v0.14.0 tcp/http sinks with standard library added, chain aggregate test script added

internal/config/config.go

@@ -291,6 +291,34 @@ type HTTPSinkOptions struct {
 	WriteTimeout int64  `toml:"write_timeout_ms"`
 }
 
+// StdTCPSinkOptions defines settings for a stdlib TCP streaming server sink.
+// TOML keys mirror TCPSinkOptions for drop-in type swap ("tcp" -> "stdtcp").
+type StdTCPSinkOptions struct {
+	Host              string `toml:"host"`
+	Port              int64  `toml:"port"`
+	BufferSize        int64  `toml:"buffer_size"`        // sink input queue
+	ClientBufferSize  int64  `toml:"client_buffer_size"` // per-client send queue
+	WriteTimeoutMS    int64  `toml:"write_timeout_ms"`   // per-write deadline
+	KeepAlive         bool   `toml:"keep_alive"`
+	KeepAlivePeriodMS int64  `toml:"keep_alive_period_ms"`
+	MaxConnections    int64  `toml:"max_connections"` // 0 = unlimited
+	// Future: TLS (cert_file/key_file/client_ca), auth (token/mTLS) blocks
+}
+
+// StdHTTPSinkOptions defines settings for a stdlib HTTP SSE streaming sink.
+// TOML keys mirror HTTPSinkOptions for drop-in type swap ("http" -> "stdhttp").
+type StdHTTPSinkOptions struct {
+	Host             string `toml:"host"`
+	Port             int64  `toml:"port"`
+	StreamPath       string `toml:"stream_path"`
+	StatusPath       string `toml:"status_path"`
+	BufferSize       int64  `toml:"buffer_size"`        // sink input queue
+	ClientBufferSize int64  `toml:"client_buffer_size"` // per-client send queue
+	WriteTimeoutMS   int64  `toml:"write_timeout_ms"`   // per-SSE-write deadline, 0 = none
+	MaxConnections   int64  `toml:"max_connections"`    // 0 = unlimited
+	// Future: TLS (server.TLSConfig), auth middleware options
+}
+
 // TCPChainSinkOptions defines settings for a stdlib TCP client forwarding
 // entries to a downstream logwisp tcp_chain source
 type TCPChainSinkOptions struct {

internal/sink/stdhttp/stdhttp.go

@@ -0,0 +1,484 @@
+package stdhttp
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"logwisp/internal/config"
+	"logwisp/internal/core"
+	"logwisp/internal/plugin"
+	"logwisp/internal/session"
+	"logwisp/internal/sink"
+	"logwisp/internal/version"
+
+	lconfig "github.com/lixenwraith/config"
+	"github.com/lixenwraith/log"
+)
+
+func init() {
+	if err := plugin.RegisterSink("stdhttp", NewStdHTTPSinkPlugin); err != nil {
+		panic(fmt.Sprintf("failed to register stdhttp sink: %v", err))
+	}
+}
+
+const (
+	DefaultStdHTTPHost             = "0.0.0.0"
+	DefaultStdHTTPBufferSize       = 1000
+	DefaultStdHTTPClientBufferSize = 256
+	DefaultStdHTTPStreamPath       = "/stream"
+	DefaultStdHTTPStatusPath       = "/status"
+	StdHTTPReadHeaderTimeout       = 10 * time.Second
+	StdHTTPShutdownTimeout         = 2 * time.Second
+)
+
+// StdHTTPSink streams log entries via Server-Sent Events using only the
+// standard library. Functional peer of the fasthttp-based http sink.
+//
+// Server.WriteTimeout is deliberately unset (it would terminate long-lived
+// SSE streams); per-write deadlines are applied via http.ResponseController.
