
+import "./chunk-XR6H326I.js";
 import {
   DEFAULT_WORKBENCH_PORT
 } from "./chunk-JIGG755T.js";
+import {
+  oomWatchdogOptionsFromEnv
+} from "./chunk-ULS4QPRE.js";
 
 // src/boot/index.ts
 import { spawn } from "child_process";
-import { statSync as statSync3 } from "fs";
+import { statSync as statSync4 } from "fs";
 import { hostname as osHostname } from "os";
 
 // src/boot/bundle.ts
@@ -262,95 +266,17 @@ async function pollBootstrapBundle(apiUrl, token, deps) {
   }
 }
 
-// src/boot/self-update.ts
+// src/boot/exec.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-var AGENT_PACKAGE = "@rallycry/conveyor-agent";
-var NPM_VIEW_TIMEOUT_MS = 3e3;
-var NPM_INSTALL_TIMEOUT_MS = 12e4;
-var NPM_CACHE_DIR = "/tmp/npm-cache";
-var NPM_REGISTRY_ARG = "--@rallycry:registry=https://registry.npmjs.org/";
-var SEMVER_RE = /^\d+\.\d+\.\d+([-+][A-Za-z0-9.-]+)?$/;
-function isValidSemver(value) {
-  return SEMVER_RE.test(value);
-}
-function isStrictlyNewer(candidate, installed) {
-  const num = (v) => (v.split(/[-+]/)[0] ?? "").split(".").map((p) => Number(p));
-  const [a, b] = [num(candidate), num(installed)];
-  for (let i = 0; i < 3; i++) {
-    const av = a[i] ?? 0;
-    const bv = b[i] ?? 0;
-    if (av !== bv) return av > bv;
-  }
-  return false;
-}
 var execFileAsync = promisify(execFile);
 function defaultExec(cmd, args, opts) {
   return execFileAsync(cmd, args, { timeout: opts.timeoutMs });
 }
-async function runPreflightUpdate(deps) {
-  let latest = "";
-  try {
-    const { stdout } = await deps.exec(
-      "npm",
-      ["view", "--cache", NPM_CACHE_DIR, NPM_REGISTRY_ARG, AGENT_PACKAGE, "version"],
-      { timeoutMs: NPM_VIEW_TIMEOUT_MS }
-    );
-    latest = stdout.replace(/\s+/g, "");
-  } catch (err) {
-    deps.log.warn(
-      `[boot] WARN preflight npm view failed (${err instanceof Error ? err.message : err}); keeping baked version`
-    );
-    return "skipped";
-  }
-  if (!isValidSemver(latest)) {
-    deps.log.warn(
-      `[boot] WARN preflight got non-semver '${latest}' from npm; keeping baked version`
-    );
-    return "skipped";
-  }
-  let installed = "";
-  try {
-    installed = (await deps.installedVersion()).trim();
-  } catch (err) {
-    deps.log.warn(
-      `[boot] WARN preflight installed-version lookup failed (${err instanceof Error ? err.message : err}); keeping baked version`
-    );
-    return "skipped";
-  }
-  if (!isValidSemver(installed) || isStrictlyNewer(latest, installed)) {
-    deps.log.info(
-      `[boot] preflight updating ${AGENT_PACKAGE} ${installed || "unknown"} -> ${latest}`
-    );
-    try {
-      await deps.exec(
-        "sudo",
-        [
-          "npm",
-          "install",
-          "-g",
-          "--cache",
-          NPM_CACHE_DIR,
-          "--silent",
-          `${AGENT_PACKAGE}@${latest}`
-        ],
-        { timeoutMs: NPM_INSTALL_TIMEOUT_MS }
-      );
-      return "updated";
-    } catch (err) {
-      deps.log.warn(
-        `[boot] WARN preflight install failed (${err instanceof Error ? err.message : err}); keeping baked version`
-      );
-      return "skipped";
-    }
-  }
-  deps.log.info(`[boot] preflight agent ${installed} is current (registry ${latest})`);
-  return "current";
-}
 
 // src/boot/supervisor.ts
 import { spawn as spawnChildProcess } from "child_process";
-import { appendFileSync as appendFileSync2, writeFileSync } from "fs";
+import { appendFileSync as appendFileSync2, statSync, writeFileSync } from "fs";
 import { join } from "path";
 
 // src/boot/crash-report.ts
@@ -377,6 +303,7 @@ async function reportAgentCrash(apiUrl, bootstrapToken, report, fetchFn = fetch)
 // src/boot/supervisor.ts
 var AGENT_CRASH_MAX = 3;
 var AGENT_LOG_PATH = "/tmp/claudespace-agent.log";
+var AGENT_LOG_MAX_BYTES = 16 * 1024 * 1024;
 var LAUNCH_MARKER_NAME = "conveyor-agent-launching";
 var RESTARTING_MARKER_NAME = "conveyor-agent-restarting";
 var LAUNCH_MARKER = `/tmp/${LAUNCH_MARKER_NAME}`;
