rtail 2.0.0-rc.2 → 2.0.0-rc.3

package/NOTICE

@@ -0,0 +1,9 @@
+rTail
+Copyright 2013-2026 Kilian Ciuffolo and the rTail contributors
+
+This product includes software developed at the rTail project
+(https://github.com/kilianc/rtail).
+
+Portions of this software, specifically releases v1.x and the history on the
+main branch preceding the v2 branch, were originally released under the MIT
+licence and remain available under those terms.

package/README.md

@@ -9,19 +9,27 @@
 
 ## Terminal output to the browser in seconds, using UNIX pipes.
 
-> **v2 — private preview.** This branch is the rewrite described in
-> [`docs/proposal-logging-system.md`](docs/proposal-logging-system.md): rTail is
-> growing into a durable, searchable log store backed by Parquet and SQL. The
-> server is now a single Go binary with the webapp embedded, and the npm
-> package carries only the client pipe.
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/media/explorer-dark.png">
+  <img alt="The rtail explorer: level>=WARN on the api stream over the last hour, a wall of upstream timeouts from payments at the top" src="docs/media/explorer-light.png">
+</picture>
+
+*`level>=WARN` on the `api` stream over the last hour: a run of upstream
+timeouts from payments in the last few minutes, with `service`, `status`,
+`latency_ms` and `region` promoted to columns.*
+
+> **v2 — release candidate.** v2 is a rewrite: a durable, searchable log store
+> backed by Parquet and SQL. The server is a single Go binary with the webapp
+> embedded, and the npm package carries only the client pipe.
 >
 > The `cmd | rtail` wire format is frozen and always will be — the client you
-> already have installed works against a v2 server unchanged. Everything else
-> on this branch is subject to change until 2.0.0 ships.
+> already have installed works against a v2 server unchanged.
 >
-> **Where it is:** P0–P5 are done — storage, search, compaction, the explorer
-> and the ingest protocols. What is left before 2.0.0 is the operational edges:
-> authentication, TLS, and a release pipeline for the three cgo platforms.
+> **Where it is:** everything described below is built and tested — storage,
+> search, compaction, the explorer, the four ingest protocols, authentication,
+> TLS, and a release pipeline that publishes four tarballs, six npm packages
+> and a container image per tag. `2.0.0-rc.3` is the current release; until
+> `2.0.0` is tagged, reaching it takes `RTAIL_PRERELEASE=1` — see below.
 
 `rtail` is a command line utility that grabs every line in `stdin` and broadcasts it over **UDP**. That's it. Nothing fancy. Nothing complicated. Tail log files, app output, or whatever you wish, using `rtail` broadcasting to an `rtail-server` – See multiple streams in the browser, in realtime.
 
@@ -29,7 +37,12 @@
 
 The server ships as a container image — this is the recommended way to run it.
 
-    $ docker run -d --name rtail -p 8888:8888 -p 9999:9999/udp ghcr.io/kilianc/rtail
+    $ docker run -d --name rtail -p 8888:8888 -p 9999:9999/udp ghcr.io/kilianc/rtail:next
+
+`:next` is the newest release candidate, the way `rtail@next` is on npm.
+`latest` only moves on a stable release, so until `2.0.0` is tagged it is
+stuck on an earlier candidate that predates `/data`; once it is, the plain
+`ghcr.io/kilianc/rtail` is right again.
 
