claude-view 0.42.0 → 0.44.0

package/index.js

@@ -6,6 +6,7 @@ const path = require('path')
 const os = require('os')
 const https = require('https')
 const zlib = require('zlib')
+const { classifyExit, superviseServer } = require('./supervise')
 
 const VERSION = require('./package.json').version
 const REPO = 'tombelieber/claude-view'
@@ -213,37 +214,65 @@ async function main() {
     env.SIDECAR_DIR = sidecarDir
   }
 
-  // Run the server, forwarding signals and exit code.
+  // Run the server under a bounded crash-supervisor (see ./supervise.js).
   //
-  // Signal handling strategy:
-  // - SIGINT: Don't forward. Terminal sends SIGINT to the entire process group,
-  //   so the child already receives it. Forwarding would double-deliver, causing
-  //   the Rust server's graceful shutdown to see two SIGINTs from one Ctrl+C.
-  // - SIGTERM/SIGHUP: Forward. These may be sent to our PID only (e.g. from
-  //   `kill` or a process manager), so the child wouldn't get them otherwise.
-  const child = spawn(binaryPath, process.argv.slice(2), { stdio: 'inherit', env })
+  // The server is long-running; an abnormal death — a panic=abort SIGABRT, an
+  // OS out-of-memory SIGKILL, or a non-zero exit — used to leave the user with
+  // a dead app until they manually relaunched. We now restart it on an abnormal
+  // exit, bounded to MAX_RESTARTS within RESTART_WINDOW_MS so a hard crash-loop
+  // gives up loudly instead of thrashing.
+  //
+  // Signal handling (intent unchanged):
+  // - SIGINT: the terminal delivers it to the whole process group, so the child
+  //   already receives it. The wrapper ignores it (so Node doesn't exit first)
+  //   and treats the child's SIGINT death as a deliberate stop — never restart.
+  // - SIGTERM/SIGHUP: forward to whichever child is currently running (it may
+  //   not get them if they were sent to our PID only); also a deliberate stop.
+  const MAX_RESTARTS = 5
+  const RESTART_WINDOW_MS = 60_000
 
   // Prevent Node from exiting on SIGINT before the child does.
   const ignoreSigint = () => {}
   process.on('SIGINT', ignoreSigint)
 
-  // Forward SIGTERM/SIGHUP — child may not receive these from process group.
-  for (const sig of ['SIGTERM', 'SIGHUP']) {
-    process.on(sig, () => child.kill(sig))
-  }
-
-  child.on('exit', (code, signal) => {
-    // Remove our SIGINT handler so the re-signal below uses default behavior.
-    process.removeListener('SIGINT', ignoreSigint)
+  const supervisor = superviseServer({
+    spawn: () => spawn(binaryPath, process.argv.slice(2), { stdio: 'inherit', env }),
+    maxRestarts: MAX_RESTARTS,
+    windowMs: RESTART_WINDOW_MS,
+    now: () => Date.now(),
+    log: (msg) => console.error(msg),
+    onExit: ({ code, signal }) => {
+      // Terminal disposition: restore default SIGINT behavior, then propagate
+      // the child's fate faithfully so the parent shell sees the right status.
+      process.removeListener('SIGINT', ignoreSigint)
+
+      // Reaching here with a crash disposition means the supervisor exhausted
+      // its restart budget — point the user at the evidence instead of dying
+      // silently.
+      if (classifyExit(code, signal) === 'crash') {
+        const logDir = path.join(os.homedir(), '.claude-view', 'logs')
+        console.error(
+          `\nCheck ${path.join(logDir, 'crash-*.log')} for a panic backtrace, ` +
+            `or your system log for an out-of-memory (jetsam) kill.`,
+        )
+      }
 
-    if (signal) {
-      // Child was killed by signal — re-signal ourselves so the parent shell
-      // sees the correct exit status (128 + signal number).
-      process.kill(process.pid, signal)
-    } else {
-      process.exit(code ?? 1)
-    }
+      if (signal) {
+        // Re-signal ourselves so the parent shell sees 128 + signal number.
+        process.kill(process.pid, signal)
+      } else {
+        process.exit(code ?? 1)
+      }
+    },
   })
+
+  // Forward deliberate-stop signals to whichever child is currently running.
+  for (const sig of ['SIGTERM', 'SIGHUP']) {
+    process.on(sig, () => {
+      const child = supervisor.getChild()
+      if (child) child.kill(sig)
+    })
+  }
 }
 
 main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-view",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "description": "You have 10 Claude sessions running. What are they doing? Live dashboard for Claude Code — monitor every session, track costs, search history, see sub-agents. One command: npx claude-view",
   "bin": {
     "claude-view": "./index.js"
@@ -57,5 +57,5 @@
   "engines": {
     "node": ">=16"
   },
-  "files": ["index.js", "README.md"]
+  "files": ["index.js", "supervise.js", "README.md"]
 }

