borgmcp 1.0.5 → 1.0.7

package/dist/log-stream.js

@@ -1,848 +1,9 @@
-/**
- * Real-time drone wakeup via Server-Sent Events.
- *
- * Replaces the long-poll + inbox-file-shim path in `client/src/inbox.ts`
- * for the wire layer; the local inbox file is preserved as the
- * Claude-side wake primitive (Monitor on tail -F) because Claude Code
- * does not currently wake idle agent loops on MCP-protocol
- * notifications. See spec:
- *   docs/superpowers/specs/2026-05-11-server-push-log-subscription.md
- *
- * Lifetimes:
- *   - One persistent fetch-streaming connection to /api/drone/stream
- *     per active cube.
- *   - On every received `event: log`, a single line is appended to the
- *     per-drone inbox file (same format the old poller wrote).
- *   - On every `event: heartbeat`, any carried hwm is compared against
- *     `lastPersistedEventId`; divergence starts a short grace timer
- *     before reconnect so an in-flight live broadcast can arrive first.
- *   - Outer `runLoop` reconnects with exponential backoff on any
- *     stream-level error, including heartbeat watchdog firing.
- *
- * State exposed via `getStreamStatus()` so the `borg:stream-status`
- * MCP tool can probe without perturbing the stream (no second
- * connection, no second auth — just an in-process state snapshot).
- */
-import { promises as fs } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { getActiveCube, inboxPathForDrone } from './cubes.js';
-import { formatCodexWakePrompt, resolveSessionAgentKind, wakeCodexViaAppServer, } from './codex-app-wake.js';
-import { getValidToken } from './remote-client.js';
-import { recordEventReceipt, emitHealthBeat, getCachedMonitorHealthy, getCachedWakeArmed, } from './health-beat.js';
-import { getPackageVersion } from './version.js';
-import { acquireStreamLease, readOwnershipSnapshot, } from './stream-owner.js';
-// ------------------------------------------------------------------
-// Tuning constants
-// ------------------------------------------------------------------
-/** Server emits heartbeats every 20s; allow several misses before reconnecting. */
-const HEARTBEAT_TIMEOUT_MS = 90_000;
-/** Grace window for a heartbeat HWM that is ahead of the local cursor. */
-const HWM_DIVERGENCE_GRACE_MS = 2_000;
-const RECONNECT_MIN_MS = 500;
-const RECONNECT_MAX_MS = 30_000;
-/**
- * Bounded recent-id set sized for the SSE replay window per spec §(3).
- * The catchup query returns up to 200 entries on reconnect; 50 is
- * comfortable headroom for the typical reorder/dedup case (1–3
- * entries) without the memory cost of the old long-poll 500-entry
- * ring buffer.
- */
-const RECENT_IDS_CAP = 50;
-function resolveRuntimeHostname() {
-    try {
-        const h = os.hostname();
-        return h && h.trim() ? h.trim().slice(0, 255) : null;
-    }
-    catch {
-        return null;
-    }
-}
-const processStartMs = Date.now();
-const streamState = {
-    connected: false,
-    lastWireActivityAt: null,
-    lastContentEventAt: null,
-    lastHeartbeatAt: null,
-    lastPersistedEventId: null,
-    reconnectAttempts: 0,
-    runLoopRestartCount: 0,
-    ownership: { state: 'unowned' },
-};
-/**
- * Snapshot of the current stream status. Safe to call at any time
- * (returns a copy, does not interact with the running connection).
- */
-export function classifyRunLoopHealth(state, uptimeMs = Date.now() - processStartMs) {
-    if (state.connected && state.lastWireActivityAt)
-        return 'connected';
-    if (!state.connected && state.reconnectAttempts > 0)
-        return 'reconnecting';
-    if (!state.connected && !state.lastWireActivityAt && state.reconnectAttempts === 0 && uptimeMs > 10_000)
-        return 'silent-inert';
-    return 'never-started';
-}
-export function getStreamStatus() {
-    return { ...streamState, runLoopHealth: classifyRunLoopHealth(streamState) };
-}
-/**
- * Reset the module-level stream state. EXPORTED FOR TESTS ONLY — the
- * stream state is a singleton that accumulates across the process
- * lifetime in normal operation. Tests asserting on the new
- * content-vs-wire field semantics need a clean slate between
- * scenarios; nothing in production code should call this.
- *
- * @internal — test-only surface; not part of the public client API. The
- * `__`-prefix + `ForTest` suffix mark it as such at every call site.
- */
-export function __resetStreamStateForTest() {
-    streamState.connected = false;
-    streamState.lastWireActivityAt = null;
-    streamState.lastContentEventAt = null;
-    streamState.lastHeartbeatAt = null;
-    streamState.lastPersistedEventId = null;
-    streamState.reconnectAttempts = 0;
-    streamState.runLoopRestartCount = 0;
-    streamState.ownership = { state: 'unowned' };
-}
-// ------------------------------------------------------------------
-// Entry point
-// ------------------------------------------------------------------
-/**
- * Spawn the background SSE consumer loop. Fire-and-forget; the loop
- * runs until process exit. Errors are written to stderr (so they don't
- * pollute the MCP stdio channel) and the loop continues.
- *
- * Idempotent in the sense that calling twice would create two parallel
- * loops; the caller (`index.ts`) wires this once at startup.
- */
-export function startLogStream() {
-    void (async () => {
-        while (true) {
-            try {
-                await runLoop();
-                process.stderr.write('[borg-mcp log stream] runLoop returned unexpectedly; restarting in 5s\n');
-            }
-            catch (err) {
-                process.stderr.write(`[borg-mcp log stream] runLoop threw: ${err?.message ?? err}; restarting in 5s\n`);
-            }
-            streamState.runLoopRestartCount += 1;
-            await sleep(5000);
-        }
-    })();
-}
-const defaultDeps = {
-    fetchImpl: globalThis.fetch.bind(globalThis),
-    appendLine: defaultAppendLine,
-    hasInboxEntryId: defaultHasInboxEntryId,
-    getToken: getValidToken,
-    wakeCodex: wakeCodexViaAppServer,
-    heartbeatTimeoutMs: HEARTBEAT_TIMEOUT_MS,
-    hwmDivergenceGraceMs: HWM_DIVERGENCE_GRACE_MS,
-    abortSignal: new AbortController().signal,
-    ownerDeps: {},
-    ownerStaleMs: 70_000,
-    onInboxReceipt: defaultOnInboxReceipt,
-};
-/**
- * gh#541 WU-2 default receipt handler: record the wake-path receipt watermark
- * and fire a best-effort health beat below the agent classifier. Reuses the
- * SSE session's already-fetched token (no extra keychain read) and the cached
- * monitor-health from the periodic tick (no pgrep per inbound entry).
