@triflux/remote 10.33.1 → 10.34.0

package/hub/hub-lifecycle.mjs

@@ -15,15 +15,21 @@ const EPHEMERAL_ENV_KEYS = [
   "TFX_TEAM_AGENT_NAME",
   "TFX_EPHEMERAL",
 ];
+const WORKTREE_CWD_PATTERNS = [
+  /\/\.claude\/worktrees\//u,
+  /\/\.worktrees\//u,
+  /\/\.codex-swarm\/wt-[^/]+(?:\/|$)/u,
+  /(^|\/)wt-[^/]+(?:\/|$)/u,
+];
 
-function parsePositiveInt(value) {
+function parsePositivePort(value) {
   const parsed = Number.parseInt(String(value ?? ""), 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
 }
 
-function parsePortFromUrl(value) {
+function parsePortFromHubUrl(value) {
   try {
-    return parsePositiveInt(new URL(String(value)).port);
+    return parsePositivePort(new URL(String(value)).port);
   } catch {
     return null;
   }
@@ -40,12 +46,7 @@ export function isWorktreeOrEphemeralHubContext({
   env = process.env,
 } = {}) {
   const normalizedCwd = String(cwd || "").replace(/\\/g, "/");
-  if (
-    normalizedCwd.includes("/.claude/worktrees/") ||
-    normalizedCwd.includes("/.worktrees/") ||
-    normalizedCwd.includes("/.codex-swarm/wt-") ||
-    /(^|\/)wt-[^/]+(?:\/|$)/u.test(normalizedCwd)
-  ) {
+  if (WORKTREE_CWD_PATTERNS.some((pattern) => pattern.test(normalizedCwd))) {
     return true;
   }
   return EPHEMERAL_ENV_KEYS.some((key) => String(env?.[key] || "").length > 0);
@@ -57,11 +58,16 @@ export function resolveHubPortForContext({
   cwd = process.cwd(),
   defaultPort = HUB_DEFAULT_PORT,
 } = {}) {
-  const envPort = parsePositiveInt(port) ?? parsePositiveInt(env?.TFX_HUB_PORT);
-  const urlPort = parsePortFromUrl(env?.TFX_HUB_URL);
+  const envPort =
+    parsePositivePort(port) ?? parsePositivePort(env?.TFX_HUB_PORT);
+  const urlPort = parsePortFromHubUrl(env?.TFX_HUB_URL);
   const resolvedPort = envPort ?? urlPort ?? defaultPort;
   if (
     resolvedPort !== defaultPort &&
+    // Test-only opt-in seam: TFX_HUB_ALLOW_EPHEMERAL_PORT=1 lets an ephemeral
+    // context (worktree cwd / TFX_TEAM_* env) honor the resolved port instead
+    // of clamping to the canonical default. Default-off — production unchanged.
+    String(env?.TFX_HUB_ALLOW_EPHEMERAL_PORT ?? "") !== "1" &&
     isWorktreeOrEphemeralHubContext({ cwd, env })
   ) {
     return defaultPort;
@@ -181,7 +187,7 @@ export async function reapExistingHubProcesses({
     typeof readPidFileFn === "function"
       ? readPidFileFn()
       : { pid: readPidFilePid({ pidFilePath }) };
-  const pidFilePid = parsePositiveInt(pidFileInfo?.pid);
+  const pidFilePid = parsePositivePort(pidFileInfo?.pid);
   const defaultPortPids = [
     ...new Set(
       (typeof findListeningPidsForPortFn === "function"

package/hub/server.mjs

@@ -2461,6 +2461,7 @@ export async function startHub({
                   hubLog.warn(
                     {
                       failed: failed.length,
+                      failedCount: failed.length,
                       processes: failed,
                       caller: "startup",
                     },

package/hub/team/claude-daemon-control.mjs

@@ -113,6 +113,29 @@ export function sendClaudeControlRequest(
   });
 }
 
+// claude daemon 은 control.sock 의 mutating op(dispatch 등)에 control-key
+// 인증을 강제한다 (미제시 시 EAUTH "didn't present the daemon control key").
+// key 는 <configDir>/daemon/control.key (configDir 스코프별). 파일이 없으면
+// 인증 미강제 daemon 으로 보고 auth 필드를 생략한다 (fail-open — 구버전 호환).
+export async function readDaemonControlKey(
+  configDir = resolveClaudeConfigDir(),
+) {
+  try {
+    const key = await fs.readFile(
+      path.join(configDir, "daemon", "control.key"),
+      "utf8",
+    );
+    return key.trim() || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+export async function buildDaemonControlAuth(configDir) {
+  const auth = await readDaemonControlKey(configDir);
+  return auth ? { auth } : {};
+}
+
 export function buildDaemonAttachRequest({
   short,
   cols = DEFAULT_DAEMON_ATTACH_COLS,
@@ -1146,11 +1169,12 @@ export async function resolveDaemonBridgeSessionId({
   }
 }
 
