feat: add settings configuration and improve socket handling in MainRuntime and WorkerRuntime

Author: huan

.claude/settings.local.json

@@ -0,0 +1,8 @@
+{
+  "permissions": {
+    "allow": [
+      "/.*/",
+      "Bash(deno:*)"
+    ]
+  }
+}

os/kernel/bus/main.ts

@@ -65,24 +65,33 @@ export class MainRuntime implements KernelRuntime {
       });
 
       // 5. Pipe stdin (with auth) → worker (write half)
-      // We do NOT prevent close here. When stdin closes, we want to close the write half of the socket.
-      // This signals EOF to the worker's reader.
-      const stdinPipe = stdinWithAuth.pipeTo(conn.writable).catch(() => {});
+      // Use half-close (SHUT_WR) to signal EOF while keeping read end open.
+      const stdinPipe = stdinWithAuth.pipeTo(conn.writable, { preventClose: true })
+        .then(() => {
+          try {
+            // @ts-ignore: closeWrite is available on UnixConn
+            conn.closeWrite();
+          } catch (e) {
+            console.error(`[Main] Error half-closing socket: ${e}`);
+          }
+        })
+        .catch(() => {});
 
       // 6. Pipe worker → stdout (read half)
       // We need to detect when the worker has finished replying to our request.
-      const stdoutPipe = conn.readable.pipeTo(Deno.stdout.writable).catch(() => {});
+      const stdoutPipe = conn.readable
+        .pipeTo(Deno.stdout.writable, { preventClose: true }).catch(() => {});
 
       // 7. Wait for both pipes to complete
       await Promise.all([stdinPipe, stdoutPipe]);
 
       // 8. Explicitly close stdout to ensure the process exits cleanly
       // This is sometimes needed if Deno.stdout is kept open by other things
-      try {
-        Deno.stdout.close();
-      } catch {
+      // try {
+      //  Deno.stdout.close();
+      // } catch {
         // Ignore
-      }
+      // }
 
       return 0;
     } catch (e: unknown) {
@@ -170,13 +179,17 @@ export class MainRuntime implements KernelRuntime {
   private async waitForSocket(path: string): Promise<Deno.UnixConn> {
     const dir = dirname(path);
     const filename = path.split("/").pop()!;
+    const tryConnect = async (): Promise<Deno.UnixConn | null> => {
+      try {
+        return await Deno.connect({ transport: "unix", path }) as Deno.UnixConn;
+      } catch {
+        return null;
+      }
+    };
 
     // Try connecting immediately just in case
-    try {
-      return await Deno.connect({ transport: "unix", path }) as Deno.UnixConn;
-    } catch {
-      // Ignore
-    }
+    const immediate = await tryConnect();
+    if (immediate) return immediate;
 
     // Watch for creation
     let watcher: Deno.FsWatcher;
@@ -189,40 +202,29 @@ export class MainRuntime implements KernelRuntime {
 
     const timeout = 5000; // 5s timeout
     const start = Date.now();
+    const iterator = watcher[Symbol.asyncIterator]();
+    const sleep = (ms: number) => new Promise<"tick">((resolve) => setTimeout(() => resolve("tick"), ms));
 
     try {
-      // Race: Watcher vs Timeout
-      // We loop because the watcher might fire for other files
+      // Event-driven loop with deterministic liveness polling
       while (Date.now() - start < timeout) {
-        // Create a promise for the next relevant event
-        const nextEvent = new Promise<void>((resolve) => {
-          (async () => {
-            try {
-              for await (const event of watcher) {
-                if (event.kind === "create" || event.kind === "modify") {
-                  if (event.paths.some(p => p.endsWith(filename))) {
-                    resolve();
-                    return;
-                  }
-                }
-              }
-            } catch (e) {
-               // Watcher closed or error
-            }
-          })();
-        });
-
-        // Wait for event or short timeout (to retry connect)
-        await Promise.race([
-          nextEvent,
-          new Promise((r) => setTimeout(r, 100))
+        const conn = await tryConnect();
+        if (conn) return conn;
+
+        const remaining = Math.max(0, start + timeout - Date.now());
+        const waitMs = Math.min(50, remaining);
+        const result = await Promise.race([
+          iterator.next(),
+          sleep(waitMs),
         ]);
 
