@undefineds.co/xpod 0.4.17 → 0.4.19

package/dist/runtime/GatewayAdminProxyAuth.d.ts

@@ -1,4 +1,4 @@
-import type { IncomingHttpHeaders } from 'node:http';
+import type { IncomingHttpHeaders, OutgoingHttpHeaders } from 'node:http';
 export declare const GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = "x-xpod-admin-proxy-loopback";
 export declare const GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = "x-xpod-admin-proxy-timestamp";
 export declare const GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = "x-xpod-admin-proxy-signature";
@@ -20,7 +20,7 @@ export interface GatewayAdminProxyMarkerVerification {
     nonce?: string;
     reason?: string;
 }
-export declare function createGatewayAdminProxyHeaders(input: GatewayAdminProxyMarkerInput): Record<string, string>;
+export declare function createGatewayAdminProxyHeaders(input: GatewayAdminProxyMarkerInput): OutgoingHttpHeaders;
 export declare function stripGatewayAdminProxyHeaders(headers: IncomingHttpHeaders): void;
 export declare function isLoopbackRemoteAddress(remoteAddress: string | undefined): boolean;
 export declare function verifyGatewayAdminProxyHeaders(input: {

package/dist/runtime/Proxy.js

@@ -594,11 +594,8 @@ class GatewayProxy {
             // Status is the entry probe every client uses, and it carries no secrets.
             if (pathname === '/service/status') {
                 const status = this.supervisor.getAllStatus();
-                // Readiness must cover every supervised child, not just CSS: a gateway whose API child
-                // crashed and gave up used to answer 200 here for hours while /api/* returned 502 (N20).
-                const servicesReady = this.supervisor.isReady();
-                const cssReady = servicesReady && await this.isCssReady();
-                const code = servicesReady && cssReady ? 200 : 503;
+                const cssReady = await this.isCssReady();
+                const code = cssReady ? 200 : 503;
                 res.writeHead(code, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify(status));
                 return;

package/dist/runtime/css-process.d.ts

@@ -6,13 +6,13 @@ import type { AuthMode } from '../authorization/AuthMode';
  * The legacy CSS child process path injects it through a generated
  * Components.js config instead of CSS_* env aliases.
  */
-export declare function buildCssChildEnv(baseUrl: string, cssPort: number, oidcIssuer?: string, authModeInput?: AuthMode | string, baseEnv?: Record<string, string | undefined>, gatewayAdminProxyAuthSecret?: string, mode?: 'local' | 'cloud'): Record<string, string>;
+export declare function buildCssChildEnv(baseUrl: string, cssPort: number, oidcIssuer?: string, authModeInput?: AuthMode | string, baseEnv?: NodeJS.ProcessEnv, gatewayAdminProxyAuthSecret?: string, mode?: 'local' | 'cloud'): Record<string, string>;
 export declare function createCssChildRuntimeConfig(options: {
     configPath: string;
     runtimeRoot: string;
     authMode?: AuthMode | string;
     externalOidcIssuer?: string;
-    baseEnv?: Record<string, string | undefined>;
+    baseEnv?: NodeJS.ProcessEnv;
 }): {
     configPath: string;
     cwd?: string;
@@ -36,5 +36,5 @@ export declare function buildApiChildEnv(options: {
     authMode?: AuthMode | string;
     externalOidcIssuer?: string;
     gatewayAdminProxyAuthSecret?: string;
-    baseEnv?: Record<string, string | undefined>;
+    baseEnv?: NodeJS.ProcessEnv;
 }): Record<string, string>;

package/dist/runtime/index.d.ts

@@ -10,13 +10,7 @@ export { createOpenAuthContext, registerManagedRuntimeServices, startApiRuntime,
 export type { RuntimeServices } from './lifecycle';
 export { GatewayProxy } from './Proxy';
 export { createGatewayAdminProxyAuthSecret } from './GatewayAdminProxyAuth';
-export { findGatewayIngressPort, getEphemeralLoopbackPort, getFreePort, getFreePortForWildcard, isFreePortForWildcard, requireFreePortForWildcard } from './port-finder';
-export { assertUsableIngressPort, parseExplicitIngressPort, resolveIngressPort, IngressPortConflictError } from './ingress-port';
-export type { IngressPortDeclaration, IngressPortResolution, IngressPortSource } from './ingress-port';
-export { identifyIngressPortOccupants } from './ingress-occupant';
-export { getUnreservedEphemeralPort, listenOnUnreservedPort, PORT_RESERVATION_DIR_ENV, RESERVED_PORTS_ENV, portReservation, portReservationDir, readPortReservations, releasePort, reservePort, reservedPorts, } from './port-reservations';
-export type { PortReservation } from './port-reservations';
-export type { IngressPortOccupant, IngressPortOccupants } from './ingress-occupant';
+export { findGatewayIngressPort, getEphemeralLoopbackPort, getFreePort, getFreePortForWildcard, requireFreePortForWildcard } from './port-finder';
 export { ensureTrailingSlash, INVALID_CONFIGURATION_PREFIX, validateBaseUrl } from './base-url';
 export type { ValidateBaseUrlOptions } from './base-url';
 export { applyEnv, loadEnvFile } from './env-utils';

