c8ctl-plugin-nano 1.35.0 → 1.35.2

package/c8ctl-plugin.js

@@ -2549,14 +2549,18 @@ function resourceContentUrl(baseUrl, resourceKey) {
 // is surfaced as a ProvisionError so the caller fails the job with a clear
 // provisioning message (never runs an agent with a silently-empty prompt).
 async function fetchLinkedResourceContent(resourceKey, opts = {}) {
-  const { baseUrl, token, fetchImpl = fetch, timeoutMs = 15_000 } = opts;
+  const { baseUrl, token, authHeaders, fetchImpl = fetch, timeoutMs = 15_000 } = opts;
   const url = resourceContentUrl(baseUrl, resourceKey);
   const controller = new AbortController();
   const timer = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : null;
   let res;
   try {
     const headers = { Accept: 'application/octet-stream' };
-    if (token) headers.Authorization = `Bearer ${token}`;
+    // A ready-made auth-headers map (from the activating SDK client's
+    // getAuthHeaders(), covering OAuth/basic/none) wins over a bare token. An
+    // empty map means unauthenticated — deliberately no Authorization header.
+    if (authHeaders && typeof authHeaders === 'object') Object.assign(headers, authHeaders);
+    else if (token) headers.Authorization = `Bearer ${token}`;
     res = await fetchImpl(url, { method: 'GET', headers, signal: controller.signal });
   } catch (err) {
     throw new ProvisionError(`prompt resource ${resourceKey} fetch failed: ${err && err.message ? err.message : String(err)}`);
@@ -2581,14 +2585,57 @@ async function fetchLinkedResourceContent(resourceKey, opts = {}) {
 // prompt resource cannot be fetched — a provisioning failure, not a silent
 // empty-prompt run.
 async function resolveLinkedPrompt(customHeaders, opts = {}) {
-  const { linkName = DEFAULT_PROMPT_LINK_NAME, baseUrl, token, fetchImpl, timeoutMs } = opts;
+  const { linkName = DEFAULT_PROMPT_LINK_NAME, baseUrl, token, authHeaders, fetchImpl, timeoutMs } = opts;
   const entry = pickLinkedResource(parseLinkedResources(customHeaders), linkName);
   if (!entry) return null;
   const resourceKey = entry.resourceKey;
-  const basePrompt = await fetchLinkedResourceContent(resourceKey, { baseUrl, token, fetchImpl, timeoutMs });
+  const basePrompt = await fetchLinkedResourceContent(resourceKey, { baseUrl, token, authHeaders, fetchImpl, timeoutMs });
   return { basePrompt, resourceKey, resourceType: entry.resourceType ?? null, linkName: String(linkName) };
 }
 
