create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/walle-kill-authority.js

@@ -11,9 +11,9 @@
 // orphan, per the same signature reapOrphanWalleProcesses() already uses).
 // A same-title row with any OTHER ppid belongs to a different instance and
 // must never be killed, adopted, or reported as pidSource:'discovered'.
-function isOwnedRow(row, { titles, myPid }) {
+function isOwnedRow(row, { titles, myPid, orphanParents = new Set([1]) }) {
   if (!row) return false;
-  return titles.has(row.command) && (row.ppid === myPid || row.ppid === 1);
+  return titles.has(row.command) && (row.ppid === myPid || orphanParents.has(row.ppid));
 }
 
 // Index a listPidsWithPpid() snapshot by pid for O(1) ownership lookups

package/template/coding-task-manager/lib/walle-log-rotation.js

@@ -3,6 +3,66 @@
 // Extracted verbatim from lib/walle-supervisor.js (file-size ratchet, restart/resume WP-7); the supervisor re-exports it.
 
 const fs = require('fs');
+const path = require('path');
+const zlib = require('node:zlib');
+const { pipeline } = require('node:stream/promises');
+
+// WP-4 (docs/temp-file-leaks-disk-full-2026-10-25.html §5 D-9): the primary CTM runs under launchd
+// with StandardOutPath/StandardErrorPath = ~/.walle/logs/ctm.log|ctm.err (bin/install-service.sh
+// :96-99). launchd opens them O_APPEND once, for the life of the process, and nothing rotates them:
+// ctm.err reached 985 MB and ctm.log 3.7 GiB before a manual rotation (§1 L-2). `rotateBoundedLog`
+// below cannot serve those fds — a rename keeps the inode, so the writer silently keeps appending
+// to the unlinked file. The only in-process rotation that works on an fd we do not own is
+// copy-then-ftruncate: clone the bytes aside, truncate the live file through its own fd, then
+// compress the clone.
+const STDIO_ROTATE_MAX_BYTES = 64 * 1024 * 1024;
+const STDIO_ROTATE_KEEP = 3;
+// One warning per distinct message per process, same shape as server.js's `_diskHygieneLogged`:
+// a rotation that keeps failing (a full disk) must not itself become a log flood.
+const _rotationLogged = new Set();
+
+function _rotationLogOnce(message) {
+  const text = String(message);
+  if (_rotationLogged.has(text)) return;
+  _rotationLogged.add(text);
+  console.warn(`[log-rotation] ${text}`);
+}
+
+function _utcStamp(date) {
+  const iso = (date instanceof Date && !Number.isNaN(date.getTime()) ? date : new Date()).toISOString();
+  return `${iso.slice(0, 10).replace(/-/g, '')}-${iso.slice(11, 19).replace(/:/g, '')}`;
+}
+
+function _unlinkQuiet(fsModule, target) {
+  try { fsModule.unlinkSync(target); }
+  catch { /* expected: the artifact was never created (or already pruned) — nothing to remove */ }
+}
+
+function _isRotationArchiveName(name, base) {
+  return name.startsWith(`${base}.`) && name.endsWith('.gz')
+    && /^\d{8}-\d{6}\.gz$/.test(name.slice(base.length + 1));
+}
+
+function _pruneRotationArchives(logPath, keep, fsModule) {
+  const directory = path.dirname(logPath);
+  const base = path.basename(logPath);
+  let entries;
+  try { entries = fsModule.readdirSync(directory); }
+  catch (error) {
+    // HANDLE: a directory we cannot read is not a reason to lose the archive we just made.
+    _rotationLogOnce(`archive prune skipped for ${base}: ${error?.message || error}`);
+    return;
+  }
+  // The stamp is fixed-width UTC, so a plain name sort is a chronological sort (newest last).
+  const archives = entries.filter((name) => _isRotationArchiveName(name, base)).sort();
+  for (const name of archives.slice(0, Math.max(0, archives.length - keep))) {
+    try { fsModule.unlinkSync(path.join(directory, name)); }
+    catch (error) {
+      // A failed prune costs disk, never data — report it once and keep the newest archives.
+      _rotationLogOnce(`archive prune failed for ${name}: ${error?.message || error}`);
+    }
+  }
+}
 
 function rotateBoundedLog(filePath, options = {}) {
   const fsModule = options.fsModule || fs;
@@ -29,4 +89,107 @@ function rotateBoundedLog(filePath, options = {}) {
   return true;
 }
 