package/supervise.js

@@ -0,0 +1,111 @@
+// Crash-supervisor decision logic for the npx-cli launcher.
+//
+// The launcher spawns the Rust `claude-view` server as a child. Historically
+// the wrapper relayed the child's exit verbatim — so ANY abnormal death of the
+// server (a panic=abort SIGABRT, an OS OOM-kill SIGKILL, a non-zero exit) left
+// the user staring at a dead app until they manually restarted. This module
+// makes the launcher self-heal: restart the server on an abnormal exit, bounded
+// to `maxRestarts` within a rolling `windowMs` so a hard crash-loop gives up
+// loudly instead of thrashing forever.
+//
+// Pure functions, no side effects — the runtime loop in index.js injects the
+// clock and the crash history so the policy is fully testable.
+
+// Signals that mean "someone deliberately asked us to stop" — propagate, never
+// restart. Everything else that kills the process (SIGKILL/SIGABRT/SIGSEGV/...)
+// is treated as a crash worth recovering from.
+const USER_STOP_SIGNALS = new Set(['SIGINT', 'SIGTERM', 'SIGHUP'])
+
+/**
+ * Classify a child exit into one of: 'normal' | 'user-stop' | 'crash'.
+ * @param {number|null} code   exit code (null when killed by a signal)
+ * @param {string|null} signal terminating signal name (null on normal exit)
+ */
+function classifyExit(code, signal) {
+  if (signal) {
+    return USER_STOP_SIGNALS.has(signal) ? 'user-stop' : 'crash'
+  }
+  return code === 0 ? 'normal' : 'crash'
+}
+
+/**
+ * Decide whether to restart, given the recent crash history.
+ * Only crashes are restartable, and only while fewer than `maxRestarts`
+ * crashes have occurred within the trailing `windowMs`.
+ * @returns {boolean}
+ */
+function shouldRestart({ exitClass, crashTimes, now, maxRestarts, windowMs }) {
+  if (exitClass !== 'crash') return false
+  const recent = crashTimes.filter((t) => now - t < windowMs)
+  return recent.length < maxRestarts
+}
+
+/**
+ * Run a child process under a bounded crash-supervisor.
+ *
+ * Dependency-injected so the restart loop is testable without real processes:
+ *   - `spawn()`   -> returns a child (an EventEmitter emitting 'exit'/'error')
+ *   - `now()`     -> current epoch ms (injected clock)
+ *   - `log(msg)`  -> visible progress/diagnostic line
+ *   - `onExit({code, signal})` -> terminal disposition (caller maps to process exit)
+ *
+ * Restarts only abnormal deaths, at most `maxRestarts` within `windowMs`;
+ * beyond that it gives up and propagates the last disposition.
+ *
+ * @returns {{ getChild: () => any, crashCount: () => number }}
+ */
+function superviseServer({ spawn, maxRestarts, windowMs, now, log, onExit }) {
+  const crashTimes = []
+  let child = null
+
+  const launch = () => {
+    // Per-launch guard: a failed spawn can emit BOTH 'error' and 'exit'; we
+    // must act on exactly one of them.
+    let settled = false
+    const settle = (disposition, restart) => {
+      if (settled) return
+      settled = true
+      if (restart) {
+        launch()
+      } else {
+        onExit(disposition)
+      }
+    }
+
+    child = spawn()
+
+    child.on('error', (err) => {
+      // Spawn-level failure (binary missing / not executable) is a permanent
+      // install problem, not a runtime crash — surface it, don't retry.
+      log(`\nFailed to launch claude-view server: ${err.message}`)
+      settle({ code: 1, signal: null }, false)
+    })
+
+    child.on('exit', (code, signal) => {
+      const exitClass = classifyExit(code, signal)
+      if (exitClass === 'crash') {
+        const t = now()
+        if (shouldRestart({ exitClass, crashTimes, now: t, maxRestarts, windowMs })) {
+          crashTimes.push(t)
+          const reason = signal ? `signal ${signal}` : `exit code ${code}`
+          log(
+            `\nclaude-view server died (${reason}) — restarting ` +
+              `(${crashTimes.length}/${maxRestarts} within ${Math.round(windowMs / 1000)}s)...`,
+          )
+          settle(null, true)
+          return
+        }
+        log(
+          `\nclaude-view server crashed ${maxRestarts} times within ` +
+            `${Math.round(windowMs / 1000)}s — giving up.`,
+        )
+      }
+      settle({ code, signal }, false)
+    })
+  }
+
+  launch()
+  return { getChild: () => child, crashCount: () => crashTimes.length }
+}
+
+module.exports = { classifyExit, shouldRestart, superviseServer, USER_STOP_SIGNALS }