+type StdHTTPSink struct {
+	// Plugin identity and session management
+	id    string
+	proxy *session.Proxy
+
+	// Configuration
+	config *config.StdHTTPSinkOptions
+	addr   string
+
+	// Network
+	server *http.Server
+
+	// Application
+	input  chan core.TransportEvent
+	logger *log.Logger
+
+	// Client registry
+	clients      map[uint64]*sseClient
+	clientsMu    sync.Mutex
+	nextClientID atomic.Uint64
+
+	// Runtime
+	done      chan struct{}
+	stopOnce  sync.Once
+	wg        sync.WaitGroup
+	startTime time.Time
+
+	writeTimeout time.Duration
+
+	// Statistics
+	activeClients   atomic.Int64
+	totalProcessed  atomic.Uint64
+	droppedWrites   atomic.Uint64
+	rejectedClients atomic.Uint64
+	lastProcessed   atomic.Value // time.Time
+}
+
+// sseClient is a registered stream consumer with a bounded send queue
+type sseClient struct {
+	send      chan []byte
+	sessionID string
+}
+
+// NewStdHTTPSinkPlugin creates a stdhttp sink through plugin factory
+func NewStdHTTPSinkPlugin(
+	id string,
+	configMap map[string]any,
+	logger *log.Logger,
+	proxy *session.Proxy,
+) (sink.Sink, error) {
+	opts := &config.StdHTTPSinkOptions{
+		Host:           DefaultStdHTTPHost,
+		WriteTimeoutMS: 0, // SSE indefinite streaming
+	}
+	if err := lconfig.ScanMap(configMap, opts); err != nil {
+		return nil, fmt.Errorf("failed to parse config: %w", err)
+	}
+	if err := lconfig.Port(opts.Port); err != nil {
+		return nil, fmt.Errorf("port: %w", err)
+	}
+	if opts.StreamPath == "" {
+		opts.StreamPath = DefaultStdHTTPStreamPath
+	} else if !strings.HasPrefix(opts.StreamPath, "/") {
+		return nil, fmt.Errorf("stream_path: must start with '/'")
+	}
+	if opts.StatusPath == "" {
+		opts.StatusPath = DefaultStdHTTPStatusPath
+	} else if !strings.HasPrefix(opts.StatusPath, "/") {
+		return nil, fmt.Errorf("status_path: must start with '/'")
+	}
+	if opts.StreamPath == opts.StatusPath {
+		return nil, fmt.Errorf("stream_path and status_path must differ")
+	}
+	if opts.BufferSize <= 0 {
+		opts.BufferSize = DefaultStdHTTPBufferSize
+	}
+	if opts.ClientBufferSize <= 0 {
+		opts.ClientBufferSize = DefaultStdHTTPClientBufferSize
+	}
+
+	h := &StdHTTPSink{
+		id:           id,
+		proxy:        proxy,
+		config:       opts,
+		addr:         net.JoinHostPort(opts.Host, strconv.FormatInt(opts.Port, 10)),
+		input:        make(chan core.TransportEvent, opts.BufferSize),
+		done:         make(chan struct{}),
+		logger:       logger,
+		clients:      make(map[uint64]*sseClient),
+		writeTimeout: time.Duration(opts.WriteTimeoutMS) * time.Millisecond,
+	}
+	h.lastProcessed.Store(time.Time{})
+
+	logger.Info("msg", "Std HTTP sink initialized",
+		"component", "stdhttp_sink",
+		"instance_id", id,
+		"host", opts.Host,
+		"port", opts.Port,
+		"stream_path", opts.StreamPath,
+		"status_path", opts.StatusPath)
+	return h, nil
+}
+
+// Capabilities returns supported capabilities
+func (h *StdHTTPSink) Capabilities() []core.Capability {
+	// CapTLS/CapAuth appended when transport security lands
+	return []core.Capability{
+		core.CapSessionAware,
+		core.CapMultiSession,
+	}
+}
+
+// Input returns the channel for sending transport events
+func (h *StdHTTPSink) Input() chan<- core.TransportEvent {
+	return h.input
+}
+
+// Start binds the listener and serves stream/status endpoints
+func (h *StdHTTPSink) Start(ctx context.Context) error {
+	// IPv4-only, parity with existing network sinks.
