greprag 5.26.0 → 5.28.0

package/dist/commands/watcher-registry.js

@@ -0,0 +1,287 @@
+"use strict";
+/** Local watcher process registry + severed-ancestry orphan reaper.
+ *
+ *  The architectural correction the whole monitor-resilience saga circled but
+ *  never landed (see adr/monitor-resilience.md 2026-05-28 "severed-ancestry =
+ *  the disarm signal" + the 2026-06-04 entry): a watcher's liveness lives at the
+ *  LOCAL process layer, not in a cloud registry. The consumer of a watcher is
+ *  the Claude Code Monitor task on THIS machine; the server can't see whether
+ *  anyone is still consuming the stream, so a server lease counts an orphan
+ *  (consumer dead, process still respawning) as "armed". Two local signals fix
+ *  that:
+ *
+ *   1. **pidfile** (`~/.greprag/watchers/<short>.json`) — written by the
+ *      supervisor on start, removed on terminal exit. `isLocallyArmed` reads it
+ *      to gate re-arming with zero cloud dependency and zero ghost-lease lag.
+ *      Paired with EPIPE-terminal in the watcher (a watcher whose consumer pipe
+ *      breaks exits and removes its own pidfile), a live pidfile means a live,
+ *      *consumed* watcher.
+ *
+ *   2. **severed-ancestry reap** — `reapOrphanWatchers` snapshots the process
+ *      table and kills any `inbox watch` process whose ancestry no longer
+ *      reaches a live `claude.exe`. Backstop for the case EPIPE can't catch (a
+ *      consumer hard-killed without closing the pipe). SAFE BY CONSTRUCTION: the
+ *      kill set is intersected with "cmdline contains `inbox watch`", so it can
+ *      only ever terminate greprag watchers — never claude.exe, an editor, or an
+ *      unrelated node server. A bug can at worst kill a watcher that then
+ *      re-arms; it can never touch the operator's work.
+ *
+ *  adr: adr/monitor-resilience.md */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeWatcherPidfile = writeWatcherPidfile;
+exports.removeWatcherPidfile = removeWatcherPidfile;
+exports.isLocallyArmed = isLocallyArmed;
+exports.reapOrphanWatchers = reapOrphanWatchers;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const WATCHER_DIRNAME = 'watchers';
+// Matches a greprag watcher's command line in every launch shape: the npm shim
+// and the old bash while-loop wrapper (`greprag inbox watch …`), and the
+// supervisor's CreateProcess re-invocation (`node …\dist\index.js inbox watch
+// …`). Anchored on the INVOKED BINARY (`greprag` or `index.js`) immediately
+// followed by the `inbox watch` args — NOT a bare `inbox watch` substring, which
+// would also match an unrelated shell that merely mentions the phrase (a grep, a
+// diagnostic, this very reaper). This is the SAFETY GUARD: only a process whose
+// command line is an actual watcher invocation is ever a kill candidate, so the
+// reaper cannot touch claude.exe, an editor, or an incidental shell.
+const WATCHER_CMD_RE = /(?:index\.js|greprag)["'\s]+inbox\s+watch\b/i;
+const CLAUDE_PROC_RE = /^claude(\.exe)?$/i;
+function grepragHome() {
+    const home = process.env.HOME || process.env.USERPROFILE || '';
+    return home ? path.join(home, '.greprag') : null;
+}
+function watchersDir() {
+    const h = grepragHome();
+    return h ? path.join(h, WATCHER_DIRNAME) : null;
+}
+/** Write the watcher pidfile (supervisor PID), keyed by the 8-hex session short.
+ *  Best-effort: a failed write only means `isLocallyArmed` falls back to
+ *  re-arming, never a crash. */
+function writeWatcherPidfile(short, pid) {
+    try {
+        const dir = watchersDir();
+        if (!dir)
+            return;
+        fs.mkdirSync(dir, { recursive: true });
+        const rec = { short, pid, startedAt: Date.now() };
+        fs.writeFileSync(path.join(dir, `${short}.json`), JSON.stringify(rec));
+    }
+    catch { /* best-effort */ }
+}
+function removeWatcherPidfile(short) {
+    try {
+        const dir = watchersDir();
+        if (!dir)
+            return;
+        fs.rmSync(path.join(dir, `${short}.json`), { force: true });
+    }
+    catch { /* best-effort */ }
+}
+function readWatcherPidfile(short) {
+    try {
+        const dir = watchersDir();
+        if (!dir)
+            return null;
+        const raw = fs.readFileSync(path.join(dir, `${short}.json`), 'utf-8');
+        const rec = JSON.parse(raw);
+        if (rec && typeof rec.pid === 'number' && rec.short === short)
+            return rec;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** True iff `pid` is a live process. `process.kill(pid, 0)` sends no signal —
+ *  it only probes existence. EPERM means the process exists but is owned by
+ *  another user (still alive); ESRCH means gone. */
+function pidAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e?.code === 'EPERM';
+    }
+}
+/** Local-first arm check: is there a live watcher PROCESS for this session on
+ *  THIS machine? This is ground truth for "armed" — the consumer (the Monitor
+ *  task) is local, so a live local pidfile means a live, consumed watcher.