 Open <http://localhost:8888> and start piping. There is a
 [`docker-compose.yml`](docker-compose.yml) if you prefer:
@@ -39,20 +52,33 @@ Open <http://localhost:8888> and start piping. There is a
 Options are flags, or `RTAIL_*` environment variables:
 
     $ docker run -d -p 8080:8080 -p 9999:9999/udp \
-        -e RTAIL_WEB_PORT=8080 ghcr.io/kilianc/rtail
+        -e RTAIL_WEB_PORT=8080 ghcr.io/kilianc/rtail:next
+
+    $ docker run -d -p 8888:8888 -p 9999:9999/udp \
+        ghcr.io/kilianc/rtail:next --backlog 500
+
+The image is memory-only until you give it somewhere to write. `/data` is
+there for that, owned by the user the server runs as:
 
     $ docker run -d -p 8888:8888 -p 9999:9999/udp \
-        ghcr.io/kilianc/rtail --backlog 500
+        -e RTAIL_DATA=/data -v rtail-data:/data ghcr.io/kilianc/rtail:next
+
+A named volume, as above, takes that owner on its own. A bind mount keeps the
+host directory's, which the server's uid 10001 cannot write to:
+`chown 10001:10001` the directory first, or run it as yourself with
+`--user "$(id -u):$(id -g)"`.
 
 The image binds `0.0.0.0` inside the container, so **the published ports are
-reachable from your whole network**. It has no authentication — keep it on a
-trusted network, or put a reverse proxy in front of it.
+reachable from your whole network**. It is open by default;
+`-e RTAIL_AUTH_TOKEN="$(openssl rand -hex 32)"` closes it — see
+[Authentication](#authentication). Without a token, keep it on a trusted
+network or put a reverse proxy in front of it.
 
 ## Releases
 
 Tagged releases carry a binary for each platform and a container image.
 
-    $ docker run -p 8888:8888 -p 9999:9999/udp ghcr.io/kilianc/rtail
+    $ docker run -p 8888:8888 -p 9999:9999/udp ghcr.io/kilianc/rtail:next
 
 Or take the binary for your platform from the
 [releases page](https://github.com/kilianc/rtail/releases) — `linux_amd64`,
@@ -70,14 +96,40 @@ The client is a UNIX pipe and belongs on the host whose output you are tailing,
 not in the container. It is a single Go binary, about 2.6 MB, with no runtime
 of any kind:
 
-    # already in the release tarball, next to rtail-server
-    $ tar -xzf rtail_2.0.0_darwin_arm64.tar.gz && sudo mv rtail /usr/local/bin
+    # the short way
+    $ curl -fsSL https://raw.githubusercontent.com/kilianc/rtail/main/install.sh | sh
+
+    # or take the tarball yourself — it is what the line above downloads
+    $ tar -xzf rtail_2.0.0-rc.3_darwin_arm64.tar.gz
+    $ sudo mv rtail_2.0.0-rc.3_darwin_arm64/rtail /usr/local/bin
 
     # or, if you have Go
     $ go install github.com/kilianc/rtail/v2/cmd/rtail@latest
 
     # or, if you are already standing in a project
-    $ npm install -g rtail
+    $ npm install -g rtail@next
+
+**While 2.0 is a release candidate, two of those four need telling.** GitHub's
+"latest release" skips prereleases, so the plain `install.sh` stops and asks
+for `RTAIL_PRERELEASE=1`; and npm's `latest` tag still points at `0.2.1` — the
+v1 Node client — so a plain `npm install -g rtail` quietly hands you that:
+
+    $ curl -fsSL https://raw.githubusercontent.com/kilianc/rtail/main/install.sh | RTAIL_PRERELEASE=1 sh
+    $ npm install -g rtail@next
+
+`go install …@latest` needs nothing: there is no `v2` release tag yet, so Go
+resolves it to the newest prerelease. Taking the tarball by name needs nothing
+either. When `2.0.0` is tagged, all four plain forms are correct.
+
+[`install.sh`](install.sh) detects your platform, checks the download against
+the release's own `checksums.txt` and refuses to continue on a mismatch,
+installs one binary into `/usr/local/bin` — or `~/.local/bin` if that is not
+writable, because a script piped from the internet should not be the thing
+that asks for your password — and touches nothing else. It never calls `sudo`
+and never edits your shell profile. `RTAIL_VERSION`, `RTAIL_INSTALL_DIR` and
+`RTAIL_SERVER=1` override the obvious things. It is a hundred lines of POSIX
+sh; `curl -fsSL https://raw.githubusercontent.com/kilianc/rtail/main/install.sh | less` reads the whole of it,
+and doing that before you pipe anything into `sh` is a good habit generally.
 