+	// TLS extension point: wrap ln with tls.NewListener (or set
+	// server.TLSConfig and use ServeTLS); single seam, handlers unchanged.
+	ln, err := net.Listen("tcp4", h.addr)
+	if err != nil {
+		return fmt.Errorf("stdhttp sink bind %s: %w", h.addr, err)
+	}
+
+	mux := http.NewServeMux()
+	// Method-scoped patterns: mux answers 405 with Allow header on non-GET
+	mux.HandleFunc(http.MethodGet+" "+h.config.StreamPath, h.handleStream)
+	mux.HandleFunc(http.MethodGet+" "+h.config.StatusPath, h.handleStatus)
+
+	// Auth extension point: wrap mux with auth middleware once credentials
+	// land, e.g. handler = authMiddleware(cfg)(handler)
+	var handler http.Handler = mux
+
+	h.server = &http.Server{
+		Handler:           handler,
+		ReadHeaderTimeout: StdHTTPReadHeaderTimeout,
+		// WriteTimeout unset by design: SSE responses are long-lived.
+		// Per-write deadlines via ResponseController in handleStream.
+	}
+	h.startTime = time.Now()
+
+	h.wg.Add(1)
+	go h.brokerLoop(ctx)
+
+	go func() {
+		if err := h.server.Serve(ln); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			h.logger.Error("msg", "HTTP server terminated",
+				"component", "stdhttp_sink",
+				"instance_id", h.id,
+				"error", err)
+		}
+	}()
+
+	go func() {
+		select {
+		case <-ctx.Done():
+			h.shutdown()
+		case <-h.done:
+		}
+	}()
+
+	h.logger.Info("msg", "Std HTTP server started",
+		"component", "stdhttp_sink",
+		"instance_id", h.id,
+		"addr", h.addr)
+	return nil
+}
+
+// Stop gracefully shuts down the sink
+func (h *StdHTTPSink) Stop() {
+	h.logger.Info("msg", "Stopping std HTTP sink",
+		"component", "stdhttp_sink",
+		"instance_id", h.id)
+
+	h.shutdown()
+	h.wg.Wait()
+
+	h.logger.Info("msg", "Std HTTP sink stopped",
+		"component", "stdhttp_sink",
+		"instance_id", h.id,
+		"total_processed", h.totalProcessed.Load())
+}
+
+// shutdown funnels ctx-cancel and Stop() teardown through a single path.
+// done is closed first so SSE handlers exit and Shutdown can complete;
+// Server.Close force-closes any handler stalled in a deadline-free write.
+func (h *StdHTTPSink) shutdown() {
+	h.stopOnce.Do(func() {
+		close(h.done)
+		if h.server != nil {
+			sctx, cancel := context.WithTimeout(context.Background(), StdHTTPShutdownTimeout)
+			defer cancel()
+			if err := h.server.Shutdown(sctx); err != nil {
+				h.server.Close()
+			}
+		}
+	})
+}
+
+// removeClient unregisters a client; the first caller closes the send
+// channel and removes the session. Broker (stale-session eviction) and
+// stream handler (disconnect) may race here safely.
