@adhdev/daemon-core 0.9.82-rc.479 → 0.9.82-rc.480

package/src/commands/low-family/session-host.ts

@@ -33,6 +33,14 @@ function toHostedCliRuntimeDescriptor(record: any): HostedCliRuntimeDescriptor |
         providerSessionId: typeof record.meta?.providerSessionId === 'string'
             ? String(record.meta.providerSessionId)
             : undefined,
+        // Real spawn time (PAST timestamp) of the underlying runtime — startedAt is
+        // stamped on markStarted; fall back to createdAt (record creation). Threaded
+        // through so an attach restores the native-history session-floor to the
+        // runtime's actual birth instead of collapsing spawnedAtMs to 0 (which broke
+        // the antigravity per-session birth-floor for co-located MAGI runtimes).
+        startedAtMs: typeof record.startedAt === 'number' && record.startedAt > 0
+            ? record.startedAt
+            : (typeof record.createdAt === 'number' && record.createdAt > 0 ? record.createdAt : undefined),
     };
 }
 

package/src/config/chat-history.ts

@@ -1742,6 +1742,11 @@ type ProviderNativeHistoryReadResult = {
     nativeHistoryCoverage?: string;
     partialReason?: string;
     unavailableReason?: string;
+    // Antigravity: whether the resolved conversation was owner-token-confirmed as
+    // this session's own (vs a bare recency pick). Threaded to the read-path so
+    // the workspace-latest pin + first-read safe-mapping trust only fire for a
+    // confirmed uuid. See dispatcher NativeHistoryResult.ownerConfirmed.
+    ownerConfirmed?: boolean;
 };
 
 function getNativeHistoryScriptName(canonicalHistory: ProviderCanonicalHistoryConfig | undefined, key: 'readSession' | 'listSessions'): string {
@@ -1860,6 +1865,7 @@ function callProviderNativeHistoryRead(
         nativeHistoryCoverage: typeof (result as any).nativeHistoryCoverage === 'string' ? (result as any).nativeHistoryCoverage.trim() : undefined,
         partialReason: typeof (result as any).partialReason === 'string' ? (result as any).partialReason.trim() : undefined,
         unavailableReason: typeof (result as any).unavailableReason === 'string' ? (result as any).unavailableReason.trim() : undefined,
+        ownerConfirmed: typeof (result as any).ownerConfirmed === 'boolean' ? (result as any).ownerConfirmed : undefined,
     };
 }
 
@@ -1957,6 +1963,7 @@ export function readProviderChatHistory(
     nativeHistoryCoverage?: string;
     partialReason?: string;
     unavailableReason?: string;
+    ownerConfirmed?: boolean;
 } {
     if (isNativeSourceCanonicalHistory(options.canonicalHistory) && (options.historySessionId || options.workspace)) {
         const nativeResult = buildNativeHistoryReadResult(agentType, options.canonicalHistory, options.scripts, options.historySessionId, options.workspace, options.excludeInProgressTurn, options.sessionStartedAtMs, options.envOverrides, options.forceRefresh, options.instanceId);
@@ -1971,6 +1978,7 @@ export function readProviderChatHistory(
             nativeHistoryCoverage: nativeResult.nativeHistoryCoverage,
             partialReason: nativeResult.partialReason,
             unavailableReason: nativeResult.unavailableReason,
+            ownerConfirmed: nativeResult.ownerConfirmed,
         };
     }
     return {

package/src/index.ts

@@ -344,6 +344,7 @@ export { getHostMemorySnapshot } from './system/host-memory.js';
 export type { HostMemorySnapshot } from './system/host-memory.js';
 export {
   classifyHotChatSessionsForSubscriptionFlush,
+  detectNewlySettledCompletedSessions,
   DEFAULT_ACTIVE_CHAT_POLL_STATUSES,
   DEFAULT_CHAT_TAIL_RECENT_MESSAGE_GRACE_MS,
 } from './status/chat-tail-hot-sessions.js';