 The npm route is a convenience, not a dependency: the package holds a short
 launcher and one optional dependency per platform, each carrying a prebuilt
@@ -92,11 +144,6 @@ anywhere, the server does not.
 
 ## The explorer
 
-![The rTail explorer](docs/media/explorer.png)
-
-*A spike of upstream timeouts, twenty minutes back: `level>=WARN` on the `api`
-stream, with `service`, `latency_ms` and `region` promoted to columns.*
-
 **One filter drives everything.** Type it and the live tail narrows — the
 server compiles the same rQL to a predicate over the ingest stream. Switch to
 history and the same query runs against Parquet. Same semantics either way,
@@ -141,14 +188,20 @@ indistinguishable once stored, whichever door it came through.
     $ node server.js 2>&1 | rtail --id api.example.com
 
 **HTTP**, for anything that would mind losing a line. UDP is at-most-once and
-capped at one datagram; this acknowledges, so a 200 means the records are in
-the write-ahead log and anything else is safe to retry:
+capped at one datagram; this acknowledges. With `--data`, a 200 means every
+line has been fsynced to the write-ahead log. Without it the server keeps only
+its in-memory ring, and a 200 means the lines were received, not stored:
 
-    $ curl -XPOST localhost:8888/v1/ingest?stream=api --data-binary @- <<'JSON'
+    $ curl -XPOST 'localhost:8888/v1/ingest?stream=api' --data-binary @- <<'JSON'
     {"level":"error","msg":"upstream timeout","service":"api","latency_ms":30004}
     a plain line works too
     JSON
 
+Anything else may arrive after part of the batch was already stored — a store
+that fails halfway through is a 503, a body past `--max-body-mb` a 413 — so
+every response says how many lines it `accepted`, and those first lines are
+durable. Resume after them rather than replaying the batch.
+
 Newline-delimited JSON or plain text — the content type is not consulted,
 because the normalizer already decides per line what it is looking at. `gzip`
 and `zstd` bodies are decoded.
@@ -161,15 +214,21 @@ with a config line and no code change:
         logs_endpoint: http://rtail:8888/v1/logs
 
 `service.name` becomes the stream, log and resource attributes become fields,
-and `trace_id`/`span_id` are promoted so correlation actually works.
+and `trace_id`/`span_id` are promoted so correlation actually works. A 200
+here promises what it does on `/v1/ingest`.
 
 **Syslog**, RFC5424 and RFC3164, UDP and TCP on the same port:
 
-    $ rtail-server --data ./logs --syslog-port 5140
+    $ rtail-server --data ./logs --syslog-host 0.0.0.0 --syslog-port 5140
 
     # rsyslog.conf
     *.* @@rtail-host:5140;RSYSLOG_SyslogProtocol23Format
 
+`--syslog-host` defaults to `--udp-host` — loopback, unless you moved it — so
+a remote rsyslog needs the `0.0.0.0`. Syslog carries no token: `--auth-token`
+covers HTTP only, and nothing refuses this bind without one, so off loopback
+you are trusting your network.
+
 APP-NAME becomes the stream, the priority becomes a real severity — so
 `level>=ERROR` works on syslog without anyone writing a parser — and RFC5424
 structured data is promoted to fields.
@@ -213,7 +272,7 @@ There are many log aggregation tools out there, but few of them are realtime. **
     $ rtail-server --data ./logs
 
 Point `--data` at a directory and every line is written to Parquet. Without it,
-rTail is what it always was: an in-memory ring, nothing on disk, nothing to
+rtail is what it always was: an in-memory ring, nothing on disk, nothing to
 clean up.
 
