feat(gc): replace long-running supervisor with cron-driven `pty gc`
The launchd-managed `pty-supervisor` daemon raced /Volumes/SSD's mount
on Mac boot: permanent sessions whose `dist/server.js` lived under the
external volume failed restart with MODULE_NOT_FOUND, exhausted 5
retries x 2s backoff within 10s, then were marked "no metadata" and
never came back without manual `pty up`. A long-running supervisor will
always have this class of bug — it can't be sure its dependencies are
ready when launchd fires it.
Replace it with a stateless reconciliation pass:
pty gc
invoked periodically by launchd (`StartInterval=30` by default) or any
other cron-driver. Three steps:
1. Orphan-children: sessions tagged `parent=<name>` whose parent's
metadata is gone OR whose parent's pid isn't alive get SIGTERM'd
and cleaned up. New user-facing tag.
2. Permanent respawn: every `strategy=permanent` session that's
exited/vanished is respawned via `spawnDaemon`. Sessions tagged
`ptyfile` re-read pty.toml to pick up edits.
3. Sweep: exited/vanished non-permanent sessions get `cleanupAll`'d
(the historic gc behavior).
Each run is independent — no persistent restart bookkeeping, no
MAX_RESTARTS, no backoff state to drift out of sync with reality.
Cron interval IS the rate limit; if /Volumes/SSD isn't mounted, the
invocation exits with ENOENT and the next tick tries again.
Install helper: `pty gc --print-launchd-plist [--interval=N]` prints
a minimal plist to stdout. No FDA wrapper, no compiled C binary, no
esbuild bundling — `<ProgramArguments>[pty, gc]</ProgramArguments>`
with `<StartInterval>`. User redirects to ~/Library/LaunchAgents/
and `launchctl load`s themselves.
Breaking changes:
- Deleted `pty supervisor *` commands entirely. Users who installed
the old supervisor should `launchctl unload` + remove the old
plist (see CHANGELOG for the exact commands).
- Deleted event types `session_restart`, `session_failed`,
`supervisor_start`, `supervisor_stop`. Added `session_respawn`.
- Deleted reserved tag `supervisor.status`. Added user-facing tag
`parent=<name>`.
- Dropped `strategy=temporary` (was functionally identical to no
strategy tag under the new sweep behavior).
- `gc()`'s return shape changed from `string[]` to a structured
`GcResult` with four buckets (`removed`, `killedOrphanChildren`,
`respawned`, `respawnFailed`). Public API.
Net delta: ~1830 lines deleted, ~485 added.
feat(gc): reap abandoned permanent daemons — cwd-gone + idle-days (#50)
Adds a new `pty gc` step 1.5 between orphan-kill (step 1) and permanent
respawn (step 2) that reaps live `strategy=permanent` sessions detected
as abandoned. Fixes #47.
Two reap shapes today:
- cwd-gone (on-by-default) — the session's recorded cwd no longer
resolves on disk (fs.statSync throws ENOENT). Strong low-false-
positive signal. Escape hatch: `strategy.abandon-if-cwd-gone=false`
tag opts a session out.
- idle (opt-in) — the session's lastAttachAt is older than the
configured threshold. Enabled via `pty gc --idle-days N` (global)
or a per-session `strategy.idle-days=N` tag (per-session wins).
Sessions with no lastAttachAt (never attached) are excluded — a
session just spawned but never used isn't "idle."
cwd-gone takes precedence over idle when both fire (cwd is the stronger
signal). Reaps SIGTERM the daemon, append a `session_abandoned` event
BEFORE cleanupAll unlinks the events file, then cleanupAll.
Public surface changes:
- SessionMetadata gains `lastAttachAt?: string` (ISO 8601), written by
the daemon on every non-readonly ATTACH.
- EventType.SESSION_ABANDONED + SessionAbandonedEvent {reason, idleDays?}.
- GcResult gains `abandoned: {name, reason, idleDays?}[]`.
- CLI: `pty gc --idle-days N` flag (positive integer required; 0/neg
rejected). Output row `Abandoned: <name> (<reason>)` and dry-run
mirror `Would abandon:`. Summary counts abandoned sessions.
- Tags: `strategy.abandon-if-cwd-gone=false`, `strategy.idle-days=N`.