@@ -393,14 +320,31 @@ function touchMarker(path, log) {
     );
   }
 }
-function teeChildOutput(child) {
-  const onData = (chunk) => {
-    process.stdout.write(chunk);
+function createLogAppender(path, maxBytes) {
+  let size = 0;
+  try {
+    size = statSync(path).size;
+  } catch {
+    size = 0;
+  }
+  return (chunk) => {
     try {
-      appendFileSync2(AGENT_LOG_PATH, chunk);
+      if (size + chunk.length > maxBytes) {
+        writeFileSync(path, chunk);
+        size = chunk.length;
+      } else {
+        appendFileSync2(path, chunk);
+        size += chunk.length;
+      }
     } catch {
     }
   };
+}
+function teeChildOutput(child, appendLog) {
+  const onData = (chunk) => {
+    process.stdout.write(chunk);
+    appendLog(chunk);
+  };
   child.stdout?.on("data", onData);
   child.stderr?.on("data", onData);
 }
@@ -474,12 +418,13 @@ async function superviseRunner(opts) {
   const launchMarkerPath = join(markerDir, LAUNCH_MARKER_NAME);
   const restartingMarkerPath = join(markerDir, RESTARTING_MARKER_NAME);
   touchMarker(launchMarkerPath, opts.log);
+  const appendLog = createLogAppender(AGENT_LOG_PATH, AGENT_LOG_MAX_BYTES);
   let attempt = 0;
   while (true) {
     attempt++;
     opts.log.info("[boot] Launching agent...");
     const child = spawnAgent(spawnFn, opts);
-    teeChildOutput(child);
+    teeChildOutput(child, appendLog);
     const exitPromise = waitForExit(child);
     const winner = await Promise.race([
       exitPromise.then((code) => ({ type: "exit", code })),
@@ -516,11 +461,13 @@ async function superviseRunner(opts) {
 import {
   chmodSync,
   copyFileSync,
+  existsSync,
   lstatSync,
   mkdirSync,
   readFileSync,
+  readdirSync,
   rmSync,
-  statSync,
+  statSync as statSync2,
   symlinkSync,
   writeFileSync as writeFileSync2
 } from "fs";
@@ -574,7 +521,7 @@ function seedClaudeJson(targetPath) {
 }
 function isDir(path) {
   try {
-    return statSync(path).isDirectory();
+    return statSync2(path).isDirectory();
   } catch {
     return false;
   }
@@ -608,6 +555,29 @@ function wireCredentials(opts) {
   safely(log, "repoint credentials symlink", () => relink(podLocal, shared));
   safely(log, "chmod pod-local credentials", () => chmodSync(podLocal, 384));
 }
+var AGENT_MEMORY_PROJECT_DIR = "-workspaces-repo";
+function migrateMemories(from, to, log) {
+  let entries;
+  try {
+    entries = readdirSync(from);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const target = join2(to, entry);
+    if (existsSync(target)) continue;
+    safely(log, `migrate memory ${entry}`, () => copyFileSync(join2(from, entry), target));
+  }
+}
+function wireSharedMemory(root, userHomeMount, projectId, log) {
+  const shared = join2(userHomeMount, "users", "_shared", "memory", projectId);
+  const link = join2(root, ".claude", "projects", AGENT_MEMORY_PROJECT_DIR, "memory");
+  safely(log, "mkdir shared memory dir", () => mkdirSync(shared, { recursive: true }));
+  safely(log, "migrate per-user memories", () => {
+    if (existsSync(link) && !lstatSync(link).isSymbolicLink()) migrateMemories(link, shared, log);
+  });
+  safely(log, "wire shared memory symlink", () => relink(shared, link));
+}
 function wireMountedUserHome(opts) {
   const { home, userHomeMount, userId, projectId, sharedDir, log } = opts;
   const root = join2(userHomeMount, "users", userId, projectId);
@@ -625,6 +595,7 @@ function wireMountedUserHome(opts) {
     rmSync(join2(home, ".claude.json"), { recursive: true, force: true });
     seedClaudeJson(join2(home, ".claude.json"));
   });
+  wireSharedMemory(root, userHomeMount, projectId, log);
   wireCredentials({ home, root, sharedDir, log });
   safely(log, "mkdir opencode root", () => {
     mkdirSync(join2(root, ".local", "share", "opencode"), { recursive: true });
@@ -658,6 +629,11 @@ function wireNoMountUserHome(opts) {
 }
 function wireUserHome(opts) {
   const { home, userHomeMount, userId, projectId, sharedDir, log } = opts;
+  safely(
+    log,