+func (h *StdHTTPSink) removeClient(id uint64) {
+	h.clientsMu.Lock()
+	c, ok := h.clients[id]
+	if ok {
+		delete(h.clients, id)
+	}
+	h.clientsMu.Unlock()
+	if ok {
+		close(c.send)
+		h.proxy.RemoveSession(c.sessionID)
+	}
+}
+
+// brokerLoop fans out transport events to all client queues, non-blocking,
+// and evicts clients whose sessions were idle-expired by the session manager
+func (h *StdHTTPSink) brokerLoop(ctx context.Context) {
+	defer h.wg.Done()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-h.done:
+			return
+		case event, ok := <-h.input:
+			if !ok {
+				return
+			}
+			h.totalProcessed.Add(1)
+			h.lastProcessed.Store(time.Now())
+
+			var stale []uint64
+			h.clientsMu.Lock()
+			for id, c := range h.clients {
+				if _, exists := h.proxy.GetSession(c.sessionID); !exists {
+					stale = append(stale, id)
+					continue
+				}
+				select {
+				case c.send <- event.Payload:
+					h.proxy.UpdateActivity(c.sessionID)
+				default:
+					h.droppedWrites.Add(1)
+				}
+			}
+			h.clientsMu.Unlock()
+
+			for _, id := range stale {
+				h.removeClient(id)
+			}
+		}
+	}
+}
+
+// handleStream serves one client's SSE stream
+func (h *StdHTTPSink) handleStream(w http.ResponseWriter, r *http.Request) {
+	if h.config.MaxConnections > 0 && h.activeClients.Load() >= h.config.MaxConnections {
+		h.rejectedClients.Add(1)
+		http.Error(w, "too many clients", http.StatusServiceUnavailable)
+		return
+	}
+
+	rc := http.NewResponseController(w)
+	remote := r.RemoteAddr
+
+	sess := h.proxy.CreateSession(remote, map[string]any{
+		"type": "stdhttp_client",
+	})
+
+	c := &sseClient{
+		send:      make(chan []byte, h.config.ClientBufferSize),
+		sessionID: sess.ID,
+	}
+	id := h.nextClientID.Add(1)
+
+	h.clientsMu.Lock()
+	h.clients[id] = c
+	h.clientsMu.Unlock()
+
+	count := h.activeClients.Add(1)
+	h.logger.Debug("msg", "HTTP client connected",
+		"component", "stdhttp_sink",
+		"remote_addr", remote,
+		"session_id", sess.ID,
+		"client_id", id,
+		"active_clients", count)
+
+	defer func() {
+		h.removeClient(id)
+		newCount := h.activeClients.Add(-1)
+		h.logger.Debug("msg", "HTTP client disconnected",
+			"component", "stdhttp_sink",
+			"remote_addr", remote,
+			"session_id", sess.ID,
+			"client_id", id,
+			"active_clients", newCount)
+	}()
+
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	w.Header().Set("X-Accel-Buffering", "no")
+	w.WriteHeader(http.StatusOK)
+
+	// Connected event with metadata, parity with fasthttp sink
+	info, _ := json.Marshal(map[string]any{
+		"client_id":   strconv.FormatUint(id, 10),
+		"session_id":  sess.ID,
+		"instance_id": h.id,
+		"stream_path": h.config.StreamPath,
+		"status_path": h.config.StatusPath,
+		"buffer_size": h.config.ClientBufferSize,
+	})
+	fmt.Fprintf(w, "event: connected\ndata: %s\n\n", info)
+	if err := rc.Flush(); err != nil {
+		return
+	}
+
+	clientGone := r.Context().Done()
+	for {
+		select {
+		case payload, ok := <-c.send:
+			if !ok {
+				return // broker evicted (stale session)
+			}
+			if h.writeTimeout > 0 {
+				_ = rc.SetWriteDeadline(time.Now().Add(h.writeTimeout))
+			}
+			if err := writeSSE(w, payload); err != nil {
+				return
+			}
+			if err := rc.Flush(); err != nil {
+				return
+			}
+			h.proxy.UpdateActivity(sess.ID)
+		case <-clientGone:
+			return
+		case <-h.done:
+			fmt.Fprintf(w, "event: disconnect\ndata: {\"reason\":\"server_shutdown\"}\n\n")
+			rc.Flush()
+			return
+		}
+	}
+}
+
+// handleStatus provides a JSON status report
+func (h *StdHTTPSink) handleStatus(w http.ResponseWriter, r *http.Request) {