- */
-function defaultOnInboxReceipt(active, token) {
-    recordEventReceipt();
-    void emitHealthBeat(active, {
-        sseConnected: true,
-        inboxMonitorHealthy: getCachedMonitorHealthy(),
-        // gh#633: reuse the cached transport-agnostic wake-armed from the periodic
-        // tick (no bridge/Monitor re-probe per inbound entry).
-        wakeArmed: getCachedWakeArmed(),
-        // gh#634: live runtime agent_kind (cheap env read, constant per session).
-        agentKind: resolveSessionAgentKind(),
-        hostname: resolveRuntimeHostname(),
-        version: getPackageVersion(),
-        getToken: async () => token,
-        // The beat rides the real global fetch — its OWN child-process HTTP wire,
-        // independent of the SSE stream's (possibly test-injected) fetchImpl.
-        fetchImpl: globalThis.fetch.bind(globalThis),
-    });
-}
-// ------------------------------------------------------------------
-// Outer reconnect loop
-// ------------------------------------------------------------------
-async function runLoop() {
-    let attempt = 0;
-    let lastEventId = null;
-    let currentCubeId = null;
-    let lease = null;
-    let leaseKey = null;
-    while (true) {
-        const active = await getActiveCube();
-        if (!active) {
-            if (lease) {
-                await lease.release();
-                lease = null;
-                leaseKey = null;
-            }
-            streamState.connected = false;
-            streamState.ownership = { state: 'unowned' };
-            await sleep(5000);
-            continue;
-        }
-        // Reset resume cursor on cube switch — entries from a prior cube
-        // mean nothing for the new cube's stream.
-        if (active.cubeId !== currentCubeId) {
-            currentCubeId = active.cubeId;
-            lastEventId = null;
-        }
-        const nextLeaseKey = `${active.cubeId}:${active.droneId}`;
-        if (lease && leaseKey !== nextLeaseKey) {
-            await lease.release();
-            lease = null;
-            leaseKey = null;
-        }
-        if (!lease) {
-            lease = await acquireStreamLease(active.cubeId, active.droneId);
-            leaseKey = lease ? nextLeaseKey : null;
-        }
-        if (!lease) {
-            streamState.connected = false;
-            streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId);
-            await sleep(5000);
-            continue;
-        }
-        streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId);
-        let ownerLost = false;
-        try {
-            const ownerAbort = new AbortController();
-            const refresh = async () => {
-                try {
-                    if (!(await lease.refresh())) {
-                        ownerLost = true;
-                        ownerAbort.abort(new Error('stream ownership lost'));
-                    }
-                }
-                catch (err) {
-                    ownerLost = true;
-                    ownerAbort.abort(err instanceof Error ? err : new Error(String(err)));
-                }
-            };
-            const refreshTimer = setInterval(() => {
-                void refresh();
-            }, Math.max(1000, Math.floor(HEARTBEAT_TIMEOUT_MS / 2)));
-            try {
-                await streamOnce(active, lastEventId, (id) => {
-                    lastEventId = id;
-                }, { abortSignal: ownerAbort.signal });
-            }
-            finally {
-                clearInterval(refreshTimer);
-            }
-            if (ownerLost) {
-                lease = null;
-                leaseKey = null;
-                streamState.connected = false;
-                streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId);
-                await sleep(5000);
-                continue;
-            }
-            // Clean disconnect (e.g. server-side rollout). Reset backoff.
-            attempt = 0;
-            streamState.reconnectAttempts = 0;
-        }
-        catch (err) {
-            if (ownerLost) {
-                lease = null;
-                leaseKey = null;
-                streamState.connected = false;
-                streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId);
-                await sleep(5000);
-                continue;
-            }
-            streamState.connected = false;
-            const delay = Math.min(RECONNECT_MIN_MS * 2 ** attempt, RECONNECT_MAX_MS) +
-                Math.random() * 500;
-            process.stderr.write(`[borg-mcp log stream] reconnect in ${Math.round(delay)}ms: ${err?.message ?? err}\n`);
-            attempt += 1;
-            streamState.reconnectAttempts = attempt;
-            await sleep(delay);
-        }
-    }
-}
-export async function streamOnce(active, lastEventId, onEventId, deps = {}) {
-    const { fetchImpl, appendLine, hasInboxEntryId, getToken, wakeCodex, heartbeatTimeoutMs, hwmDivergenceGraceMs, abortSignal, onInboxReceipt, } = { ...defaultDeps, ...deps };
-    const token = await getToken();
-    const headers = {
-        Authorization: `Bearer ${token}`,
-        'X-Drone-Session': active.sessionToken,
-        Accept: 'text/event-stream',
-    };
-    if (lastEventId)
-        headers['Last-Event-ID'] = lastEventId;
-    const ac = new AbortController();
-    const abortFromExternal = () => {
-        try {
-            ac.abort(abortSignal.reason ?? new Error('external abort'));
-        }
-        catch {
-            // ignore
-        }
-    };
-    if (abortSignal.aborted)
-        abortFromExternal();
-    abortSignal.addEventListener('abort', abortFromExternal, { once: true });
-    // Heartbeat watchdog: if no event of any type arrives within
-    // heartbeatTimeoutMs, abort the request so the outer loop reconnects.
