@rubytech/create-maxy-code 0.1.614 → 0.1.615

package/payload/platform/scripts/vnc.sh

@@ -8,14 +8,16 @@
 #   Xtigervnc :${VNC_DISPLAY}      — virtual X11 display per brand
 #   Xtigervnc -rfbport ${RFB_PORT} — RFB port per brand
 #   websockify :${WEBSOCKIFY_PORT} — WebSocket bridge per brand
-#   Chromium                       — headless browser with --user-data-dir per brand
+#   Chromium                       — browser with --user-data-dir per brand
 #   CDP :${CDP_PORT}               — browser plugin (browser-render) CDP endpoint per brand
 #
-# Task 1562: virtual-mode Chromium is HEADLESS. The X display, RFB port and
-# websockify still boot, but no browser renders onto them and no surface reads
-# them — every consumer (agent browser-* tools, the operator screencast viewer,
-# the Claude sign-in browser) is a CDP client on ${CDP_PORT}. Retiring the three
-# now-unread components, their ports and their apt deps is Task 2198.
+# Virtual-mode Chromium is HEADED on the brand's Xtigervnc display. Task 1562
+# made it headless on 2026-07-30 and commit b1b007b03 reverted that the next
+# day: Cloudflare's managed challenge on claude.ai refuses `--headless=new`, so
+# Claude sign-in could never complete. Every consumer (agent browser-* tools,
+# the operator screencast viewer, the Claude sign-in browser) is still a CDP
+# client on ${CDP_PORT} rather than a reader of the RFB port; retiring the
+# now-unread RFB and websockify components is Task 2198.
 #
 # Brand isolation (Tasks 553 + 924): the X display number, Chromium profile,
 # rfbport, websockify port, and CDP port are all brand-scoped so any number
@@ -41,11 +43,18 @@
 # cloudflare-setup actions run via the detached action runner
 # (/api/admin/actions/*) rather than an in-browser terminal.
 #
-# Display modes (DISPLAY_MODE env var, set by installer --display flag):
-#   virtual (default) — Chromium runs headless; no display at all (Task 1562)
+# Display modes, set by the installer --display flag and recorded in the brand
+# .env. resolve_display_mode() is the ONLY reader of DISPLAY_MODE in this
+# script: it prefers the environment variable and falls back to the .env,
+# defaulting to virtual. No unit file in the fleet exports the variable, so a
+# second reader taking the env var directly always resolved to virtual and
+# silently disagreed with the .env — Task 2780.
+#   virtual (default) — Chromium runs headed on the brand's Xtigervnc display
 #   native            — Chromium runs on the login session's real display
 #                        (discovered via loginctl, NOT from $DISPLAY which
 #                         is poisoned by the systemd Environment=DISPLAY line)
+# Both modes are supervised by the standing cdp-liveness check; only the launch
+# precondition differs.
 
 set -uo pipefail
 
@@ -183,10 +192,23 @@ resolve_websockify_bind() {
 # The standing cdp-liveness probe runs every rss-sampler cycle; skip this
 # per-invocation resolution line on that path so vnc-boot.log is not spammed.
 # The FATAL guards above still run (and hard-exit) on every invocation.
+#
+# PER_CYCLE=1 marks that path for every other would-be per-cycle writer too.
+# vnc-boot.log is NOT one of logs-rotate.sh's targets, so nothing bounds it: a
+# writer that fires once per 30s cycle grows it without limit. Keep this file
+# event-driven and let the per-cycle signal go to stdout, which is the
+# rss-sampler's journal and is bounded by journald.
+PER_CYCLE=0
 if [ "${1:-}" != "cdp-liveness" ]; then
   log "[vnc.sh:chromium] bin=${CHROMIUM_BIN} realpath=${CHROMIUM_REALPATH} confinement=${CHROMIUM_CONFINEMENT}"
+else
+  PER_CYCLE=1
 fi
 
+# log() that is a no-op on the per-cycle path. For detail that is worth having
+# when a launch is attempted but must not accumulate once per cycle forever.
+log_event() { [ "$PER_CYCLE" -eq 1 ] || log "$@"; }
+
 kill_stale() {
   # Brand-scoped matchers: pkill on --user-data-dir narrows the
   # Chromium kill to this brand's profile only, so two brands on the same
@@ -291,52 +313,75 @@ check_window_on_display() {
   DISPLAY="$display" xdotool search --onlyvisible --class '[Cc]hrom' >/dev/null 2>&1
 }
 