+// Normalize a client-configured REST address for use as a linked-resource fetch
+// base. The SDK's restAddress may or may not already include the `/v2` API
+// prefix (CAMUNDA_REST_ADDRESS accepts either); resourceContentUrl re-adds it,
+// so strip a trailing `/v2` (and any trailing slashes) to avoid a double `/v2`.
+function normalizeRestBase(addr) {
+  return String(addr || '').replace(/\/+$/, '').replace(/\/v2$/i, '');
+}
+
+// Derive the linked-resource fetch base URL + auth headers from the SAME SDK
+// client that activated the job. A linked-resource `resourceKey` is broker-local,
+// so prompt content must be fetched from the broker this worker is connected to
+// — never a localhost default (the cause of "prompt resource N fetch failed").
+// An explicit NANO_REST_URL / NANO_REST_TOKEN override still wins as an operator
+// escape hatch. Both getConfig()/getAuthHeaders() are guarded so an older or
+// atypical client runtime degrades to the override/legacy path rather than throw.
+//
+// TODO: once c8ctl bumps @camunda8/orchestration-cluster-api to v10 (10.0.0-alpha
+// exposes the typed camunda.getResourceContentBinary({resourceKey}) → Blob), drop
+// this raw /content/binary fetch and call that method directly. The pinned ^9.1.0
+// SDK only exposes the deprecated getResourceContent, which 406s for generic
+// (Markdown) prompt resources — see camunda/orchestration-cluster-api-js.
+async function resolveLinkedPromptSource(camunda, env = process.env) {
+  let baseUrl = env.NANO_REST_URL || '';
+  if (!baseUrl && camunda && typeof camunda.getConfig === 'function') {
+    try {
+      baseUrl = normalizeRestBase(camunda.getConfig().restAddress);
+    } catch {
+      // ignore — fall back to the legacy resolveBrokerRestConfig base below
+    }
+  }
+  let authHeaders;
+  if (env.NANO_REST_TOKEN) {
+    authHeaders = { Authorization: `Bearer ${env.NANO_REST_TOKEN}` };
+  } else if (camunda && typeof camunda.getAuthHeaders === 'function') {
+    try {
+      authHeaders = await camunda.getAuthHeaders();
+    } catch {
+      authHeaders = undefined;
+    }
+  }
+  return { baseUrl, authHeaders };
+}
+
 // Secrets are referenced by NAME, never by value, in the model. A resolver maps
 // a name → value at run time. The wrapper injects them into the child ENV, so
 // values never appear in argv or `docker inspect`.
@@ -4357,6 +4404,16 @@ async function workAgent(req, flags) {
   // path via NANO_SUPERVISOR_ACTIVITY_FILE; a standalone `nano work` has no such
   // env var and writes nothing (this is entirely advisory).
   const activityFile = process.env.NANO_SUPERVISOR_ACTIVITY_FILE || null;
+  // Supervised workers (spawned by the daemon, hence NANO_SUPERVISOR_ACTIVITY_FILE)
+  // arm a parent-death watchdog: if the daemon dies *ungracefully* (SIGKILL /
+  // crash / its host force-killed) it can't run its child-reaping shutdown, and
+  // this worker would otherwise idle forever as an orphan reparented to init.
+  // The watchdog makes the child self-exit the moment it is reparented. A
+  // standalone `nano work` (no activity file) keeps classic nohup semantics.
+  if (activityFile) {
+    const daemonPid = Number.parseInt(process.env.NANO_SUPERVISOR_DAEMON_PID ?? '', 10);
+    installParentDeathWatchdog({ parentPid: Number.isInteger(daemonPid) ? daemonPid : undefined });
+  }
   const activeJobs = new Map(); // jobKey -> { type, since (ms epoch) }
   const writeActivity = () => {
     if (!activityFile) return;
@@ -4533,8 +4590,13 @@ async function workAgent(req, flags) {
         let promptResourceKey = null;
         let basePromptOverride;
         try {
+          // Fetch the prompt from the broker the SDK client is connected to,
+          // deriving base URL + auth from that client (not restConfig, whose base
+          // defaults to localhost) — the resourceKey is broker-local.
+          const promptSource = await resolveLinkedPromptSource(camunda);
           const linked = await resolveLinkedPrompt(job.customHeaders ?? {}, {
-            baseUrl: restConfig.baseUrl,
+            baseUrl: promptSource.baseUrl || restConfig.baseUrl,
+            authHeaders: promptSource.authHeaders,
             token: restConfig.token,
           });
           if (linked) {
@@ -5497,6 +5559,63 @@ function waitForChildExit(child, timeoutMs) {
   });
 }
 
+/**
+ * Self-terminate a supervised worker if its parent daemon dies *ungracefully*.
+ *
+ * The daemon reaps its `nano work` children on a clean stop/SIGTERM/SIGINT (see
+ * `shutdown`). But a `SIGKILL`, a crash, or the daemon's host process being
+ * force-killed cannot run that path, and the children — spawned attached, with
+ * no controlling TTY — would otherwise survive forever as orphans reparented to
+ * init (ppid 1). That is exactly how a test/agent run that force-kills its
+ * supervisor leaks a whole idle worker fleet.
+ *
+ * The watchdog closes that gap from the child's side. The parent to watch is the
+ * daemon pid the spawn recorded (`parentPid`, forwarded via
+ * NANO_SUPERVISOR_DAEMON_PID) rather than a late `process.ppid` sample: a worker
+ * whose ~async startup (an 8k-line dynamic import) is outrun by the daemon's
+ * death is *already* reparented to init by the time it arms, so a bare
+ * `process.ppid` read would miss the very race that leaks. Given the known pid,
+ * the worker self-reaps whenever it is reparented away from it OR that pid is
+ * gone — and does so *immediately* if it was orphaned during its own startup.
+ *
+ * The poll timer is unref'd so it never keeps an otherwise-idle worker alive;
+ * the real work loop (or, in tests, an explicit keep-alive) holds the event loop
+ * open while the worker is meant to run.
+ *
+ * Unix-only: reparent-to-init is a POSIX semantic; Windows job objects are the
+ * equivalent lifecycle tie and are out of scope here (matching the daemon's
+ * other `win32` guards). Returns a canceller so callers/tests can stop it.
+ */
+function installParentDeathWatchdog({ intervalMs = 2000, parentPid, onOrphan, readPpid } = {}) {
+  if (osPlatform() === 'win32') return () => {};
+  // `readPpid` is an injectable seam (defaults to the live value) so the pid-1
+  // container case — which a normal test process can't reproduce, since its own
+  // ppid is never 1 — is unit-testable.
+  const ppid = typeof readPpid === 'function' ? readPpid : () => process.ppid;
+  // Prefer the daemon pid the spawn recorded (`explicit`); fall back to the
+  // current parent. An explicit pid is authoritative even if it is 1 — the
+  // daemon may legitimately run as PID 1 (a container entrypoint) — so we must
+  // NOT treat that as "orphaned". A *fallback* ppid of 1, by contrast, means we
+  // were already reparented to init with no daemon left to watch.
+  const explicit = Number.isInteger(parentPid) && parentPid > 0;
+  const watched = explicit ? parentPid : ppid();
+  const orphaned = typeof onOrphan === 'function' ? onOrphan : () => process.exit(0);
+  const isOrphan = () => {
+    // Reparented away from the daemon (typically to init, pid 1) → orphaned.
+    if (ppid() !== watched) return true;
+    // Defensive: the daemon pid is gone even though ppid still names it (a
+    // zombie/racey read). ESRCH ⇒ gone; EPERM ⇒ alive but not ours to signal.
+    try { process.kill(watched, 0); return false; } catch (err) { return err.code !== 'EPERM'; }
+  };
+  // Orphaned already — self-reap now rather than idle forever. Either we fell
+  // back to ppid and it is already init (no known parent), or the recorded
+  // daemon is verifiably gone/reparented (e.g. it died before we armed).
+  if ((!explicit && watched === 1) || isOrphan()) { orphaned(); return () => {}; }
+  const timer = setInterval(() => { if (isOrphan()) { clearInterval(timer); orphaned(); } }, intervalMs);
+  if (typeof timer.unref === 'function') timer.unref();
+  return () => { try { clearInterval(timer); } catch { /* ignore */ } };
+}
+
 // --- Daemon ----------------------------------------------------------------
 
