@teamscala/service-boot 0.23.297 → 0.23.299

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.297",
+  "version": "0.23.299",
   "sideEffects": false,
   "files": [
     "src"
@@ -35,6 +35,7 @@
     "@teamscala/object-storage": "*",
     "@teamscala/orpc": "*",
     "@teamscala/os": "*",
+    "@teamscala/proc-walker": "*",
     "@teamscala/realtime-utils": "*",
     "@teamscala/resolver-engine": "*",
     "@teamscala/timing": "*",
@@ -393,6 +394,14 @@
       "types": "./src/fn-routers/task-sync-dispatch.d.ts",
       "default": "./src/fn-routers/task-sync-dispatch.ts"
     },
+    "./fn-routers/task-sync-lane": {
+      "types": "./src/fn-routers/task-sync-lane.d.ts",
+      "default": "./src/fn-routers/task-sync-lane.ts"
+    },
+    "./fn-routers/task-sync-lane.ts": {
+      "types": "./src/fn-routers/task-sync-lane.d.ts",
+      "default": "./src/fn-routers/task-sync-lane.ts"
+    },
     "./fn-routers/task-sync-projection": {
       "types": "./src/fn-routers/task-sync-projection.d.ts",
       "default": "./src/fn-routers/task-sync-projection.ts"

package/src/fn-routers/task-sync-bind.test.ts

@@ -61,10 +61,15 @@ describe("discardApplied (observable no-task-bound discards)", () => {
 });
 
 describe("lane task binding is deterministic and race-proof (source contract)", () => {
+	// Two sources since the router hit its 1000-line budget: lane RESOLUTION
+	// moved to task-sync-lane.ts, the bindLane HANDLER stayed on the router. A
+	// source-text contract has to point at wherever the code actually lives, so
+	// these read separately rather than sharing one handle.
+	const laneSrc = Bun.file(new URL("./task-sync-lane.ts", import.meta.url).pathname);
 	const src = Bun.file(new URL("./task-sync-router.ts", import.meta.url).pathname);
 
 	test("resolveLaneTask orders, so duplicates cannot flip the answer", async () => {
-		const text = await src.text();
+		const text = await laneSrc.text();
 		// An unordered findFirst returns whichever row Postgres hands back. With
 		// two parents for one lane, one turn wrote the lane's todos under parent A
 		// and the next read parent B and found nothing — the list appeared to

package/src/fn-routers/task-sync-lane.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Lane RESOLUTION for task-sync: given a session or a pane, which work_items
+ * task IS this lane, and what is it called.
+ *
+ * Split out of task-sync-router.ts, which had reached 998 of its 1000-line
+ * budget — two lines from frozen. That is not tidiness: the budget is a commit
+ * gate, so at 998 lines ANY change to task-sync was blocked for every lane, and
+ * the four-line fix that needed to land could not. The router header records
+ * being split once before for exactly this reason; it grew back.
+ *
+ * The seam matches the one that split the projection. Everything here answers
+ * "which lane, called what" from an identity, and none of it touches the ORPC
+ * surface or decides what a task list should become — which is why these move
+ * together rather than one at a time: resolveLaneTask alone has seven callers.
+ *
+ * CAPABILITY HARVEST (capability-harvest-on-split): APP-LOCAL, not a capability
+ * candidate. Checked against the 14 platform singletons and the package
+ * catalogue; the doctrine test fails plainly, because every export is bound to
+ * the work_items schema and to task-sync own kind_data.lane convention, so no
+ * unrelated app could install this unmodified.
+ */
+import type { Prisma, WorkItem } from "./task-sync-router.ts";
+export declare function resolveLaneWorkName(prisma: Prisma, pane: string): Promise<string | null>;
+export declare function resolveLaneTask(prisma: Prisma, session: string): Promise<WorkItem | null>;