+ *  Replaces the server `isSessionArmed` check, which counts orphans (consumer
+ *  dead, socket still open) as armed and so both (a) suppresses re-arm when the
+ *  real watcher is gone and (b) lets re-arm stack new watchers on undead
+ *  orphans. A dead-PID pidfile is swept here so the next turn re-arms. */
+function isLocallyArmed(short) {
+    const rec = readWatcherPidfile(short);
+    if (!rec)
+        return false;
+    if (!pidAlive(rec.pid)) {
+        removeWatcherPidfile(short);
+        return false;
+    }
+    return true;
+}
+/** Snapshot (pid, ppid, name, cmdline) for every process. Windows via one CIM
+ *  call (a single PowerShell invocation — avoids the per-PID `wmic` calls that
+ *  hung historically, see ADR 2026-05-26); POSIX via `ps`. Best-effort: any
+ *  failure returns [] and the reaper becomes a no-op. */
+function snapshotProcs() {
+    try {
+        if (process.platform === 'win32') {
+            const script = 'Get-CimInstance Win32_Process | ' +
+                'Select-Object ProcessId,ParentProcessId,Name,CommandLine | ' +
+                'ConvertTo-Json -Compress';
+            const out = (0, child_process_1.execFileSync)('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], { timeout: 12_000, maxBuffer: 64 * 1024 * 1024, windowsHide: true }).toString();
+            const parsed = JSON.parse(out);
+            const arr = Array.isArray(parsed) ? parsed : [parsed];
+            return arr
+                .map((p) => ({
+                pid: Number(p.ProcessId),
+                ppid: Number(p.ParentProcessId),
+                name: String(p.Name || ''),
+                cmd: String(p.CommandLine || ''),
+            }))
+                .filter(p => Number.isFinite(p.pid) && p.pid > 0);
+        }
+        // POSIX fallback.
+        const out = (0, child_process_1.execFileSync)('ps', ['-eo', 'pid=,ppid=,comm=,args='], {
+            timeout: 12_000, maxBuffer: 64 * 1024 * 1024,
+        }).toString();
+        const rows = [];
+        for (const line of out.split('\n')) {
+            const m = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.*)$/.exec(line);
+            if (!m)
+                continue;
+            rows.push({ pid: Number(m[1]), ppid: Number(m[2]), name: m[3], cmd: m[4] });
+        }
+        return rows;
+    }
+    catch {
+        return [];
+    }
+}
+/** Walk `start`'s parent chain in the snapshot; true iff a live `claude.exe`
+ *  appears as an ancestor. A healthy watcher is launched (via the Monitor task)
+ *  under the live claude.exe, so its chain reaches it; an orphan's owning
+ *  claude.exe died on reload, so its chain is severed (a parent PID absent from
+ *  the live snapshot) before any claude.exe. Depth- and cycle-guarded. */
+function hasLiveClaudeAncestor(start, byPid) {
+    let cur = start;
+    const seen = new Set();
+    for (let depth = 0; cur && depth < 32; depth++) {
+        if (seen.has(cur.pid))
+            break; // cycle guard
+        seen.add(cur.pid);
+        if (CLAUDE_PROC_RE.test(cur.name))
+            return true; // start/ancestor IS claude
+        const parent = byPid.get(cur.ppid);
+        if (!parent)
+            return false; // severed — parent not in the live table
+        cur = parent;
+    }
+    return false;
+}
+/** Kill every `inbox watch` process whose ancestry no longer reaches a live
+ *  claude.exe (severed = orphan), plus sweep dead-PID pidfiles. Returns a
+ *  summary. Best-effort and bounded: a snapshot failure yields a zero result;
+ *  the kill set is guaranteed (by `WATCHER_CMD_RE`) to contain only greprag
+ *  watchers. Intended to run at SessionStart, before this session arms — at that
+ *  moment every live watcher belongs to a PRIOR incarnation, so reaping is the
+ *  common path, not the exception. */
+function reapOrphanWatchers() {
+    sweepDeadPidfiles();
+    const procs = snapshotProcs();
+    if (procs.length === 0)
+        return { scanned: 0, orphans: 0, killed: [] };
+    const byPid = new Map();
+    for (const p of procs)
+        byPid.set(p.pid, p);
+    // Candidate set — the SAFETY GUARD. Only these are ever eligible to be killed.