 **There is no schema to define.** The envelope — timestamp, stream, level,
@@ -230,7 +289,7 @@ reconcile by name at read time.
       wal/
       streams/api.example.com/2026/08/11/L0-…parquet
 
-which means any tool reads them, with rTail uninstalled and nothing exported:
+which means any tool reads them, with rtail uninstalled and nothing exported:
 
     $ duckdb -c "
         SELECT a_service, count(*)
@@ -311,11 +370,15 @@ so `status=200` is the number and `status="200"` is the string.
 
 **Raw SQL**, for everything else:
 
-    curl -XPOST localhost:8888/v1/sql -d '{
-      "sql": "SELECT a_service, count(*) n, quantile_cont(a_latency_ms, 0.95) p95
-              FROM logs WHERE level = '"'"'ERROR'"'"' GROUP BY 1 ORDER BY n DESC",
+    $ curl -XPOST localhost:8888/v1/sql --data-binary @- <<'JSON'
+    {
+      "sql": "SELECT a_service, count(*) n, quantile_cont(a_latency_ms, 0.95) p95 FROM logs WHERE level = 'ERROR' GROUP BY 1 ORDER BY n DESC",
       "from": "-6h"
-    }'
+    }
+    JSON
+
+The query is one line because JSON strings cannot hold a raw newline; write
+`\n` if you want the SQL to keep its shape.
 
 `logs` is a view over the pruned files. The query runs read-only in a DuckDB
 sandbox that can see nothing but your data directory.
@@ -375,9 +438,11 @@ For fun and debugging:
 
 ## `rtail-server(1)`
 
-`rtail-server` receives all messages broadcast from every `rtail` client, displaying all incoming log streams in a realtime web view. **Under the hood it is a single static Go binary with the webapp embedded, pushing every incoming UDP message to the browser over server-sent events.**
+`rtail-server` receives all messages broadcast from every `rtail` client, displaying all incoming log streams in a realtime web view. **Under the hood it is a single Go binary with the webapp embedded, pushing every incoming UDP message to the browser over server-sent events.**
 
-There is little to no configuration – The default UDP/HTTP ports can be changed, but that's it.
+Everything is a flag, or the same name as an `RTAIL_*` environment variable.
+The defaults are chosen so that `rtail-server` with no arguments is the v1
+behaviour: both listeners on loopback, an in-memory ring, nothing on disk.
 
 ## Examples
 
@@ -397,34 +462,63 @@ Open your browser and start tailing logs!
 
 ## Params
 
-    $ rtail-server --help
-    Usage: rtail-server [OPTIONS]
+`rtail-server --help` prints the lot. Grouped by what they touch:
 
-    Every option is also settable as RTAIL_*, e.g. RTAIL_WEB_PORT.
+**Listening**
 
-      -udp-host string   the listening UDP hostname     (default "127.0.0.1")
-      -udp-port int      the listening UDP port         (default 9999)
-      -web-host string   the listening HTTP hostname    (default "127.0.0.1")
-      -web-port int      the listening HTTP port        (default 8888)
-      -backlog int       lines of history kept per stream (default 100)
-      -data string       directory for durable storage  (unset: memory only)
-      -web-root string   serve the webapp from this directory instead of the binary
-      -auth-token string require this bearer token on the API and webapp
-      -tls-cert string   serve HTTPS with this certificate (PEM)
-      -tls-key string    the private key for --tls-cert (PEM)
-      -insecure          allow a non-loopback address with no --auth-token
-      -verbose           log at debug level
-      -version           print the version and exit
+| flag | default | |
+|---|---|---|
+| `--web-host` | `127.0.0.1` | HTTP listen address |
+| `--web-port` | `8888` | HTTP port |
+| `--udp-host` | `127.0.0.1` | UDP listen address |
+| `--udp-port` | `9999` | UDP port |
+| `--syslog-host` | `--udp-host` | syslog listen address |
+| `--syslog-port` | `0` | syslog on this port, UDP and TCP; `0` disables it |
+
+**Storage** — see [Storage](#storage)
+
+| flag | default | |
+|---|---|---|
+| `--data` | unset | directory for durable storage; unset is memory only |
+| `--backlog` | `100` | lines of live history kept per stream |
+| `--compact-interval` | `5m` | how often to compact; `0` disables it |
+| `--cluster-by` | `level` | leading sort column for daily files; empty is time only |
+| `--retention` | `0` | delete data older than this; `0` keeps it forever |
+| `--retention-raw` | `0` | drop the original line after this, keeping the columns |
+| `--downsample-after` | `0` | discard low-severity records older than this |
+| `--downsample-level` | `WARN` | the lowest severity `--downsample-after` keeps |
+
+**Ingest**
+
+| flag | default | |
+|---|---|---|
+| `--ingest-stream` | `http` | stream for HTTP records that name none |
+| `--max-body-mb` | `32` | largest accepted ingest request |
 