package/src/fn-routers/task-sync-lane.ts

@@ -0,0 +1,91 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Lane RESOLUTION for task-sync: given a session or a pane, which work_items
+ * task IS this lane, and what is it called.
+ *
+ * Split out of task-sync-router.ts, which had reached 998 of its 1000-line
+ * budget — two lines from frozen. That is not tidiness: the budget is a commit
+ * gate, so at 998 lines ANY change to task-sync was blocked for every lane, and
+ * the four-line fix that needed to land could not. The router header records
+ * being split once before for exactly this reason; it grew back.
+ *
+ * The seam matches the one that split the projection. Everything here answers
+ * "which lane, called what" from an identity, and none of it touches the ORPC
+ * surface or decides what a task list should become — which is why these move
+ * together rather than one at a time: resolveLaneTask alone has seven callers.
+ *
+ * CAPABILITY HARVEST (capability-harvest-on-split): APP-LOCAL, not a capability
+ * candidate. Checked against the 14 platform singletons and the package
+ * catalogue; the doctrine test fails plainly, because every export is bound to
+ * the work_items schema and to task-sync own kind_data.lane convention, so no
+ * unrelated app could install this unmodified.
+ */
+
+import type { Prisma, WorkItem } from "./task-sync-router.ts";
+
+export async function resolveLaneWorkName(prisma: Prisma, pane: string): Promise<string | null> {
+	try {
+		const runs = (
+			prisma as unknown as {
+				fleet_agent_runs?: {
+					findFirst: (a: unknown) => Promise<{ slot_name?: string | null } | null>;
+				};
+			}
+		).fleet_agent_runs;
+		if (!runs?.findFirst) return null;
+		const run = await runs.findFirst({
+			where: { pane, state: { not: "closed" } },
+			select: { slot_name: true },
+		});
+		const name = run?.slot_name?.trim();
+		return name ? name : null;
+	} catch {
+		return null;
+	}
+}
+
+export async function resolveLaneTask(prisma: Prisma, session: string): Promise<WorkItem | null> {
+	const active = await prisma.work_items.findFirst({
+		where: {
+			kind: "task",
+			status: "active",
+			kind_data: { path: ["lane", "session"], equals: session },
+		},
+		// Deterministic by oldest. An unordered findFirst returns whichever row
+		// Postgres happens to hand back, so with two parents for one lane (the
+		// bindLane race, below) one turn wrote the lane's todos under parent A
+		// and the next read parent B and found nothing — the lane's task list
+		// appeared to empty itself, and the watchdog accused lanes that were
+		// holding a populated list. Migration 109 makes the duplicate
+		// unwritable; this makes the read stable regardless.
+		orderBy: { created_at: "asc" },
+	});
+	if (active) return active;
+
+	// FALL BACK TO AN ARCHIVED PARENT FOR THE SAME SESSION.
+	//
+	// Closing a run archives the lane's parent (close-run.ts) specifically to
+	// drop it from the active match set above. That is correct when the LANE is
+	// gone, and wrong whenever the run record closes while the lane keeps
+	// running — which happens on a tmux-server restart (runs are reaped, panes
+	// are restored) and whenever an orchestrator closes a run on a stale read.
+	// The lane then has a full task list that this function cannot see, so
+	// callers mint a FRESH parent, the old list is orphaned, and the compliance
+	// watchdog reports "working with NO task list" at a lane holding 85 tasks.
+	// That is the "KNOWN ADJACENT DEFECT" recorded on the lane-working-has-task-list
+	// guard row, observed live 2026-07-31.
+	//
+	// Safe because a session id is minted per lane spawn and never reused, so an
+	// archived parent under this session belongs to THIS lane. Newest-first.
+	return prisma.work_items.findFirst({
+		where: {
+			kind: "task",
+			status: "archived",
+			kind_data: { path: ["lane", "session"], equals: session },
+		},
+		orderBy: { created_at: "desc" },
+	});
+}

package/src/fn-routers/task-sync-router.d.ts

@@ -92,6 +92,17 @@ export interface WorkItem {
     completed: boolean | null;
     kind_data: Record<string, unknown>;
 }
+export type Prisma = {
+    work_items: {
+        findFirst: (a: unknown) => Promise<WorkItem | null>;
+        findMany: (a: unknown) => Promise<WorkItem[]>;
+        create: (a: unknown) => Promise<WorkItem>;
+        update: (a: unknown) => Promise<WorkItem>;
+        deleteMany: (a: unknown) => Promise<{
+            count: number;
+        }>;
+    };
+};
 /**
  * A dispatched run already points at its fleet_tasks row. Task-sync may fill
  * the convenience join for an adopted lane, but must never replace that

package/src/fn-routers/task-sync-router.ts

@@ -40,6 +40,7 @@ import { recordEvent } from "@teamscala/event-log/record-event";
 import { getPlatformOrgId } from "@teamscala/db/registry/platform";
 import { authed, type Context } from "./auth-router.ts";
 import { notifyLaneOfTaskChange } from "./task-sync-dispatch.ts";
+import { resolveLaneTask, resolveLaneWorkName } from "./task-sync-lane.ts";
 import * as v from "valibot";
 import {
 	STATUS_TO_WORK_ITEM,
@@ -113,7 +114,7 @@ export interface WorkItem {
 	kind_data: Record<string, unknown>;
 }
 
-type Prisma = {
+export type Prisma = {
 	work_items: {
 		findFirst: (a: unknown) => Promise<WorkItem | null>;
 		findMany: (a: unknown) => Promise<WorkItem[]>;
@@ -189,26 +190,6 @@ export function discardApplied(
  * name must not block the bind. Feature-detected like the run-link below, because
  * fleet_agent_runs lives only in the fleet service's schema.
  */
-async function resolveLaneWorkName(prisma: Prisma, pane: string): Promise<string | null> {
-	try {
-		const runs = (
-			prisma as unknown as {
-				fleet_agent_runs?: {
-					findFirst: (a: unknown) => Promise<{ slot_name?: string | null } | null>;
-				};
-			}
-		).fleet_agent_runs;
-		if (!runs?.findFirst) return null;
-		const run = await runs.findFirst({
-			where: { pane, state: { not: "closed" } },
-			select: { slot_name: true },
-		});
-		const name = run?.slot_name?.trim();
-		return name ? name : null;
-	} catch {
-		return null;
-	}
-}
 