+    const watchers = procs.filter(p => WATCHER_CMD_RE.test(p.cmd));
+    const severed = watchers.filter(p => !hasLiveClaudeAncestor(p, byPid));
+    const killed = [];
+    for (const p of severed) {
+        if (killProcessTree(p.pid))
+            killed.push(p.pid);
+    }
+    return { scanned: watchers.length, orphans: severed.length, killed };
+}
+/** Force-kill a process and its descendants. `taskkill /T` reaps the tree in one
+ *  shot so a supervisor can't respawn its child in the race window. */
+function killProcessTree(pid) {
+    try {
+        if (process.platform === 'win32') {
+            (0, child_process_1.execFileSync)('taskkill.exe', ['/PID', String(pid), '/T', '/F'], { timeout: 5_000, stdio: 'ignore', windowsHide: true });
+        }
+        else {
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch { /* already gone */ }
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Remove pidfiles whose recorded PID is dead. Keeps `isLocallyArmed` honest
+ *  even when a watcher died without removing its own file (hard kill / crash). */
+function sweepDeadPidfiles() {
+    try {
+        const dir = watchersDir();
+        if (!dir || !fs.existsSync(dir))
+            return;
+        for (const f of fs.readdirSync(dir)) {
+            if (!f.endsWith('.json'))
+                continue;
+            try {
+                const rec = JSON.parse(fs.readFileSync(path.join(dir, f), 'utf-8'));
+                if (!rec || typeof rec.pid !== 'number' || !pidAlive(rec.pid)) {
+                    fs.rmSync(path.join(dir, f), { force: true });
+                }
+            }
+            catch {
+                fs.rmSync(path.join(dir, f), { force: true }); // unparseable → drop
+            }
+        }
+    }
+    catch { /* best-effort */ }
+}
+//# sourceMappingURL=watcher-registry.js.map

package/dist/commands/watcher-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher-registry.js","sourceRoot":"","sources":["../../src/commands/watcher-registry.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA2BqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCrC,kDAQC;AAED,oDAMC;AA6BD,wCAKC;AA2ED,gDAiBC;AAlLD,uCAAyB;AACzB,2CAA6B;AAC7B,iDAA6C;AAE7C,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,+EAA+E;AAC/E,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,qEAAqE;AACrE,MAAM,cAAc,GAAG,8CAA8C,CAAC;AACtE,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAE3C,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IAC/D,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAQD;;gCAEgC;AAChC,SAAgB,mBAAmB,CAAC,KAAa,EAAE,GAAW;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,GAAG,GAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAa;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QAChD,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED;;oDAEoD;AACpD,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAC1C,OAAO,CAAC,EAAE,CAAC;QAAC,OAAQ,CAA2B,EAAE,IAAI,KAAK,OAAO,CAAC;IAAC,CAAC;AACtE,CAAC;AAED;;;;;;0EAM0E;AAC1E,SAAgB,cAAc,CAAC,KAAa;IAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAMD;;;yDAGyD;AACzD,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GACV,kCAAkC;gBAClC,6DAA6D;gBAC7D,0BAA0B,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAA,4BAAY,EACtB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EACrD,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CACpE,CAAC,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACtD,OAAO,GAAG;iBACP,GAAG,CAAC,CAAC,CAAC,EAAW,EAAE,CAAC,CAAC;gBACpB,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC/B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC1B,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;aACjC,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,kBAAkB;QAClB,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,IAAI,EAAE,CAAC,KAAK,EAAE,wBAAwB,CAAC,EAAE;YAChE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC7C,CAAC,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,GAAc,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED;;;;0EAI0E;AAC1E,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAA2B;IACxE,IAAI,GAAG,GAAwB,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,CAAO,cAAc;QAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAG,2BAA2B;QAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,CAAU,yCAAyC;QAC7E,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID;;;;;;sCAMsC;AACtC,SAAgB,kBAAkB;IAChC,iBAAiB,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAEtE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE3C,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAEvE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AACvE,CAAC;AAED;uEACuE;AACvE,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAA,4BAAY,EAAC,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAC5D,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED;kFACkF;AAClF,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QACxC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAqB,CAAC;gBACxF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9D,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAE,qBAAqB;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC/B,CAAC"}