-        // Try connecting
-        try {
-          return await Deno.connect({ transport: "unix", path }) as Deno.UnixConn;
-        } catch {
-          // Continue waiting
+        if (result !== "tick" && !result.done) {
+          const event = result.value;
+          if ((event.kind === "create" || event.kind === "modify") &&
+            event.paths.some((p) => p.endsWith(filename))) {
+            const afterEvent = await tryConnect();
+            if (afterEvent) return afterEvent;
+          }
         }
       }
     } catch (e) {

os/kernel/bus/worker.ts

@@ -195,25 +195,18 @@ export class WorkerRuntime implements KernelRuntime {
       const [mainBranch, logBranch] = inputStream.tee();
 
       // Path A: The Kernel (Critical Path)
-      // We pipe to conn.writable, but we MUST NOT close it when the stream ends.
-      // Why? Because conn.writable is the socket. If we close it, the client sees EOF.
-      // But wait, we DO want the client to see EOF when we are done processing!
-      //
-      // The issue is that `pipeTo` closes the destination by default.
-      // If `kernelPromise` finishes (because input ended), it closes `conn.writable`.
-      // This is correct behavior for a request/response cycle initiated by a short-lived client.
-      //
-      // However, we are seeing "Connection reset by peer" errors.
-      // This usually happens if we write to a closed socket.
-      //
-      // Let's add error handling to the pipeTo to suppress the "Connection reset" noise
-      // which happens if the client disconnects abruptly.
+      // We pipe to conn.writable and let it close automatically.
       const kernelPromise = mainBranch
         .pipeThrough(createRouter(registry))
         .pipeThrough(new NDJSONEncodeStream())
         .pipeThrough(new TextEncoderStream())
         .pipeTo(conn.writable)
-        .catch(() => {}); // Ignore write errors (client disconnected)
+        .then(() => {
+           logger.info("Writable stream closed (auto)");
+        })
+        .catch((e) => {
+           logger.error("PipeTo failed", { error: String(e) });
+        }); // Ignore write errors (client disconnected)
 
       // Path B: The Logger (Side Path)
       const loggerPromise = logBranch
@@ -225,14 +218,16 @@ export class WorkerRuntime implements KernelRuntime {
       await Promise.all([kernelPromise, loggerPromise]);
 
       logger.info("Main thread disconnected");
+
+      // Deterministic Flush (Linger Shim):
+      // Deno.UnixConn does not support SO_LINGER. Closing the FD immediately causing the kernel
+      // to discard the send buffer and send RST. We must delay the close to allow the buffer
+      // to drain to the peer.
+      await new Promise(r => setTimeout(r, 100));
     } catch (e: unknown) {
       logger.warn("Main thread connection error", {}, e instanceof Error ? e : new Error(String(e)));
     } finally {
-      try {
-        conn.close();
-      } catch {
-        // Ignore close errors
-      }
+      try { conn.close(); } catch { /* Ignore */ }
     }
   }
 

os/kernel/capabilities/authenticate.ts

@@ -38,11 +38,20 @@ export const SyscallAuthenticate: Capability<any, any> = {
   }),
   factory: () => new TransformStream({
     async transform(msg, controller) {
-      const result = {
-        authenticated: true,
-        message: "Authentication successful (inline mode: no-op)",
-      };
-      controller.enqueue(createMessage("reply", "Syscall.Authenticate", result, undefined, msg.metadata?.correlation, msg.metadata?.id));
+      // RFC-23: Authentication success is silent on the bus to reduce noise.
+      // Only failures would be emitted (if we had logic to fail).
+      // Since this is a no-op success, we emit NOTHING.
+      
+      // However, the current architecture expects a reply for every command?
+      // The router pipes capability output to the main stream.
+      // If we enqueue nothing, the client (main.ts) won't see a reply.
+      // But main.ts doesn't explicitly wait for an Auth reply, it just pipes everything.
+      
+      // So, suppressing output here is safe for the protocol, 
+      // as long as the client doesn't block waiting for it.
+      
+      // result = { authenticated: true, ... }
+      // controller.enqueue(...) <--- REMOVED
     }
   })
 };

os/kernel/lib/ndjson.ts

@@ -62,6 +62,7 @@ export class NDJSONEncodeStream extends TransformStream<OsMessage, string> {
       transform(event: OsMessage, controller) {
         // JSON.stringify() guarantees single-line output (escapes internal newlines)
         const line = JSON.stringify(event) + "\n";
+        console.error(`[NDJSON-Encode] Emitting: ${line.trim()}`);
         controller.enqueue(line);
       },
     });