@agentdeck/bridge 1.0.21 → 1.0.23

package/dist/daemon-server.js

@@ -76,7 +76,7 @@ import { listActive as listActiveSessions, findAvailablePort, findExistingDaemon
 import { isForeignDaemon } from './daemon-takeover.js';
 import { loadDaemonSettings } from './daemon-settings.js';
 import { resolveDaemonPort, describeDaemonPortSource, PREFERRED_PORT_RECLAIM_MS, } from './daemon-port.js';
-import { fetchUsageFromApi, hasOAuthToken, resetConsecutiveFailures } from './usage-api.js';
+import { fetchUsageFromApi, resetConsecutiveFailures } from './usage-api.js';
 import { getOrCreateToken, isLocalConnection, validateToken } from './auth.js';
 import { buildPublicHealth, gateHttpRequest, isAuthorizedHttpRequest } from './http-auth-gate.js';
 import { closePairingWindow, getPairingWindowStatus, openPairingWindow, pairingWindowOpen, redeemPairingCode, } from './pairing-window.js';
@@ -102,7 +102,8 @@ import { codexTurnOutcomeFromRollout, lastAgentMessageFromCodexRollout } from '.
 import { callFoundationModelsHelper } from './foundation-models-helper.js';
 import { initModules, stopModules, createDefaultModules, } from './modules/index.js';
 import { bindHostFor, daemonModuleConfigs, describeDaemonPosture, resolveDaemonPosture, } from './network-posture.js';
-import { esp32ConnectionCount, getESP32DeviceInfo, onESP32Message, sendAuthProvisionToAll, sendWifiProvision, sendWifiProvisionToAll, handleESP32Wake, getESP32Ports, getSerialConnectionStatus, getSerialLastError, getSerialReachableBoards } from './esp32-serial.js';
+import { esp32ConnectionCount, getESP32DeviceInfo, onESP32Message, sendAuthProvisionToAll, sendWifiProvision, sendWifiProvisionToAll, handleESP32Wake, getESP32Ports, getSerialConnectionStatus, getSerialLastError, getSerialReachableBoards, releaseESP32SerialPorts } from './esp32-serial.js';
+import { clampLeaseSeconds, clearLease, readLease, writeLease } from './esp32-flash-lease.js';
 import { loadWifiConfig } from './wifi-config.js';
 import { getConnectedAdbDevices, hasAdb, getAdbDeviceCount } from './adb-reverse.js';
 import { getPixooDeviceDetails, pixooDeviceCount } from './pixoo/pixoo-bridge.js';
@@ -201,16 +202,50 @@ function saveStagedFw() {
         log(`[agentdeck] staged-fw persist failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/** Resolve a stage target (canonical board, registry key, or IP) to the board
+ *  string the advert is keyed on.
+ *
+ *  This map is read back by `stagedFwAdvert(device_info.board)`, so anything
+ *  else stored as the key is an advert that can never fire. Staging with an IP
+ *  is not a misuse to reject — it is the documented way to name one unit when
+ *  two share a `board` string (see esp32-ota's ambiguity error) — so normalize
+ *  it here instead. Consequence worth stating: the feed pull carries only a
+ *  board, so a stage aimed at one unit adverts to every unit of that board.
+ *  They run the same image, so that is correct rather than merely tolerable.
+ *
+ *  Unlike `findWifiOtaTarget` this must NOT require an open socket: a
+ *  wake-sync-sleep board holds none by design, which is the entire reason
+ *  staging exists. An unrecognized target is kept verbatim — staging for a
+ *  board this daemon has not met yet is legitimate. */
+function resolveStagedFwBoard(target) {
+    for (const [key, device] of wifiEsp32Devices) {
+        if (key === target || device.board === target || device.ip === target)
+            return device.board;
+    }
+    // A pull-sync client ages out of the WS roster between wakes; the feed
+    // tracker keeps its IP→board memory precisely for that gap.
+    const puller = feedPulls.clients().find((c) => c.client === target || c.board === target);
+    return puller?.board ?? target;
+}
 /** Stage a build for a board. Reads the file once to fingerprint it; the file
  *  itself is re-read at device download time (a rebuild at the same path is
- *  re-fingerprinted by re-staging). */
-function stageEsp32Fw(board, firmwarePath) {
+ *  re-fingerprinted by re-staging).
+ *
+ *  `pullSeen` reports whether this daemon has actually observed a feed pull
+ *  from the board, because "staged" proves neither transfer nor install and a
+ *  bare success reads as if it did. Only pull-sync firmware fetches a staged
+ *  image; a board that holds a live WS never asks, so its stage sits forever
+ *  while the CLI says it is handled. It is daemon-lifetime state, so `false`
+ *  means "not seen since this daemon started" — not "cannot pull". */
+function stageEsp32Fw(target, firmwarePath) {
+    const board = resolveStagedFwBoard(target);
     const firmware = readFileSync(firmwarePath);
     const md5 = createHash('md5').update(firmware).digest('hex');
     stagedFwByBoard.set(board, { firmwarePath, md5, size: firmware.length, stagedAt: Date.now() });
     saveStagedFw();
-    log(`[agentdeck] staged firmware for ${board}: ${firmware.length} bytes md5=${md5} — installs on its next feed pull`);
-    return { board, bytes: firmware.length, md5 };
+    const pullSeen = feedPulls.clients().some((c) => c.board === board);
+    log(`[agentdeck] staged firmware for ${board}: ${firmware.length} bytes md5=${md5} — ${pullSeen ? 'installs on its next feed pull' : 'NO feed pull seen from this board since daemon start'}`);
+    return { board, bytes: firmware.length, md5, pullSeen };
 }
 /** The staged advert for a feed response, re-validated against the file on
  *  disk so a rebuilt-in-place binary never adverts a stale md5. */
@@ -490,6 +525,11 @@ export const __wifiOtaTestApi = {
     unregisterWifiEsp32Socket,
     handleEsp32OtaReply,
     performWifiEsp32Ota,
+    resolveStagedFwBoard,
+    stageEsp32Fw,
+    stagedFwAdvert,
+    feedPulls,
+    clearStagedFwForTest: () => { stagedFwByBoard.clear(); },
 };
 async function performWifiEsp32Ota(core, target, firmwarePath) {
     const { key, device } = findWifiOtaTarget(target);
@@ -679,13 +719,15 @@ async function fetchUsageViaWs(siblings) {
 export async function fetchUsageRelayed(selfPort) {
     const sessions = listActiveSessions();
     const siblings = sessions.filter(s => s.port !== selfPort && s.agentType !== 'daemon');
+    // A sibling's reading is a real successful one, not a failure fallback, so it
+    // is `fresh` — its age contract is the 5-minute gate inside fetchUsageViaHttp.