package/dist/hook.js

@@ -53,6 +53,7 @@ const turn_provenance_1 = require("./turn-provenance");
 const codex_steering_1 = require("./codex-steering");
 const front_desk_mail_1 = require("./front-desk-mail");
 const email_pull_1 = require("./email-pull");
+const watcher_registry_1 = require("./commands/watcher-registry");
 const API_URL_DEFAULT = 'https://api.greprag.com';
 const MAX_FIELD_CHARS = 500_000; // safety cap per text field
 // ---------- Env + config ---------------------------------------------------
@@ -996,6 +997,20 @@ function writeRecapOutput(text, mode) {
  *  Storage and display are both UTC. The agent can compute local time itself
  *  if needed — a server-side UTC display avoids straddle-day confusion. */
 async function recap(input, mode = 'plain') {
+    // SessionStart orphan reap (best-effort, side-effect only — never writes to
+    // stdout, which carries this hook's additionalContext JSON). At session start
+    // every live watcher belongs to a PRIOR incarnation; this kills any whose
+    // consumer is gone (severed ancestry) and sweeps stale pidfiles, so the orphan
+    // pile that OOM-crashed the desktop cannot accumulate across reloads. Bounded
+    // (~one process snapshot) and guaranteed to touch only `inbox watch`
+    // processes. adr: adr/monitor-resilience.md
+    try {
+        const reaped = (0, watcher_registry_1.reapOrphanWatchers)();
+        if (reaped.killed.length > 0) {
+            process.stderr.write(`[greprag] reaped ${reaped.killed.length} orphan watcher(s) [${reaped.killed.join(', ')}]\n`);
+        }
+    }
+    catch { /* reaping is best-effort — never block session start */ }
     const cwd = input.cwd || process.cwd();
     const cfg = getConfig(cwd);
     if (!cfg.enabled || !cfg.apiKey)
@@ -1124,27 +1139,17 @@ async function recap(input, mode = 'plain') {
     }
     writeRecapOutput(parts.join('\n') + '\n', mode);
 }
-/** Self-scoped arm-state check: does THIS session have a live inbox watcher?
- *  Asks the server's watcher registry (GET /v1/inbox/watchers — the same live-
- *  WebSocket state the Discord emergency router uses; a dead watcher drops its
- *  socket and falls off the list, so this is ground truth, not a stale PID),
- *  filtered to the caller's own 8-hex session id. Returns true/false when the
- *  server answers, or null when the check itself failed (network/HTTP error) so
- *  callers can tell "confirmed unarmed" apart from "couldn't tell". */
-async function isSessionArmed(apiUrl, apiKey, short) {
-    try {
-        const res = await fetch(`${apiUrl.replace(/\/+$/, '')}/v1/inbox/watchers`, {
-            headers: { 'Authorization': `Bearer ${apiKey}` },
-        });
-        if (!res.ok)
-            return null;
-        const data = await res.json();
-        return (data.watchers ?? []).some(w => (0, session_id_1.truncateSessionId)(w.session_id) === short);
-    }
-    catch {
-        return null;
-    }
-}
+/** Arm-state detection moved LOCAL (2026-06-04). The former `isSessionArmed`
+ *  asked the server's watcher registry "does this session have a live socket?"
+ *  and its docstring claimed that was "ground truth, not a stale PID". It was
+ *  the opposite: an ORPHAN (consumer dead, SSE socket still open and respawning)
+ *  keeps its socket, so it never falls off the registry — it reads as armed.
+ *  That single false premise drove the whole failure: a fresh ghost lease
+ *  suppressed re-arm (the live session went unwatched — "it keeps dying"), and
+ *  an expired one let re-arm stack a new watcher on the undead orphan (the
+ *  pile-up that OOM-crashed the desktop). Liveness is a LOCAL-process fact now —
+ *  see `isLocallyArmed` in commands/watcher-registry.ts, gated on a supervisor
+ *  pidfile this machine actually owns. adr: adr/monitor-resilience.md */
 /** UserPromptSubmit — fires on every user prompt. History:
  *
  *  v1: surfaced a project-wide unread inbox COUNT. Removed in v5.6.1 — the count
@@ -1152,8 +1157,10 @@ async function isSessionArmed(apiUrl, apiKey, short) {
  *  v2: turn-2 fallback arm injection — blind (fired on turn 2 regardless, with a
  *  conditional "if already armed, ignore" hedge because it couldn't see state).