-# Discover the login session's display type and display values.
+# Discover the login session Chromium should render onto, by evidence.
 # Uses loginctl (systemd) to bypass the poisoned $DISPLAY env var.
-# Sets: NATIVE_SESSION_TYPE (wayland|x11), NATIVE_DISPLAY (:N),
-#       NATIVE_WAYLAND_DISPLAY (wayland-0 or from session environ).
-# Falls back to x11/:0 when loginctl is unavailable or no graphical session exists.
+#
+# Selection is over EVERY listed session, not the first row: on a box with
+# remote tty sessions the first row is one of those, it reports an empty
+# Display, and the old `:0` substitution then reached the right screen by
+# accident on a single-seat desktop and the wrong screen — or none — anywhere
+# else, while still reporting success. A session qualifies only when it is
+# Active=yes, Remote=no, and Type x11 or wayland.
+#
+# Returns 0 with NATIVE_SESSION_TYPE (x11|wayland), NATIVE_DISPLAY and
+# NATIVE_WAYLAND_DISPLAY set. Returns 1 with NATIVE_DISPLAY UNSET, so a caller
+# that ignores the exit status still cannot launch onto a guess.
 discover_native_session() {
-  NATIVE_SESSION_TYPE="x11"
-  NATIVE_DISPLAY=":0"
+  NATIVE_SESSION_TYPE=""
   NATIVE_WAYLAND_DISPLAY=""
+  unset NATIVE_DISPLAY
 
   if ! command -v loginctl >/dev/null 2>&1; then
-    log "WARNING: loginctl not found — falling back to DISPLAY=:0, ozone-platform=x11"
-    return
+    log_event "[vnc.sh:native] no-graphical-session reason=loginctl-absent"
+    return 1
   fi
 
-  local session_id
-  session_id=$(loginctl list-sessions --no-legend 2>/dev/null | awk 'NR==1{print $1}')
-  if [ -z "$session_id" ]; then
-    log "WARNING: no login sessions found — falling back to DISPLAY=:0, ozone-platform=x11"
-    return
+  local session_ids session_id active remote session_type session_display leader_pid
+  session_ids=$(loginctl list-sessions --no-legend 2>/dev/null | awk '{print $1}')
+  if [ -z "$session_ids" ]; then
+    log_event "[vnc.sh:native] no-graphical-session reason=no-sessions-listed"
+    return 1
   fi
 
-  local session_type
-  session_type=$(loginctl show-session "$session_id" -p Type --value 2>/dev/null)
-
-  local session_display
-  session_display=$(loginctl show-session "$session_id" -p Display --value 2>/dev/null)
-
-  if [ "$session_type" = "wayland" ]; then
-    NATIVE_SESSION_TYPE="wayland"
-    NATIVE_DISPLAY="${session_display:-:0}"
+  for session_id in $session_ids; do
+    active=$(loginctl show-session "$session_id" -p Active --value 2>/dev/null)
+    [ "$active" = "yes" ] || continue
+    remote=$(loginctl show-session "$session_id" -p Remote --value 2>/dev/null)
+    [ "$remote" = "no" ] || continue
+    session_type=$(loginctl show-session "$session_id" -p Type --value 2>/dev/null)
+    case "$session_type" in x11|wayland) ;; *) continue ;; esac
+
+    session_display=$(loginctl show-session "$session_id" -p Display --value 2>/dev/null)
+
+    if [ "$session_type" = "wayland" ]; then
+      NATIVE_SESSION_TYPE="wayland"
+      NATIVE_DISPLAY="$session_display"
+      # Discover WAYLAND_DISPLAY from the session leader's environment; it, not
+      # DISPLAY, is the launch vector under the wayland ozone backend.
+      leader_pid=$(loginctl show-session "$session_id" -p Leader --value 2>/dev/null)
+      if [ -n "$leader_pid" ] && [ -r "/proc/$leader_pid/environ" ]; then
+        NATIVE_WAYLAND_DISPLAY=$(tr '\0' '\n' < "/proc/$leader_pid/environ" 2>/dev/null | \
+          grep '^WAYLAND_DISPLAY=' | cut -d= -f2)
+      fi
+      NATIVE_WAYLAND_DISPLAY="${NATIVE_WAYLAND_DISPLAY:-wayland-0}"
+      log_event "[vnc.sh:native] session=${session_id} type=wayland display=${NATIVE_DISPLAY:-none} wayland=${NATIVE_WAYLAND_DISPLAY}"
+      return 0
+    fi
 