package/src/providers/native-history/dispatcher.ts

@@ -50,6 +50,19 @@ export interface NativeHistoryResult {
     sourcePath: string;
     sourceMtimeMs: number;
     nativeHistoryCoverage?: 'full' | 'partial' | 'best-effort';
+    /**
+     * True only when the resolved conversation is confirmed to belong to THIS
+     * reading session by the owner-token identity (an exact uuid bind, or a
+     * spawn-floor/birth-time pick born after this session started). False for a
+     * bare recency/newest-by-mtime pick made with no spawn floor — that pick may
+     * alias a co-located concurrent session (the antigravity coordinator↔replica
+     * crosswire), so its uuid must NEVER be recorded as a pin nor trusted to
+     * satisfy the same-pass safe-mapping identity check. Read-path callers gate
+     * the workspace-latest pin + first-read trust on this flag. Non-antigravity
+     * readers leave it undefined (their existing exact-file resolution is
+     * unaffected by this signal).
+     */
+    ownerConfirmed?: boolean;
 }
 
 export function createNativeHistoryDispatcher(reader: ReaderId): (input: NativeHistoryInput) => NativeHistoryResult | null {
@@ -74,8 +87,13 @@ export function createNativeHistoryDispatcher(reader: ReaderId): (input: NativeH
             : typeof input.args?.instanceId === 'string'
                 ? (input.args.instanceId as string)
                 : '';
-        const sourcePath = resolveSourcePath(reader, workspace, sessionId, sessionStartedAtMs, instanceId);
+        const resolved = resolveSourcePath(reader, workspace, sessionId, sessionStartedAtMs, instanceId);
+        const sourcePath = resolved?.path || null;
         if (!sourcePath) return null;
+        // Owner-confirmation only meaningful for antigravity (see resolveAntigravityPath).
+        // For other readers the file was resolved by exact per-session key already;
+        // leave the flag undefined so the read-path callers treat them as before.
+        const ownerConfirmed = reader === 'antigravity-cli' ? resolved?.ownerConfirmed === true : undefined;
         if (input.forceRefresh === true || input.args?.forceRefresh === true) {
             try { fs.statSync(sourcePath); } catch { /* best-effort metadata refresh */ }
         }
@@ -116,6 +134,7 @@ export function createNativeHistoryDispatcher(reader: ReaderId): (input: NativeH
             sourcePath: session.sourcePath,
             sourceMtimeMs: session.sourceMtimeMs,
             nativeHistoryCoverage: (session as any).nativeHistoryCoverage || 'full',
+            ownerConfirmed,
         };
     };
 }
@@ -124,12 +143,19 @@ export function createNativeHistoryDispatcher(reader: ReaderId): (input: NativeH
 // Per-provider path resolution
 // ────────────────────────────────────────────────────────────────────────────
 
-function resolveSourcePath(reader: ReaderId, workspace: string, sessionId: string, sessionStartedAtMs: number, instanceId: string): string | null {
+interface ResolvedSource {
+    path: string;
+    /** Antigravity only: whether the resolution was owner-token-confirmed (see
+     *  NativeHistoryResult.ownerConfirmed / resolveAntigravityPath). */
+    ownerConfirmed?: boolean;
+}
+
+function resolveSourcePath(reader: ReaderId, workspace: string, sessionId: string, sessionStartedAtMs: number, instanceId: string): ResolvedSource | null {
     switch (reader) {
-        case 'claude-cli':   return resolveClaudePath(workspace, sessionId);
-        case 'codex-cli':    return resolveCodexPath(workspace, sessionId, sessionStartedAtMs);
+        case 'claude-cli':   { const p = resolveClaudePath(workspace, sessionId); return p ? { path: p } : null; }
+        case 'codex-cli':    { const p = resolveCodexPath(workspace, sessionId, sessionStartedAtMs); return p ? { path: p } : null; }
         case 'antigravity-cli': return resolveAntigravityPath(workspace, sessionId, sessionStartedAtMs, instanceId);
-        case 'hermes-cli':   return resolveHermesPath(workspace, sessionId);
+        case 'hermes-cli':   { const p = resolveHermesPath(workspace, sessionId); return p ? { path: p } : null; }
     }
 }
 
