c8ctl-plugin-nano 1.53.1 → 1.54.1

package/README.md

@@ -966,6 +966,13 @@ How it works and where things live:
   socket is unreachable (to report a stale/dead daemon).
 - Per-worker and daemon logs live under `logs/supervisor/` in the state home
   (`worker-<id>.log`, `daemon.log`).
+- **Per-worker log cap:** each `worker-<id>.log` is bounded (default **10 MB**) —
+  the daemon pipes the child's stdout/stderr through a rotating ring, keeping the
+  **newest** output and rolling the previous fill to `worker-<id>.log.1` (so
+  on-disk usage stays ~2× the cap). `nano supervisor logs <id>` still tails the
+  live output across a rotation. Set `NANO_SUPERVISOR_LOG_MAX_BYTES` to change the
+  cap (bytes); `0` or a negative value disables the cap (unbounded append). An
+  unset/invalid value falls back to the 10 MB default.
 - **Restart policy:** a crashed child is restarted with exponential backoff
   (1s → 30s cap); a child that stayed up ≥60s resets its backoff. `remove`/`stop`
   cancel any pending restart, and a `restart` cleanly swaps the child (a late

package/c8ctl-plugin.js

@@ -66,6 +66,7 @@ import { platformForHost } from './platforms.mjs';
 import { redactAgenticUrl, buildAgenticUrl } from './work-channel.mjs';
 import { createHostRelaySession, roleTerminalMode } from './work-relay.mjs';
 import { resolveBufferCapacity } from './work-buffer.mjs';
+import { createLogRing, resolveLogMaxBytes } from './supervisor-log-ring.mjs';
 // Canonical ACP → transcript wire bridge (nanobpm/nano-ide#534), consumed through
 // the single agentic import surface. `acpUpdateToTranscriptChunk(update)` maps one
 // raw ACP `session/update` to the exact transcript-chunk bytes the cockpit decodes,
@@ -8840,9 +8841,21 @@ async function runSupervisorDaemon() {
     }
   };
 
+  // Per-worker log cap (#183). A supervised worker is long-lived and chatty, so
+  // an unbounded append fd could grow `worker-<id>.log` to multiple GB and fill
+  // the disk. When capped (the default), the daemon OWNS the bytes: it pipes the
+  // child's stdout/stderr through a rotating ring (see `supervisor-log-ring.mjs`)
+  // that keeps the newest output and bounds on-disk usage to ~2x the cap. Set
+  // `NANO_SUPERVISOR_LOG_MAX_BYTES=0` to opt out (legacy raw-fd append).
+  const workerLogMaxBytes = resolveLogMaxBytes(process.env.NANO_SUPERVISOR_LOG_MAX_BYTES);
+
   const startWorker = (w) => {
-    let fd;
-    try { fd = openSync(w.logFile, 'a'); } catch { fd = 'ignore'; }
+    // With a cap we pipe stdout/stderr through the daemon so the ring can bound
+    // them; unbounded (opt-out) keeps the legacy direct-fd append. `fd` is only
+    // used on the direct-fd path.
+    const ringed = workerLogMaxBytes > 0;
+    let fd = 'ignore';
+    if (!ringed) { try { fd = openSync(w.logFile, 'a'); } catch { fd = 'ignore'; } }
     // Clear any stale activity marker from a previous incarnation so a freshly
     // (re)started worker never briefly shows a dead job as in-flight.
     const activityFile = supervisorWorkerActivityFile(w.id);
@@ -8858,9 +8871,40 @@ async function runSupervisorDaemon() {
     // child reparents to init.
     const child = spawn(exec, [entry, 'nano', 'work', w.profile, '--name', w.id, ...w.args], {
       env: { ...process.env, NANO_SUPERVISOR_ACTIVITY_FILE: activityFile, NANO_SUPERVISOR_DAEMON_PID: String(process.pid) },
-      stdio: ['ignore', fd, fd],
+      stdio: ['ignore', ringed ? 'pipe' : fd, ringed ? 'pipe' : fd],
     });
     if (typeof fd === 'number') { try { closeSync(fd); } catch { /* dup'd into child */ } }
+    // On the ringed path, relay every stdout/stderr chunk into a bounded,
+    // rotating writer the daemon owns. Sync writes mean received bytes are on
+    // disk before the child can die, and the ring is closed in the death handler
+    // (and before a restart re-opens it) so fds never leak.
+    if (ringed) {
+      let ring = null;
+      try {
+        ring = createLogRing(w.logFile, workerLogMaxBytes);
+        const feed = (chunk) => { try { ring.write(chunk); } catch { /* never crash the daemon */ } };
+        if (child.stdout) { child.stdout.on('data', feed); child.stdout.on('error', () => {}); }
+        if (child.stderr) { child.stderr.on('data', feed); child.stderr.on('error', () => {}); }
+      } catch { ring = null; /* fall back to dropping output rather than crashing */ }
+      // If ring setup threw, the child was still spawned with piped stdio, so we
+      // MUST still drain stdout/stderr — an undrained pipe applies backpressure
+      // and can deadlock the worker once its buffers fill. `resume()` discards
+      // the bytes harmlessly (better than a wedged worker).
+      if (!ring) {
+        if (child.stdout) { child.stdout.on('error', () => {}); child.stdout.resume(); }
+        if (child.stderr) { child.stderr.on('error', () => {}); child.stderr.resume(); }
+      }
+      // Close THIS child's ring once its stdio streams end ('close' fires after
+      // stdout/stderr have flushed) AND on a spawn 'error' — an ENOENT/EMFILE
+      // spawn failure emits only 'error' with no 'close', so without this the
+      // ring fd would leak. Bound to the local `ring` (kept as worker-local
+      // closure state, never on `w`) so a stale child's late event never shuts
+      // a restarted worker's live ring;
+      // `ring.close()` is idempotent, so the close+error double-fire is safe.
+      const closeRing = () => { if (ring) { try { ring.close(); } catch { /* best effort */ } } };
+      child.once('close', closeRing);
+      child.once('error', closeRing);
+    }
     w.child = child;
     w.pid = child.pid || null;
     w.startedAt = new Date().toISOString();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.53.1",
+  "version": "1.54.1",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -26,6 +26,7 @@
     "agentic-loader-hook.mjs",
     "agentic-endpoint.mjs",
     "supervisor-engine.mjs",
+    "supervisor-log-ring.mjs",
     "work-channel.mjs",
     "work-relay.mjs",
     "work-buffer.mjs",
@@ -70,12 +71,12 @@
   },
   "optionalDependencies": {
     "node-pty": "^1.0.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.53.1",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.53.1"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.54.1",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.54.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.54.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.54.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.54.1",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.54.1",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.54.1"
   }
 }