-    # Discover WAYLAND_DISPLAY from the session leader's environment.
-    local leader_pid
-    leader_pid=$(loginctl show-session "$session_id" -p Leader --value 2>/dev/null)
-    if [ -n "$leader_pid" ] && [ -r "/proc/$leader_pid/environ" ]; then
-      NATIVE_WAYLAND_DISPLAY=$(tr '\0' '\n' < "/proc/$leader_pid/environ" 2>/dev/null | \
-        grep '^WAYLAND_DISPLAY=' | cut -d= -f2)
+    # x11: $DISPLAY IS the launch vector, so a session that names none does not
+    # resolve. Keep scanning rather than substituting a value nothing reported.
+    if [ -z "$session_display" ]; then
+      log_event "[vnc.sh:native] session=${session_id} type=x11 skipped reason=no-display-value"
+      continue
     fi
-    NATIVE_WAYLAND_DISPLAY="${NATIVE_WAYLAND_DISPLAY:-wayland-0}"
-  elif [ -n "$session_type" ]; then
-    NATIVE_SESSION_TYPE="$session_type"
-    NATIVE_DISPLAY="${session_display:-:0}"
-  else
-    log "WARNING: loginctl returned empty session type — falling back to DISPLAY=:0, ozone-platform=x11"
-  fi
+    NATIVE_SESSION_TYPE="x11"
+    NATIVE_DISPLAY="$session_display"
+    log_event "[vnc.sh:native] session=${session_id} type=x11 display=${NATIVE_DISPLAY}"
+    return 0
+  done
+
+  log_event "[vnc.sh:native] no-graphical-session reason=no-active-local-graphical-session"
+  return 1
 }
 
 # Virtual-mode Chromium: HEADED on the brand's Xtigervnc display, driven over
@@ -408,8 +453,25 @@ start_chrome() {
 # admin chat PTY is the only interactive surface.
 # ---------------------------------------------------------------------------
 
+# A native launch that cannot name a display must say so on the caller's own
+# op label, so the refusal is visible to whichever grep is watching that path:
+# op=chromium-start on the on-demand ensureCdp path, op=chromium-respawn on the
+# standing-check path. A supervisor that declines to supervise must say so.
+emit_native_decline() {
+  echo "[vnc] op=$1 display-mode=native cdp=:${CDP_PORT} outcome=declined reason=no-graphical-session"
+}
+
 start_chrome_native() {
-  discover_native_session
+  # The precondition for a native launch is an active local graphical session.
+  # Guarded here rather than at the call sites so BOTH callers are covered: the
+  # standing check and the on-demand ensureCdp path from the browser-pane route.
+  # ensureCdp shells this through execFileSync, which throws on a non-zero exit,
+  # so a refusal already surfaces there as restart-chrome-failed → false.
+  if ! discover_native_session; then
+    log "ERROR: refusing native Chromium launch — no active local graphical session"
+    emit_native_decline chromium-start
+    return 1
+  fi
 
   # Brand-scoped Chromium kill: only this brand's profile-bound chromium.
   pkill -f "chromium.*--user-data-dir=${CHROMIUM_PROFILE_DIR}" 2>/dev/null || true
@@ -469,8 +531,15 @@ start_chrome_native() {
     else
       log "WARNING: Chromium CDP up on :${CDP_PORT} but no window visible on ${NATIVE_DISPLAY} (native) — observability-only, not gating"
     fi
+    echo "[vnc] op=chromium-start display-mode=native mode=${NATIVE_SESSION_TYPE} cdp=:${CDP_PORT} outcome=ready"
   else
     log "ERROR: Chromium failed to start on ${NATIVE_DISPLAY} (native) — CDP port ${CDP_PORT} not listening (browser-specialist degraded)"
+    echo "[vnc] op=chromium-start display-mode=native mode=${NATIVE_SESSION_TYPE} cdp=:${CDP_PORT} outcome=failed"
+    # Deliberately still exit 0, matching start_chrome. Only the DECLINE exits
+    # non-zero, because that is the case ensureCdp must not mistake for a launch
+    # that merely needs longer. A launch that started and failed keeps the old
+    # contract: ensureCdp's own waitForPort classifies it, and execFileSync does
+    # not throw, so its second grace window is not cut short.
   fi
 }
 
