@vibelord/lanes 1.3.0 → 1.5.1

package/payload/lanes/libexec/attach.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Bound the desktop client's terminal backlog; reconnect a slow display, never its session.
+
+Zellij 0.45.1 removes a slow client when its 5,000-message queue fills, but
+sends Exit only after draining that queue. Input can wait for an unblock that
+the removed client will never receive. SSH keepalives cannot detect this.
+This relay bounds bytes and age before the terminal can block Zellij's writer.
+"""
+import collections
+import errno
+import fcntl
+import os
+import pty
+import select
+import signal
+import sys
+import termios
+import time
+import tty
+
+OUTPUT_LIMIT = 1024 * 1024
+OUTPUT_AGE = 5.0
+CHUNK = 65536
+STOP_GRACE = 1.0
+# CAN cancels a partial escape sequence. Leave the alternate screen and restore
+# terminal modes even when the child cannot run its own teardown.
+RESET = (b'\x18\x1b[?2026l\x1b[?1049l\x1b[?1000l\x1b[?1002l\x1b[?1003l'
+         b'\x1b[?1006l\x1b[?2004l\x1b[<u\x1b[0m\x1b[?25h')
+
+
+def relay(command, output_limit=OUTPUT_LIMIT, output_age=OUTPUT_AGE):
+    if not command:
+        raise ValueError('No display command supplied')
+    if not os.isatty(0) or not os.isatty(1):
+        raise ValueError('The Lanes display needs a terminal')
+    saved = termios.tcgetattr(0)
+    size = fcntl.ioctl(0, termios.TIOCGWINSZ, b'\0' * 8)
+    flags = fcntl.fcntl(1, fcntl.F_GETFL)
+    pending = collections.deque()  # (time read, remaining bytes); includes partial writes
+    pending_size = 0
+    input_pending = b''
+    child = master = None
+    status = None
+    stopped = False
+    reason = None
+
+    def stop(_sig, _frame):
+        nonlocal stopped
+        stopped = True
+
+    def resize(_sig=None, _frame=None):
+        # forkpty returns -1 in the child. The parent's first resize can send
+        # SIGWINCH before that child has restored its inherited handlers.
+        if master is not None and master >= 0:
+            try:
+                fcntl.ioctl(master, termios.TIOCSWINSZ,
+                            fcntl.ioctl(0, termios.TIOCGWINSZ, b'\0' * 8))
+            except OSError:
+                pass  # the terminal may have closed while SIGWINCH was pending
+
+    signals = (signal.SIGHUP, signal.SIGTERM, signal.SIGINT, signal.SIGWINCH)
+    handlers = {sig: signal.getsignal(sig) for sig in signals}
+    try:
+        # Install before fork: a close during startup must still reap our child.
+        for sig in signals:
+            signal.signal(sig, resize if sig == signal.SIGWINCH else stop)
+        tty.setraw(0)
+        child, master = pty.fork()
+        if child == 0:
+            for sig in signals:
+                signal.signal(sig, signal.SIG_DFL)
+            try:
+                # Give the first render the real dimensions, before exec can
+                # race the parent's initial SIGWINCH forwarding.
+                fcntl.ioctl(0, termios.TIOCSWINSZ, size)
+                os.execvpe(command[0], command, os.environ)
+            except OSError as error:
+                os.write(2, f'lanes: cannot start display: {error}\r\n'.encode())
+                os._exit(127)
+        os.set_blocking(master, False)
+        fcntl.fcntl(1, fcntl.F_SETFL, flags | os.O_NONBLOCK)
+        resize()
+        eof = False
+        while not stopped:
+            if status is None:
+                pid, value = os.waitpid(child, os.WNOHANG)
+                if pid:
+                    status = value
+            if pending and time.monotonic() - pending[0][0] >= output_age:
+                reason = 'display output stalled'
+                break
+            if eof and not pending:
+                break
+            readers = ([] if eof else [master]) + ([] if input_pending or status is not None else [0])
+            writers = ([1] if pending else []) + ([master] if input_pending and not eof else [])
+            readable, writable, _ = select.select(readers, writers, [], 0.05)
+            # Drain first: a writable terminal should not trip the byte limit.
+            if 1 in writable:
+                at, data = pending[0]
+                try:
+                    written = os.write(1, data)
+                except BlockingIOError:
+                    written = 0
+                pending_size -= written
+                if written == len(data):
+                    pending.popleft()
+                elif written:
+                    pending[0] = (at, data[written:])
+            if master in writable:
+                try:
+                    written = os.write(master, input_pending)
+                    input_pending = input_pending[written:]
+                except BlockingIOError:
+                    pass
+            if 0 in readable:
+                input_pending = os.read(0, CHUNK)
+                if not input_pending:
+                    break
+            if master in readable:
+                try:
+                    data = os.read(master, CHUNK)
+                except BlockingIOError:
+                    continue
+                except OSError as error:
+                    if error.errno != errno.EIO:
+                        raise
+                    data = b''  # Linux PTYs report EIO when the slave closes
+                if not data:
+                    eof = True
+                elif pending_size + len(data) > output_limit:
+                    reason = 'display output exceeded its backlog limit'
+                    break
+                else:
+                    pending.append((time.monotonic(), data))
+                    pending_size += len(data)
+    finally:
+        if child and status is None:
+            # Signal only our unreaped child, never a session server or holder.
+            try:
+                os.kill(child, signal.SIGTERM)
+            except ProcessLookupError:
+                pass
+            deadline = time.monotonic() + STOP_GRACE
+            while time.monotonic() < deadline:
+                pid, value = os.waitpid(child, os.WNOHANG)
+                if pid:
+                    status = value
+                    break
+                time.sleep(0.02)
+            if status is None:
+                try:
+                    os.kill(child, signal.SIGKILL)
+                except ProcessLookupError:
+                    pass
+                _, status = os.waitpid(child, 0)
+        if master is not None:
+            os.close(master)
+        # Never block cleanup on the display that caused the timeout. The next
+        # attach repaints from current session state; queued stale output dies here.
+        ending = RESET
+        if reason:
+            ending += f'\r\nlanes: {reason}; reconnecting the display.\r\n'.encode()
+        try:
+            os.write(1, ending)
+        except OSError:
+            pass
+        try:
+            termios.tcsetattr(0, termios.TCSANOW, saved)
+        finally:
+            fcntl.fcntl(1, fcntl.F_SETFL, flags)
+            for sig, handler in handlers.items():
+                signal.signal(sig, handler)
+    # 1 is a reconnectable failure in lanes-launch; 64–78 impose a 60 s hold.
+    return 1 if reason or stopped else (os.waitstatus_to_exitcode(status) if status is not None else 0)
+
+
+if __name__ == '__main__':
+    try:
+        sys.exit(relay(sys.argv[1:]))
+    except (OSError, ValueError) as error:
+        sys.exit(f'lanes: display attach failed: {error}')