-module.exports = { rotateBoundedLog };
+// D-9. Rotates an fd we inherited (launchd's stdout/stderr) in place: clone, truncate through the
+// fd, compress the clone, keep the newest `keep` archives.
+//
+// Returns `{ rotated, reason, archive? }` with reason one of:
+//   'not-file'        — the fd is not a regular file (a pipe/TTY/socket), so there is nothing to
+//                       rotate and nothing was touched;
+//   'inode-mismatch'  — logPath is not the file this fd points at (a dev instance, a TTY, a
+//                       rotated/relaunched process): touching either one would be wrong;
+//   'below-threshold' — under maxBytes, or an I/O failure left the log exactly as it was;
+//   'rotated'         — the fd's file now holds only the rotation notice, and `archive` holds the
+//                       bytes that were there before.
+// It never throws: this runs on the disk-hygiene timer, where a rotation failure must stay a
+// logged no-op rather than break the hygiene pass (or the boot sequence).
+async function rotateInheritedStdio({
+  fd,
+  logPath,
+  maxBytes = STDIO_ROTATE_MAX_BYTES,
+  keep = STDIO_ROTATE_KEEP,
+  now = () => new Date(),
+  fsModule = fs,
+} = {}) {
+  const limit = Math.max(1024, Number(maxBytes) || STDIO_ROTATE_MAX_BYTES);
+  const keepCount = Math.max(1, Math.min(20, Number(keep) || STDIO_ROTATE_KEEP));
+  const base = path.basename(String(logPath || ''));
+
+  let fdStat;
+  try { fdStat = fsModule.fstatSync(fd); }
+  catch { /* expected: EBADF/closed fd — not a file we can rotate, and nothing was touched */ return { rotated: false, reason: 'not-file' }; }
+  if (typeof fdStat?.isFile !== 'function' || !fdStat.isFile()) return { rotated: false, reason: 'not-file' };
+
+  let pathStat;
+  try { pathStat = fsModule.statSync(logPath); }
+  catch { /* expected: logPath missing/unreadable — this is not the file the fd points at */ return { rotated: false, reason: 'inode-mismatch' }; }
+  // dev+ino, not the path string: this is the whole point — a second process (dev instance) or a
+  // shell redirect has a DIFFERENT file at the same path, and rotating the primary's log from here
+  // would truncate a file we do not own.
+  if (Number(pathStat.dev) !== Number(fdStat.dev) || Number(pathStat.ino) !== Number(fdStat.ino)) {
+    return { rotated: false, reason: 'inode-mismatch' };
+  }
+
+  const bytes = Math.max(0, Number(fdStat.size) || 0);
+  if (bytes < limit) return { rotated: false, reason: 'below-threshold' };
+
+  const clonePath = `${logPath}.${_utcStamp(typeof now === 'function' ? now() : now)}`;
+  const gzPath = `${clonePath}.gz`;
+  const copyFlags = (fsModule.constants || fs.constants).COPYFILE_FICLONE;