package/dist/runtime/index.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NodeRuntimePlatform = exports.nodeRuntimeHost = exports.NodeRuntimeHost = exports.resolveXpodEnvPath = exports.defaultXpodEnvPath = exports.loadEnvFile = exports.applyEnv = exports.validateBaseUrl = exports.INVALID_CONFIGURATION_PREFIX = exports.ensureTrailingSlash = exports.reservedPorts = exports.reservePort = exports.releasePort = exports.readPortReservations = exports.portReservationDir = exports.portReservation = exports.RESERVED_PORTS_ENV = exports.PORT_RESERVATION_DIR_ENV = exports.listenOnUnreservedPort = exports.getUnreservedEphemeralPort = exports.identifyIngressPortOccupants = exports.IngressPortConflictError = exports.resolveIngressPort = exports.parseExplicitIngressPort = exports.assertUsableIngressPort = exports.requireFreePortForWildcard = exports.isFreePortForWildcard = exports.getFreePortForWildcard = exports.getFreePort = exports.getEphemeralLoopbackPort = exports.findGatewayIngressPort = exports.createGatewayAdminProxyAuthSecret = exports.GatewayProxy = exports.stopRuntimeServices = exports.startGatewayRuntime = exports.startCssRuntime = exports.startApiRuntime = exports.registerManagedRuntimeServices = exports.createOpenAuthContext = exports.createRuntimeEnvironmentSession = exports.nodeRuntimeDriver = exports.NodeRuntimeDriver = exports.resolveRuntimeBootstrap = exports.initRuntimeLogger = exports.createCssRuntimeConfig = exports.buildRuntimeShorthand = exports.buildRuntimeEnv = exports.ensureBunUndiciCompat = exports.findPackageRoot = exports.PACKAGE_ROOT = void 0;
-exports.startXpodRuntime = exports.nodeGatewayRuntimeRunner = exports.NodeGatewayRuntimeRunner = exports.nodeApiRuntimeRunner = exports.NodeApiRuntimeRunner = exports.communitySolidServerCssRunner = exports.CommunitySolidServerCssRunner = exports.registerSocketOriginShims = exports.registerSocketFetchOrigin = exports.nodeRuntimePlatform = void 0;
+exports.startXpodRuntime = exports.nodeGatewayRuntimeRunner = exports.NodeGatewayRuntimeRunner = exports.nodeApiRuntimeRunner = exports.NodeApiRuntimeRunner = exports.communitySolidServerCssRunner = exports.CommunitySolidServerCssRunner = exports.registerSocketOriginShims = exports.registerSocketFetchOrigin = exports.nodeRuntimePlatform = exports.NodeRuntimePlatform = exports.nodeRuntimeHost = exports.NodeRuntimeHost = exports.resolveXpodEnvPath = exports.defaultXpodEnvPath = exports.loadEnvFile = exports.applyEnv = exports.validateBaseUrl = exports.INVALID_CONFIGURATION_PREFIX = exports.ensureTrailingSlash = exports.requireFreePortForWildcard = exports.getFreePortForWildcard = exports.getFreePort = exports.getEphemeralLoopbackPort = exports.findGatewayIngressPort = exports.createGatewayAdminProxyAuthSecret = exports.GatewayProxy = exports.stopRuntimeServices = exports.startGatewayRuntime = exports.startCssRuntime = exports.startApiRuntime = exports.registerManagedRuntimeServices = exports.createOpenAuthContext = exports.createRuntimeEnvironmentSession = exports.nodeRuntimeDriver = exports.NodeRuntimeDriver = exports.resolveRuntimeBootstrap = exports.initRuntimeLogger = exports.createCssRuntimeConfig = exports.buildRuntimeShorthand = exports.buildRuntimeEnv = exports.ensureBunUndiciCompat = exports.findPackageRoot = exports.PACKAGE_ROOT = void 0;
 require("./configure-drizzle-solid");
 var package_root_1 = require("./package-root");
 Object.defineProperty(exports, "PACKAGE_ROOT", { enumerable: true, get: function () { return package_root_1.PACKAGE_ROOT; } });
@@ -35,26 +34,7 @@ Object.defineProperty(exports, "findGatewayIngressPort", { enumerable: true, get
 Object.defineProperty(exports, "getEphemeralLoopbackPort", { enumerable: true, get: function () { return port_finder_1.getEphemeralLoopbackPort; } });
 Object.defineProperty(exports, "getFreePort", { enumerable: true, get: function () { return port_finder_1.getFreePort; } });
 Object.defineProperty(exports, "getFreePortForWildcard", { enumerable: true, get: function () { return port_finder_1.getFreePortForWildcard; } });
-Object.defineProperty(exports, "isFreePortForWildcard", { enumerable: true, get: function () { return port_finder_1.isFreePortForWildcard; } });
 Object.defineProperty(exports, "requireFreePortForWildcard", { enumerable: true, get: function () { return port_finder_1.requireFreePortForWildcard; } });
-var ingress_port_1 = require("./ingress-port");
-Object.defineProperty(exports, "assertUsableIngressPort", { enumerable: true, get: function () { return ingress_port_1.assertUsableIngressPort; } });
-Object.defineProperty(exports, "parseExplicitIngressPort", { enumerable: true, get: function () { return ingress_port_1.parseExplicitIngressPort; } });
-Object.defineProperty(exports, "resolveIngressPort", { enumerable: true, get: function () { return ingress_port_1.resolveIngressPort; } });
-Object.defineProperty(exports, "IngressPortConflictError", { enumerable: true, get: function () { return ingress_port_1.IngressPortConflictError; } });
-var ingress_occupant_1 = require("./ingress-occupant");
-Object.defineProperty(exports, "identifyIngressPortOccupants", { enumerable: true, get: function () { return ingress_occupant_1.identifyIngressPortOccupants; } });
-var port_reservations_1 = require("./port-reservations");
-Object.defineProperty(exports, "getUnreservedEphemeralPort", { enumerable: true, get: function () { return port_reservations_1.getUnreservedEphemeralPort; } });
-Object.defineProperty(exports, "listenOnUnreservedPort", { enumerable: true, get: function () { return port_reservations_1.listenOnUnreservedPort; } });
-Object.defineProperty(exports, "PORT_RESERVATION_DIR_ENV", { enumerable: true, get: function () { return port_reservations_1.PORT_RESERVATION_DIR_ENV; } });
-Object.defineProperty(exports, "RESERVED_PORTS_ENV", { enumerable: true, get: function () { return port_reservations_1.RESERVED_PORTS_ENV; } });
-Object.defineProperty(exports, "portReservation", { enumerable: true, get: function () { return port_reservations_1.portReservation; } });
-Object.defineProperty(exports, "portReservationDir", { enumerable: true, get: function () { return port_reservations_1.portReservationDir; } });
-Object.defineProperty(exports, "readPortReservations", { enumerable: true, get: function () { return port_reservations_1.readPortReservations; } });
-Object.defineProperty(exports, "releasePort", { enumerable: true, get: function () { return port_reservations_1.releasePort; } });
-Object.defineProperty(exports, "reservePort", { enumerable: true, get: function () { return port_reservations_1.reservePort; } });
-Object.defineProperty(exports, "reservedPorts", { enumerable: true, get: function () { return port_reservations_1.reservedPorts; } });
 var base_url_1 = require("./base-url");
 Object.defineProperty(exports, "ensureTrailingSlash", { enumerable: true, get: function () { return base_url_1.ensureTrailingSlash; } });
 Object.defineProperty(exports, "INVALID_CONFIGURATION_PREFIX", { enumerable: true, get: function () { return base_url_1.INVALID_CONFIGURATION_PREFIX; } });