-The v1 short aliases still work: `--uh`, `--up`, `--wh`, `--wp`, `-b`.
+**Access** — see [Authentication](#authentication)
 
-Every option can also be set as an environment variable, prefixed with
-`RTAIL_` — `RTAIL_WEB_PORT=8080`, `RTAIL_BACKLOG=500`, and so on. This is how
-the container image is configured.
+| flag | default | |
+|---|---|---|
+| `--auth-token` | unset | require this bearer token on the HTTP API and webapp |
+| `--insecure` | off | allow a non-loopback address with no `--auth-token` |
+| `--tls-cert`, `--tls-key` | unset | serve HTTPS; both or neither |
+
+**Everything else**
+
+| flag | default | |
+|---|---|---|
+| `--web-root` | unset | serve the webapp from this directory instead of the binary |
+| `--verbose` | off | log at debug level |
+| `--version` | | print the version and exit |
+
+Each one is also an environment variable, upper-cased and prefixed with
+`RTAIL_` — `RTAIL_WEB_PORT=8080`, `RTAIL_BACKLOG=500`,
+`RTAIL_DATA=/data`. That is how the container image is configured.
+The v1 short aliases still work too: `--uh`, `--up`, `--wh`, `--wp`, `-b`.
 
 Note that `--backlog` is about the *live view* — how many recent lines a
-freshly opened browser tab is handed. It has nothing to do with how much is
-kept on disk, which is everything until retention exists.
+freshly opened browser tab is handed. How much is kept on disk is
+`--retention`'s business, and is unlimited until you set it.
 
 ## API
 
@@ -433,7 +527,7 @@ The webapp is a client of a small documented API, so anything else can be too:
 | endpoint | what it does |
 |---|---|
 | `GET /v1/streams` | every known stream |
-| `GET /v1/tail?stream=<name>` | SSE feed: `streams`, `backlog`, then `line` events. Omit `stream` to watch the stream list only |
+| `GET /v1/tail?stream=<name>` | SSE feed: `streams`, `backlog`, then `line` events. Omit `stream` to tail every stream at once, backlog merged |
 | `GET /v1/search` | matching records, keyset-paginated |
 | `GET /v1/histogram` | match counts over time, split by severity |
 | `GET /v1/fields?field=<name>` | the most common values of a field, within the current filter |
@@ -441,10 +535,10 @@ The webapp is a client of a small documented API, so anything else can be too:
 | `POST /v1/sql` | read-only SQL over a `logs` view |
 | `POST /v1/ingest` | NDJSON or plain lines, optionally gzip/zstd |
 | `POST /v1/logs` | OTLP logs, protobuf or JSON |
-| `GET /healthz` | version, stream count, per-receiver ingest counters |
+| `GET /healthz` | version, stream count, store size, per-receiver ingest counters |
 
 The search endpoints share their parameters: `q` (filter), `stream`, `from` and
-`to` (RFC3339, epoch millis, or a relative `-6h`), `limit`, `cursor`, `order`.
+`to` (RFC3339, epoch millis, or a relative `-6h` or `-7d`), `limit`, `cursor`, `order`.
 They return 503 with an explanation when the server is running without
 `--data`, since there is nothing to search.
 
