create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/bin/memory-census.js

@@ -21,6 +21,7 @@
 const http = require('node:http');
 const fs = require('node:fs');
 const { execFileSync } = require('node:child_process');
+const { orphanParentPids } = require('../../shared/orphan-parents'); // WP-12 (S-29)
 const { isNodeAbiMismatchError, pinnedNodeHintMessage } = require('../lib/pinned-node-hint');
 const { parkJournalPath } = require('../lib/park-journal');
 
@@ -105,9 +106,9 @@ function computeManagedStdioChildren(port, rows) {
 // process reparented to pid 1 (launchd/init) is the expected steady state
 // for a backgrounded tunnel; MORE than one is the residual-orphan signal
 // this column exists to surface, so devtunnelOrphans = max(0, ppid1Count-1).
-function computeDevtunnelHosts(rows) {
+function computeDevtunnelHosts(rows, orphanParents = orphanParentPids()) {
   const matches = rows.filter((row) => DEVTUNNEL_HOST_RE.test(row.command));
-  const ppid1Count = matches.filter((row) => row.ppid === 1).length;
+  const ppid1Count = matches.filter((row) => orphanParents.has(row.ppid)).length;
   return {
     devtunnelHostsCount: matches.length,
     devtunnelHosts: matches.map((row) => ({ pid: row.pid, ppid: row.ppid, etime: row.etime })),
@@ -529,6 +530,7 @@ if (require.main === module) {
 }
 
 module.exports = {
+  computeDevtunnelHosts,
   parseArgs,
   refusePrimaryPort,
   median,