  *
- *  v3 (current): DETECTION-GATED arm injection. Every turn, ask the server
- *  whether THIS session has a live watcher (isSessionArmed):
+ *  v3: DETECTION-GATED arm injection, server-registry version (retired 2026-06-04
+ *  — the registry counted orphans as armed; see isSessionArmed's gravestone).
+ *  v4 (current): DETECTION-GATED on LOCAL state. Every turn, check whether THIS
+ *  session has a live watcher PROCESS on this machine (isLocallyArmed, pidfile):
  *    armed      → silent (never nag once armed)
  *    not armed  → inject the LOUD arm directive (buildArmDirective). Unconditional:
  *                 we only reach here when the server CONFIRMS no watcher, so there
@@ -1199,9 +1206,17 @@ async function notify(input, source = 'claude-code') {
             writeAdditionalContext('UserPromptSubmit', context);
         return;
     }
-    const armed = await isSessionArmed(cfg.apiUrl, cfg.apiKey, short);
-    if (armed !== false)
-        return; // armed OR couldn't tell → silent
+    // Local-first arm detection. Ground truth is a live watcher PROCESS on THIS
+    // machine — its consumer (the Monitor task) is local, so a live supervisor
+    // pidfile means a live, consumed watcher. This replaces the server
+    // `isSessionArmed` registry check, whose ghost-lease flaw made an orphan
+    // (consumer dead, socket still open) read as "armed" — which both suppressed
+    // re-arm when the real watcher was gone AND, once the lease expired, let
+    // re-arm stack a new watcher on the undead orphan. With EPIPE-terminal + the
+    // SessionStart reaper sweeping stale pidfiles, "no live pidfile" reliably means
+    // "needs arming", lag-free and with no cloud round-trip. adr: adr/monitor-resilience.md
+    if ((0, watcher_registry_1.isLocallyArmed)(short))
+        return; // live local watcher → silent
     writeAdditionalContext('UserPromptSubmit', (0, session_id_1.buildArmDirective)(short, (0, session_id_1.readIdentityAlias)()));
 }
 /** "You've got mail" turn hook (Chip B) — wire as a UserPromptSubmit hook.
@@ -1259,9 +1274,9 @@ async function maybeAutoSaveAttachments(cwd, apiUrl, apiKey) {
     return (0, email_pull_1.buildAutoSaveSummary)(saved, dir);
 }
 /** UserPromptSubmit PROBE / manual diagnostic — prints a per-turn readout of
- *  whether THIS session has a live watcher (the same isSessionArmed signal
- *  `notify` gates on). Kept as a separate subcommand for visibility/debugging:
- *  wire it as a second UserPromptSubmit hook to see arm state on every turn.
+ *  whether THIS session has a live watcher (the same isLocallyArmed pidfile
+ *  signal `notify` gates on). Kept as a separate subcommand for visibility/
+ *  debugging: wire it as a second UserPromptSubmit hook to see arm state.
  *  adr: adr/session-id-awareness.md */
 async function armCheck(input) {
     const cfg = getConfig(input.cwd || process.cwd());
@@ -1270,10 +1285,10 @@ async function armCheck(input) {
     const short = (0, session_id_1.truncateSessionId)(input.session_id);
     if (!short)
         return;
-    const armed = await isSessionArmed(cfg.apiUrl, cfg.apiKey, short);
-    const verdict = armed === null
-        ? `ARM-CHECK (probe): could not determine arm state (watcher registry unreachable).`
-        : `ARM-CHECK (probe): session ${short} ${armed ? 'IS armed — live watcher detected.' : 'is NOT armed — no live watcher detected.'}`;
+    // Local ground truth — the same signal `notify` gates on (live supervisor
+    // pidfile on this machine), not the ghost-prone cloud registry.
+    const armed = (0, watcher_registry_1.isLocallyArmed)(short);
+    const verdict = `ARM-CHECK (probe): session ${short} ${armed ? 'IS armed — live local watcher detected.' : 'is NOT armed — no live local watcher detected.'}`;
     process.stdout.write(JSON.stringify({
         hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: verdict },
     }) + '\n');