-    let watchdog = null;
-    const bumpWatchdog = () => {
-        if (watchdog)
-            clearTimeout(watchdog);
-        watchdog = setTimeout(() => {
-            try {
-                ac.abort(new Error('heartbeat watchdog timeout'));
-            }
-            catch {
-                // ignore
-            }
-        }, heartbeatTimeoutMs);
-    };
-    bumpWatchdog();
-    // Local mirror of the resume cursor, updated AFTER each successful
-    // disk write (or dedup-recognized replay). Heartbeat-hwm comparison
-    // reads this value.
-    let lastPersistedEventId = lastEventId;
-    let lastBroadcastHwm = null;
-    let pendingHwmDivergence = null;
-    const clearPendingHwmDivergence = () => {
-        if (!pendingHwmDivergence)
-            return;
-        clearTimeout(pendingHwmDivergence.timer);
-        pendingHwmDivergence = null;
-    };
-    // gh#402 replay-storm amplifier fix (c80b1aaa #1): advance the resume cursor
-    // MONOTONICALLY by (created_at, id). An out-of-order older broadcast (or a
-    // catchup replay of an older entry) must NOT regress lastPersistedEventId —
-    // a regressed resume cursor widens the next reconnect's catchup window and
-    // re-replays entries (the tail -F storm). Reuses compareBroadcastHwm
-    // ((created_at,id) tiebreak), the SAME key the server orders broadcasts by.
-    //
-    // FAIL-OPEN on a missing created_at: every real SSE payload carries a
-    // non-empty created_at (EnrichedEntry / ack / heartbeat-hwm all guarantee
-    // it server-side), so the guard engages for every production event. But an
-    // absent/empty created_at is NOT ordinally comparable (UUID ids aren't
-    // either — see the dedup branch), so we only BLOCK a regression we can
-    // PROVE: both the incoming entry and the current cursor carry a real
-    // created_at AND the incoming is older-or-equal. Otherwise ADVANCE —
-    // freezing the resume cursor on a fresh forward entry that happens to lack
-    // a created_at would itself widen the next reconnect's window (the very
-    // storm this fixes). Proven older-or-equal events are still recorded in
-    // recentIds for dedup but do not move the cursor or re-fire onEventId.
-    let lastPersistedHwm = null;
-    const markEventPersisted = (id, createdAt) => {
-        const next = { id, created_at: createdAt };
-        if (lastPersistedHwm &&
-            createdAt &&
-            lastPersistedHwm.created_at &&
-            compareBroadcastHwm(next, lastPersistedHwm) <= 0) {
-            return;
-        }
-        lastPersistedHwm = next;
-        lastPersistedEventId = id;
-        streamState.lastPersistedEventId = id;
-        onEventId(id);
-    };
-    const markBroadcastPersisted = (hwm) => {
-        if (!hwm)
-            return;
-        lastBroadcastHwm =
-            !lastBroadcastHwm || compareBroadcastHwm(hwm, lastBroadcastHwm) > 0
-                ? hwm
-                : lastBroadcastHwm;
-        if (pendingHwmDivergence &&
-            compareBroadcastHwm(lastBroadcastHwm, pendingHwmDivergence.hwm) >= 0) {
-            clearPendingHwmDivergence();
-        }
-    };
-    const scheduleHwmDivergenceReconnect = (hwm) => {
-        if (pendingHwmDivergence?.hwm.id === hwm.id)
-            return;
-        clearPendingHwmDivergence();
-        const timer = setTimeout(() => {
-            if (lastBroadcastHwm && compareBroadcastHwm(lastBroadcastHwm, hwm) >= 0) {
-                clearPendingHwmDivergence();
-                return;
-            }
-            try {
-                ac.abort(new Error('hwm divergence — reconnect for catchup'));
-            }
-            catch {
-                // ignore
-            }
-        }, hwmDivergenceGraceMs);
-        pendingHwmDivergence = { hwm, timer };
-    };
-    // Bounded recent-id set for replay-on-reconnect dedup per spec §(3).
-    // Set + FIFO array for O(1) membership + bounded memory.
-    const recentIds = new Set();
-    const recentIdsOrder = [];
-    let isCatchingUp = lastEventId !== null;
-    // gh#29 quality-stream (#5): shared inbox-write + cursor-advance helpers,
-    // extracted from the previously-duplicated ack / regular-log branches in the
-    // event loop below. Behavior-preserving — the per-branch comments document
-    // the load-bearing semantics each path relies on.
-    // Format + (catchup-dedup-aware) append the entry's inbox line.
-    // LOAD-BEARING ORDER: the disk write must complete before the cursor
-    // advances (recordSeen), so an append failure (disk full, EACCES, path race
-    // during cube switch) replays the entry on reconnect rather than being
-    // skipped past by an already-advanced Last-Event-ID — the §(3) durability
-    // contract. Returns 'persisted-skip' when the entry is already on disk from
-    // an earlier catchup receive (caller advances the cursor via markEventPersisted
-    // here, then continues WITHOUT re-recording); 'written' after a fresh append.
-    const writeInboxLine = async (ev) => {
-        const line = formatInboxLine(withSseEventId(ev.data, ev.id));
-        if (isCatchingUp &&
-            // gh#441: pass the rendered line so the dedup can also recognize LEGACY
-            // (no-entry_id-prefix) on-disk lines, not just the [entry_id:] marker.
-            (await hasInboxEntryId(active.cubeId, active.droneId, ev.id, line))) {
-            markEventPersisted(ev.id, ev.data?.created_at ?? '');
-            return 'persisted-skip';
-        }
-        await appendLine(active.cubeId, active.droneId, line);
-        wakeCodex(formatCodexWakePrompt(line));
-        // gh#541 WU-2: a fresh inbound entry just hit the inbox (the wake-path
-        // receipt). Record it + beat below the classifier (best-effort).