+    "mkdir agent scratch dir",
+    () => mkdirSync(opts.scratchDir ?? "/tmp/claude-cmd", { recursive: true })
+  );
   if (userId && projectId && isDir(userHomeMount)) {
     wireMountedUserHome({ home, userHomeMount, userId, projectId, sharedDir, log });
   } else {
@@ -695,15 +671,27 @@ async function reclaimHomeOwnership(home, exec, log) {
 }
 
 // src/boot/sshd.ts
-import { chmodSync as chmodSync2, closeSync, existsSync, mkdirSync as mkdirSync2, openSync } from "fs";
+import { chmodSync as chmodSync2, closeSync, copyFileSync as copyFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, openSync } from "fs";
 import { join as join3 } from "path";
+function persistedAuthorizedKeys() {
+  return join3(
+    process.env.CONVEYOR_SHARED_DIR || "/var/run/conveyor-workbench",
+    "ssh",
+    "authorized_keys"
+  );
+}
 async function startWorkspaceSshd(exec, log, port = process.env.CONVEYOR_WORKSPACE_SSH_PORT || "2222", home = "/home/conveyor") {
   try {
     const sshDir = join3(home, ".ssh");
     mkdirSync2(sshDir, { recursive: true });
     chmodSync2(sshDir, 448);
     const authorizedKeys = join3(sshDir, "authorized_keys");
-    if (!existsSync(authorizedKeys)) closeSync(openSync(authorizedKeys, "a"));
+    const persisted = persistedAuthorizedKeys();
+    if (existsSync2(persisted)) {
+      copyFileSync2(persisted, authorizedKeys);
+    } else if (!existsSync2(authorizedKeys)) {
+      closeSync(openSync(authorizedKeys, "a"));
+    }
     chmodSync2(authorizedKeys, 384);
   } catch (err) {
     log.warn(
@@ -711,7 +699,7 @@ async function startWorkspaceSshd(exec, log, port = process.env.CONVEYOR_WORKSPA
     );
     return;
   }
-  if (!existsSync("/usr/sbin/sshd")) {
+  if (!existsSync2("/usr/sbin/sshd")) {
     log.warn("[boot] WARN: workspace SSHD unavailable");
     return;
   }
@@ -728,12 +716,15 @@ async function startWorkspaceSshd(exec, log, port = process.env.CONVEYOR_WORKSPA
 
 // src/boot/workspace-extras.ts
 import {
-  existsSync as existsSync2,
+  appendFileSync as appendFileSync3,
+  existsSync as existsSync3,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync3,
-  readdirSync,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync2,
+  readlinkSync,
   rmSync as rmSync2,
-  statSync as statSync2,
+  statSync as statSync3,
   symlinkSync as symlinkSync2
 } from "fs";
 import { join as join4 } from "path";
@@ -742,7 +733,7 @@ function errText(err) {
 }
 function isDir2(path) {
   try {
-    return statSync2(path).isDirectory();
+    return statSync3(path).isDirectory();
   } catch {
     return false;
   }
@@ -768,7 +759,7 @@ function bindGraphifyBundle(workspace, graphifyEnv, log) {
   const sourceDir = graphifyEnv.CONVEYOR_GRAPHIFY_DIR;
   const graphFile = graphifyEnv.CONVEYOR_GRAPHIFY_GRAPH;
   if (!slug || !sourceDir || !graphFile) return;
-  if (!existsSync2(graphFile)) {
+  if (!existsSync3(graphFile)) {
     log.info(`[boot] Graphify bundle not found for '${slug}' at ${sourceDir}`);
     return;
   }
@@ -782,8 +773,8 @@ function bindGraphifyBundle(workspace, graphifyEnv, log) {
   for (const rel of GRAPHIFY_BUNDLE_FILES) {
     const source = join4(sourceDir, rel);
     const target = join4(targetDir, rel);
-    if (!existsSync2(source)) continue;
-    if (existsSync2(target) || isSymlink(target)) continue;
+    if (!existsSync3(source)) continue;
+    if (existsSync3(target) || isSymlink(target)) continue;
     try {
       symlinkSync2(source, target);
     } catch {
@@ -793,7 +784,7 @@ function bindGraphifyBundle(workspace, graphifyEnv, log) {
 }
 async function ensureGrimoireSubmodule(workspace, githubToken, git, log) {
   try {
-    if (!existsSync2(join4(workspace, ".gitmodules"))) return;
+    if (!existsSync3(join4(workspace, ".gitmodules"))) return;
     let paths = "";
     try {
       ({ stdout: paths } = await git(
@@ -831,6 +822,30 @@ async function ensureGrimoireSubmodule(workspace, githubToken, git, log) {