package/template/coding-task-manager/bin/memory-sync-verify.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+'use strict';
+
+// WP-6a (docs/shared-memory-every-machine-2026-10-31.html §6.5, gate E-3): the convergence verifier
+// CLI. Run it on the HUB machine, with the hub's CTM environment (CTM_PORT / WALL_E_PORT /
+// WALL_E_API_TOKEN), and it prints, per enabled registry member, whether every D-11 table's
+// bucketed digest matches the hub's.
+//
+//   node bin/memory-sync-verify.js [--port <n>] [--tables a,b] [--timeout <ms>] [--json]
+//
+// Exit code is 0 ONLY when `allEqual` — every enabled member reachable and every table equal. A
+// single unreachable box, or a single mismatched bucket, is a non-zero exit.
+//
+// REGISTRY ACCESS — read through the LOCAL CTM's HTTP API, not the CTM SQLite file. The brief asks
+// for a `listMachines` caller to mirror; there is none in bin/ (grep: no bin tool opens the
+// machines registry), and every tool that DOES open the CTM DB (bin/census-codex-lead-history.js,
+// bin/repair-session-image-refs.js, …) opens it `readonly: true, fileMustExist: true` against a
+// STOPPED CTM or a copy — precisely because a second handle against the live WAL DB is what this
+// repo forbids. `GET /api/machines` is a loopback read (lib/auth-rules.js: `exact('GET',
+// '/api/machines', 'read', …)`), and a loopback request satisfies every scope with no step-up and
+// no token — the same posture every other loopback drivetool (bin/ctm-machine-pair.js) relies on.
+// So: one loopback GET, and the verifier dials exactly the rows it returns.
+//
+// Contacts nothing but 127.0.0.1 (the local CTM + the local Wall-E, via lib/walle-client) and the
+// member URLs the registry itself holds. Writes nothing.
+
+const http = require('node:http');
+// CTM_PORT is read through lib/env-flags.js — the one parser — rather than raw process.env (the
+// bin/flag-lint.js rule; CTM_PORT is a genuinely shared knob).
+const { intFlag } = require('../lib/env-flags');
+const { verifyMemorySync, formatReport, exitCodeFor, DEFAULT_TABLES } = require('../lib/memory-sync-verify');
+const { buildPeerControlHeaders } = require('../lib/remote-machine-create');
+const walleClient = require('../lib/walle-client');
+
+const DEFAULT_PORT = 3456;
+
+function parseArgs(argv) {
+  const envPort = intFlag('CTM_PORT', DEFAULT_PORT);
+  const out = { port: envPort > 0 ? envPort : DEFAULT_PORT, tables: null, timeoutMs: null, json: false, help: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === '--port' || arg === '-p') {
+      const value = Number(argv[++i]);
+      if (Number.isInteger(value) && value > 0) out.port = value;
+    } else if (arg === '--tables') {
+      const value = String(argv[++i] || '');
+      const list = value.split(',').map((t) => t.trim()).filter(Boolean);
+      if (list.length) out.tables = list;
+    } else if (arg === '--timeout') {
+      const value = Number(argv[++i]);
+      if (Number.isFinite(value) && value > 0) out.timeoutMs = value;
+    } else if (arg === '--json') {
+      out.json = true;
+    } else if (arg === '--help' || arg === '-h') {
+      out.help = true;
+    }
+  }
+  return out;
+}
+
+function usage(out) {
+  out.write('usage: memory-sync-verify [--port <n>] [--tables a,b,...] [--timeout <ms>] [--json]\n');
+  out.write('\n');
+  out.write('  Compares the bucketed content digest of every enabled registry member against this\n');
+  out.write("  hub's, table by table. Exits 0 only when every member matches.\n");
+  out.write('\n');
+  out.write(`  --port <n>       local CTM port (default: CTM_PORT, else ${DEFAULT_PORT})\n`);
+  out.write(`  --tables a,b     tables to compare (default: ${DEFAULT_TABLES.join(',')})\n`);
+  out.write('  --timeout <ms>   per-request deadline (default: 30000)\n');
+  out.write('  --json           print the raw verify result as JSON\n');
+  out.write('  --help           this text\n');
+}
+
+/**
+ * The hub's own registry view through the local CTM (`GET /api/machines`, loopback). 127.0.0.1 is
+ * hard-coded: this verifier must never read a registry off a machine other than the one it runs on.
+ */
+function fetchMachines(port) {
+  return new Promise((resolve) => {
+    const req = http.request({
+      host: '127.0.0.1',
+      port,
+      path: '/api/machines',
+      method: 'GET',
+      headers: { Accept: 'application/json' },
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(chunk));
+      res.on('end', () => {
+        const raw = Buffer.concat(chunks).toString('utf8');
+        let parsed = null;
+        try { parsed = raw ? JSON.parse(raw) : null; } catch { parsed = null; /* expected: a non-JSON error page is reported by status alone */ }
+        const status = Number(res.statusCode) || 0;
+        if (status < 200 || status >= 300 || !parsed || !Array.isArray(parsed.machines)) {
+          resolve({ ok: false, status, error: `machines_http_${status}` });
+          return;
+        }
+        resolve({ ok: true, status, machines: parsed.machines });
+      });
+    });
+    req.on('error', (err) => resolve({ ok: false, status: 0, error: err && err.message ? err.message : String(err) }));
+    req.end();
+  });
+}
+
+async function main(argv, io) {
+  const out = io.out;
+  const err = io.err;
+  const args = parseArgs(argv);
+  if (args.help) {
+    usage(out);
+    return 0;
+  }
+  const registry = await fetchMachines(args.port);
+  if (!registry.ok) {
+    err.write(`memory-sync-verify: cannot read the machine registry from local CTM on 127.0.0.1:${args.port} — ${registry.error}\n`);
+    err.write(`  is CTM running on ${args.port}? (CTM_PORT overrides)\n`);
+    return 2;
+  }
+
+  let result;
+  try {
+    result = await verifyMemorySync({
+      machines: registry.machines,
+      fetchImpl: global.fetch,
+      walle: walleClient,
+      env: process.env,
+      peerHeadersFor: (instanceId) => buildPeerControlHeaders(process.env, { instanceId }),
+      tables: args.tables || DEFAULT_TABLES,
+      timeoutMs: args.timeoutMs || undefined,
+    });
+  } catch (error) {
+    err.write(`memory-sync-verify: verify failed — ${error && error.message ? error.message : error}\n`);
+    return 1;
+  }
+
+  if (args.json) out.write(`${JSON.stringify(result, null, 2)}\n`);
+  else out.write(formatReport(result, { tables: args.tables || DEFAULT_TABLES }));
+  return exitCodeFor(result);
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2), { out: process.stdout, err: process.stderr })
+    .then((code) => { process.exitCode = code; })
+    .catch((error) => {
+      process.stderr.write(`memory-sync-verify: ${error && error.stack ? error.stack : error}\n`);
+      process.exitCode = 1;
+    });
+}
+
+module.exports = { parseArgs, main, fetchMachines, formatReport, exitCodeFor };