+	status := map[string]any{
+		"service":     "LogWisp",
+		"version":     version.Short(),
+		"instance_id": h.id,
+		"server": map[string]any{
+			"type":           "stdhttp",
+			"host":           h.config.Host,
+			"port":           h.config.Port,
+			"active_clients": h.activeClients.Load(),
+			"buffer_size":    h.config.BufferSize,
+			"uptime_seconds": int(time.Since(h.startTime).Seconds()),
+		},
+		"endpoints": map[string]string{
+			"stream": h.config.StreamPath,
+			"status": h.config.StatusPath,
+		},
+		"statistics": map[string]any{
+			"total_processed":  h.totalProcessed.Load(),
+			"dropped_writes":   h.droppedWrites.Load(),
+			"rejected_clients": h.rejectedClients.Load(),
+		},
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(status)
+}
+
+// GetStats returns sink statistics
+func (h *StdHTTPSink) GetStats() sink.SinkStats {
+	lastProc, _ := h.lastProcessed.Load().(time.Time)
+	return sink.SinkStats{
+		ID:                h.id,
+		Type:              "stdhttp",
+		TotalProcessed:    h.totalProcessed.Load(),
+		ActiveConnections: h.activeClients.Load(),
+		StartTime:         h.startTime,
+		LastProcessed:     lastProc,
+		Details: map[string]any{
+			"host":             h.config.Host,
+			"port":             h.config.Port,
+			"buffer_size":      h.config.BufferSize,
+			"dropped_writes":   h.droppedWrites.Load(),
+			"rejected_clients": h.rejectedClients.Load(),
+			"endpoints": map[string]string{
+				"stream": h.config.StreamPath,
+				"status": h.config.StatusPath,
+			},
+		},
+	}
+}
+
+// writeSSE frames a payload per the W3C SSE spec (multi-line safe)
+func writeSSE(w http.ResponseWriter, payload []byte) error {
+	for _, line := range splitLines(payload) {
+		if _, err := fmt.Fprintf(w, "data: %s\n", line); err != nil {
+			return err
+		}
+	}
+	_, err := fmt.Fprint(w, "\n")
+	return err
+}
+
+// splitLines splits payload by newlines, trimming a single trailing newline
+func splitLines(data []byte) [][]byte {
+	if len(data) == 0 {
+		return nil
+	}
+	if data[len(data)-1] == '\n' {
+		data = data[:len(data)-1]
+	}
+	var lines [][]byte
+	start := 0
+	for i := 0; i < len(data); i++ {
+		if data[i] == '\n' {
+			lines = append(lines, data[start:i])
+			start = i + 1
+		}
+	}
+	if start < len(data) {
+		lines = append(lines, data[start:])
+	}
+	if len(lines) == 0 {
+		return [][]byte{data}
+	}
+	return lines
+}

internal/sink/stdtcp/stdtcp.go

@@ -0,0 +1,399 @@
+package stdtcp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"logwisp/internal/config"
+	"logwisp/internal/core"
+	"logwisp/internal/plugin"
+	"logwisp/internal/session"
+	"logwisp/internal/sink"
+
+	lconfig "github.com/lixenwraith/config"
+	"github.com/lixenwraith/log"
+)
+
+func init() {
+	if err := plugin.RegisterSink("stdtcp", NewStdTCPSinkPlugin); err != nil {
+		panic(fmt.Sprintf("failed to register stdtcp sink: %v", err))
+	}
+}
+
+const (
+	DefaultStdTCPHost              = "0.0.0.0"
+	DefaultStdTCPBufferSize        = 1000
+	DefaultStdTCPClientBufferSize  = 256
+	DefaultStdTCPWriteTimeoutMS    = 5000
+	DefaultStdTCPKeepAlivePeriodMS = 30000
+)
+
+// StdTCPSink streams formatted log entries to connected TCP clients using
+// only the standard library. Functional peer of the gnet-based tcp sink.
+//
+// Concurrency model: one broadcast loop fans out into bounded per-client
+// queues; each connection owns a writer goroutine (drains queue) and a
+// reader goroutine (disconnect detection). A stalled client drops events,
+// never the pipeline.