@@ -465,13 +559,16 @@ as a header; browsers sign in once and get a cookie.
 
 `X-Rtail-Token` works too, for clients that reserve `Authorization`. In a
 browser, opening the server without one gives you a sign-in form, and
-`https://logs.example.com/?token=…` signs you in from a link — the token is
-spent immediately and redirected out of the address bar so it does not end up
-in your history.
+`https://logs.example.com/?token=…` signs you in from a link. It is the shared
+token itself, not a one-time code, so treat the link as the secret it is: the
+server sets the cookie and redirects the token out of the address bar so it
+does not end up in your history or a bookmark.
 
 `/healthz` is deliberately left open, so a container healthcheck or a load
-balancer keeps working without being handed the secret. It reports liveness
-and stream names; everything that could show a log line is behind the token.
+balancer keeps working without being handed the secret. It reports liveness,
+the version and a handful of numbers — how many streams, how much is stored,
+what each receiver has counted — and never a name; everything that could show
+a log line is behind the token.
 
 **Running with no token is refused on any address but loopback.** This is the
 one rule the server enforces on your behalf:
@@ -484,7 +581,7 @@ Pass `--insecure` if something in front of it handles access. Nothing stops
 you; it just will not happen by accident.
 
 What this deliberately is not: accounts, roles, OIDC, SAML, or per-stream
-permissions. rTail is a single-node tool, and anyone who needs those already
+permissions. rtail is a single-node tool, and anyone who needs those already
 has a reverse proxy that does them properly.
 
 **Two holes worth knowing about.** UDP ingest is unauthenticated, because UDP
@@ -504,8 +601,8 @@ a certificate is the one thing every reverse proxy already solves.
 
 Note there are two images, and they are not the same thing:
 [`Dockerfile`](Dockerfile) is the server you deploy, and
-[`tools/Dockerfile`](tools/Dockerfile) below is the development toolchain,
-which mounts your checkout.
+[`tools/Dockerfile`](tools/Dockerfile) is the development toolchain, which
+mounts your checkout.
 
 The toolchain lives in a container ([`tools/Dockerfile`](tools/Dockerfile)), so Docker is
 the only thing you need installed — no Node.js, no Go, no npm, no global CLIs.
@@ -532,13 +629,17 @@ To leave it running in the background instead:
 Other targets:
 
     $ make server     # build bin/rtail-server
+    $ make client     # build bin/rtail
     $ make release    # build the self-contained server, webapp embedded
     $ make build      # build the webapp into app/ (development)
     $ make dist       # build the minified webapp into web/dist
-    $ make test       # run the Go and Node test suites
+    $ make ci         # everything CI runs, before you spend a runner minute
+    $ make test       # go test -race ./...
     $ make vet        # go vet
     $ make fmt        # gofmt the Go sources
     $ make typecheck  # type-check the webapp
+    $ make npm-pack   # lay out the npm packages under dist/npm
+    $ make screenshots # retake the screenshot at the top of this README
     $ make shell      # open a shell inside the toolchain container
     $ make clean      # remove generated assets, binaries and dependencies
 
@@ -553,9 +654,14 @@ receives a log line.
 `make url` reports the current one. Override with `make dev PORT=9000
 UDP_PORT=9001`.
 
-If you do have a Node.js toolchain on your machine, the same targets are plain
-npm scripts — `npm install && npm run dev`. Node builds the webapp and is not
-in the product: the server embeds the bundle, and the client is a Go binary.
+If you have Node on your machine, the webapp targets are plain npm scripts —
+`npm install`, then `npm run build`, `npm run dist`, `npm run typecheck`.
+`npm run dev` also spawns `bin/rtail-server` and `bin/rtail`, so it needs Go
+as well, to build those two for your machine. `make server client` is not a
+substitute on a Mac: both build inside the Linux toolchain container, so what
+lands in `bin/` is a Linux binary — right for `make dev`, which runs there, and
+not something macOS will start. Node builds the webapp and is not in the
+product: the server embeds the bundle, and the client is a Go binary.
 