 /**
@@ -5570,8 +5689,12 @@ async function runSupervisorDaemon() {
     // supervisor id, so the same profile launched twice is distinct end-to-end.
     // NANO_SUPERVISOR_ACTIVITY_FILE tells the child where to report per-job
     // activity for `supervisor status` (idle vs the job key it is servicing).
+    // NANO_SUPERVISOR_DAEMON_PID hands the child our pid so its parent-death
+    // watchdog can self-reap if we die ungracefully (SIGKILL/crash) and can't
+    // run the child-draining shutdown — even if we die mid-startup, before the
+    // child reparents to init.
     const child = spawn(exec, [entry, 'nano', 'work', w.profile, '--name', w.id, ...w.args], {
-      env: { ...process.env, NANO_SUPERVISOR_ACTIVITY_FILE: activityFile },
+      env: { ...process.env, NANO_SUPERVISOR_ACTIVITY_FILE: activityFile, NANO_SUPERVISOR_DAEMON_PID: String(process.pid) },
       stdio: ['ignore', fd, fd],
     });
     if (typeof fd === 'number') { try { closeSync(fd); } catch { /* dup'd into child */ } }
@@ -5837,6 +5960,11 @@ async function runSupervisorDaemon() {
 
   process.once('SIGTERM', () => shutdown('SIGTERM'));
   process.once('SIGINT', () => shutdown('SIGINT'));
+  // SIGHUP (controlling terminal/session gone) must also drain children rather
+  // than let Node's default terminate the daemon and orphan the fleet. SIGKILL
+  // and hard crashes still can't run this — the per-worker parent-death
+  // watchdog is the backstop for those.
+  process.once('SIGHUP', () => shutdown('SIGHUP'));
   dlog(`supervisor daemon up (pid ${process.pid}) — control ${socketPath}`);
   persist();
 
@@ -7865,6 +7993,8 @@ export {
   resourceContentUrl,
   fetchLinkedResourceContent,
   resolveLinkedPrompt,
+  resolveLinkedPromptSource,
+  normalizeRestBase,
   coerceBool,
   coerceInt,
   deepMerge,
@@ -7944,6 +8074,7 @@ export {
   supervisorJobCell,
   supervisorWorkerActivityFile,
   WORK_FORWARD_FLAGS,
+  installParentDeathWatchdog,
   runSupervisorDaemon,
   startSupervisorDaemon,
   supervisorRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.35.0",
+  "version": "1.35.2",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -57,12 +57,12 @@
   },
   "optionalDependencies": {
     "node-pty": "^1.0.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.35.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.35.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.35.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.35.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.35.0",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.35.0",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.35.0"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.35.2",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.35.2",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.35.2",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.35.2",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.35.2",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.35.2",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.35.2"
   }
 }