Docs: disk-layout.md updated with the new metadata field, event, and
tags. CHANGELOG entry under Unreleased.
Tests: 11 new in tests/gc-abandoned.test.ts covering all six paths
(cwd-gone live reap, non-permanent unaffected, opt-out tag honored,
--dry-run preview, idle reap on old lastAttachAt, under-threshold
preserved, never-attached preserved, per-session tag opt-in without
CLI flag, cwd-gone > idle precedence, flag validation) plus one
mixed-bucket test proving abandoned-reap composes with the existing
respawn/sweep in the same pass.
feat(gc): replace long-running supervisor with cron-driven `pty gc`
The launchd-managed `pty-supervisor` daemon raced /Volumes/SSD's mount
on Mac boot: permanent sessions whose `dist/server.js` lived under the
external volume failed restart with MODULE_NOT_FOUND, exhausted 5
retries x 2s backoff within 10s, then were marked "no metadata" and
never came back without manual `pty up`. A long-running supervisor will
always have this class of bug — it can't be sure its dependencies are
ready when launchd fires it.
Replace it with a stateless reconciliation pass:
pty gc
invoked periodically by launchd (`StartInterval=30` by default) or any
other cron-driver. Three steps:
1. Orphan-children: sessions tagged `parent=<name>` whose parent's
metadata is gone OR whose parent's pid isn't alive get SIGTERM'd
and cleaned up. New user-facing tag.
2. Permanent respawn: every `strategy=permanent` session that's
exited/vanished is respawned via `spawnDaemon`. Sessions tagged
`ptyfile` re-read pty.toml to pick up edits.
3. Sweep: exited/vanished non-permanent sessions get `cleanupAll`'d
(the historic gc behavior).
Each run is independent — no persistent restart bookkeeping, no
MAX_RESTARTS, no backoff state to drift out of sync with reality.
Cron interval IS the rate limit; if /Volumes/SSD isn't mounted, the
invocation exits with ENOENT and the next tick tries again.
Install helper: `pty gc --print-launchd-plist [--interval=N]` prints
a minimal plist to stdout. No FDA wrapper, no compiled C binary, no
esbuild bundling — `<ProgramArguments>[pty, gc]</ProgramArguments>`
with `<StartInterval>`. User redirects to ~/Library/LaunchAgents/
and `launchctl load`s themselves.
Breaking changes:
- Deleted `pty supervisor *` commands entirely. Users who installed
the old supervisor should `launchctl unload` + remove the old
plist (see CHANGELOG for the exact commands).
- Deleted event types `session_restart`, `session_failed`,
`supervisor_start`, `supervisor_stop`. Added `session_respawn`.
- Deleted reserved tag `supervisor.status`. Added user-facing tag
`parent=<name>`.
- Dropped `strategy=temporary` (was functionally identical to no
strategy tag under the new sweep behavior).
- `gc()`'s return shape changed from `string[]` to a structured
`GcResult` with four buckets (`removed`, `killedOrphanChildren`,
`respawned`, `respawnFailed`). Public API.
Net delta: ~1830 lines deleted, ~485 added.
list & gc ergonomics: vanished status, --summary/--status/age filters, gc --dry-run (closes #21)
Four changes, one PR:
1. Third session status `vanished` for the "daemon is gone, no exit
record written" case (SIGKILL / OOM / crash). Listed in its own
yellow-headered bucket with a warning icon so it doesn't blend into
cleanly-exited sessions. Reapable by `pty gc` like any other dead
session. TTL anchor falls back to createdAt so they can't accumulate
indefinitely.
2. `pty list --summary` (+ `--json --summary`) — compact counts and
oldest/newest pointers, respects all other filters.
3. `pty list --status <state>` and `--older-than/--newer-than <Ns|Nm|Nh|Nd>`
filters. Compose with `--filter-tag` and `--summary`. Grammar is
deliberately single-unit (no `1h30m`) to keep --help trivial.
4. `pty gc --dry-run` (`-n`) — preview what would be removed without
mutating anything. Covers exited AND vanished sessions AND orphan
`:l<pid>-<rand>` layout tags in one pass.