-        onInboxReceipt(active, token);
-        return 'written';
-    };
-    // Record the event in the bounded recent-ids dedup set (FIFO-capped) and
-    // advance both cursors. The broadcast-HWM cursor advances via
-    // broadcastHwmFromLogEvent, which returns null for visibility==='direct' and
-    // kind==='ack' (those do NOT advance the server's DO broadcast HWM either —
-    // D6), so it advances ONLY for broadcast entries. gh#402 replay-storm fix
-    // (583aed7e): this runs for OWN-POST broadcasts too — the author's own
-    // broadcast IS counted by the server HWM, so the client broadcast cursor
-    // must advance to match; otherwise the next heartbeat reads server-hwm >
-    // client-cursor and fires a spurious divergence-reconnect (the storm
-    // trigger). The null-for-direct/ack guard keeps own-direct echoes correct.
-    const recordSeen = (ev) => {
-        recentIds.add(ev.id);
-        recentIdsOrder.push(ev.id);
-        while (recentIdsOrder.length > RECENT_IDS_CAP) {
-            const oldId = recentIdsOrder.shift();
-            if (oldId)
-                recentIds.delete(oldId);
-        }
-        markEventPersisted(ev.id, ev.data?.created_at ?? '');
-        markBroadcastPersisted(broadcastHwmFromLogEvent(ev));
-    };
-    let response;
-    try {
-        response = await fetchImpl(`${active.apiUrl}/api/drone/stream`, {
-            method: 'GET',
-            headers,
-            signal: ac.signal,
-        });
-    }
-    catch (err) {
-        if (watchdog)
-            clearTimeout(watchdog);
-        throw err;
-    }
-    if (!response.ok || !response.body) {
-        if (watchdog)
-            clearTimeout(watchdog);
-        throw new Error(`stream HTTP ${response.status}`);
-    }
-    streamState.connected = true;
-    try {
-        for await (const event of parseSSE(response.body)) {
-            bumpWatchdog();
-            const nowIso = new Date().toISOString();
-            streamState.lastWireActivityAt = nowIso;
-            // Content vs wire split (T1.2): content freshness is what a reader
-            // skimming the top-line verdict actually cares about. Heartbeats
-            // bump wire-activity only; log and bookmark events bump both.
-            if (event.type === 'log' || event.type === 'bookmark') {
-                streamState.lastContentEventAt = nowIso;
-            }
-            if (event.type === 'heartbeat') {
-                streamState.lastHeartbeatAt = nowIso;
-                // First/baseline heartbeat absorb: until this session has seen
-                // a broadcast entry, the server's broadcast HWM is our baseline.
-                // Direct messages may advance the persistence cursor past this
-                // value; directional comparison must not treat that mirror case
-                // as missed-broadcast evidence.
-                if (event.hwm && lastBroadcastHwm === null) {
-                    markBroadcastPersisted(event.hwm);
-                    if (lastPersistedEventId === null) {
-                        markEventPersisted(event.hwm.id, event.hwm.created_at);
-                    }
-                    continue;
-                }
-                if (event.hwm &&
-                    lastBroadcastHwm &&
-                    compareBroadcastHwm(event.hwm, lastBroadcastHwm) <= 0) {
-                    clearPendingHwmDivergence();
-                    continue;
-                }
-                // §(5) divergence-detection: reconnect only when the server's
-                // broadcast HWM is AHEAD of the client's broadcast cursor. A
-                // recipient persisting a direct entry legitimately advances
-                // lastPersistedEventId beyond the broadcast HWM; strict
-                // inequality would reintroduce gh#402 churn for that mirror case.
-                if (event.hwm &&
-                    lastBroadcastHwm &&
-                    compareBroadcastHwm(event.hwm, lastBroadcastHwm) > 0) {
-                    scheduleHwmDivergenceReconnect(event.hwm);
-                }
-                continue;
-            }
-            if (event.type === 'bookmark') {
-                isCatchingUp = false;
-                continue;
-            }
-            if (event.type === 'log') {
-                // DEDUP per §(3) recent-ids contract: an out-of-order DO
-                // broadcast followed by reconnect+catchup can replay an entry
-                // we already persisted. The entry IS on disk from an earlier
-                // receive in this session — just not from THIS iteration's
-                // appendLine. So we skip the duplicate write AND advance the
-                // cursor (so the heartbeat-hwm comparison converges and so
-                // Last-Event-ID on the next reconnect reflects the highest
-                // id we've actually got persisted). UUIDs are not ordinally
-                // comparable with created_at, so set membership is the check.
-                if (recentIds.has(event.id)) {
-                    markEventPersisted(event.id, event.data?.created_at ?? '');
-                    markBroadcastPersisted(broadcastHwmFromLogEvent(event));
-                    continue;
-                }
-                // OWN-DRONE FILTER: restore the silent-self property — parity
-                // with pre-cutover inbox.ts:87-88. The DO broadcasts every
-                // entry to every connected drone INCLUDING the originator;
-                // without this skip, posting a log entry would wake the
-                // posting drone on its own message (visible via Monitor on
-                // the inbox file). The entry IS on disk (we wrote it via
-                // appendLog), so skip the inbox echo but still advance the
-                // cursor + record in recentIds so heartbeat-hwm comparison
-                // converges and the next reconnect's Last-Event-ID reflects
-                // the highest id we've actually got persisted. Structurally
-                // identical to the dedup branch above — same "skip write,
-                // advance state" shape, different trigger condition.
-                //
-                // HEARTBEAT-PING CARVE-OUT (gh#71): the gh#39 cron watchdog
-                // authors heartbeat-pings WITH the silent target as drone_id
-                // so each ping is attributed to the drone it intends to wake.
-                // Without this carve-out, the own-drone filter would silently
-                // skip the target's own ping → inbox file never written →
-                // Monitor never fires → the platform-level wake guarantee is
-                // broken for the cube-wide-silent class gh#39 was designed to
-                // prevent. We let heartbeat-pings authored "by" the target
-                // drone through the disk-write path; the existing rate-limit
-                // in workers/heartbeat.ts (max 1 ping per drone per ~1h)
-                // bounds the silent-self property's relaxation.