+  try {
+    fsModule.copyFileSync(logPath, clonePath, copyFlags);
+  } catch (error) {
+    // HANDLE: nothing was truncated, so the log is untouched and the caller's only correct
+    // response is the below-threshold one — try again on the next hygiene pass.
+    _rotationLogOnce(`clone failed for ${base}: ${error?.message || error}`);
+    _unlinkQuiet(fsModule, clonePath);
+    return { rotated: false, reason: 'below-threshold' };
+  }
+
+  try {
+    fsModule.ftruncateSync(fd, 0);
+  } catch (error) {
+    // HANDLE: the truncate is what makes this a rotation. It failed, so every byte is still in
+    // place — the clone is a redundant copy of a file that was never rotated, drop it.
+    _rotationLogOnce(`truncate failed for ${base}: ${error?.message || error}`);
+    _unlinkQuiet(fsModule, clonePath);
+    return { rotated: false, reason: 'below-threshold' };
+  }
+
+  // From here on the fd's file is empty: the clone is the ONLY copy of the pre-rotation bytes, so
+  // a failure below keeps it and never removes it.
+  const streamFs = (typeof fsModule.createReadStream === 'function' && typeof fsModule.createWriteStream === 'function') ? fsModule : fs;
+  try {
+    await pipeline(streamFs.createReadStream(clonePath), zlib.createGzip(), streamFs.createWriteStream(gzPath));
+  } catch (error) {
+    // REPORT: the un-compressed clone survives as the archive (never lose data), with one line.
+    _rotationLogOnce(`gzip failed for ${clonePath}: ${error?.message || error}`);
+    _unlinkQuiet(fsModule, gzPath);
+    return { rotated: true, reason: 'rotated', archive: clonePath };
+  }
+
+  try { fsModule.unlinkSync(clonePath); }
+  catch (error) {
+    // HANDLE: the .gz is written; a surviving clone costs one extra file, not correctness.
+    if (error?.code !== 'ENOENT') _rotationLogOnce(`clone unlink failed for ${clonePath}: ${error?.message || error}`);
+  }
+
+  _pruneRotationArchives(logPath, keepCount, fsModule);
+
+  // The notice goes to the ROTATED stream itself, so the next launchd line lands right after it
+  // and the archive never contains its own notice.
+  const writer = typeof fsModule.writeSync === 'function' ? fsModule : fs;
+  try { writer.writeSync(fd, `[log-rotation] rotated ${base} at ${bytes} bytes -> ${gzPath}\n`); }
+  catch (error) {
+    // REPORT: the rotation itself succeeded; only the notice is missing.
+    _rotationLogOnce(`rotation notice write failed for ${base}: ${error?.message || error}`);
+  }
+
+  return { rotated: true, reason: 'rotated', archive: gzPath };
+}
+
+module.exports = {
+  STDIO_ROTATE_MAX_BYTES,
+  STDIO_ROTATE_KEEP,
+  rotateBoundedLog,
+  rotateInheritedStdio,
+};

