c8ctl-plugin-nano 1.53.1 → 1.54.0

package/README.md

@@ -966,6 +966,13 @@ How it works and where things live:
   socket is unreachable (to report a stale/dead daemon).
 - Per-worker and daemon logs live under `logs/supervisor/` in the state home
   (`worker-<id>.log`, `daemon.log`).
+- **Per-worker log cap:** each `worker-<id>.log` is bounded (default **10 MB**) —
+  the daemon pipes the child's stdout/stderr through a rotating ring, keeping the
+  **newest** output and rolling the previous fill to `worker-<id>.log.1` (so
+  on-disk usage stays ~2× the cap). `nano supervisor logs <id>` still tails the
+  live output across a rotation. Set `NANO_SUPERVISOR_LOG_MAX_BYTES` to change the
+  cap (bytes); `0` or a negative value disables the cap (unbounded append). An
+  unset/invalid value falls back to the 10 MB default.
 - **Restart policy:** a crashed child is restarted with exponential backoff
   (1s → 30s cap); a child that stayed up ≥60s resets its backoff. `remove`/`stop`
   cancel any pending restart, and a `restart` cleanly swaps the child (a late

package/c8ctl-plugin.js

@@ -66,6 +66,7 @@ import { platformForHost } from './platforms.mjs';
 import { redactAgenticUrl, buildAgenticUrl } from './work-channel.mjs';
 import { createHostRelaySession, roleTerminalMode } from './work-relay.mjs';
 import { resolveBufferCapacity } from './work-buffer.mjs';
+import { createLogRing, resolveLogMaxBytes } from './supervisor-log-ring.mjs';
 // Canonical ACP → transcript wire bridge (nanobpm/nano-ide#534), consumed through
 // the single agentic import surface. `acpUpdateToTranscriptChunk(update)` maps one
 // raw ACP `session/update` to the exact transcript-chunk bytes the cockpit decodes,
@@ -8840,9 +8841,21 @@ async function runSupervisorDaemon() {
     }
   };
 
+  // Per-worker log cap (#183). A supervised worker is long-lived and chatty, so
+  // an unbounded append fd could grow `worker-<id>.log` to multiple GB and fill
+  // the disk. When capped (the default), the daemon OWNS the bytes: it pipes the
+  // child's stdout/stderr through a rotating ring (see `supervisor-log-ring.mjs`)
+  // that keeps the newest output and bounds on-disk usage to ~2x the cap. Set
+  // `NANO_SUPERVISOR_LOG_MAX_BYTES=0` to opt out (legacy raw-fd append).
+  const workerLogMaxBytes = resolveLogMaxBytes(process.env.NANO_SUPERVISOR_LOG_MAX_BYTES);
+
   const startWorker = (w) => {
-    let fd;
-    try { fd = openSync(w.logFile, 'a'); } catch { fd = 'ignore'; }
+    // With a cap we pipe stdout/stderr through the daemon so the ring can bound
+    // them; unbounded (opt-out) keeps the legacy direct-fd append. `fd` is only
+    // used on the direct-fd path.
+    const ringed = workerLogMaxBytes > 0;
+    let fd = 'ignore';
+    if (!ringed) { try { fd = openSync(w.logFile, 'a'); } catch { fd = 'ignore'; } }
     // Clear any stale activity marker from a previous incarnation so a freshly
     // (re)started worker never briefly shows a dead job as in-flight.
     const activityFile = supervisorWorkerActivityFile(w.id);
@@ -8858,9 +8871,40 @@ async function runSupervisorDaemon() {
     // child reparents to init.
     const child = spawn(exec, [entry, 'nano', 'work', w.profile, '--name', w.id, ...w.args], {
       env: { ...process.env, NANO_SUPERVISOR_ACTIVITY_FILE: activityFile, NANO_SUPERVISOR_DAEMON_PID: String(process.pid) },
-      stdio: ['ignore', fd, fd],
+      stdio: ['ignore', ringed ? 'pipe' : fd, ringed ? 'pipe' : fd],
     });
     if (typeof fd === 'number') { try { closeSync(fd); } catch { /* dup'd into child */ } }
+    // On the ringed path, relay every stdout/stderr chunk into a bounded,
+    // rotating writer the daemon owns. Sync writes mean received bytes are on
+    // disk before the child can die, and the ring is closed in the death handler
+    // (and before a restart re-opens it) so fds never leak.
+    if (ringed) {
+      let ring = null;
+      try {
+        ring = createLogRing(w.logFile, workerLogMaxBytes);
+        const feed = (chunk) => { try { ring.write(chunk); } catch { /* never crash the daemon */ } };
+        if (child.stdout) { child.stdout.on('data', feed); child.stdout.on('error', () => {}); }
+        if (child.stderr) { child.stderr.on('data', feed); child.stderr.on('error', () => {}); }
+      } catch { ring = null; /* fall back to dropping output rather than crashing */ }
+      // If ring setup threw, the child was still spawned with piped stdio, so we
+      // MUST still drain stdout/stderr — an undrained pipe applies backpressure
+      // and can deadlock the worker once its buffers fill. `resume()` discards
+      // the bytes harmlessly (better than a wedged worker).
+      if (!ring) {
+        if (child.stdout) { child.stdout.on('error', () => {}); child.stdout.resume(); }
+        if (child.stderr) { child.stderr.on('error', () => {}); child.stderr.resume(); }
+      }
+      // Close THIS child's ring once its stdio streams end ('close' fires after
+      // stdout/stderr have flushed) AND on a spawn 'error' — an ENOENT/EMFILE
+      // spawn failure emits only 'error' with no 'close', so without this the
+      // ring fd would leak. Bound to the local `ring` (kept as worker-local
+      // closure state, never on `w`) so a stale child's late event never shuts
+      // a restarted worker's live ring;
+      // `ring.close()` is idempotent, so the close+error double-fire is safe.
+      const closeRing = () => { if (ring) { try { ring.close(); } catch { /* best effort */ } } };
+      child.once('close', closeRing);
+      child.once('error', closeRing);
+    }
     w.child = child;
     w.pid = child.pid || null;
     w.startedAt = new Date().toISOString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.53.1",
+  "version": "1.54.0",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -70,12 +70,12 @@
   },
   "optionalDependencies": {
     "node-pty": "^1.0.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.53.1"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.54.0",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.54.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.54.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.54.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.54.0",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.54.0",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.54.0"
   }
 }