package/payload/lanes/libexec/economy_poll.py

@@ -26,7 +26,9 @@ Trace keys: `cc-session/<id>` and `codex-session/<id>` (first two segments of th
 
 The poller (plan Task 11, opt-in `lanes-economy.service`; enabling it is an operator gate because it reads the
 production daemon's loopback control port): every `--interval` seconds it GETs `/status` and `/sessions` (3 s
-timeout, optional bearer from `LANES_THROTTLE_TOKEN_FILE`), folds today's log through `day_totals`, and writes
+timeout, bearer from `LANES_THROTTLE_TOKEN_FILE`: both routes are guarded control reads, and the daemon's ControlAuth
+answers 401 to a request without the bearer whatever the bind — there is no loopback exemption on the control port,
+DEF-1930), folds today's log through `day_totals`, and writes
 `STATE/economy.json` (schema `v: 1`, additive) only when the payload changed apart from `at` — or when the file's
 `at` is HEARTBEAT seconds old, so `at` is a liveness heartbeat the sidebar ages with its own clock (DEF-1528); the
 cursor lives in `STATE/economy.cursor.json`. `LANES_THROTTLE_CONTROL=none` disables every daemon request (the log fold still runs);
@@ -442,7 +444,9 @@ def control_url(env):
 
 
 def read_token(env):
-    """The optional bearer (loopback without `remote_key` needs none). Never logged, never written anywhere."""
+    """The bearer, or None when no file is named. `/status` and `/sessions` are guarded control routes: the daemon's
+    ControlAuth (its `remote_key` or the claude pool's managed local client token) answers 401 without one, loopback
+    or not (DEF-1930), so a poll without it degrades to `HTTP 401`. Never logged, never written anywhere."""
     path = env.get('LANES_THROTTLE_TOKEN_FILE')
     if not path:
         return None