@@ -489,8 +558,22 @@ start_chrome_native() {
 # Bounded: after RESPAWN_MAX_FAILS consecutive failed respawns it backs off for
 # RESPAWN_COOLDOWN_SECS so an unlaunchable Chromium does not hot-loop (the
 # snap-confinement FATAL guard at the top of this script already hard-exits
-# before any respawn). Virtual-mode only: native mode launches Chromium
-# on-demand, so display-up + CDP-down is its normal idle state, not a fault.
+# before any respawn).
+#
+# Task 2780: BOTH modes are supervised. Native was previously a silent
+# early-return on the reasoning that its Chromium is launched on-demand, so
+# display-up + CDP-down was its normal idle state. That was wrong twice over:
+# the only native launcher needs an operator to act, so an agent's browser call
+# found no browser and nothing in the product started one; and a supervisor
+# that emits nothing while declining to supervise is indistinguishable in the
+# journal from one that is running and finding everything healthy — the blind
+# spot this check exists to remove, reintroduced by its own gate.
+#
+# What differs per mode is only the LAUNCH PRECONDITION. Virtual renders onto
+# the brand's Xtigervnc display, so it keeps the RFB_PORT check and a down
+# display stays the ensureVnc case. Native's precondition is an active local
+# graphical session, enforced inside start_chrome_native. The state file, cap
+# and cooldown are shared unchanged.
 # ---------------------------------------------------------------------------
 RESPAWN_STATE_FILE="${LOG_DIR}/cdp-respawn.state"
 RESPAWN_MAX_FAILS="${RESPAWN_MAX_FAILS:-3}"
@@ -512,23 +595,32 @@ port_listening() {
 }
 
 cdp_liveness() {
-  # Native mode supervises nothing here — Chromium is launched on-demand
-  # (ensureCdp), so display-up + CDP-down is the normal idle state, and a
-  # respawn would launch an unsolicited browser on the operator's real display.
-  if [ "$(resolve_display_mode)" = "native" ]; then
-    return 0
-  fi
+  local mode
+  mode="$(resolve_display_mode)"
 
   if port_listening "${CDP_PORT}"; then
-    echo "[vnc] op=cdp-liveness display=${VNC_DISPLAY} cdp=:${CDP_PORT} reachable=true"
+    echo "[vnc] op=cdp-liveness display-mode=${mode} display=${VNC_DISPLAY} cdp=:${CDP_PORT} reachable=true"
     rm -f "$RESPAWN_STATE_FILE" 2>/dev/null || true
     return 0
   fi
-  echo "[vnc] op=cdp-liveness display=${VNC_DISPLAY} cdp=:${CDP_PORT} reachable=false"
-
-  # Only the VNC-display Chromium is supervised. A down display is the
-  # VNC-stack-restart case (ensureVnc, on the next browser call) — out of scope.
-  port_listening "${RFB_PORT}" || return 0
+  echo "[vnc] op=cdp-liveness display-mode=${mode} display=${VNC_DISPLAY} cdp=:${CDP_PORT} reachable=false"
+
+  # Launch precondition, per mode. Evaluated BEFORE the cooldown gate so a
+  # native decline is never silenced by a cooldown a previous failure set.
+  if [ "$mode" = "native" ]; then
+    # A decline attempts no launch, so there is nothing to hot-loop: it never
+    # counts against the cap and never writes the state file. A box whose real
+    # display has gone keeps reporting reachable=false plus this decline every
+    # cycle, which is the visibility the cap exists to preserve.
+    if ! discover_native_session; then
+      emit_native_decline chromium-respawn
+      return 0
+    fi
+  else
+    # Only the VNC-display Chromium is supervised here. A down display is the
+    # VNC-stack-restart case (ensureVnc, on the next browser call).
+    port_listening "${RFB_PORT}" || return 0
+  fi
 