+type StdTCPSink struct {
+	// Plugin identity and session management
+	id    string
+	proxy *session.Proxy
+
+	// Configuration
+	config *config.StdTCPSinkOptions
+	addr   string
+
+	// Network
+	listener net.Listener
+
+	// Application
+	input  chan core.TransportEvent
+	logger *log.Logger
+
+	// Client registry
+	clients      map[uint64]*tcpClient
+	clientsMu    sync.Mutex
+	nextClientID atomic.Uint64
+
+	// Runtime
+	done      chan struct{}
+	stopOnce  sync.Once
+	wg        sync.WaitGroup
+	startTime time.Time
+
+	writeTimeout time.Duration
+
+	// Statistics
+	activeConns    atomic.Int64
+	totalProcessed atomic.Uint64
+	writeErrors    atomic.Uint64
+	droppedWrites  atomic.Uint64
+	rejectedConns  atomic.Uint64
+	lastProcessed  atomic.Value // time.Time
+}
+
+// tcpClient pairs a connection with its bounded send queue.
+// send is written by the broadcast loop (non-blocking) and drained by the
+// writer goroutine; closed signals reader-detected disconnect.
+type tcpClient struct {
+	conn      net.Conn
+	send      chan []byte
+	sessionID string
+	closed    chan struct{}
+}
+
+// NewStdTCPSinkPlugin creates a stdtcp sink through plugin factory
+func NewStdTCPSinkPlugin(
+	id string,
+	configMap map[string]any,
+	logger *log.Logger,
+	proxy *session.Proxy,
+) (sink.Sink, error) {
+	opts := &config.StdTCPSinkOptions{
+		Host:      DefaultStdTCPHost,
+		KeepAlive: true,
+	}
+	if err := lconfig.ScanMap(configMap, opts); err != nil {
+		return nil, fmt.Errorf("failed to parse config: %w", err)
+	}
+	if err := lconfig.Port(opts.Port); err != nil {
+		return nil, fmt.Errorf("port: %w", err)
+	}
+	if opts.BufferSize <= 0 {
+		opts.BufferSize = DefaultStdTCPBufferSize
+	}
+	if opts.ClientBufferSize <= 0 {
+		opts.ClientBufferSize = DefaultStdTCPClientBufferSize
+	}
+	if opts.WriteTimeoutMS <= 0 {
+		opts.WriteTimeoutMS = DefaultStdTCPWriteTimeoutMS
+	}
+	if opts.KeepAlivePeriodMS <= 0 {
+		opts.KeepAlivePeriodMS = DefaultStdTCPKeepAlivePeriodMS
+	}
+
+	t := &StdTCPSink{
+		id:           id,
+		proxy:        proxy,
+		config:       opts,
+		addr:         net.JoinHostPort(opts.Host, strconv.FormatInt(opts.Port, 10)),
+		input:        make(chan core.TransportEvent, opts.BufferSize),
+		done:         make(chan struct{}),
+		logger:       logger,
+		clients:      make(map[uint64]*tcpClient),
+		writeTimeout: time.Duration(opts.WriteTimeoutMS) * time.Millisecond,
+	}
+	t.lastProcessed.Store(time.Time{})
+
+	logger.Info("msg", "Std TCP sink initialized",
+		"component", "stdtcp_sink",
+		"instance_id", id,
+		"host", opts.Host,
+		"port", opts.Port)
+	return t, nil
+}
+
+// Capabilities returns supported capabilities
+func (t *StdTCPSink) Capabilities() []core.Capability {
+	// CapTLS/CapAuth appended when transport security lands
+	return []core.Capability{
+		core.CapSessionAware,
+		core.CapMultiSession,
+	}
+}
+
+// Input returns the channel for sending transport events
+func (t *StdTCPSink) Input() chan<- core.TransportEvent {
+	return t.input
+}
+
+// listen creates the server listener.