package/supervisor-log-ring.mjs

@@ -0,0 +1,162 @@
+// Bounded per-worker log writer for the supervisor daemon (jwulf/c8ctl-plugin-nano#183).
+//
+// A supervised `nano work` child is long-lived and chatty: it streams
+// stdout/stderr for the entire life of the fleet. The daemon used to hand the
+// child a *raw append fd* as its stdio, so the OS wrote straight to
+// `logs/supervisor/worker-<id>.log` and the file only ever grew — multi-GB logs
+// could fill the disk with no cap and no rotation.
+//
+// This module lets the daemon OWN the bytes instead. The child is spawned with
+// piped stdout/stderr and every chunk is fed through {@link createLogRing},
+// which appends to the primary log file and, when it reaches the cap, ROTATES:
+// the primary is renamed to `<log>.1` (replacing any previous `.1`) and a fresh
+// primary is started. That keeps the newest output always retained (a ring/tail,
+// not a hard stop) while bounding on-disk usage to ~2x the cap (the live primary
+// plus one rotated file). `nano supervisor logs` tails the primary, so it keeps
+// showing the most recent output across a rotation.
+//
+// The cap is operator-configurable via `NANO_SUPERVISOR_LOG_MAX_BYTES`
+// (see {@link resolveLogMaxBytes}); `0`/negative opts out (unbounded), matching
+// the existing `NANO_SUPERVISOR_*` env conventions.
+
+import {
+  openSync as fsOpenSync,
+  writeSync as fsWriteSync,
+  closeSync as fsCloseSync,
+  fstatSync as fsFstatSync,
+  renameSync as fsRenameSync,
+} from 'node:fs';
+
+/** Default per-worker log cap: 10 MB. */
+export const DEFAULT_LOG_MAX_BYTES = 10 * 1024 * 1024;
+
+/** Suffix of the single rotated-out file kept alongside the primary log. */
+export const ROTATED_SUFFIX = '.1';
+
+/**
+ * Resolve the per-worker log byte cap from an operator-supplied value with a
+ * sane fallback. Accepts a number or a numeric string (env vars arrive as
+ * strings). An unset/blank/non-numeric value falls back to `fallback`
+ * (default 10 MB). A value `<= 0` means "unbounded / off" and is returned as `0`
+ * so callers can opt out of the ring entirely and keep the legacy direct-fd
+ * write.
+ *
+ * @param {unknown} raw the operator value (e.g. `process.env.NANO_SUPERVISOR_LOG_MAX_BYTES`)
+ * @param {number} [fallback] the default when `raw` is absent/invalid
+ * @returns {number} a non-negative integer byte cap (`0` == unbounded/off)
+ */
+export function resolveLogMaxBytes(raw, fallback = DEFAULT_LOG_MAX_BYTES) {
+  const base = Number.isFinite(fallback) && fallback > 0 ? Math.floor(fallback) : DEFAULT_LOG_MAX_BYTES;
+  if (raw === undefined || raw === null || raw === '') return base;
+  const s = typeof raw === 'number' ? raw : String(raw).trim();
+  if (s === '') return base; // whitespace-only == unset
+  const n = typeof s === 'number' ? s : Number(s);
+  if (!Number.isFinite(n)) return base;
+  if (n <= 0) return 0; // explicit opt-out: unbounded
+  return Math.floor(n);
+}
+
+/**
+ * @typedef {object} LogRing
+ * @property {(chunk: Buffer|string) => void} write append a chunk, rotating at the cap
+ * @property {() => void} close close the underlying fd (idempotent)
+ * @property {() => number} size current byte size of the live primary file
+ * @property {() => number} rotations how many times the log has rotated
+ */
+
+/**
+ * Create a bounded, rotating writer for one worker's log file.
+ *
+ * Semantics:
+ *  - Opens `logFile` in append mode (preserving any existing content — its bytes
+ *    count toward the cap, so a reopen of a nearly-full file rotates promptly).
+ *  - On each {@link LogRing.write}, if writing the chunk would push the primary
+ *    file over `maxBytes` (and the file is non-empty), it ROTATES first: close
+ *    the primary, rename it to `<logFile><ROTATED_SUFFIX>` (atomically replacing
+ *    any prior rotated file), then open a fresh empty primary. The chunk is then
