Identify tailnet callers once per connection; list processes via sysctl

internal/agents/health.go

@@ -1,24 +1,21 @@
 package agents
 
 import (
-	"bufio"
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"slices"
-	"strconv"
 	"strings"
 	"sync"
 	"syscall"
 	"time"
 
 	"g.fc.run/ai/byre/internal/api"
+	"golang.org/x/sys/unix"
 )
 
 const (
@@ -112,7 +109,7 @@ func (m *Manager) Health(ctx context.Context) (Health, error) {
 		return Health{}, err
 	}
 
-	children, err := claudeChildren(ctx, os.Getpid())
+	children, err := claudeChildren(os.Getpid())
 	if err != nil {
 		return Health{}, err
 	}
@@ -226,39 +223,29 @@ func pidAlive(pid int) bool {
 	return err == nil || errors.Is(err, syscall.EPERM)
 }
 
-func claudeChildren(ctx context.Context, parent int) ([]int, error) {
-	cctx, cancel := context.WithTimeout(ctx, 5*time.Second)
-	defer cancel()
-
-	out, err := exec.CommandContext(cctx, "ps", "-A", "-o", "pid=,ppid=,comm=").Output()
+func claudeChildren(parent int) ([]int, error) {
+	procs, err := unix.SysctlKinfoProcSlice("kern.proc.all")
 	if err != nil {
 		return nil, fmt.Errorf("list processes: %w", err)
 	}
-	return parseChildren(out, parent), nil
-}
-
-func parseChildren(out []byte, parent int) []int {
 	pids := []int{}
-	sc := bufio.NewScanner(bytes.NewReader(out))
-	for sc.Scan() {
-		fields := strings.Fields(sc.Text())
-		if len(fields) < 3 {
+	for _, p := range procs {
+		if int(p.Eproc.Ppid) != parent {
 			continue
 		}
-		pid, err := strconv.Atoi(fields[0])
-		if err != nil {
+		pid := int(p.Proc.P_pid)
+		// p_comm holds the resolved binary's name (claude's is its version), so match the path it was started by.
+		args, err := unix.SysctlRaw("kern.procargs2", pid)
+		if err != nil || len(args) < 4 {
 			continue
 		}
-		ppid, err := strconv.Atoi(fields[1])
-		if err != nil || ppid != parent {
-			continue
-		}
-		if filepath.Base(strings.Join(fields[2:], " ")) != "claude" {
+		path, _, _ := strings.Cut(string(args[4:]), "\x00")
+		if filepath.Base(path) != "claude" {
 			continue
 		}
 		pids = append(pids, pid)
 	}
-	return pids
+	return pids, nil
 }
 
 func problems(h Health) []string {

internal/agents/preview.go

@@ -17,6 +17,7 @@ import (
 
 	"g.fc.run/ai/byre/internal/api"
 	"g.fc.run/ai/byre/internal/mcp"
+	"g.fc.run/ai/byre/internal/peer"
 	"g.fc.run/ai/byre/internal/store"
 )
 
@@ -169,7 +170,7 @@ func (m *Manager) servePreview(port int) error {
 			http.Error(w, "forbidden preview host", http.StatusForbidden)
 			return
 		}
-		who, err := lc.WhoIs(r.Context(), r.RemoteAddr)
+		who, err := peer.WhoIs(r, lc)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusForbidden)
 			return
@@ -183,7 +184,7 @@ func (m *Manager) servePreview(port int) error {
 		proxy.ServeHTTP(w, r)
 	})
 	go func() {
-		err := (&http.Server{Handler: handler}).Serve(tracked)
+		err := (&http.Server{Handler: handler, ConnContext: peer.ConnContext}).Serve(tracked)
 		if !errors.Is(err, net.ErrClosed) {
 			slog.Error("serve preview", "port", port, "err", err)
 		}