-export async function killDaemonJob(controlSock, short) {
+export async function killDaemonJob(controlSock, short, { auth } = {}) {
   return await sendClaudeControlRequest(controlSock, {
     proto: 1,
     op: "kill",
     short,
+    ...(auth ? { auth } : {}),
   });
 }
 
@@ -1237,6 +1261,7 @@ export async function dispatchClaudeDaemonJob({
   const writeProjection =
     _deps.writeClaudeSessionProjection || writeClaudeSessionProjection;
   const readProcStart = _deps.getProcStart || getProcStart;
+  const buildAuth = _deps.buildDaemonControlAuth || buildDaemonControlAuth;
 
   const short = payload.short;
   const sessionsDir =
@@ -1246,6 +1271,7 @@ export async function dispatchClaudeDaemonJob({
   // native-bridge 는 control.sock 존재를 미리 점검한다 (없으면 fast-fail).
   if (accessControlSock) await accessControlSock(resolvedControlSock);
 
+  const controlAuth = await buildAuth(paths?.configDir);
   const dispatch = await sendControl(
     resolvedControlSock,
     {
@@ -1253,11 +1279,17 @@ export async function dispatchClaudeDaemonJob({
       op: "dispatch",
       d: payload,
       timeoutMs: dispatchTimeoutMs,
+      ...controlAuth,
     },
     { timeoutMs: dispatchTimeoutMs },
   );
   if (dispatch?.ok !== true) {
-    throw new Error(`Claude daemon dispatch failed for ${name || short}`);
+    // daemon 거부 사유를 보존한다 — generic 메시지만 던지면 EAUTH 같은
+    // 실원인이 묻혀 진단이 어려워진다.
+    const reason = dispatch?.error ? `: ${dispatch.error}` : "";
+    throw new Error(
+      `Claude daemon dispatch failed for ${name || short}${reason}`,
+    );
   }
 
   const pidOpts =

package/hub/team/synapse-registry.mjs

@@ -6,6 +6,7 @@ const DEFAULT_LOCAL_TIMEOUT_MS = 30_000;
 const DEFAULT_REMOTE_HEARTBEAT_INTERVAL_MS = 15_000;
 const DEFAULT_REMOTE_TIMEOUT_MS = 90_000;
 const DEFAULT_EXPIRE_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+const DEFAULT_CLEAN_EXPIRE_TIMEOUT_MS = 2 * 60 * 60 * 1000;
 // Interactive (Claude/Codex) sessions idle for long stretches; a 30s local
 // timeout produces stale false-positives. 5-minute TTL + an `idle` state
 // distinguishes "alive but inactive" from "presumed dead".
@@ -23,6 +24,27 @@ function normalizeSessionKind(raw) {
   return VALID_SESSION_KINDS.has(raw) ? raw : "headless";
 }
 
+function normalizeDurationMs(raw, fallback) {
+  if (raw == null) return fallback;
+  const str = String(raw).trim();
+  if (!str) return fallback;
+  const parsed = Number(str);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallback;
+}
+
+function defaultCleanExpireTimeoutMs() {
+  return normalizeDurationMs(
+    process.env.TFX_SYNAPSE_CLEAN_EXPIRE_MS,
+    DEFAULT_CLEAN_EXPIRE_TIMEOUT_MS,
+  );
+}
+
+function hasDirtyFiles(session) {
+  return Array.isArray(session?.dirtyFiles)
+    ? session.dirtyFiles.some((file) => typeof file === "string" && file)
+    : false;
+}
+
 // A session is "live" while active OR idle. Idle is an interactive session that
 // missed its heartbeat interval but is still under the TTL — alive but inactive,
 // not presumed dead. getActive() and querySessions() share this single predicate
@@ -135,6 +157,7 @@ export function createSynapseRegistry(opts = {}) {
     interactiveHeartbeatIntervalMs = DEFAULT_INTERACTIVE_HEARTBEAT_INTERVAL_MS,
     interactiveTimeoutMs = DEFAULT_INTERACTIVE_TIMEOUT_MS,
     expireTimeoutMs = DEFAULT_EXPIRE_TIMEOUT_MS,
+    cleanExpireTimeoutMs = defaultCleanExpireTimeoutMs(),
   } = opts;
 
   const sessions = new Map();
@@ -357,19 +380,23 @@ export function createSynapseRegistry(opts = {}) {
     return true;
   }
 