package/dist/runtime/port-finder.d.ts

@@ -5,20 +5,8 @@
  * into a provider console and it survives restarts - while staying clear of the block a
  * neighbouring runtime plans for its own services. When the neighbourhood is busy the caller
  * gets an OS-assigned port instead of a stolen one; the runtime reports whichever it got.
- *
- * Reserved ports are skipped here too: a group that needs a fixed port has published a
- * reservation, and a dynamic entry that took it would break that group's tunnel instead of
- * merely moving its own listener.
  */
 export declare function findGatewayIngressPort(gatewayPort: number): Promise<number>;
-/**
- * The first free port at or above `basePort`.
- *
- * Reserved ports are skipped, not merely avoided by convention: a group that needs a fixed port
- * (the tunnel acceptance's console-owned 5737) publishes a reservation, and every allocator -
- * the runtime, the test helpers, the integration runners - goes around it instead of racing for
- * it. That is the difference between "usually fine" and "cannot collide".
- */
 export declare function getFreePort(basePort: number, host?: string, timeoutMs?: number): Promise<number>;
 /**
  * Loopback port handed out by the OS for a listener that must not collide with ports the
@@ -31,16 +19,10 @@ export declare function getFreePort(basePort: number, host?: string, timeoutMs?:
  */
 export declare function getEphemeralLoopbackPort(): Promise<number>;
 /**
- * Whether this runtime could take the port as-is, on both address families.
- *
- * A tunnel origin is bound on the wildcard address, so a listener on `*:<port>` owns the
- * number even when IPv4 loopback alone still looks free.
- *
- * This is a probe, not an allocation: it answers about the socket, so a *reserved* port that is
- * genuinely free answers `true` (the group that reserved it still has to bind it). The
- * `getFreePort*` family is the allocating one, and it skips reserved ports.
+ * Allocates a port for child services that bind wildcard addresses.
+ * CSS may bind `::` while the API binds `0.0.0.0`, so probing only localhost
+ * can miss an occupied port on the other address family.
  */
-export declare function isFreePortForWildcard(port: number, timeoutMs?: number): Promise<boolean>;
 /**
  * Takes exactly this port or fails.
  *
@@ -48,10 +30,4 @@ export declare function isFreePortForWildcard(port: number, timeoutMs?: number):
  * scans upward, which would leave the runtime listening somewhere the tunnel never reaches.
  */
 export declare function requireFreePortForWildcard(port: number, timeoutMs?: number): Promise<number>;
-/**
- * Allocates a port for child services that bind wildcard addresses.
- *
- * CSS may bind `::` while the API binds `0.0.0.0`, so probing only localhost can miss an
- * occupied port on the other address family - and a reserved port is skipped either way.
- */
 export declare function getFreePortForWildcard(basePort: number, timeoutMs?: number): Promise<number>;

package/dist/runtime/port-finder.js

@@ -6,12 +6,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.findGatewayIngressPort = findGatewayIngressPort;
 exports.getFreePort = getFreePort;
 exports.getEphemeralLoopbackPort = getEphemeralLoopbackPort;
-exports.isFreePortForWildcard = isFreePortForWildcard;
 exports.requireFreePortForWildcard = requireFreePortForWildcard;
 exports.getFreePortForWildcard = getFreePortForWildcard;
 const node_net_1 = __importDefault(require("node:net"));
 const node_os_1 = __importDefault(require("node:os"));
-const port_reservations_1 = require("./port-reservations");
 const HIGHEST_PORT = 65_535;
 const PORT_PROBE_TIMEOUT_MS = 1_000;
 const RETRYABLE_PORT_ERRORS = new Set([
@@ -109,10 +107,6 @@ async function canListen(port, host, timeoutMs = PORT_PROBE_TIMEOUT_MS) {
  * into a provider console and it survives restarts - while staying clear of the block a
  * neighbouring runtime plans for its own services. When the neighbourhood is busy the caller
  * gets an OS-assigned port instead of a stolen one; the runtime reports whichever it got.
- *
- * Reserved ports are skipped here too: a group that needs a fixed port has published a
- * reservation, and a dynamic entry that took it would break that group's tunnel instead of
- * merely moving its own listener.
  */
 async function findGatewayIngressPort(gatewayPort) {
     for (let offset = 3; offset < 10; offset += 1) {