-                const isHeartbeatPing = typeof event.data?.message === 'string' &&
-                    event.data.message.startsWith('[HEARTBEAT-PING]');
-                // Sprint 26 ack-fan-out: ack events have `kind: 'ack'` plus an
-                // `author_drone_id` field naming the recipient (the author of
-                // the entry that got acked). Only the author writes the ack
-                // line to their inbox — all other subscribers drop the event
-                // but still advance the cursor. The legacy entry-shaped fields
-                // on the ack payload exist for pre-Sprint-26 clients that
-                // don't recognize the `kind` discriminator; new clients route
-                // here BEFORE the legacy own-drone filter so the ack-specific
-                // semantic takes precedence.
-                if (event.data?.kind === 'ack') {
-                    if (event.data?.author_drone_id === active.droneId) {
-                        if ((await writeInboxLine(event)) === 'persisted-skip')
-                            continue;
-                    }
-                    recordSeen(event);
-                    continue;
-                }
-                if (event.data?.drone_id === active.droneId && !isHeartbeatPing) {
-                    // Own post: silent-self (no inbox echo — already on disk via
-                    // appendLog). recordSeen still advances BOTH cursors, including the
-                    // broadcast cursor for an own broadcast — see recordSeen's gh#402
-                    // (583aed7e) note for why skipping it here would storm.
-                    recordSeen(event);
-                    continue;
-                }
-                // Regular inbound entry: write the inbox line (catchup-dedup aware),
-                // then advance both cursors.
-                if ((await writeInboxLine(event)) === 'persisted-skip')
-                    continue;
-                recordSeen(event);
-            }
-        }
-    }
-    finally {
-        abortSignal.removeEventListener('abort', abortFromExternal);
-        if (watchdog)
-            clearTimeout(watchdog);
-        clearPendingHwmDivergence();
-        streamState.connected = false;
-    }
-}
-export async function streamOnceIfOwner(active, lastEventId, onEventId, deps = {}) {
-    const { ownerDeps, ownerStaleMs } = { ...defaultDeps, ...deps };
-    const lease = await acquireStreamLease(active.cubeId, active.droneId, ownerStaleMs, ownerDeps);
-    if (!lease) {
-        streamState.connected = false;
-        streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId, ownerDeps);
-        return 'skipped';
-    }
-    streamState.ownership = await readOwnershipSnapshot(active.cubeId, active.droneId, ownerDeps);
-    try {
-        await streamOnce(active, lastEventId, onEventId, deps);
-        return 'streamed';
-    }
-    finally {
-        await lease.release();
-    }
-}
-/**
- * Async generator over an SSE response body. Yields one ParsedEvent
- * per "event:/data:" block (separated by blank lines per RFC 5234).
- *
- * Exported so tests can pump a synthetic ReadableStream through it.
- */
-export async function* parseSSE(body) {
-    const reader = body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
-    try {
-        while (true) {
-            const { value, done } = await reader.read();
-            if (done) {
-                if (buffer.trim()) {
-                    const parsed = parseEventBlock(buffer);
-                    if (parsed)
-                        yield parsed;
-                }
-                return;
-            }
-            buffer += decoder.decode(value, { stream: true });
-            // Split on double-newline (event terminator). Keep the trailing
-            // partial block in `buffer` for the next read.
-            let idx;
-            while ((idx = buffer.indexOf('\n\n')) !== -1) {
-                const block = buffer.slice(0, idx);
-                buffer = buffer.slice(idx + 2);
-                const parsed = parseEventBlock(block);
-                if (parsed)
-                    yield parsed;
-            }
-        }
-    }
-    finally {
-        try {
-            reader.releaseLock();
-        }
-        catch {
-            // ignore — stream may already be closed
-        }
-    }
-}
-function parseEventBlock(block) {
-    let eventName = null;
-    let id = null;
-    let dataLines = [];
-    for (const line of block.split('\n')) {
-        if (line.startsWith('event:')) {
-            eventName = line.slice(6).trim();
-        }
-        else if (line.startsWith('id:')) {
-            id = line.slice(3).trim();
-        }
-        else if (line.startsWith('data:')) {
-            dataLines.push(line.slice(5).trim());
-        }
-    }
-    const dataStr = dataLines.join('\n');
-    if (!eventName)
-        return null;
-    if (eventName === 'log') {
-        if (!id)
-            return null;
-        let parsed;
-        try {
-            parsed = JSON.parse(dataStr);
-        }
-        catch {
-            return null;
-        }
-        return { type: 'log', id, data: parsed };
-    }
-    if (eventName === 'heartbeat') {
-        let ts = null;
-        let hwm = null;
-        try {
-            const parsed = JSON.parse(dataStr);
-            ts = typeof parsed.ts === 'string' ? parsed.ts : null;
-            hwm = parseHeartbeatHwm(parsed.hwm);
-        }
-        catch {
-            // fall through with nulls
-        }
-        return { type: 'heartbeat', ts, hwm };
-    }
-    if (eventName === 'bookmark') {
-        let as_of = null;
-        try {
-            const parsed = JSON.parse(dataStr);
-            as_of = typeof parsed.as_of === 'string' ? parsed.as_of : null;
-        }
-        catch {
-            // fall through with null
-        }
-        return { type: 'bookmark', as_of };
-    }
-    return { type: 'unknown', raw: block };
-}
-function parseHeartbeatHwm(value) {
-    if (!value || typeof value !== 'object')
-        return null;
-    const candidate = value;
-    return typeof candidate.id === 'string' &&
-        candidate.id.length > 0 &&
-        typeof candidate.created_at === 'string' &&
-        candidate.created_at.length > 0
-        ? { id: candidate.id, created_at: candidate.created_at }
-        : null;
-}
-// Cross-bundle duplicate of workers/log-hwm.ts `compareBroadcastHwm` — the two
-// MUST stay in sync on the (created_at, id) tiebreak, else a heartbeat-HWM
-// comparison could diverge between client and server and cause spurious or
-// missed gh#402 divergence-reconnects. Exported so the parity test
-// (workers/__tests__/log-hwm-parity.test.ts) can pin them equal on a shared
-// fixture set. See ISSUE-FOUND fb3986b7.