+// TLS extension point: wrap the returned listener with tls.NewListener here
+// once cert config lands; no other code path changes. mTLS peer identity is
+// then available via conn.(*tls.Conn).ConnectionState() in the auth hook.
+func (t *StdTCPSink) listen() (net.Listener, error) {
+	lc := net.ListenConfig{}
+	if t.config.KeepAlive {
+		lc.KeepAliveConfig = net.KeepAliveConfig{
+			Enable: true,
+			Idle:   time.Duration(t.config.KeepAlivePeriodMS) * time.Millisecond,
+		}
+	}
+	// IPv4-only, parity with existing network sinks
+	return lc.Listen(context.Background(), "tcp4", t.addr)
+}
+
+// Start binds the listener and launches accept and broadcast loops
+func (t *StdTCPSink) Start(ctx context.Context) error {
+	ln, err := t.listen()
+	if err != nil {
+		return fmt.Errorf("stdtcp sink bind %s: %w", t.addr, err)
+	}
+	t.listener = ln
+	t.startTime = time.Now()
+
+	t.wg.Add(2)
+	go t.acceptLoop()
+	go t.broadcastLoop(ctx)
+
+	// Pipeline context cancellation mirrors gnet engine stop: cease accepting
+	// and tear down existing connections
+	go func() {
+		select {
+		case <-ctx.Done():
+			t.shutdown()
+		case <-t.done:
+		}
+	}()
+
+	t.logger.Info("msg", "Std TCP server started",
+		"component", "stdtcp_sink",
+		"instance_id", t.id,
+		"addr", t.addr)
+	return nil
+}
+
+// Stop gracefully shuts down the sink
+func (t *StdTCPSink) Stop() {
+	t.logger.Info("msg", "Stopping std TCP sink",
+		"component", "stdtcp_sink",
+		"instance_id", t.id)
+
+	t.shutdown()
+	t.wg.Wait()
+
+	t.logger.Info("msg", "Std TCP sink stopped",
+		"component", "stdtcp_sink",
+		"instance_id", t.id,
+		"total_processed", t.totalProcessed.Load())
+}
+
+// shutdown funnels ctx-cancel and Stop() teardown through a single path
+func (t *StdTCPSink) shutdown() {
+	t.stopOnce.Do(func() {
+		close(t.done)
+		if t.listener != nil {
+			t.listener.Close() // unblocks acceptLoop
+		}
+		t.clientsMu.Lock()
+		for _, c := range t.clients {
+			c.conn.Close() // unblocks per-connection readers
+		}
+		t.clientsMu.Unlock()
+	})
+}
+
+// acceptLoop accepts client connections until listener close
+func (t *StdTCPSink) acceptLoop() {
+	defer t.wg.Done()
+	for {
+		conn, err := t.listener.Accept()
+		if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return
+			}
+			t.logger.Warn("msg", "Accept error",
+				"component", "stdtcp_sink",
+				"error", err)
+			continue
+		}
+
+		if t.config.MaxConnections > 0 && t.activeConns.Load() >= t.config.MaxConnections {
+			// Load/admit race can over-admit by a conn under burst; acceptable
+			t.rejectedConns.Add(1)
+			conn.Close()
+			continue
+		}
+
+		// Auth extension point: credential/peer verification runs here,
+		// pre-registration (password preamble read or TLS peer cert check)
+
+		t.wg.Add(1)
+		go t.handleConn(conn)
+	}
+}
+
+// handleConn registers the client and runs its writer; a companion reader
+// goroutine drains inbound bytes for disconnect detection
+func (t *StdTCPSink) handleConn(conn net.Conn) {
+	defer t.wg.Done()
+	remote := conn.RemoteAddr().String()
+
+	sess := t.proxy.CreateSession(remote, map[string]any{
+		"type":        "stdtcp_client",
+		"remote_addr": remote,
+	})
+
+	c := &tcpClient{
+		conn:      conn,