@@ -291,7 +317,7 @@ function resolveAntigravityPath(
     sessionId: string,
     sessionStartedAtMs: number,
     instanceId: string,
-): string | null {
+): ResolvedSource | null {
     const agyRoot = path.join(os.homedir(), '.gemini', 'antigravity-cli');
     // Owner token identifies THIS reading session. The provider instance derives
     // the identical token (workspace + startedAt, or instanceId) so it can
@@ -309,7 +335,9 @@ function resolveAntigravityPath(
         const dbPath = path.join(agyRoot, 'conversations', `${sessionId}.db`);
         if (fs.existsSync(dbPath)) {
             if (owner) claimAntigravityConversation(sessionId, owner);
-            return dbPath;
+            // Exact uuid bind — the caller named this conversation, so it is
+            // authoritatively this session's own. Owner-confirmed.
+            return { path: dbPath, ownerConfirmed: true };
         }
     }
 
@@ -344,6 +372,10 @@ function resolveAntigravityPath(
             })
             .filter(e => e.mtime >= cutoff);
         let ordered: Array<{ uuid: string; p: string }> = [];
+        // Floor branch (sessionStartedAtMs > 0) is birth-confirmed as this
+        // session's own store → owner-confirmed. Floor-less newest-by-mtime is a
+        // bare recency pick that can alias a co-located session → NOT confirmed.
+        const brainOwnerConfirmed = sessionStartedAtMs > 0;
         if (sessionStartedAtMs > 0) {
             // Floor branch: this session's own = born at/after (floor - grace),
             // oldest-birth first. Mirrors pickUnboundConversationDb exactly so the
@@ -360,7 +392,7 @@ function resolveAntigravityPath(
             const t = nonEmptyBrain(e.uuid, e.p);
             if (t) {
                 if (owner) claimAntigravityConversation(e.uuid, owner);
-                return t;
+                return { path: t, ownerConfirmed: brainOwnerConfirmed };
             }
         }
     }
@@ -372,7 +404,7 @@ function resolveAntigravityPath(
     const picked = pickUnboundConversationDb(convRoot, sessionStartedAtMs, owner);
     if (picked) {
         if (owner) claimAntigravityConversation(picked.uuid, owner);
-        return picked.path;
+        return { path: picked.path, ownerConfirmed: picked.ownerConfirmed };
     }
 
     return null;
@@ -402,7 +434,7 @@ function pickUnboundConversationDb(
     convRoot: string,
     sessionFloorMs: number,
     owner: string,
-): { path: string; uuid: string } | null {
+): { path: string; uuid: string; ownerConfirmed: boolean } | null {
     let entries: fs.Dirent[] = [];
     try { entries = fs.readdirSync(convRoot, { withFileTypes: true }); } catch { return null; }
 
@@ -442,11 +474,15 @@ function pickUnboundConversationDb(
         // session — do NOT bind to it. Wait for our own store on the next read.
         if (own.length === 0) return null;
         own.sort((a, b) => (a.birth || a.mtime) - (b.birth || b.mtime));
-        return { path: own[0].path, uuid: own[0].uuid };
+        // Birth-time confirmed as this session's own store → owner-confirmed.
+        return { path: own[0].path, uuid: own[0].uuid, ownerConfirmed: true };
     }
 
+    // Floor-less newest-by-mtime: a bare recency pick with no per-session
+    // guarantee — it can alias a co-located concurrent session, so it is NOT
+    // owner-confirmed and must not be pinned/trusted by the read-path callers.
     candidates.sort((a, b) => b.mtime - a.mtime);
-    return { path: candidates[0].path, uuid: candidates[0].uuid };
+    return { path: candidates[0].path, uuid: candidates[0].uuid, ownerConfirmed: false };
 }
 