 /**
  * Resolve a lane's CLI-native session id from its live run row by pane. Used by
@@ -289,48 +270,6 @@ async function ensureLaneTask(
 	}
 }
 
-async function resolveLaneTask(prisma: Prisma, session: string): Promise<WorkItem | null> {
-	const active = await prisma.work_items.findFirst({
-		where: {
-			kind: "task",
-			status: "active",
-			kind_data: { path: ["lane", "session"], equals: session },
-		},
-		// Deterministic by oldest. An unordered findFirst returns whichever row
-		// Postgres happens to hand back, so with two parents for one lane (the
-		// bindLane race, below) one turn wrote the lane's todos under parent A
-		// and the next read parent B and found nothing — the lane's task list
-		// appeared to empty itself, and the watchdog accused lanes that were
-		// holding a populated list. Migration 109 makes the duplicate
-		// unwritable; this makes the read stable regardless.
-		orderBy: { created_at: "asc" },
-	});
-	if (active) return active;
-
-	// FALL BACK TO AN ARCHIVED PARENT FOR THE SAME SESSION.
-	//
-	// Closing a run archives the lane's parent (close-run.ts) specifically to
-	// drop it from the active match set above. That is correct when the LANE is
-	// gone, and wrong whenever the run record closes while the lane keeps
-	// running — which happens on a tmux-server restart (runs are reaped, panes
-	// are restored) and whenever an orchestrator closes a run on a stale read.
-	// The lane then has a full task list that this function cannot see, so
-	// callers mint a FRESH parent, the old list is orphaned, and the compliance
-	// watchdog reports "working with NO task list" at a lane holding 85 tasks.
-	// That is the "KNOWN ADJACENT DEFECT" recorded on the lane-working-has-task-list
-	// guard row, observed live 2026-07-31.
-	//
-	// Safe because a session id is minted per lane spawn and never reused, so an
-	// archived parent under this session belongs to THIS lane. Newest-first.
-	return prisma.work_items.findFirst({
-		where: {
-			kind: "task",
-			status: "archived",
-			kind_data: { path: ["lane", "session"], equals: session },
-		},
-		orderBy: { created_at: "desc" },
-	});
-}
 
 /** Match key for a subtask: stable mark when the CLI provides one, else content, else title. Uses || (not ??) so an empty-string content (passed for existing rows that key by title) falls through. */
 /**
@@ -518,7 +457,16 @@ export const taskSyncRouter = {
 			const kindData = { ...existing.kind_data, lane };
 			const updated = await prisma.work_items.update({
 				where: { id: existing.id },
-				data: { kind_data: kindData },
+				// A supplied parent is an INSTRUCTION, not a default: the spawn named
+				// the project this lane is for, which is newer than whatever the row
+				// carried. Set only on create until now, so a re-bind — the common
+				// case, since this matches by session — silently dropped it.
+				// Omitted leaves the existing parent alone, so a re-bind without a
+				// project cannot orphan a lane that already has one.
+				data: {
+					kind_data: kindData,
+					...(raw.parent_id ? { parent_id: raw.parent_id } : {}),
+				},
 			});
 			taskId = updated.id;
 			created = false;

package/src/serve/serve.ts

@@ -10,6 +10,7 @@
 
 import type { Hono } from "hono";
 import { createBunWebSocket } from "hono/bun";
+import { resolveSocketPeer } from "@teamscala/proc-walker/socket-peer";
 
 const _bunWs = createBunWebSocket();
 
@@ -88,6 +89,31 @@ function createFetchHandler(
 					headers.delete("x-caller-remote-address");
 					headers.set("x-caller-remote-address", String(address));
 				}
+				// Local-caller attribution: a local `fetch` carries no forwarding
+				// header, so for a loopback peer (no CF-Connecting-IP / X-Forwarded-
+				// For) resolve the owning local PROCESS from the socket + stamp it for
+				// the access log. Names the daemon behind every local request —
+				// including an unidentified sweeper keeping scale-to-zero apps awake.
+				// Trust stays transport-derived (no-client-controlled-trust-signals);
+				// the comm is attribution only. resolveSocketPeer is TTL-cached + never
+				// throws (returns null on any miss); skipped for external callers.
+				if (
+					address &&
+					(address === "127.0.0.1" ||
+						address === "::1" ||
+						address === "::ffff:127.0.0.1") &&
+					!headers.has("cf-connecting-ip") &&
+					!headers.get("x-forwarded-for") &&
+					typeof port === "number" &&
+					port > 0
+				) {
+					const owner = resolveSocketPeer(port);
+					if (owner) {
+						headers.set("x-caller-local-comm", owner.comm);
+						const cmd = owner.cmdline.join(" ").trim();
+						if (cmd) headers.set("x-caller-local-cmd", cmd.slice(0, 160));
+					}
+				}
 				const cloned = new Request(req.url, {
 					method: req.method,
 					headers,