+		send:      make(chan []byte, t.config.ClientBufferSize),
+		sessionID: sess.ID,
+		closed:    make(chan struct{}),
+	}
+	id := t.nextClientID.Add(1)
+
+	t.clientsMu.Lock()
+	t.clients[id] = c
+	t.clientsMu.Unlock()
+
+	count := t.activeConns.Add(1)
+	t.logger.Debug("msg", "TCP connection opened",
+		"component", "stdtcp_sink",
+		"remote_addr", remote,
+		"session_id", sess.ID,
+		"active_connections", count)
+
+	defer func() {
+		t.clientsMu.Lock()
+		delete(t.clients, id)
+		t.clientsMu.Unlock()
+		conn.Close()
+		<-c.closed // reader has exited
+		t.proxy.RemoveSession(sess.ID)
+		newCount := t.activeConns.Add(-1)
+		t.logger.Debug("msg", "TCP connection closed",
+			"component", "stdtcp_sink",
+			"remote_addr", remote,
+			"active_connections", newCount)
+	}()
+
+	// Reader: sink is write-only; drain and discard inbound bytes to detect
+	// disconnect and refresh session activity on client traffic
+	go func() {
+		defer close(c.closed)
+		buf := make([]byte, 4096)
+		for {
+			n, err := conn.Read(buf)
+			if n > 0 {
+				t.proxy.UpdateActivity(sess.ID)
+			}
+			if err != nil {
+				return
+			}
+		}
+	}()
+
+	// Writer: synchronous stdlib write with deadline. A failed write means
+	// the kernel buffer stayed full for the full deadline - connection is
+	// dead or hopelessly stalled, so disconnect immediately (no gnet-style
+	// consecutive-error counter needed for transient async callback errors).
+	for {
+		select {
+		case data := <-c.send:
+			if t.writeTimeout > 0 {
+				conn.SetWriteDeadline(time.Now().Add(t.writeTimeout))
+			}
+			if _, err := conn.Write(data); err != nil {
+				t.writeErrors.Add(1)
+				t.logger.Debug("msg", "Write failed, closing client",
+					"component", "stdtcp_sink",
+					"remote_addr", remote,
+					"error", err)
+				return
+			}
+			t.proxy.UpdateActivity(sess.ID)
+		case <-c.closed:
+			return
+		case <-t.done:
+			return
+		}
+	}
+}
+
+// broadcastLoop fans out transport events to all client queues, non-blocking
+func (t *StdTCPSink) broadcastLoop(ctx context.Context) {
+	defer t.wg.Done()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.done:
+			return
+		case event, ok := <-t.input:
+			if !ok {
+				return
+			}
+			t.totalProcessed.Add(1)
+			t.lastProcessed.Store(time.Now())
+
+			t.clientsMu.Lock()
+			for _, c := range t.clients {
+				select {
+				case c.send <- event.Payload:
+				default:
+					// Slow client: drop its event, never stall siblings
+					t.droppedWrites.Add(1)
+				}
+			}
+			t.clientsMu.Unlock()
+		}
+	}
+}
+
+// GetStats returns sink statistics
+func (t *StdTCPSink) GetStats() sink.SinkStats {
+	lastProc, _ := t.lastProcessed.Load().(time.Time)
+	return sink.SinkStats{
+		ID:                t.id,
+		Type:              "stdtcp",
+		TotalProcessed:    t.totalProcessed.Load(),
+		ActiveConnections: t.activeConns.Load(),
+		StartTime:         t.startTime,
+		LastProcessed:     lastProc,
+		Details: map[string]any{
+			"host":           t.config.Host,
+			"port":           t.config.Port,
+			"buffer_size":    t.config.BufferSize,
+			"write_errors":   t.writeErrors.Load(),
+			"dropped_writes": t.droppedWrites.Load(),
+			"rejected_conns": t.rejectedConns.Load(),
+		},
+	}
+}