 ### The stack
 
@@ -563,9 +669,9 @@ in the product: the server embeds the bundle, and the client is a Go binary.
 | --- | --- |
 | Client | Go, one static binary, [json5](https://github.com/titanous/json5) its only dependency |
 | Server | Go + [DuckDB](https://duckdb.org) + [parquet-go](https://github.com/parquet-go/parquet-go) |
-| Webapp | [Preact](https://preactjs.com) + TypeScript, ~33 KB gzipped |
+| Webapp | [Preact](https://preactjs.com) + TypeScript, ~31 KB of JS and ~13 KB of CSS, gzipped |
 | Build | [esbuild](https://esbuild.github.io); the stylesheets are plain CSS |
-| Tests | `go test ./...` |
+| Tests | `go test -race ./...` |
 
 The webapp has no framework runtime beyond Preact: routing, preferences,
 popovers, and timestamp formatting are a few dozen lines each over the
@@ -573,22 +679,29 @@ platform (`history`, `localStorage`, `Intl`) rather than dependencies.
 
 # How to contribute
 
-This project follows the awesome [Vincent Driessen](http://nvie.com/about/) [branching model](http://nvie.com/posts/a-successful-git-branching-model/).
-
-* You must add a new feature on its own branch
-* You must contribute to hot-fixing, directly into the master branch (and pull-request to it)
+There is one long-lived branch, `main`. Work on a branch of your own and open
+a pull request against it. Releases are cut by pushing a `v*` tag — the
+version in `package.json` has to match it, or the release fails before it
+publishes anything.
 
-The test suite is `make test`, which is `go test -race ./...` inside the
-toolchain image. Use it to check whether your contribution breaks some part of
-the library, and be sure to add new tests for each new feature.
+Before you push, run what CI runs:
 
-    $ make test
+    $ make ci
 
-The webapp is TypeScript; please keep it type-clean:
+That is the same [`tools/ci.sh`](tools/ci.sh) the workflow calls, so a green
+run here is a green run there — `go vet`, `gofmt`, `go test -race ./...`,
+shellcheck on `install.sh`, the webapp typecheck and production build, the npm
+packaging smoke-tested through real tarballs, and the container image. The two
+things it cannot cover are the macOS server build and the Node 20 webapp
+build, because both need a second machine.
 
-    $ make typecheck
+`make` builds the toolchain image only when there is none, so after a change
+to [`tools/Dockerfile`](tools/Dockerfile), `docker build -t rtail-tools tools/`
+brings yours level with CI's.
 
-CI runs both, plus the production build, on Node 20 and 22.
+Add tests with each new feature, and keep the webapp type-clean — `make
+typecheck` on its own is the quick version. CI builds the webapp on Node 20
+and 22.
 
 ## Contributors
 
@@ -600,10 +713,6 @@ CI runs both, plus the production build, on Node 20 and 22.
 