 /**

package/src/status/chat-tail-hot-sessions.ts

@@ -60,8 +60,35 @@ export function classifyHotChatSessionsForSubscriptionFlush(
     recentMessageGraceMs?: number;
     activeStatuses?: ReadonlySet<string>;
     activeSessionIds?: ReadonlySet<string>;
+    /**
+     * Per-session `lastMessageAt` of the most recent completion tail that has
+     * already been flushed to subscribers. A completed-but-unseen session is
+     * kept hot for delivery REGARDLESS of the 8s recency timer, but only until
+     * its current tail has been delivered once — bounding the guaranteed
+     * delivery so a slow-finalizing turn is not re-pushed every tick forever.
+     * A newer `lastMessageAt` (fresh turn) re-arms delivery.
+     */
+    deliveredCompletionTailAt?: ReadonlyMap<string, number>;
+    /**
+     * (D8) PER-SUBSCRIPTION ACK gate — the authoritative guaranteed-delivery
+     * signal. Session ids for which at least one currently-subscribed ws has
+     * NOT yet been sent the session's finalized tail (its per-ws
+     * `lastDeliveredSignature` is empty / does not match the session's current
+     * tail). The daemon computes this from its live ws-subscription map; the
+     * classifier keeps every such session hot-for-delivery INDEPENDENT of the
+     * seen/unread badge, so a session whose unread badge cleared (or a fresh
+     * browser that re-subscribed after the single completion flush already
+     * fired) still gets its assistant-final tail delivered. Bounded because a
+     * subscriber's `lastDeliveredSignature` converges to the current tail the
+     * moment it is actually sent, dropping the session out of this set. When
+     * provided, this set is the guaranteed-delivery driver and the
+     * `deliveredCompletionTailAt` recency-watermark path is bypassed for these
+     * sessions (it stays only as the legacy opt-in for callers that don't pass
+     * a per-subscription set).
+     */
+    underDeliveredSessionIds?: ReadonlySet<string>;
   } = {},
-): { active: Set<string>; finalizing: Set<string> } {
+): { active: Set<string>; finalizing: Set<string>; guaranteedDelivery: Set<string> } {
   const now = options.now ?? Date.now();
   const recentMessageGraceMs = Math.max(
     0,
@@ -71,8 +98,19 @@ export function classifyHotChatSessionsForSubscriptionFlush(
   );
   const activeStatuses = options.activeStatuses ?? DEFAULT_ACTIVE_CHAT_POLL_STATUSES;
   const activeSessionIds = options.activeSessionIds ?? new Set<string>();
+  // The guaranteed-delivery path is opt-in: only callers that provide a
+  // delivered-watermark map (so they can BOUND re-pushes) participate. Callers
+  // without it keep the original recency-window-only behavior and never enter
+  // the completed-but-unseen keep-hot branch (which would otherwise thrash by
+  // re-pushing every tick with no delivered record to stop it).
+  const deliveredCompletionTailAt = options.deliveredCompletionTailAt ?? null;
+  const underDeliveredSessionIds = options.underDeliveredSessionIds ?? null;
   const active = new Set<string>();
   const excluded = new Set<string>();
+  // Sessions kept hot purely because they finalized late (outside the 8s
+  // window) and have not been delivered yet. The caller records these so the
+  // next classification knows their tail is now delivered.
+  const guaranteedDelivery = new Set<string>();
 
   for (const session of sessions) {
     const sessionId = typeof session?.id === 'string' ? session.id : '';
@@ -104,6 +142,49 @@ export function classifyHotChatSessionsForSubscriptionFlush(
 