@@ -123,20 +117,8 @@ async function findGatewayIngressPort(gatewayPort) {
     }
     return await getEphemeralLoopbackPort();
 }
-/**
- * The first free port at or above `basePort`.
- *
- * Reserved ports are skipped, not merely avoided by convention: a group that needs a fixed port
- * (the tunnel acceptance's console-owned 5737) publishes a reservation, and every allocator -
- * the runtime, the test helpers, the integration runners - goes around it instead of racing for
- * it. That is the difference between "usually fine" and "cannot collide".
- */
 async function getFreePort(basePort, host = '127.0.0.1', timeoutMs = PORT_PROBE_TIMEOUT_MS) {
-    const reserved = (0, port_reservations_1.reservedPorts)();
     for (let port = basePort; port <= HIGHEST_PORT; port++) {
-        if (reserved.has(port)) {
-            continue;
-        }
         if (await canListen(port, host, timeoutMs)) {
             return port;
         }
@@ -153,35 +135,30 @@ async function getFreePort(basePort, host = '127.0.0.1', timeoutMs = PORT_PROBE_
  * runtime's service.
  */
 async function getEphemeralLoopbackPort() {
-    // One retry rule for "the OS does not know about reservations", shared with the fixtures that
-    // bind their own server (`listenOnUnreservedPort`).
-    return await (0, port_reservations_1.getUnreservedEphemeralPort)('127.0.0.1');
+    return await new Promise((resolve, reject) => {
+        const server = node_net_1.default.createServer();
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            const port = typeof address === 'object' && address ? address.port : 0;
+            server.close((error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(port);
+            });
+        });
+    });
 }
 function hasIpv6Address() {
     return Object.values(node_os_1.default.networkInterfaces()).some((entries) => entries?.some((entry) => entry.family === 'IPv6'));
 }
 /**
- * Whether this runtime could take the port as-is, on both address families.
- *
- * A tunnel origin is bound on the wildcard address, so a listener on `*:<port>` owns the
- * number even when IPv4 loopback alone still looks free.
- *
- * This is a probe, not an allocation: it answers about the socket, so a *reserved* port that is
- * genuinely free answers `true` (the group that reserved it still has to bind it). The
- * `getFreePort*` family is the allocating one, and it skips reserved ports.
+ * Allocates a port for child services that bind wildcard addresses.
+ * CSS may bind `::` while the API binds `0.0.0.0`, so probing only localhost
+ * can miss an occupied port on the other address family.
  */
-async function isFreePortForWildcard(port, timeoutMs = PORT_PROBE_TIMEOUT_MS) {
-    if (!Number.isInteger(port) || port <= 0 || port > 65535) {
-        return false;
-    }
-    if (!await canListen(port, '0.0.0.0', timeoutMs)) {
-        return false;
-    }
-    if (hasIpv6Address() && !await canListen(port, '::', timeoutMs)) {
-        return false;
-    }
-    return true;
-}
 /**
  * Takes exactly this port or fails.
  *
@@ -192,24 +169,17 @@ async function requireFreePortForWildcard(port, timeoutMs = PORT_PROBE_TIMEOUT_M
     if (!Number.isInteger(port) || port <= 0 || port > 65535) {
         throw new Error(`ingress port ${port} is not a valid port number`);
     }
-    if (!await isFreePortForWildcard(port, timeoutMs)) {
+    if (!await canListen(port, '0.0.0.0', timeoutMs)) {
         throw new Error(`ingress port ${port} is already in use; free it or point the tunnel at another port`);
     }
+    if (hasIpv6Address() && !await canListen(port, '::', timeoutMs)) {
+        throw new Error(`ingress port ${port} is already in use on IPv6; free it or point the tunnel at another port`);
+    }
     return port;
 }
-/**
- * Allocates a port for child services that bind wildcard addresses.
- *
- * CSS may bind `::` while the API binds `0.0.0.0`, so probing only localhost can miss an
- * occupied port on the other address family - and a reserved port is skipped either way.
- */
 async function getFreePortForWildcard(basePort, timeoutMs = PORT_PROBE_TIMEOUT_MS) {
     const probeIpv6 = hasIpv6Address();
-    const reserved = (0, port_reservations_1.reservedPorts)();
     for (let port = basePort; port <= HIGHEST_PORT; port++) {
-        if (reserved.has(port)) {
-            continue;
-        }
         if (!await canListen(port, '0.0.0.0', timeoutMs)) {
             continue;
         }