Client API:
- gc({ dryRun }), pruneOrphanLayoutTags({ dryRun })
- New `isGone(status)` helper — replaces hand-rolled
`status === "exited"` checks that should have included vanished all
along. Swept existing callers (run -a, peek fallback, pty up/down
cleanup, stats --all) to use it.
- New parseDuration/formatDuration exports for downstream tools.
Tests:
- duration.test.ts — full grammar coverage.
- list-filters.test.ts — vanished inference, --status, age filters,
--summary (text + json), filter composition.
- gc.test.ts — extended with --dry-run and vanished-session reaping.
726 → 728 local tests pass (+37 new), 0 failures.
feat(gc): reap abandoned permanent daemons — cwd-gone + idle-days (#50)
Adds a new `pty gc` step 1.5 between orphan-kill (step 1) and permanent
respawn (step 2) that reaps live `strategy=permanent` sessions detected
as abandoned. Fixes #47.
Two reap shapes today:
- cwd-gone (on-by-default) — the session's recorded cwd no longer
resolves on disk (fs.statSync throws ENOENT). Strong low-false-
positive signal. Escape hatch: `strategy.abandon-if-cwd-gone=false`
tag opts a session out.
- idle (opt-in) — the session's lastAttachAt is older than the
configured threshold. Enabled via `pty gc --idle-days N` (global)
or a per-session `strategy.idle-days=N` tag (per-session wins).
Sessions with no lastAttachAt (never attached) are excluded — a
session just spawned but never used isn't "idle."
cwd-gone takes precedence over idle when both fire (cwd is the stronger
signal). Reaps SIGTERM the daemon, append a `session_abandoned` event
BEFORE cleanupAll unlinks the events file, then cleanupAll.
Public surface changes:
- SessionMetadata gains `lastAttachAt?: string` (ISO 8601), written by
the daemon on every non-readonly ATTACH.
- EventType.SESSION_ABANDONED + SessionAbandonedEvent {reason, idleDays?}.
- GcResult gains `abandoned: {name, reason, idleDays?}[]`.
- CLI: `pty gc --idle-days N` flag (positive integer required; 0/neg
rejected). Output row `Abandoned: <name> (<reason>)` and dry-run
mirror `Would abandon:`. Summary counts abandoned sessions.
- Tags: `strategy.abandon-if-cwd-gone=false`, `strategy.idle-days=N`.
Docs: disk-layout.md updated with the new metadata field, event, and
tags. CHANGELOG entry under Unreleased.
Tests: 11 new in tests/gc-abandoned.test.ts covering all six paths
(cwd-gone live reap, non-permanent unaffected, opt-out tag honored,
--dry-run preview, idle reap on old lastAttachAt, under-threshold
preserved, never-attached preserved, per-session tag opt-in without
CLI flag, cwd-gone > idle precedence, flag validation) plus one
mixed-bucket test proving abandoned-reap composes with the existing
respawn/sweep in the same pass.
feat(name): decouple on-disk identifier from display label (#45)
* feat(name): decouple on-disk identifier from display label
Sessions now have a short random on-disk identifier (sock + json filename)
that is independent of the user-visible display label. This unblocks long
descriptive labels — both via `pty.toml` prefixes and via `pty run --name`
— which previously hit the macOS `sockaddr_un.sun_path` 104-byte limit.
Breaking changes
- `pty run --name <X>` now sets the displayName (any length, any printable
chars). The on-disk id is set by `--id <X>`. Both omitted → random short
id + auto-generated displayName. Both can be combined.
- `pty up` (pty.toml) gives every session a random short on-disk id. The
toml-derived `<prefix>-<sessionKey>` becomes the displayName, not the
filename. `pty up` re-run detection now matches by `(ptyfile,
ptyfile.session)` tag pair instead of by name.
- `pty.toml` gains two optional per-session fields: `id = "..."` to pin the
on-disk id and `display_name = "..."` to override the default label.
- `pty rename` validation: displayName uses the new permissive
`validateDisplayName` (≤ 500 chars, no slashes / null / newlines /
control bytes) instead of the strict `validateName` (sock-filename
charset, sock-path length). Strict validation is reserved for ids.
- `SessionMetadata.displayName` is now preserved through exit (previously
`saveExitMetadata` dropped it).