     if (activeStatuses.has(status) || shouldKeepRecentTailHot) {
       active.add(sessionId);
+      continue;
+    }
+
+    // (D8) PER-SUBSCRIPTION ACK-BASED guaranteed delivery — the authoritative
+    // path. If ANY currently-subscribed ws for this session still lacks the
+    // finalized tail (empty / mismatched per-ws lastDeliveredSignature), keep
+    // the session hot-for-delivery REGARDLESS of the seen/unread badge. This is
+    // the fix for the agy coordinator stranded user-only: the single completion
+    // flush was marked "delivered" on FLUSH-FIRE (not browser-APPLIED), and
+    // re-delivery was gated on completedUnseen — so once the unread badge
+    // cleared, a subscriber that never actually applied the assistant tail (D6
+    // shrink-defer drop, or a fresh browser that re-subscribed after the flush
+    // instant) was permanently dropped and stayed user-only forever. Gating on
+    // "does a live subscriber still lack the tail" instead of the badge makes it
+    // re-arm for exactly those subscribers, and it self-bounds: the moment a
+    // subscriber is actually sent the tail its signature matches and it leaves
+    // this set (a same-tail re-flush is a cheap no-op via prepareSessionChatTailUpdate).
+    if (underDeliveredSessionIds && underDeliveredSessionIds.has(sessionId)) {
+      active.add(sessionId);
+      guaranteedDelivery.add(sessionId);
+      continue;
+    }
+
+    // Legacy recency-watermark guaranteed-delivery path (opt-in via
+    // deliveredCompletionTailAt): a completed-but-unseen session whose native
+    // tail finalized AFTER the 8s window (common for multi-turn MAGI
+    // coordinators — the native-history tail lags the last PTY echo). Kept for
+    // callers that do not supply a per-subscription ACK set. When the
+    // per-subscription set is provided it is authoritative and this path is not
+    // consulted (the `continue` above already handled under-delivered sessions;
+    // a session NOT in the set is genuinely delivered, so it must not be revived
+    // here on the stale badge alone).
+    const completedUnseen = unread || inboxBucket === 'task_complete';
+    if (!underDeliveredSessionIds && deliveredCompletionTailAt && completedUnseen) {
+      const delivered = deliveredCompletionTailAt.get(sessionId) ?? 0;
+      // Not yet delivered for this turn (no record, or a newer tail arrived
+      // since the last delivery). lastMessageAt===0 (unknown ts) still counts
+      // as undelivered so the tail is not silently dropped.
+      const alreadyDelivered = delivered > 0 && lastMessageAt > 0 && delivered >= lastMessageAt;
+      if (!alreadyDelivered) {
+        active.add(sessionId);
+        guaranteedDelivery.add(sessionId);
+      }
     }
   }
 
@@ -111,5 +192,39 @@ export function classifyHotChatSessionsForSubscriptionFlush(
     Array.from(previousHotSessionIds).filter((sessionId) => !active.has(sessionId) && !excluded.has(sessionId)),
   );
 
-  return { active, finalizing };
+  return { active, finalizing, guaranteedDelivery };
+}
+
+/**
+ * Detect sessions that just transitioned from an active/generating state into
+ * a settled/completed-but-unseen state, so their finalized completion tail can
+ * be flushed exactly once regardless of the recency window. Pure: the caller
+ * owns the `previousStatus` map and updates it from the returned `nextStatus`.
+ */
+export function detectNewlySettledCompletedSessions(
+  sessions: HotChatSessionLike[],
+  previousStatus: ReadonlyMap<string, string>,
+  options: { activeStatuses?: ReadonlySet<string> } = {},
+): { settled: Set<string>; nextStatus: Map<string, string> } {
+  const activeStatuses = options.activeStatuses ?? DEFAULT_ACTIVE_CHAT_POLL_STATUSES;
+  const settled = new Set<string>();
+  const nextStatus = new Map<string, string>();
+
+  for (const session of sessions) {
+    const sessionId = typeof session?.id === 'string' ? session.id : '';
+    if (!sessionId) continue;
+    const status = String(session?.status || '').toLowerCase();
+    const prevStatus = previousStatus.get(sessionId);
+    nextStatus.set(sessionId, status);
+
+    const wasActive = prevStatus !== undefined && activeStatuses.has(prevStatus);
+    const isSettledNow = !activeStatuses.has(status);
+    const inboxBucket = String(session?.inboxBucket || '').toLowerCase();
+    const completedUnseen = session?.unread === true || inboxBucket === 'task_complete';
+    if (wasActive && isSettledNow && completedUnseen) {
+      settled.add(sessionId);
+    }
+  }
+
+  return { settled, nextStatus };
 }