package/dist/runtime/safe-env.d.ts

@@ -4,7 +4,7 @@ export interface AiConnectionsRuntimeConfig {
     apiKey: string;
     model?: string;
 }
-export declare function sanitizeRuntimeEnv(source?: Record<string, string | undefined> | Record<string, string | undefined>): Record<string, string>;
+export declare function sanitizeRuntimeEnv(source?: NodeJS.ProcessEnv | Record<string, string | undefined>): Record<string, string>;
 export declare function requireAiConnectionsRuntimeConfig(input: {
     baseUrl?: string;
     apiKey?: string;

package/dist/runtime/user-env.d.ts

@@ -1,6 +1,6 @@
 export declare function defaultXpodEnvPath({ env, platform, homeDir, }?: {
-    env?: Record<string, string | undefined>;
+    env?: NodeJS.ProcessEnv;
     platform?: NodeJS.Platform;
     homeDir?: string;
 }): string;
-export declare function resolveXpodEnvPath(explicitPath: string | undefined, env?: Record<string, string | undefined>): string;
+export declare function resolveXpodEnvPath(explicitPath: string | undefined, env?: NodeJS.ProcessEnv): string;

package/dist/supervisor/Supervisor.d.ts

@@ -5,15 +5,6 @@ export interface SupervisorLog {
     source: string;
     message: string;
 }
-export interface SupervisorOptions {
-    handleProcessSignals?: boolean;
-    /** Consecutive failed runs tolerated before giving up. */
-    maxRestarts?: number;
-    /** First restart delay; doubles per consecutive failure up to 60s. */
-    restartBaseDelayMs?: number;
-    /** Uptime that counts as a healthy run and resets the failure streak. */
-    healthyUptimeMs?: number;
-}
 export declare class Supervisor {
     private processes;
     private managedStops;
@@ -22,13 +13,9 @@ export declare class Supervisor {
     private logs;
     private onStatusChange?;
     private isShuttingDown;
-    private childOutput;
-    private pendingRestarts;
-    private intentionalStops;
-    private readonly maxRestarts;
-    private readonly restartBaseDelayMs;
-    private readonly healthyUptimeMs;
-    constructor(options?: SupervisorOptions);
+    constructor(options?: {
+        handleProcessSignals?: boolean;
+    });
     private shutdown;
     private killAll;
     setStatusChangeHandler(handler: StatusChangeHandler): void;
@@ -44,16 +31,6 @@ export declare class Supervisor {
     startAll(): Promise<void>;
     stopAll(): Promise<void>;
     start(name: string): void;
-    /**
-     * Stop restarting a service and say why. The gateway must not keep advertising itself as
-     * healthy afterwards: readiness derives from supervised state, not from HTTP reachability.
-     */
-    private giveUp;
-    /**
-     * Readiness of the supervised set: every configured child must be running. Managed services
-     * (for example the gateway itself) are lifecycle-owned elsewhere and are not required here.
-     */
-    isReady(): boolean;
     stop(name: string): Promise<void>;
     restart(name: string): Promise<boolean>;
     getStatus(name: string): ServiceState | undefined;