+ *    written to the fresh primary. A single chunk larger than the cap is still
+ *    written whole (never split mid-line); it just triggers a rotation on the
+ *    following write.
+ *  - `maxBytes <= 0` disables rotation entirely (unbounded append). Callers
+ *    normally take the legacy direct-fd path instead of constructing a ring in
+ *    that case; this is a defensive no-op for symmetry.
+ *
+ * All IO is synchronous so that, by the time a `write` returns, the bytes are on
+ * disk — that is what makes the rotation boundary deterministically testable
+ * without wall-clock flushing, and it means the daemon never loses already
+ * received bytes if the worker dies.
+ *
+ * @param {string} logFile absolute path to the primary log file
+ * @param {number} maxBytes byte cap (`<= 0` == unbounded); see {@link resolveLogMaxBytes}
+ * @param {object} [io] injectable fs surface for deterministic tests
+ * @param {typeof fsOpenSync} [io.openSync]
+ * @param {typeof fsWriteSync} [io.writeSync]
+ * @param {typeof fsCloseSync} [io.closeSync]
+ * @param {typeof fsFstatSync} [io.fstatSync]
+ * @param {typeof fsRenameSync} [io.renameSync]
+ * @returns {LogRing}
+ */
+export function createLogRing(logFile, maxBytes, io = {}) {
+  const openSync = io.openSync || fsOpenSync;
+  const writeSync = io.writeSync || fsWriteSync;
+  const closeSync = io.closeSync || fsCloseSync;
+  const fstatSync = io.fstatSync || fsFstatSync;
+  const renameSync = io.renameSync || fsRenameSync;
+
+  const cap = Number.isFinite(maxBytes) && maxBytes > 0 ? Math.floor(maxBytes) : 0;
+  const rotatedFile = `${logFile}${ROTATED_SUFFIX}`;
+
+  let fd = openSync(logFile, 'a');
+  // Seed `size` from the existing file so appending to a nearly-full log rotates
+  // at the right point rather than starting the count from zero.
+  let size = 0;
+  try { size = fstatSync(fd).size; } catch { size = 0; }
+  let rotations = 0;
+  let closed = false;
+
+  const rotate = () => {
+    try { closeSync(fd); } catch { /* fd may already be gone */ }
+    try {
+      // Replace any previous rotated file with the just-filled primary. `rename`
+      // is atomic, so a concurrent tail reopening the primary never sees a gap.
+      renameSync(logFile, rotatedFile);
+      fd = openSync(logFile, 'a');
+      size = 0;
+      rotations += 1;
+    } catch {
+      // Rotation failed (permissions / transient FS issue). `renameSync` or the
+      // subsequent `openSync` threw AFTER we closed the primary fd, so leaving it
+      // as-is would strand the ring on a closed fd and silently stop draining.
+      // Instead, best-effort reopen the primary in append mode and keep writing:
+      // we favor continued log capture over strict bounding, briefly exceeding the
+      // cap until rotation can succeed again.
+      try {
+        fd = openSync(logFile, 'a');
+        try { size = fstatSync(fd).size; } catch { size = 0; }
+      } catch { /* can't reopen either; the write() try/catch swallows the fallout */ }
+    }
+  };
+
+  return {
+    write(chunk) {
+      if (closed) return;
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+      if (buf.length === 0) return;
+      // Rotate BEFORE writing when the primary already holds bytes and this
+      // chunk would tip it over the cap — this bounds each file at <= cap + the
+      // final chunk (pipe chunks are small), and never splits a chunk mid-line.
+      if (cap > 0 && size > 0 && size + buf.length > cap) rotate();
+      try {
+        writeSync(fd, buf);
+        size += buf.length;
+      } catch { /* a transient write failure must not crash the daemon */ }
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      try { closeSync(fd); } catch { /* best effort */ }
+    },
+    size() { return size; },
+    rotations() { return rotations; },
+  };
+}