-export function compareBroadcastHwm(a, b) {
-    const aTime = Date.parse(a.created_at);
-    const bTime = Date.parse(b.created_at);
-    if (Number.isFinite(aTime) && Number.isFinite(bTime) && aTime !== bTime) {
-        return aTime - bTime;
-    }
-    if (a.created_at !== b.created_at) {
-        return a.created_at < b.created_at ? -1 : 1;
-    }
-    return a.id.localeCompare(b.id);
-}
-function broadcastHwmFromLogEvent(event) {
-    if (event.data?.visibility === 'direct' || event.data?.kind === 'ack') {
-        return null;
-    }
-    const createdAt = event.data?.created_at;
-    return typeof createdAt === 'string' && createdAt.length > 0
-        ? { id: event.id, created_at: createdAt }
-        : null;
-}
-function withSseEventId(entry, eventId) {
-    if (!entry || typeof entry !== 'object')
-        return { id: eventId };
-    if (typeof entry.id === 'string' && entry.id.length > 0)
-        return entry;
-    return { ...entry, id: eventId };
-}
-/**
- * First argument that is a non-empty string, else ''. Used to pick the
- * inbox entry id from the server `id` field, falling back to the legacy
- * `entry_id` field. Flattens what was a nested ternary at the call site.
- */
-function firstNonEmptyString(...candidates) {
-    for (const candidate of candidates) {
-        if (typeof candidate === 'string' && candidate.length > 0)
-            return candidate;
-    }
-    return '';
-}
-/**
- * Format one inbox-file line. Preserves the long-poll inbox.ts prefix
- * shape (`<iso-ts> <drone-label> (<role-name>): ...`) so existing
- * Monitor tail consumers and audit tooling keep parsing it.
- *
- * Newlines in the message body are joined to ` ⏎ ` (U+23CE Return Symbol,
- * space-padded) so the entire entry is one physical line in the inbox
- * file. Rationale: Claude Code's Monitor primitive consumes stdout via
- * Node `readline` — every `\n` creates a NEW notification event, so a
- * multi-line cube-log entry would fire multiple notifications with only
- * the first line being a recognized entry-start (the rest dropped by
- * `formatEventLine`'s regex). Joining at write time delivers the full
- * entry content in a single notification body. Drones recognize ⏎ as
- * "newline was here" — convention noted in the regen-format playbook.
- */
-export function formatInboxLine(entry) {
-    const ts = typeof entry.created_at === 'string'
-        ? new Date(entry.created_at).toISOString()
-        : new Date().toISOString();
-    const label = entry.drone_label ?? '?';
-    const role = entry.role_name ?? '?';
-    const rawMessage = typeof entry.message === 'string' ? entry.message : '';
-    // Server `id`, else legacy `entry_id`, else '' (behavior-identical to the
-    // prior nested ternary).
-    const entryId = firstNonEmptyString(entry.id, entry.entry_id);
-    const idPrefix = entryId ? `[entry_id: ${entryId}] ` : '';
-    // Normalize \r\n, \r, and \n all to ` ⏎ ` so the entry fits on one
-    // physical line regardless of line-ending convention in the source.
-    const message = rawMessage.replace(/\r\n|\r|\n/g, ' ⏎ ');
-    return `${ts} ${label} (${role}): ${idPrefix}${message}`;
-}
-async function defaultAppendLine(cubeId, droneId, line) {
-    const p = inboxPathForDrone(cubeId, droneId);
-    await fs.mkdir(path.dirname(p), { recursive: true });
-    await fs.appendFile(p, line + '\n', 'utf-8');
-}
-/**
- * @internal Exported for unit tests.
- *
- * Decide whether `raw` (the full inbox-file contents) already contains the
- * entry identified by `entryId` / rendered as `renderedLine`. Robust to BOTH
- * on-disk line formats (gh#441 — catchup-replay-flood fix):
- *   - NEW format (0.9.39+): `…: [entry_id: <id>] <message>` — matched by the
- *     `[entry_id: <id>]` marker (the #412 dedup, preserved verbatim).
- *   - LEGACY format (pre-0.9.39 / old ACK lines): `…: <message>` with NO
- *     entry_id prefix — matched by an EXACT, line-anchored comparison against
- *     the entry's legacy rendering (`renderedLine` with the id-prefix stripped).
- *
- * Why this exists: a worker DEPLOY evicts the LogBroadcaster DO → every drone's
- * SSE drops → fleet-wide simultaneous reconnect → catchup. The old substring
- * check (`raw.includes('[entry_id: <id>]')`) missed legacy lines, so catchup
- * re-appended them → tail -F replay flood.
- *
- * The legacy match is LINE-ANCHORED (exact line equality), NOT a substring
- * match, on purpose: a substring match would false-positive-DROP a genuinely
- * new entry whose message merely EXTENDS an existing line (e.g. `…: hello` vs
- * `…: hello world`). A dropped entry is worse than a re-append — the drone
- * misses a wake — so when in doubt this fails toward re-append, never drop.
- */
-export function inboxRawHasEntry(raw, entryId, renderedLine) {
-    // New-format: entry_id marker (preserves the #412 dedup).
-    if (entryId && raw.includes(`[entry_id: ${entryId}]`))
-        return true;
-    // Legacy-format: exact, line-anchored match against the id-prefix-stripped
-    // rendering. `String.prototype.replace` with a string pattern strips only the
-    // first (sole) prefix occurrence; entryId is treated literally (not regex).