     log.warn(`[boot] WARN: grimoire submodule check failed: ${errText(err)}`);
   }
 }
+function excludeLinkedSkills(workspace, names, log) {
+  if (names.length === 0) return;
+  const infoDir = join4(workspace, ".git", "info");
+  if (!isDir2(join4(workspace, ".git"))) return;
+  try {
+    mkdirSync3(infoDir, { recursive: true });
+    const excludePath = join4(infoDir, "exclude");
+    const existing = existsSync3(excludePath) ? readFileSync2(excludePath, "utf8") : "";
+    const missing = names.map((name) => `.claude/skills/${name}`).filter((line) => !existing.split("\n").includes(line));
+    if (missing.length === 0) return;
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    appendFileSync3(excludePath, `${prefix}${missing.join("\n")}
+`);
+  } catch (err) {
+    log.warn(`[boot] WARN: unable to exclude grimoire skill links: ${errText(err)}`);
+  }
+}
+function symlinkTargetsGrimoire(path) {
+  try {
+    return readlinkSync(path).includes(join4("grimoire", "skills"));
+  } catch {
+    return false;
+  }
+}
 function linkGrimoireSkills(workspace, log) {
   const sourceDir = join4(workspace, ".claude", "grimoire", "skills");
   const targetDir = join4(workspace, ".claude", "skills");
@@ -841,28 +856,42 @@ function linkGrimoireSkills(workspace, log) {
     log.warn(`[boot] WARN: unable to create ${targetDir}; skipping grimoire skill links`);
     return;
   }
-  let linked = 0;
+  const linkedNames = [];
   let names = [];
   try {
-    names = readdirSync(sourceDir);
+    names = readdirSync2(sourceDir);
   } catch {
     return;
   }
   for (const name of names) {
     if (!isDir2(join4(sourceDir, name))) continue;
     const target = join4(targetDir, name);
-    if (existsSync2(target) && !isSymlink(target)) {
+    if (existsSync3(target) && !isSymlink(target)) {
       log.warn(`[boot] WARN: ${target} exists and is not a symlink; skipping`);
       continue;
     }
+    if (isSymlink(target) && !symlinkTargetsGrimoire(target)) continue;
     try {
       rmSync2(target, { force: true });
       symlinkSync2(join4("..", "grimoire", "skills", name), target);
-      linked++;
+      linkedNames.push(name);
     } catch {
     }
   }
-  log.info(`[boot] Linked ${linked} grimoire skills into ${targetDir}`);
+  excludeLinkedSkills(workspace, linkedNames, log);
+  log.info(`[boot] Linked ${linkedNames.length} grimoire skills into ${targetDir}`);
+}
+async function neutralizeGrimoirePointer(workspace, git, log) {
+  if (!existsSync3(join4(workspace, ".claude", "grimoire"))) return;
+  try {
+    await git(["update-index", "--assume-unchanged", ".claude/grimoire"], {
+      cwd: workspace,
+      timeoutMs: 1e4
+    });
+    log.info("[boot] Marked .claude/grimoire assume-unchanged (submodule pointer drift is noise)");
+  } catch (err) {
+    log.warn(`[boot] WARN: grimoire assume-unchanged failed: ${errText(err)}`);
+  }
 }
 function parseReferenceRepos(refsJson) {
   let parsed;
@@ -893,6 +922,7 @@ async function runPreReadyBinds(workspace, bundle, git, log) {
   bindGraphifyBundle(workspace, graphifyEnv, log);
   await ensureGrimoireSubmodule(workspace, bundle.githubToken, git, log);
   linkGrimoireSkills(workspace, log);
+  await neutralizeGrimoirePointer(workspace, git, log);
 }
 async function cloneReferenceRepos(refsJson, git, log, referencesDir = "/workspaces/references") {
   if (!refsJson) return;
@@ -905,7 +935,7 @@ async function cloneReferenceRepos(refsJson, git, log, referencesDir = "/workspa
   }
   for (const ref of refs) {
     const dest = join4(referencesDir, ref.slug);
-    if (existsSync2(join4(dest, ".git"))) continue;
+    if (existsSync3(join4(dest, ".git"))) continue;
     try {
       await git(
         [
@@ -1014,16 +1044,22 @@ async function runWorkbenchBoot(ctx, overrides = {}) {
   const job = new GitPrepJob(deps.gitPrepDeps(ctx, bundle), {
     // Order pinned by the old entrypoint-grimoire test: binds BEFORE the
     // ready flip (Claude must not spawn before skills exist), references after.