- `PtySessionDef.name` replaced by `displayName` + optional `id`;
`shortName` unchanged. External callers (`pty kill`, `peek`, `send`,
`attach`) are unaffected — they already resolved by either field via
`resolveRef`.
- `spawnDaemon`'s bundled-context fallback now passes `--id` (instead of
`--name`) to the CLI delegation path and explicitly threads
`displayName` / `--no-display-name`.
Tests
- New `tests/up-name-decouple.test.ts` covers random id, long-prefix
support, `(ptyfile, ptyfile.session)` re-run lookup, pty.toml `id` and
`display_name` overrides, and operations resolving by displayName.
- Existing tests migrated from `--name <id>` to `--id <id>` for tests
whose intent was pinning the on-disk identifier. `display-name.test.ts`
rewritten to test the new `--id` / `--name` semantics including
long-label, kernel-limit rejection, and id/name collision rejection.
Full suite green (1168 passed / 22 skipped / 1190 total).
* fix(cli): drop validateName from session-resolution paths
Long displayNames could be created via `pty run --name <long>` but
operating on them (`pty peek|send|kill|tag|events|attach|restart|rm`)
failed with the `validateName` sock-path kernel-limit error — the
strict validator was running on the user-supplied ref BEFORE
resolveRef did the lookup. The strict validator's job is to gate
on-disk id creation, not session-reference resolution.
Fix per schickling-assistant's PR #45 review:
- Drop the validateName(ref) block from 7 sites in cli.ts: attach,
peek, send, events, tag, kill, rm, cmdRestart, and tag-multi by-name
selector.
- Add resolveRef at the supervisor forget/reset dispatch sites so
cmdSupervisorForget/Reset receive a resolved name (their bodies
drop their own redundant validateName as a consequence).
- Drop the redundant validateName inside cmdRestart — its dispatcher
already resolved the ref.
validateName remains in place where it belongs: on-disk id creation
in `pty run --id`, pty.toml session id, and `pty rename` displayName
candidate paths.
Tests: 6 new regression tests in tests/display-name.test.ts covering
a 110-char displayName roundtripped through peek/send/tag/events/kill
plus the create case. Full suite: 1174 passed / 22 skipped / 0 failures.
feat(gc): reap abandoned permanent daemons — cwd-gone + idle-days (#50)
Adds a new `pty gc` step 1.5 between orphan-kill (step 1) and permanent
respawn (step 2) that reaps live `strategy=permanent` sessions detected
as abandoned. Fixes #47.
Two reap shapes today:
- cwd-gone (on-by-default) — the session's recorded cwd no longer
resolves on disk (fs.statSync throws ENOENT). Strong low-false-
positive signal. Escape hatch: `strategy.abandon-if-cwd-gone=false`
tag opts a session out.
- idle (opt-in) — the session's lastAttachAt is older than the
configured threshold. Enabled via `pty gc --idle-days N` (global)
or a per-session `strategy.idle-days=N` tag (per-session wins).
Sessions with no lastAttachAt (never attached) are excluded — a
session just spawned but never used isn't "idle."
cwd-gone takes precedence over idle when both fire (cwd is the stronger
signal). Reaps SIGTERM the daemon, append a `session_abandoned` event
BEFORE cleanupAll unlinks the events file, then cleanupAll.
Public surface changes:
- SessionMetadata gains `lastAttachAt?: string` (ISO 8601), written by
the daemon on every non-readonly ATTACH.
- EventType.SESSION_ABANDONED + SessionAbandonedEvent {reason, idleDays?}.
- GcResult gains `abandoned: {name, reason, idleDays?}[]`.
- CLI: `pty gc --idle-days N` flag (positive integer required; 0/neg
rejected). Output row `Abandoned: <name> (<reason>)` and dry-run
mirror `Would abandon:`. Summary counts abandoned sessions.
- Tags: `strategy.abandon-if-cwd-gone=false`, `strategy.idle-days=N`.
Docs: disk-layout.md updated with the new metadata field, event, and
tags. CHANGELOG entry under Unreleased.