   # Bounded respawn: read the consecutive-failure state.
   local fails=0 last=0 now
@@ -548,27 +640,37 @@ cdp_liveness() {
     return 0
   fi
 
-  # Relaunch via the existing brand-scoped start_chrome path, then re-probe to
-  # classify the outcome. start_chrome already blocks on wait_for_port, so the
-  # CDP port state is settled when it returns; reading the port directly keeps
-  # start_chrome's exit contract untouched (the reactive ensureCdp path in
-  # vnc.ts consumes it).
-  start_chrome || true
+  # Relaunch via the existing brand-scoped start path for this mode, then
+  # re-probe to classify the outcome. Both start paths already block on
+  # wait_for_port, so the CDP port state is settled when they return; reading
+  # the port directly keeps their exit contracts untouched (the reactive
+  # ensureCdp path in vnc.ts consumes them).
+  if [ "$mode" = "native" ]; then
+    start_chrome_native || true
+  else
+    start_chrome || true
+  fi
   if port_listening "${CDP_PORT}"; then
-    echo "[vnc] op=chromium-respawn reason=cdp-unreachable cdp=:${CDP_PORT} outcome=ready"
+    echo "[vnc] op=chromium-respawn display-mode=${mode} reason=cdp-unreachable cdp=:${CDP_PORT} outcome=ready"
     rm -f "$RESPAWN_STATE_FILE" 2>/dev/null || true
   else
     # Climb to the cap and hold there; bump last so the next attempt waits a
     # full cooldown rather than retrying every cycle.
     [ "$fails" -lt "$RESPAWN_MAX_FAILS" ] && fails=$(( fails + 1 ))
     printf 'fails=%s\nlast=%s\n' "$fails" "$now" > "$RESPAWN_STATE_FILE"
-    echo "[vnc] op=chromium-respawn reason=cdp-unreachable cdp=:${CDP_PORT} outcome=failed"
+    echo "[vnc] op=chromium-respawn display-mode=${mode} reason=cdp-unreachable cdp=:${CDP_PORT} outcome=failed"
   fi
 }
 
 case "${1:-}" in
   start)
-    log "[vnc.sh] start brand=${BRAND_HOSTNAME} display=${VNC_DISPLAY} rfb=${RFB_PORT} websockify=${WEBSOCKIFY_PORT} cdp=${CDP_PORT} profile=${CHROMIUM_PROFILE_DIR} mode=${DISPLAY_MODE:-virtual}"
+    # resolve_display_mode() is the ONLY reader of DISPLAY_MODE in this script.
+    # Boot previously read the env var directly while the standing check read
+    # the brand .env; no unit file in the fleet exports DISPLAY_MODE, so every
+    # install whose .env said native still booted the virtual-mode browser
+    # while its supervisor believed it was native and supervised nothing.
+    START_DISPLAY_MODE="$(resolve_display_mode)"
+    log "[vnc.sh] start brand=${BRAND_HOSTNAME} display=${VNC_DISPLAY} rfb=${RFB_PORT} websockify=${WEBSOCKIFY_PORT} cdp=${CDP_PORT} profile=${CHROMIUM_PROFILE_DIR} mode=${START_DISPLAY_MODE}"
     # Collision checks run BEFORE kill_stale: kill_stale removes our own
     # locks/processes, so a check afterwards would always see them empty
     # and never refuse. The checks are no-ops for our own brand's prior
@@ -616,10 +718,11 @@ case "${1:-}" in
       exit 1
     fi
 
-    # Native mode: VNC stack runs for remote fallback, but Chromium
-    # is launched on-demand by ensureCdp(transport) — not at boot.
-    if [ "${DISPLAY_MODE:-virtual}" = "native" ]; then
-      log "Native display mode — skipping boot-time Chromium (launched on-demand)"
+    # Native mode: VNC stack runs for remote fallback, but Chromium is not
+    # launched at boot. It comes up on-demand via ensureCdp(transport), and is
+    # restored by the standing cdp-liveness check when it dies.
+    if [ "${START_DISPLAY_MODE}" = "native" ]; then
+      log "Native display mode — skipping boot-time Chromium (launched on-demand and by the standing check)"
     else
       start_chrome
     fi