-    const legacyForm = entryId
-        ? renderedLine.replace(`[entry_id: ${entryId}] `, '')
-        : renderedLine;
-    if (legacyForm && raw.split(/\r?\n/).includes(legacyForm))
-        return true;
-    return false;
-}
-async function defaultHasInboxEntryId(cubeId, droneId, entryId, renderedLine) {
-    const p = inboxPathForDrone(cubeId, droneId);
-    let raw;
-    try {
-        raw = await fs.readFile(p, 'utf-8');
-    }
-    catch (err) {
-        if (err?.code === 'ENOENT')
-            return false;
-        throw err;
-    }
-    return inboxRawHasEntry(raw, entryId, renderedLine);
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-//# sourceMappingURL=log-stream.js.map
+import{promises as D}from"node:fs";import X from"node:os";import q from"node:path";import{getActiveCube as z,inboxPathForDrone as W}from"./cubes.js";import{formatCodexWakePrompt as Q,resolveSessionAgentKind as Y,wakeCodexViaAppServer as Z}from"./codex-app-wake.js";import{getValidToken as ee}from"./remote-client.js";import{recordEventReceipt as te,emitHealthBeat as ne,getCachedMonitorHealthy as re,getCachedWakeArmed as ae}from"./health-beat.js";import{getPackageVersion as oe}from"./version.js";import{acquireStreamLease as F,readOwnershipSnapshot as g}from"./stream-owner.js";const B=9e4,ie=2e3,se=500,ce=3e4,le=50;function de(){try{const e=X.hostname();return e&&e.trim()?e.trim().slice(0,255):null}catch{return null}}const ue=Date.now(),o={connected:!1,lastWireActivityAt:null,lastContentEventAt:null,lastHeartbeatAt:null,lastPersistedEventId:null,reconnectAttempts:0,runLoopRestartCount:0,ownership:{state:"unowned"}};function fe(e,t=Date.now()-ue){return e.connected&&e.lastWireActivityAt?"connected":!e.connected&&e.reconnectAttempts>0?"reconnecting":!e.connected&&!e.lastWireActivityAt&&e.reconnectAttempts===0&&t>1e4?"silent-inert":"never-started"}function De(){return{...o,runLoopHealth:fe(o)}}function Re(){o.connected=!1,o.lastWireActivityAt=null,o.lastContentEventAt=null,o.lastHeartbeatAt=null,o.lastPersistedEventId=null,o.reconnectAttempts=0,o.runLoopRestartCount=0,o.ownership={state:"unowned"}}function Ne(){(async()=>{for(;;){try{await me(),process.stderr.write(`[borg-mcp log stream] runLoop returned unexpectedly; restarting in 5s
+`)}catch(e){process.stderr.write(`[borg-mcp log stream] runLoop threw: ${e?.message??e}; restarting in 5s
+`)}o.runLoopRestartCount+=1,await y(5e3)}})()}const G={fetchImpl:globalThis.fetch.bind(globalThis),appendLine:Ie,hasInboxEntryId:Ee,getToken:ee,wakeCodex:Z,heartbeatTimeoutMs:B,hwmDivergenceGraceMs:ie,abortSignal:new AbortController().signal,ownerDeps:{},ownerStaleMs:7e4,onInboxReceipt:pe};function pe(e,t){te(),ne(e,{sseConnected:!0,inboxMonitorHealthy:re(),wakeArmed:ae(),agentKind:Y(),hostname:de(),version:oe(),getToken:async()=>t,fetchImpl:globalThis.fetch.bind(globalThis)})}async function me(){let e=0,t=null,i=null,a=null,s=null;for(;;){const r=await z();if(!r){a&&(await a.release(),a=null,s=null),o.connected=!1,o.ownership={state:"unowned"},await y(5e3);continue}r.cubeId!==i&&(i=r.cubeId,t=null);const c=`${r.cubeId}:${r.droneId}`;if(a&&s!==c&&(await a.release(),a=null,s=null),a||(a=await F(r.cubeId,r.droneId),s=a?c:null),!a){o.connected=!1,o.ownership=await g(r.cubeId,r.droneId),await y(5e3);continue}o.ownership=await g(r.cubeId,r.droneId);let l=!1;try{const f=new AbortController,h=async()=>{try{await a.refresh()||(l=!0,f.abort(new Error("stream ownership lost")))}catch(p){l=!0,f.abort(p instanceof Error?p:new Error(String(p)))}},k=setInterval(()=>{h()},Math.max(1e3,Math.floor(B/2)));try{await K(r,t,p=>{t=p},{abortSignal:f.signal})}finally{clearInterval(k)}if(l){a=null,s=null,o.connected=!1,o.ownership=await g(r.cubeId,r.droneId),await y(5e3);continue}e=0,o.reconnectAttempts=0}catch(f){if(l){a=null,s=null,o.connected=!1,o.ownership=await g(r.cubeId,r.droneId),await y(5e3);continue}o.connected=!1;const h=Math.min(se*2**e,ce)+Math.random()*500;process.stderr.write(`[borg-mcp log stream] reconnect in ${Math.round(h)}ms: ${f?.message??f}
+`),e+=1,o.reconnectAttempts=e,await y(h)}}}async function K(e,t,i,a={}){const{fetchImpl:s,appendLine:r,hasInboxEntryId:c,getToken:l,wakeCodex:f,heartbeatTimeoutMs:h,hwmDivergenceGraceMs:k,abortSignal:p,onInboxReceipt:J}={...G,...a},R=await l(),N={Authorization:`Bearer ${R}`,"X-Drone-Session":e.sessionToken,Accept:"text/event-stream"};t&&(N["Last-Event-ID"]=t);const E=new AbortController,x=()=>{try{E.abort(p.reason??new Error("external abort"))}catch{}};p.aborted&&x(),p.addEventListener("abort",x,{once:!0});let m=null;const O=()=>{m&&clearTimeout(m),m=setTimeout(()=>{try{E.abort(new Error("heartbeat watchdog timeout"))}catch{}},h)};O();let P=t,u=null,w=null;const I=()=>{w&&(clearTimeout(w.timer),w=null)};let A=null;const S=(n,d)=>{const T={id:n,created_at:d};A&&d&&A.created_at&&b(T,A)<=0||(A=T,P=n,o.lastPersistedEventId=n,i(n))},C=n=>{n&&(u=!u||b(n,u)>0?n:u,w&&b(u,w.hwm)>=0&&I())},U=n=>{if(w?.hwm.id===n.id)return;I();const d=setTimeout(()=>{if(u&&b(u,n)>=0){I();return}try{E.abort(new Error("hwm divergence \u2014 reconnect for catchup"))}catch{}},k);w={hwm:n,timer:d}},H=new Set,M=[];let v=t!