Tests: 11 new in tests/gc-abandoned.test.ts covering all six paths
(cwd-gone live reap, non-permanent unaffected, opt-out tag honored,
--dry-run preview, idle reap on old lastAttachAt, under-threshold
preserved, never-attached preserved, per-session tag opt-in without
CLI flag, cwd-gone > idle precedence, flag validation) plus one
mixed-bucket test proving abandoned-reap composes with the existing
respawn/sweep in the same pass.
feat(gc): reap abandoned permanent daemons — cwd-gone + idle-days (#50)
Adds a new `pty gc` step 1.5 between orphan-kill (step 1) and permanent
respawn (step 2) that reaps live `strategy=permanent` sessions detected
as abandoned. Fixes #47.
Two reap shapes today:
- cwd-gone (on-by-default) — the session's recorded cwd no longer
resolves on disk (fs.statSync throws ENOENT). Strong low-false-
positive signal. Escape hatch: `strategy.abandon-if-cwd-gone=false`
tag opts a session out.
- idle (opt-in) — the session's lastAttachAt is older than the
configured threshold. Enabled via `pty gc --idle-days N` (global)
or a per-session `strategy.idle-days=N` tag (per-session wins).
Sessions with no lastAttachAt (never attached) are excluded — a
session just spawned but never used isn't "idle."
cwd-gone takes precedence over idle when both fire (cwd is the stronger
signal). Reaps SIGTERM the daemon, append a `session_abandoned` event
BEFORE cleanupAll unlinks the events file, then cleanupAll.
Public surface changes:
- SessionMetadata gains `lastAttachAt?: string` (ISO 8601), written by
the daemon on every non-readonly ATTACH.
- EventType.SESSION_ABANDONED + SessionAbandonedEvent {reason, idleDays?}.
- GcResult gains `abandoned: {name, reason, idleDays?}[]`.
- CLI: `pty gc --idle-days N` flag (positive integer required; 0/neg
rejected). Output row `Abandoned: <name> (<reason>)` and dry-run
mirror `Would abandon:`. Summary counts abandoned sessions.
- Tags: `strategy.abandon-if-cwd-gone=false`, `strategy.idle-days=N`.
Docs: disk-layout.md updated with the new metadata field, event, and
tags. CHANGELOG entry under Unreleased.
Tests: 11 new in tests/gc-abandoned.test.ts covering all six paths
(cwd-gone live reap, non-permanent unaffected, opt-out tag honored,
--dry-run preview, idle reap on old lastAttachAt, under-threshold
preserved, never-attached preserved, per-session tag opt-in without
CLI flag, cwd-gone > idle precedence, flag validation) plus one
mixed-bucket test proving abandoned-reap composes with the existing
respawn/sweep in the same pass.
feat(name): decouple on-disk identifier from display label (#45)
* feat(name): decouple on-disk identifier from display label
Sessions now have a short random on-disk identifier (sock + json filename)
that is independent of the user-visible display label. This unblocks long
descriptive labels — both via `pty.toml` prefixes and via `pty run --name`
— which previously hit the macOS `sockaddr_un.sun_path` 104-byte limit.
Breaking changes
- `pty run --name <X>` now sets the displayName (any length, any printable
chars). The on-disk id is set by `--id <X>`. Both omitted → random short
id + auto-generated displayName. Both can be combined.
- `pty up` (pty.toml) gives every session a random short on-disk id. The
toml-derived `<prefix>-<sessionKey>` becomes the displayName, not the
filename. `pty up` re-run detection now matches by `(ptyfile,
ptyfile.session)` tag pair instead of by name.
- `pty.toml` gains two optional per-session fields: `id = "..."` to pin the
on-disk id and `display_name = "..."` to override the default label.
- `pty rename` validation: displayName uses the new permissive
`validateDisplayName` (≤ 500 chars, no slashes / null / newlines /
control bytes) instead of the strict `validateName` (sock-filename
charset, sock-path length). Strict validation is reserved for ids.
- `SessionMetadata.displayName` is now preserved through exit (previously
`saveExitMetadata` dropped it).
- `PtySessionDef.name` replaced by `displayName` + optional `id`;
`shortName` unchanged. External callers (`pty kill`, `peek`, `send`,
`attach`) are unaffected — they already resolved by either field via
`resolveRef`.
- `spawnDaemon`'s bundled-context fallback now passes `--id` (instead of
`--name`) to the CLI delegation path and explicitly threads
`displayName` / `--no-display-name`.