-  // stale/expired 세션이 expireTimeoutMs 넘게 누적되면 Map에서 제거.
+  // stale/expired 세션이 cutoff 넘게 누적되면 Map에서 제거.
   // live(active/idle)는 lastHeartbeat가 오래돼도 보존 — git-preflight dirty-file 가드가 의존.
+  // Dirty stale rows keep the historical 24h window because same-id resume
+  // revives their dirty-file guard; clean stale rows expire quickly to avoid
+  // daily dummy rows after overnight operator gaps.
   function pruneExpired(opts2 = {}) {
     if (destroyed) return { removed: [], count: 0 };
 
-    const cutoff =
-      typeof opts2.olderThanMs === "number"
-        ? opts2.olderThanMs
-        : expireTimeoutMs;
+    const explicitCutoff =
+      typeof opts2.olderThanMs === "number" ? opts2.olderThanMs : null;
     const removed = [];
     const currentTime = now();
 
     for (const [sessionId, session] of sessions) {
+      const cutoff =
+        explicitCutoff ??
+        (hasDirtyFiles(session) ? expireTimeoutMs : cleanExpireTimeoutMs);
       if (
         isLiveStatus(session.status) ||
         currentTime - session.lastHeartbeat <= cutoff

package/hub/tray-lifecycle.mjs

@@ -1,7 +1,10 @@
 // hub/tray-lifecycle.mjs — Hub/Tray bidirectional auto-start helpers
 
 import { spawn } from "node:child_process";
-import { resolveHubPortForContext } from "./hub-lifecycle.mjs";
+import {
+  isWorktreeOrEphemeralHubContext,
+  resolveHubPortForContext,
+} from "./hub-lifecycle.mjs";
 
 const DEFAULT_HUB_PORT = "27888";
 const DEFAULT_HEALTH_TIMEOUT_MS = 1_000;
@@ -117,6 +120,9 @@ export function spawnTrayForHub({
   spawnFn = spawn,
 } = {}) {
   if (env?.TFX_HUB_AUTO_TRAY === "0") return { status: "disabled" };
+  if (isWorktreeOrEphemeralHubContext({ env })) {
+    return { status: "disabled", reason: "ephemeral-or-worktree-context" };
+  }
   if (platform !== "darwin") return { status: "unsupported-platform" };
   if (!trayPath) return { status: "missing-tray-path" };
 

package/hub/tray.mjs

@@ -19,15 +19,20 @@ function sleep(ms) {
   return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
 }
 
+function isNodeCommand(command) {
+  return /\bnode(?:\s|$)|[/\\]node(?:\s|$)/u.test(command);
+}
+
+function hasMacTrayScriptArg(command) {
+  return /(?:^|[\s"'])[^"'<>|]*[/\\]hub[/\\]tray\.mjs(?:$|[\s"'])/u.test(
+    command,
+  );
+}
+
 export function collectMacTrayProcesses(
   psOutput = "",
-  {
-    scriptPath = fileURLToPath(import.meta.url),
-    currentPid = process.pid,
-  } = {},
+  { currentPid = process.pid } = {},
 ) {
-  const target = String(scriptPath || "");
-  if (!target) return [];
   const ownPid = Number(currentPid);
   return String(psOutput)
     .split(/\r?\n/u)
@@ -38,8 +43,8 @@ export function collectMacTrayProcesses(
       const ppid = Number.parseInt(match[2], 10);
       const command = match[3].trim();
       if (!Number.isFinite(pid) || pid === ownPid) return [];
-      if (!command.includes(target)) return [];
-      if (!/\bnode(?:\s|$)|\/node(?:\s|$)/u.test(command)) return [];
+      if (!isNodeCommand(command)) return [];
+      if (!hasMacTrayScriptArg(command)) return [];
       return [{ pid, ppid, command }];
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triflux/remote",
-  "version": "10.33.1",
+  "version": "10.34.0",
   "description": "triflux remote — team mode, psmux, MCP workers, SQLite store.",
   "type": "module",
   "main": "hub/index.mjs",