==null;const $=async n=>{const d=ye(ge(n.data,n.id));return v&&await c(e.cubeId,e.droneId,n.id,d)?(S(n.id,n.data?.created_at??""),"persisted-skip"):(await r(e.cubeId,e.droneId,d),f(Q(d)),J(e,R),"written")},L=n=>{for(H.add(n.id),M.push(n.id);M.length>le;){const d=M.shift();d&&H.delete(d)}S(n.id,n.data?.created_at??""),C(j(n))};let _;try{_=await s(`${e.apiUrl}/api/drone/stream`,{method:"GET",headers:N,signal:E.signal})}catch(n){throw m&&clearTimeout(m),n}if(!_.ok||!_.body)throw m&&clearTimeout(m),new Error(`stream HTTP ${_.status}`);o.connected=!0;try{for await(const n of we(_.body)){O();const d=new Date().toISOString();if(o.lastWireActivityAt=d,(n.type==="log"||n.type==="bookmark")&&(o.lastContentEventAt=d),n.type==="heartbeat"){if(o.lastHeartbeatAt=d,n.hwm&&u===null){C(n.hwm),P===null&&S(n.hwm.id,n.hwm.created_at);continue}if(n.hwm&&u&&b(n.hwm,u)<=0){I();continue}n.hwm&&u&&b(n.hwm,u)>0&&U(n.hwm);continue}if(n.type==="bookmark"){v=!1;continue}if(n.type==="log"){if(H.has(n.id)){S(n.id,n.data?.created_at??""),C(j(n));continue}const T=typeof n.data?.message=="string"&&n.data.message.startsWith("[HEARTBEAT-PING]");if(n.data?.kind==="ack"){if(n.data?.author_drone_id===e.droneId&&await $(n)==="persisted-skip")continue;L(n);continue}if(n.data?.drone_id===e.droneId&&!T){L(n);continue}if(await $(n)==="persisted-skip")continue;L(n)}}}finally{p.removeEventListener("abort",x),m&&clearTimeout(m),I(),o.connected=!1}}async function Oe(e,t,i,a={}){const{ownerDeps:s,ownerStaleMs:r}={...G,...a},c=await F(e.cubeId,e.droneId,r,s);if(!c)return o.connected=!1,o.ownership=await g(e.cubeId,e.droneId,s),"skipped";o.ownership=await g(e.cubeId,e.droneId,s);try{return await K(e,t,i,a),"streamed"}finally{await c.release()}}async function*we(e){const t=e.getReader(),i=new TextDecoder;let a="";try{for(;;){const{value:s,done:r}=await t.read();if(r){if(a.trim()){const l=V(a);l&&(yield l)}return}a+=i.decode(s,{stream:!0});let c;for(;(c=a.indexOf(`
+
+`))!==-1;){const l=a.slice(0,c);a=a.slice(c+2);const f=V(l);f&&(yield f)}}}finally{try{t.releaseLock()}catch{}}}function V(e){let t=null,i=null,a=[];for(const r of e.split(`
+`))r.startsWith("event:")?t=r.slice(6).trim():r.startsWith("id:")?i=r.slice(3).trim():r.startsWith("data:")&&a.push(r.slice(5).trim());const s=a.join(`
+`);if(!t)return null;if(t==="log"){if(!i)return null;let r;try{r=JSON.parse(s)}catch{return null}return{type:"log",id:i,data:r}}if(t==="heartbeat"){let r=null,c=null;try{const l=JSON.parse(s);r=typeof l.ts=="string"?l.ts:null,c=he(l.hwm)}catch{}return{type:"heartbeat",ts:r,hwm:c}}if(t==="bookmark"){let r=null;try{const c=JSON.parse(s);r=typeof c.as_of=="string"?c.as_of:null}catch{}return{type:"bookmark",as_of:r}}return{type:"unknown",raw:e}}function he(e){if(!e||typeof e!="object")return null;const t=e;return typeof t.id=="string"&&t.id.length>0&&typeof t.created_at=="string"&&t.created_at.length>0?{id:t.id,created_at:t.created_at}:null}function b(e,t){const i=Date.parse(e.created_at),a=Date.parse(t.created_at);return Number.isFinite(i)&&Number.isFinite(a)&&i!==a?i-a:e.created_at!==t.created_at?e.created_at<t.created_at?-1:1:e.id.localeCompare(t.id)}function j(e){if(e.data?.visibility==="direct"||e.data?.kind==="ack")return null;const t=e.data?.created_at;return typeof t=="string"&&t.length>0?{id:e.id,created_at:t}:null}function ge(e,t){return!e||typeof e!="object"?{id:t}:typeof e.id=="string"&&e.id.length>0?e:{...e,id:t}}function be(...e){for(const t of e)if(typeof t=="string"&&t.length>0)return t;return""}function ye(e){const t=typeof e.created_at=="string"?new Date(e.created_at).toISOString():new Date().toISOString(),i=e.drone_label??"?",a=e.role_name??"?",s=typeof e.message=="string"?e.message:"",r=be(e.id,e.entry_id),c=r?`[entry_id: ${r}] `:"",l=s.replace(/\r\n|\r|\n/g," \u23CE ");return`${t} ${i} (${a}): ${c}${l}`}async function Ie(e,t,i){const a=W(e,t);await D.mkdir(q.dirname(a),{recursive:!0}),await D.appendFile(a,i+`
+`,"utf-8")}function _e(e,t,i){if(t&&e.includes(`[entry_id: ${t}]`))return!0;const a=t?i.replace(`[entry_id: ${t}] `,""):i;return!!(a&&e.split(/\r?\n/).includes(a))}async function Ee(e,t,i,a){const s=W(e,t);let r;try{r=await D.readFile(s,"utf-8")}catch(c){if(c?.code==="ENOENT")return!1;throw c}return _e(r,i,a)}function y(e){return new Promise(t=>setTimeout(t,e))}export{Re as __resetStreamStateForTest,fe as classifyRunLoopHealth,b as compareBroadcastHwm,ye as formatInboxLine,De as getStreamStatus,_e as inboxRawHasEntry,we as parseSSE,Ne as startLogStream,K as streamOnce,Oe as streamOnceIfOwner};