package/template/coding-task-manager/lib/walle-mcp-auto-config.js

@@ -37,6 +37,57 @@ function getMcpAutoConfigSkipReason(env = process.env) {
   return '';
 }
 
+// WP-5 (§5 R-6/§9 S-21, opencode-lead-and-delegate-model-selection-2026-10-28.html §6.5): the entry
+// an OpenCode LEAD's inline runtime config needs for the Wall-E MCP server.
+//
+// This is deliberately NOT the global client-config writer below: R-6 forbids CTM writing anything
+// under ~/.config/opencode, and OpenCode's inline `OPENCODE_CONFIG_CONTENT` is a per-process carrier,
+// so there is no file to write and no lock to take. The caller (session-create/provider-process.js)
+// merges the returned entry into that inline document for THIS launch only.
+//
+// Only an explicit OPT-OUT (`getMcpAutoConfigSkipReason(env) === 'disabled'`) suppresses the entry.
+// A `transient_instance` (test/dev) does NOT: an inline value writes no file, so suppressing it would
+// only make the test/dev instance -- the one this feature is verified on -- unable to see its own
+// MCP server. The command is the canonical stdio-proxy tuple from Wall-E's own mcp-integration
+// (resolved real node + walle-mcp-stdio.js); CTM never hand-builds the path.
+//
+// NEVER throws: a module that fails to load or a config generator that refuses leaves the launch
+// exactly as it was (null), and the failure is REPORTED to stderr ONCE per process.
+let _opencodeWalleMcpEntryReported = false;
+function _reportOpencodeWalleMcpEntryFailure(detail) {
+  if (_opencodeWalleMcpEntryReported) return;
+  _opencodeWalleMcpEntryReported = true;
+  process.stderr.write('[walle-mcp-auto-config] OpenCode Wall-E MCP entry unavailable: ' + detail + '\n');
+}
+
+function opencodeWalleMcpEntry(env = process.env) {
+  if (getMcpAutoConfigSkipReason(env) === 'disabled') return null;
+  let integration;
+  try {
+    integration = loadMcpIntegration();
+  } catch (err) {
+    _reportOpencodeWalleMcpEntryFailure(String((err && err.message) || err).slice(0, 200));
+    return null;
+  }
+  if (!integration || typeof integration.wallEMcpStdioConfig !== 'function') {
+    _reportOpencodeWalleMcpEntryFailure('wallEMcpStdioConfig is not exported by wall-e/lib/mcp-integration');
+    return null;
+  }
+  let config;
+  try {
+    config = integration.wallEMcpStdioConfig();
+  } catch (err) {
+    _reportOpencodeWalleMcpEntryFailure(String((err && err.message) || err).slice(0, 200));
+    return null;
+  }
+  const command = config && config.command;
+  if (typeof command !== 'string' || !command) {
+    _reportOpencodeWalleMcpEntryFailure('wallEMcpStdioConfig returned no command');
+    return null;
+  }
+  return { command, args: Array.isArray(config.args) ? config.args : [] };
+}
+
 async function ensureWalleMcpForAgentSession({
   cmd,
   wallePort,
@@ -52,6 +103,7 @@ async function ensureWalleMcpForAgentSession({
   if (lastEnsureAt && now - lastEnsureAt < minIntervalMs) return { skipped: 'throttled' };
   lastEnsureAt = now;
 
+  let failureMessage = (err) => err.message;
   try {
     // WP-3: ensureMcpIntegrations is async — it holds the SAME
     // client-config lock (wall-e/lib/client-config-lock.js) that Wall-E's own
@@ -60,7 +112,8 @@ async function ensureWalleMcpForAgentSession({
     // loadMcpIntegration() above) rather than re-implementing the write path.
     // A single shared module means a single lock protects both processes —
     // no separate lock protocol needed here.
-    const { ensureMcpIntegrations } = loadMcpIntegration();
+    const { ensureMcpIntegrations, ensureFailureMessage } = loadMcpIntegration();
+    failureMessage = ensureFailureMessage;
     const results = await ensureMcpIntegrations(wallePort, { homeDir: homeDir || env.HOME || process.env.HOME });
     const changed = results.filter(r => r.kind === 'mcp_config' && (r.action === 'added' || r.action === 'updated'));
     const instructionChanged = results.filter(r => r.kind === 'agent_instructions' && (r.action === 'added' || r.action === 'updated'));
@@ -76,7 +129,7 @@ async function ensureWalleMcpForAgentSession({
     }
     return { results, changed: changed.length, instructionChanged: instructionChanged.length, errors: errors.length };
   } catch (err) {
-    logger.warn(`[ctm] Wall-E MCP auto-config failed: ${err.message}`);
+    logger.warn(`[ctm] Wall-E MCP auto-config failed: ${failureMessage(err)}`);
     return { error: err.message };
   }
 }
@@ -87,6 +140,7 @@ function _resetWalleMcpAutoConfigState() {
 
 module.exports = {
   ensureWalleMcpForAgentSession,
+  opencodeWalleMcpEntry,
   getMcpAutoConfigSkipReason,
   isMcpAutoConfigDisabled,
   isMcpCapableAgentCommand,