 ## Roadmap (aka where you can help)
 
-* Optional HTTP basic auth on the web port, and a shared secret on UDP ingest.
-  Full OAuth ([#44](https://github.com/kilianc/rtail/issues/44)) needs a user
-  model and session storage, which is a lot of machinery for a tool with no
-  persistence layer — basic auth covers the actual risk.
 * A catch-all docker logs image: watch `docker events`, pipe every container's
   `docker logs -f` into a stream named after it.
 * Broaden the test suite, particularly around the UDP ingest path.
@@ -616,6 +725,13 @@ Dropped, and why:
   than DockerHub, since it needs no separate account or secrets.
 * ~~Write a rock solid test suite~~ — a suite exists and runs in CI. Deepening
   it is the open item above.
+* ~~Optional HTTP basic auth on the web port~~ — done, though as one shared
+  bearer token rather than basic auth; see
+  [Authentication](#authentication). Full OAuth
+  ([#44](https://github.com/kilianc/rtail/issues/44)) is still declined: it
+  needs a user model and session storage, which is a lot of machinery for a
+  single-node tool. A shared secret on UDP ingest is the one part that cannot
+  be done — the v1 wire format is frozen and has nowhere to carry one.
 * ~~Allow use of DTLS~~ — the linked PR was against `joyent/node`, a repo that
   no longer exists, and Node core still has no DTLS. Run rtail over WireGuard
   or Tailscale instead; that is the modern answer to this problem.
@@ -625,7 +741,7 @@ Dropped, and why:
   which contradicts the design. `--backlog` covers the useful part.
 
 ## Sponsors
-❤ rTail? Consider sponsoring this project to keep it alive and free for the community.
+❤ rtail? Consider sponsoring this project to keep it alive and free for the community.
 
 * ? (wildcard TLS cert)
 * ? (.io domain)
@@ -634,7 +750,7 @@ Dropped, and why:
 
 ## License
 
-rTail is licensed under the **Apache License 2.0** — see [`LICENSE`](LICENSE)
+rtail is licensed under the **Apache License 2.0** — see [`LICENSE`](LICENSE)
 and [`COPYRIGHT.md`](COPYRIGHT.md).
 
 Run it, modify it, ship it inside your own product, commercially, at any
@@ -642,7 +758,7 @@ scale. Keep the notice, say what you changed, and the patent grant in §3
 covers you. There is nothing to buy and no feature held back for a paid tier,
 because there is no paid tier.
 
-rTail **v1.x remains under the MIT licence** it was released with. That does
+rtail **v1.x remains under the MIT licence** it was released with. That does
 not change retroactively; if you are on v1, the terms you accepted still
 apply. v2 spent part of its life under AGPL-3.0; that is reversed, and
 [`COPYRIGHT.md`](COPYRIGHT.md) has the reasoning.

package/bin/rtail.js

@@ -30,6 +30,7 @@
  */
 
 const { spawnSync } = require('node:child_process')
+const { constants } = require('node:os')
 
 // Go and Node spell the same architectures differently.
 const PLATFORMS = {
@@ -88,4 +89,9 @@ if (result.error) {
 
 // A child killed by a signal has a null status; 128 + signal is the shell's
 // convention for reporting that, and exiting 0 would claim it succeeded.
-process.exit(null === result.status ? 1 : result.status)
+if (null === result.status) {
+  const number = constants.signals[result.signal]
+  process.exit(number ? 128 + number : 1)
+}
+
+process.exit(result.status)

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "rtail",
-  "version": "2.0.0-rc.2",
+  "version": "2.0.0-rc.3",
   "description": "Terminal output to the browser in seconds, using UNIX pipes.",
   "keywords": ["log", "logging", "logio", "logs", "tail", "udp"],
   "bin": { "rtail": "bin/rtail.js" },
-  "files": ["bin"],
+  "files": ["bin", "NOTICE"],
   "engines": { "node": ">=20" },
   "optionalDependencies": {
-    "@rtail/linux-x64": "2.0.0-rc.2",
-    "@rtail/linux-arm64": "2.0.0-rc.2",
-    "@rtail/darwin-x64": "2.0.0-rc.2",
-    "@rtail/darwin-arm64": "2.0.0-rc.2",
-    "@rtail/win32-x64": "2.0.0-rc.2"
+    "@rtail/linux-x64": "2.0.0-rc.3",
+    "@rtail/linux-arm64": "2.0.0-rc.3",
+    "@rtail/darwin-x64": "2.0.0-rc.3",
+    "@rtail/darwin-arm64": "2.0.0-rc.3",
+    "@rtail/win32-x64": "2.0.0-rc.3"
   },
   "repository": {
     "type": "git",