package/dist/supervisor/Supervisor.js

@@ -8,29 +8,6 @@ const node_child_process_1 = require("node:child_process");
 const tree_kill_1 = __importDefault(require("tree-kill"));
 const MAX_RESTARTS = 5;
 const MAX_LOGS = 500;
-/** Restart backoff: 2s, 4s, 8s, 16s, 32s, capped at 60s. */
-const RESTART_BASE_DELAY_MS = 2_000;
-const RESTART_MAX_DELAY_MS = 60_000;
-/** A run that stays up this long counts as healthy and clears the failure streak. */
-const HEALTHY_UPTIME_MS = 60_000;
-/** Bounded tail of child output kept per service for crash diagnosis. */
-const MAX_CHILD_OUTPUT_LINES = 20;
-/**
- * Failures that cannot be fixed by retrying: the child's own runtime cannot resolve a module,
- * so every restart fails identically. Retrying only hides the breakage behind a healthy-looking
- * gateway, which is exactly how the audited instance stayed half-dead for hours (N20).
- */
-const NON_RETRYABLE_PATTERNS = [
-    { pattern: /Cannot find package ['"][^'"]+['"]/u, reason: 'missing dependency (Cannot find package)' },
-    { pattern: /Cannot find module ['"][^'"]+['"]/u, reason: 'missing module (Cannot find module)' },
-    { pattern: /\bMODULE_NOT_FOUND\b/u, reason: 'missing module (MODULE_NOT_FOUND)' },
-];
-/** Mask credentials before child output is stored in supervisor state or served over HTTP. */
-function redactSecrets(line) {
-    return line
-        .replace(/([A-Za-z0-9_]*(?:token|secret|password|passwd|api[_-]?key|credential)[A-Za-z0-9_]*)(\s*[:=]\s*)("[^"]*"|'[^']*'|\S+)/giu, (_match, key, separator) => `${key}${separator}***`)
-        .replace(/\b([Bb]earer)\s+[A-Za-z0-9\-._~+/=]{8,}/gu, '$1 ***');
-}
 class Supervisor {
     constructor(options = {}) {
         this.processes = new Map();
@@ -39,12 +16,6 @@ class Supervisor {
         this.configs = new Map();
         this.logs = [];
         this.isShuttingDown = false;
-        this.childOutput = new Map();
-        this.pendingRestarts = new Map();
-        this.intentionalStops = new Set();
-        this.maxRestarts = options.maxRestarts ?? MAX_RESTARTS;
-        this.restartBaseDelayMs = options.restartBaseDelayMs ?? RESTART_BASE_DELAY_MS;
-        this.healthyUptimeMs = options.healthyUptimeMs ?? HEALTHY_UPTIME_MS;
         if (options.handleProcessSignals === false) {
             return;
         }
@@ -140,10 +111,6 @@ class Supervisor {
     }
     async stopAll() {
         this.isShuttingDown = true;
-        for (const [name, timer] of this.pendingRestarts) {
-            clearTimeout(timer);
-            this.pendingRestarts.delete(name);
-        }
         const promises = [];
         for (const name of this.processes.keys()) {
             promises.push(this.stop(name));
@@ -162,16 +129,9 @@ class Supervisor {
             return;
         if (state.status === 'running' || state.status === 'starting')
             return;
-        const pendingRestart = this.pendingRestarts.get(name);
-        if (pendingRestart) {
-            clearTimeout(pendingRestart);
-            this.pendingRestarts.delete(name);
-        }
-        this.intentionalStops.delete(name);
-        this.childOutput.set(name, []);
         console.log(`[Supervisor] Starting ${name}...`);
         this.addLog(name, 'info', 'Service starting');
-        this.updateState(name, { status: 'starting', startTime: Date.now(), givenUpReason: undefined });
+        this.updateState(name, { status: 'starting', startTime: Date.now() });
         const env = config.env ?? process.env;
         const child = (0, node_child_process_1.spawn)(config.command, config.args, {
             stdio: ['ignore', 'pipe', 'pipe'],
@@ -181,16 +141,6 @@ class Supervisor {
         });
         this.processes.set(name, child);
         this.updateState(name, { status: 'running', pid: child.pid });
-        const recordOutput = (line) => {
-            const tail = this.childOutput.get(name);
-            if (!tail) {
-                return;
-            }
-            tail.push(line);
-            if (tail.length > MAX_CHILD_OUTPUT_LINES) {
-                tail.splice(0, tail.length - MAX_CHILD_OUTPUT_LINES);
-            }
-        };
         const prefixLog = (source, data, isError = false) => {
             const output = data.toString();
             const lines = output.split('\n');
@@ -199,18 +149,13 @@ class Supervisor {
                 if (!trimmed) {
                     continue;
                 }
-                // Redact once, at the single point where child output enters supervisor state:
-                // the console, the log ring buffer (served by /service/logs) and the retained
-                // crash tail must not disagree about what the child printed.
-                const text = redactSecrets(trimmed);
-                recordOutput(text);
                 if (isError) {
-                    console.error(`[${source}] ${text}`);
-                    this.addLog(source, 'error', text);
+                    console.error(`[${source}] ${trimmed}`);
+                    this.addLog(source, 'error', trimmed);
                 }
                 else {
-                    console.log(`[${source}] ${text}`);
-                    this.addLog(source, 'info', text);
+                    console.log(`[${source}] ${trimmed}`);
+                    this.addLog(source, 'info', trimmed);
                 }
             }
         };
@@ -223,94 +168,44 @@ class Supervisor {
         child.on('error', (err) => {
             console.error(`[Supervisor] Error spawning ${name}:`, err);
             this.addLog(name, 'error', `Spawn error: ${String(err)}`);
-            this.updateState(name, { status: 'crashed', givenUpReason: `Spawn error: ${String(err)}` });
+            this.updateState(name, { status: 'crashed' });
         });
         child.on('exit', (code, signal) => {
-            const exitedAt = Date.now();
-            const stateBeforeExit = this.states.get(name);
-            const uptimeMs = stateBeforeExit?.startTime ? exitedAt - stateBeforeExit.startTime : 0;
-            const wasManualStop = stateBeforeExit?.status === 'stopped' || this.intentionalStops.has(name);