-    onReady: () => deps.bindsBeforeReady(ctx, bundle),
+    onReady: () => {
+      const binds = deps.bindsBeforeReady(ctx, bundle);
+      void reportBootMilestone({ key: "repo_synced" });
+      return binds;
+    },
     afterReady: () => deps.cloneReferences(ctx, bundle)
   });
   await deps.startDaemon({
     port: workbenchPort() ?? DEFAULT_WORKBENCH_PORT,
     token: ctx.bootstrapToken,
     version: readAgentVersion() ?? "unknown",
-    getGitStatus: () => toGitStatusFrame(job.status)
+    getGitStatus: () => toGitStatusFrame(job.status),
+    oomWatchdog: oomWatchdogOptionsFromEnv(ctx.log)
   });
   ctx.log.info("[boot] step=startDaemon listen socket up (startupProbe gate open)");
+  void reportBootMilestone({ key: "workbench_ready" });
   try {
     deps.ensureWorkspaceDir(ctx);
   } catch (err) {
@@ -1051,13 +1087,9 @@ function defaultBootDeps() {
     }),
     spawnFn: spawn,
     exec: defaultExec,
-    installedVersion: () => {
-      const version = readAgentVersion();
-      return version ? Promise.resolve(version) : Promise.reject(new Error("could not read installed agent version"));
-    },
     dirExists: (path) => {
       try {
-        return statSync3(path).isDirectory();
+        return statSync4(path).isDirectory();
       } catch {
         return false;
       }
@@ -1079,11 +1111,13 @@ function whenAborted2(signal) {
   });
 }
 function agentBootSteps(deps = defaultBootDeps(), signal = new AbortController().signal) {
+  let reclaim;
   return [
     {
       name: "pollBootstrap",
       critical: true,
       run: async (ctx) => {
+        reclaim = reclaimHomeOwnership(HOME_DIR2, deps.exec, ctx.log).catch(() => void 0);
         const bundle = await pollBootstrapBundle(ctx.apiUrl, ctx.bootstrapToken, {
           fetchFn: deps.fetchFn,
           sleepFn: deps.sleepFn,
@@ -1122,7 +1156,7 @@ function agentBootSteps(deps = defaultBootDeps(), signal = new AbortController()
       critical: false,
       run: async (ctx) => {
         if (!ctx.bundle) return;
-        await reclaimHomeOwnership(HOME_DIR2, deps.exec, ctx.log);
+        await (reclaim ?? reclaimHomeOwnership(HOME_DIR2, deps.exec, ctx.log));
       }
     },
     {
@@ -1226,11 +1260,7 @@ async function runWorkbenchRole(ctx, deps, signal) {
 async function runBoot(argv, deps = defaultBootDeps()) {
   const { log } = deps;
   if (argv.includes("--preflight-update")) {
-    await runPreflightUpdate({
-      exec: deps.exec,
-      installedVersion: deps.installedVersion,
-      log
-    });
+    log.info("[boot] --preflight-update is a no-op (baked agent, no runtime self-update)");
     return 0;
   }
   const role = process.env.CONVEYOR_CONTAINER_ROLE;
@@ -1255,7 +1285,9 @@ async function runBoot(argv, deps = defaultBootDeps()) {
     hostname: deps.hostname,
     log
   };
-  return role === "workbench" ? runWorkbenchRole(ctx, deps, controller.signal) : runAgentRole(ctx, deps, controller.signal);
+  const code = await (role === "workbench" ? runWorkbenchRole(ctx, deps, controller.signal) : runAgentRole(ctx, deps, controller.signal));
+  controller.abort();
+  return code;
 }
 export {
   TOMBSTONE_MESSAGE,
@@ -1265,4 +1297,4 @@ export {
   runBoot,
   workbenchBootSteps
 };
-//# sourceMappingURL=boot-NMXFM4GK.js.map
+//# sourceMappingURL=boot-I353EAK6.js.map