feat(daemon): agent-readable retrieval path for activity-divergence probe (lr-8b476f) - #404
Conversation
… probe (lr-8b476f) Adds a get_activity_diagnostics command on the existing daemon.sock Unix IPC socket, reading the same shared module-level counter the WS-only process_stats handler already folds into its response (lib/sdk-bridge.js's getActivityDivergenceStats). No new auth surface: gated by the same filesystem permissions (chmod 0700 CONFIG_DIR) every other IPC command already relies on, and does not copy process_stats's missing role gate (lr-2016fe). buildActivityDiagnosticsResponse() is factored into lib/sdk-bridge.js (not inlined in daemon.js, which has no module.exports and cannot be required in-process without binding real sockets) so the response shape is directly unit-testable.
Prints the activity-divergence probe totals as JSON to stdout via lib/cli/ipc-subcommands.js's handleActivityDiagnostics, mirroring handleList's existing IPC-subcommand pattern. This is the exact command a Bash-only crew agent runs: clagentic-console --activity-diagnostics No devtools, no browser, no WS client, no interactive session required.
…e data (lr-8b476f) Regression tests for the get_activity_diagnostics IPC command / --activity-diagnostics CLI subcommand. Test 1 constructs a genuine divergence via a real idle-reaper tick and asserts buildActivityDiagnosticsResponse() reflects it exactly (not a stubbed/hardcoded shape) -- stash-verified to fail on pre-fix code (TypeError: not a function, since the response builder did not exist), not merely asserted to fail. Test 2 confirms no sessionId leaks through this second retrieval path, matching process_stats's BOBBIE-remediated shape. Tests 3-5 confirm the daemon.js IPC case and CLI wiring call the shared, tested function rather than a hand-duplicated inline copy.
…IPC path (lr-8b476f) Adds a subsection under 'CLI <-> Daemon' naming the exact command a Bash-only agent runs (clagentic-console --activity-diagnostics), the response shape, and the auth posture (filesystem-permission-gated via the existing chmod 0700 CONFIG_DIR, not a new per-command check).
|
BOBBIE security audit of PR #404 (lr-8b476f), base 308a400..HEAD bd4d968. Scope: new agent-readable IPC retrieval path (get_activity_diagnostics) for the activity-divergence probe merged in PR #403 (lr-58c813). Files: lib/sdk-bridge.js (buildActivityDiagnosticsResponse), lib/daemon.js (IPC case), lib/cli/ipc-subcommands.js + bin/cli.js (--activity-diagnostics CLI), test/activity-diagnostics-retrieval-lr-8b476f.test.js, docs/guides/architecture.md.
lr-c4da07: no reference found in this repo's LORE or in the PR diff/commits -- orthogonal by absence of any connection. Zero findings. No rule in RULEBOOK.md is triggered by this diff. scanners_run: gitleaks (ok, 0 findings), trufflehog (ok, 0 findings), semgrep --config=auto (ok, 6 hits all pre-existing/out-of-scope), osv-scanner (ok, 80 pre-existing findings, zero lockfile diff in this PR) |
|
PEACHES — clean (0 findings)
|
|
Merged via clagentic-loadout v0.2.0
|
What
Adds an agent-readable retrieval path for the lr-58c813 server-side activity-divergence probe, closing lr-8b476f: the probe (lib/sdk-bridge.js) was previously reachable ONLY through the process_stats WebSocket message (lib/project-sessions.js:668-709), which requires a live WS client -- unreachable by a read-only crew agent holding Bash+Read only (MILLER was dispatched twice and could not read it; the operator was then asked to open devtools himself).
Shape chosen: (b) an authenticated local endpoint on the existing daemon.sock Unix IPC socket
Adds a new get_activity_diagnostics command to the daemon existing IPC dispatch (lib/daemon.js), alongside get_status, add_project, etc. -- the same channel bin/cli.js already uses for --list/--shutdown/--restart.
Why (b) over (a) (a JSON file under ~/.clagentic/ on the reaper tick) and (c) (a periodic log line):
What I gave up: (b) requires the daemon to be reachable via its socket file, which means a Bash-only agent needs the CLI binary (or equivalent socket-speaking client) rather than being able to cat a plain file. Traded for zero new auth/rate-limit surface, which given lr-2016fe adjacent finding (a sibling handler ungated) felt like the safer default: a stricter, already-audited gate for the new surface rather than inventing a new one.
The exact command a Bash-only agent runs
clagentic-console --activity-diagnostics
Prints JSON to stdout with fields activeLiveCount, activityDivergenceCount, activityDivergenceRecentSamples.
Documented in docs/guides/architecture.md under a new Agent-readable diagnostics over IPC subsection.
Auth posture of the new path (explicit, per dispatch brief)
Read-only, mutates nothing. Gated by filesystem permissions on CONFIG_DIR (chmod 0700), the SAME gate every other IPC command on daemon.sock already relies on -- no new auth surface introduced, and nothing copied from process_stats WS gap (lr-2016fe, deliberately NOT touched here): this is a different transport with its own, stricter, already-existing OS-level gate rather than an unaudited role check. lr-2016fe remains open and unresolved by this PR, as scoped.
Samples carry no session-identifying field -- reads the exact same BOBBIE-remediated shape (ts, rawIsProcessing, derivedIsActive, hasQueryInstance) that lib/sdk-bridge.js _recordActivityDivergenceIfAny already produces for process_stats. No identifying context was judged necessary or added back.
What was explicitly NOT done (scope conflict, reported per dispatch brief)
The CLIENT-side ledger (window.__clagenticActivityLedger accessor, lib/public/modules/activity-latch.js) is fundamentally out of reach for any server-side/file/IPC retrieval path: it is a plain in-memory object living in one browser tabs JS heap, reset on page load, with no persistence and no channel back to the server. There is no shape (file, IPC, log line) that could expose it without the browser itself pushing it somewhere -- that would be a new feature (e.g. periodically reporting the ledger to the server), not a retrieval-path fix, and was out of scope per the dispatch briefs instruction not to change what the probes measure or how they sample. Flagging this explicitly rather than silently leaving it unaddressed: closing the client-ledger gap, if wanted, needs a follow-up task with its own design (e.g. the client periodically reporting the ledger over the existing WS channel), not bundled here.
Scope discipline
Tests
1469/1469 pass (npm test), new tests individually confirmed present and passing in raw TAP output (not inferred from exit code alone -- this repos harness was fail-open until 863f359).
test/activity-diagnostics-retrieval-lr-8b476f.test.js: 5 new tests.
Two pre-existing, environment-timing-sensitive failures were observed across repeated runs in this sandbox and are NOT introduced by this diff: test/daemon-bootstrap-guard.test.js EX_CONFIG subprocess-spawn test, and separately lr-e33776 unauthed-asset test -- both are subprocess-spawn-based tests that timed out (5000ms) on different runs of the SAME unmodified pre-fix checkout (confirmed via git stash), never together, and neither touches any file in this diffs blast radius (bin/cli.js, lib/daemon.js, lib/sdk-bridge.js, lib/cli/ipc-subcommands.js, docs/guides/architecture.md). Final pre-push run: 1469/1469 pass, 0 failures.
TASK: lr-8b476f