-            const wasHealthy = uptimeMs >= this.healthyUptimeMs;
-            const consecutiveFailures = wasHealthy ? 0 : (stateBeforeExit?.consecutiveFailures ?? 0) + 1;
-            const outputTail = this.childOutput.get(name) ?? [];
-            const nonRetryable = NON_RETRYABLE_PATTERNS.find(({ pattern }) => outputTail.some((line) => pattern.test(line)));
             console.log(`[Supervisor] ${name} exited with code ${code} signal ${signal}`);
             this.addLog(name, code === 0 ? 'info' : 'error', `Exited with code ${code ?? 'null'} signal ${signal ?? 'null'}`);
-            this.processes.delete(name);
-            this.childOutput.delete(name);
-            this.intentionalStops.delete(name);
+            const currentState = this.states.get(name);
+            const wasManualStop = currentState?.status === 'stopped';
             this.updateState(name, {
                 status: 'stopped',
                 lastExitCode: code ?? undefined,
-                lastExitAt: exitedAt,
-                lastOutput: outputTail,
-                consecutiveFailures,
                 pid: undefined,
             });
-            // Auto-restart on crash (not on clean exit, manual stop or shutdown)
-            if (code === 0 || wasManualStop || this.isShuttingDown) {
-                return;
-            }
-            if (nonRetryable) {
-                this.giveUp(name, `Unrecoverable child failure: ${nonRetryable.reason}; restart suppressed`, consecutiveFailures);
-                return;
-            }
-            if (consecutiveFailures > this.maxRestarts) {
-                this.giveUp(name, `Exceeded max restarts (budget ${this.maxRestarts}, ${consecutiveFailures} consecutive failures)`, consecutiveFailures);
-                return;
+            this.processes.delete(name);
+            // Auto-restart on crash (not on manual stop or shutdown)
+            if (code !== 0 && !wasManualStop && !this.isShuttingDown) {
+                const newState = this.states.get(name);
+                const restartCount = (newState?.restartCount || 0) + 1;
+                if (restartCount <= MAX_RESTARTS) {
+                    this.updateState(name, { restartCount });
+                    console.log(`[Supervisor] Restarting ${name} in 2s... (attempt ${restartCount}/${MAX_RESTARTS})`);
+                    this.addLog(name, 'warn', `Restarting in 2s (attempt ${restartCount}/${MAX_RESTARTS})`);
+                    setTimeout(() => this.start(name), 2000);
+                }
+                else {
+                    console.error(`[Supervisor] ${name} exceeded max restarts (${MAX_RESTARTS}), giving up`);
+                    this.addLog(name, 'error', `Exceeded max restarts (${MAX_RESTARTS})`);
+                }
             }
-            const delay = Math.min(this.restartBaseDelayMs * 2 ** (consecutiveFailures - 1), RESTART_MAX_DELAY_MS);
-            this.updateState(name, { restartCount: (stateBeforeExit?.restartCount ?? 0) + 1 });
-            const attempt = `(${consecutiveFailures}/${this.maxRestarts} consecutive failures)`;
-            console.log(`[Supervisor] Restarting ${name} in ${delay}ms... ${attempt}`);
-            this.addLog(name, 'warn', `Restarting in ${Math.round(delay / 1000)}s ${attempt}`);
-            const timer = setTimeout(() => {
-                this.pendingRestarts.delete(name);
-                this.start(name);
-            }, delay);
-            this.pendingRestarts.set(name, timer);
         });
     }
-    /**
-     * Stop restarting a service and say why. The gateway must not keep advertising itself as
-     * healthy afterwards: readiness derives from supervised state, not from HTTP reachability.
-     */
-    giveUp(name, reason, consecutiveFailures) {
-        console.error(`[Supervisor] ${name}: ${reason}`);
-        this.addLog(name, 'error', `Giving up on ${name}: ${reason}`);
-        this.updateState(name, { status: 'given-up', givenUpReason: reason, consecutiveFailures });
-    }
-    /**
-     * Readiness of the supervised set: every configured child must be running. Managed services
-     * (for example the gateway itself) are lifecycle-owned elsewhere and are not required here.
-     */
-    isReady() {
-        for (const name of this.configs.keys()) {
-            if (this.states.get(name)?.status !== 'running') {
-                return false;
-            }
-        }
-        return true;
-    }
     stop(name) {
         return new Promise((resolve) => {
-            const pendingRestart = this.pendingRestarts.get(name);
-            if (pendingRestart) {
-                // A service waiting out its backoff is not running, but it is not stopped either:
-                // cancel the timer so a stop request cannot be undone by a scheduled restart.
-                clearTimeout(pendingRestart);
-                this.pendingRestarts.delete(name);
-            }
             const child = this.processes.get(name);
             if (!child || !child.pid) {
-                if (this.states.has(name)) {
-                    this.updateState(name, { status: 'stopped', pid: undefined, givenUpReason: undefined });
-                }
                 resolve();
                 return;
             }
             // Mark as stopped first to prevent auto-restart
-            this.intentionalStops.add(name);
             this.updateState(name, { status: 'stopped' });
             this.addLog(name, 'info', 'Stopping service');
             (0, tree_kill_1.default)(child.pid, 'SIGTERM', (err) => {
@@ -335,8 +230,6 @@ class Supervisor {
             this.addLog(name, 'error', 'Timed out waiting for service to stop before restart');
             return false;
         }
-        // An explicit restart follows a deliberate operator action: grant a fresh retry budget.
-        this.updateState(name, { consecutiveFailures: 0, givenUpReason: undefined });
         this.addLog(name, 'info', 'Service restart requested');
         this.start(name);
         return true;