Tests
- New `tests/up-name-decouple.test.ts` covers random id, long-prefix
support, `(ptyfile, ptyfile.session)` re-run lookup, pty.toml `id` and
`display_name` overrides, and operations resolving by displayName.
- Existing tests migrated from `--name <id>` to `--id <id>` for tests
whose intent was pinning the on-disk identifier. `display-name.test.ts`
rewritten to test the new `--id` / `--name` semantics including
long-label, kernel-limit rejection, and id/name collision rejection.
Full suite green (1168 passed / 22 skipped / 1190 total).
* fix(cli): drop validateName from session-resolution paths
Long displayNames could be created via `pty run --name <long>` but
operating on them (`pty peek|send|kill|tag|events|attach|restart|rm`)
failed with the `validateName` sock-path kernel-limit error — the
strict validator was running on the user-supplied ref BEFORE
resolveRef did the lookup. The strict validator's job is to gate
on-disk id creation, not session-reference resolution.
Fix per schickling-assistant's PR #45 review:
- Drop the validateName(ref) block from 7 sites in cli.ts: attach,
peek, send, events, tag, kill, rm, cmdRestart, and tag-multi by-name
selector.
- Add resolveRef at the supervisor forget/reset dispatch sites so
cmdSupervisorForget/Reset receive a resolved name (their bodies
drop their own redundant validateName as a consequence).
- Drop the redundant validateName inside cmdRestart — its dispatcher
already resolved the ref.
validateName remains in place where it belongs: on-disk id creation
in `pty run --id`, pty.toml session id, and `pty rename` displayName
candidate paths.
Tests: 6 new regression tests in tests/display-name.test.ts covering
a 110-char displayName roundtripped through peek/send/tag/events/kill
plus the create case. Full suite: 1174 passed / 22 skipped / 0 failures.
feat(gc): replace long-running supervisor with cron-driven `pty gc`
The launchd-managed `pty-supervisor` daemon raced /Volumes/SSD's mount
on Mac boot: permanent sessions whose `dist/server.js` lived under the
external volume failed restart with MODULE_NOT_FOUND, exhausted 5
retries x 2s backoff within 10s, then were marked "no metadata" and
never came back without manual `pty up`. A long-running supervisor will
always have this class of bug — it can't be sure its dependencies are
ready when launchd fires it.
Replace it with a stateless reconciliation pass:
pty gc
invoked periodically by launchd (`StartInterval=30` by default) or any
other cron-driver. Three steps:
1. Orphan-children: sessions tagged `parent=<name>` whose parent's
metadata is gone OR whose parent's pid isn't alive get SIGTERM'd
and cleaned up. New user-facing tag.
2. Permanent respawn: every `strategy=permanent` session that's
exited/vanished is respawned via `spawnDaemon`. Sessions tagged
`ptyfile` re-read pty.toml to pick up edits.
3. Sweep: exited/vanished non-permanent sessions get `cleanupAll`'d
(the historic gc behavior).
Each run is independent — no persistent restart bookkeeping, no
MAX_RESTARTS, no backoff state to drift out of sync with reality.
Cron interval IS the rate limit; if /Volumes/SSD isn't mounted, the
invocation exits with ENOENT and the next tick tries again.
Install helper: `pty gc --print-launchd-plist [--interval=N]` prints
a minimal plist to stdout. No FDA wrapper, no compiled C binary, no
esbuild bundling — `<ProgramArguments>[pty, gc]</ProgramArguments>`
with `<StartInterval>`. User redirects to ~/Library/LaunchAgents/
and `launchctl load`s themselves.
Breaking changes:
- Deleted `pty supervisor *` commands entirely. Users who installed
the old supervisor should `launchctl unload` + remove the old
plist (see CHANGELOG for the exact commands).
- Deleted event types `session_restart`, `session_failed`,
`supervisor_start`, `supervisor_stop`. Added `session_respawn`.
- Deleted reserved tag `supervisor.status`. Added user-facing tag
`parent=<name>`.
- Dropped `strategy=temporary` (was functionally identical to no
strategy tag under the new sweep behavior).
- `gc()`'s return shape changed from `string[]` to a structured
`GcResult` with four buckets (`removed`, `killedOrphanChildren`,
`respawned`, `respawnFailed`). Public API.
Net delta: ~1830 lines deleted, ~485 added.