package/dist/supervisor/types.d.ts

@@ -6,12 +6,7 @@ export interface ServiceConfig {
     cwd?: string;
     readyUrl?: string;
 }
-/**
- * `given-up` means the supervisor stopped restarting the child on purpose (unrecoverable
- * failure or exhausted retries). It is distinct from `stopped` (intentional stop) and
- * `crashed` (spawn failed) because a given-up child never returns without operator action.
- */
-export type ServiceStatus = 'stopped' | 'starting' | 'running' | 'crashed' | 'given-up';
+export type ServiceStatus = 'stopped' | 'starting' | 'running' | 'crashed';
 export interface ServiceState {
     name: string;
     status: ServiceStatus;
@@ -19,14 +14,6 @@ export interface ServiceState {
     startTime?: number;
     uptime?: number;
     lastExitCode?: number;
-    /** Epoch millis of the last child exit, so a stale crash can be told apart from a live one. */
-    lastExitAt?: number;
     restartCount: number;
-    /** Consecutive failed runs; a run that stayed up long enough clears it. */
-    consecutiveFailures?: number;
-    /** Bounded, redacted tail of the child's own output, for diagnosing a crash without shell access. */
-    lastOutput?: string[];
-    /** Why the supervisor stopped restarting this service (set while status is `given-up`). */
-    givenUpReason?: string;
 }
 export type StatusChangeHandler = (name: string, state: ServiceState) => void;