     if (siblings.length > 0) {
         const httpResult = await fetchUsageViaHttp(siblings);
         if (httpResult)
-            return httpResult.usage;
+            return { data: httpResult.usage, fresh: true };
         const wsResult = await fetchUsageViaWs(siblings);
         if (wsResult)
-            return wsResult;
+            return { data: wsResult, fresh: true };
         // Relay is only an optimization to avoid multiple API pollers. A PTY session
         // bridge only refreshes usage when it has *direct* inbound WS clients, but
         // dashboards/Stream Deck connect to the daemon (sole entry point) — so a
@@ -1093,6 +1135,10 @@ export async function startDaemon(opts) {
     /** Produces live timeline rows for observed Kiro sessions — see the class
      *  doc for why Kiro needs a producer when hook agents do not. */
     const kiroTimelineFeed = new KiroTimelineFeed();
+    /** Kiro has no CLI hooks, so transcript rows also feed APME. These maps are
+     *  bounded by the observer's current live set and discarded on disappearance. */
+    const kiroApmeSessions = new Set();
+    const kiroApmeResponseBySession = new Map();
     /** Observed Claude sessions whose AskUserQuestion PreToolUse is held open for
      *  a device answer, keyed by the bare Claude session UUID. Its presence is
      *  what makes the session's options pressable (`liveAnswerable`) and what
@@ -1606,6 +1652,62 @@ export async function startDaemon(opts) {
             }
             return;
         }
+        // ===== Serial suspend / resume (USB flashing) =====
+        // Both sit BEHIND the normal auth gate — `isAuthorizedHttpRequest()` treats
+        // same-machine as authenticated, which is exactly the audience here, so
+        // this adds no standing unauthenticated route. The one always-on pre-auth
+        // route is still `GET /health`.
+        //
+        // `agentdeck esp32 flash` calls suspend, flashes, and calls resume in a
+        // `finally`. Neither call is load-bearing on its own: expiry is enforced
+        // when the lease is READ, so a CLI that is killed mid-flash recovers with
+        // nothing running.
+        if (req.method === 'POST' && pathname === '/esp32/serial/suspend') {
+            (async () => {
+                const body = await readJsonBody(req);
+                const seconds = clampLeaseSeconds(body.seconds ?? 120);
+                const lease = writeLease({
+                    until: Date.now() + seconds * 1000,
+                    reason: typeof body.reason === 'string' ? body.reason : 'usb flash',
+                    pid: typeof body.pid === 'number' ? body.pid : undefined,
+                    board: typeof body.board === 'string' ? body.board : undefined,
+                });
+                // Refusing to OPEN is only half of it — a port this daemon already
+                // holds still blocks the flasher, and two readers on one TTY steal
+                // each other's bytes instead of failing cleanly.
+                const released = releaseESP32SerialPorts(`flash lease (${lease.board ?? 'usb flash'})`);
+                return { ok: true, until: lease.until, seconds, released };
+            })().then((result) => {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(result));
+            }).catch((err) => {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: err instanceof Error ? err.message : String(err) }));
+            });
+            return;
+        }
+        if (req.method === 'POST' && pathname === '/esp32/serial/resume') {
+            // Idempotent by contract: resuming when nothing is suspended is a
+            // success. The CLI calls this from a `finally`, where it may well run
+            // after the lease has already expired on its own.
+            const was = readLease();
+            clearLease();
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, wasSuspended: was !== null }));
+            return;
+        }
+        if (req.method === 'GET' && pathname === '/esp32/serial/status') {
+            const lease = readLease();
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                ok: true,
+                suspended: lease !== null,
+                until: lease?.until,
+                board: lease?.board,
+                ports: getESP32Ports(),
+            }));
+            return;
+        }
         if (req.method === 'POST' && pathname === '/esp32/ota') {
             (async () => {
                 const body = await readJsonBody(req);
@@ -3074,15 +3176,7 @@ export async function startDaemon(opts) {
         // Reset backoff from pre-sleep failures and fetch fresh usage after network stabilizes
         resetConsecutiveFailures();
         setTimeout(() => {
-            fetchUsageRelayed(port).then((usage) => {
-                if (usage)
-                    core.updateApiUsage(usage);
-                else {
-                    core.oauthConnected = hasOAuthToken();
-                    if (core.cachedApiUsage)
-                        core.apiUsageStale = true;
-                }
-            });
+            fetchUsageRelayed(port).then((result) => core.applyUsageResult(result));
         }, 4000);
     });
     // Subscribe to sibling session bridges' timelines + modelCatalog relay
@@ -3177,6 +3271,19 @@ export async function startDaemon(opts) {
             // So split the event by half instead of by event: the ACCOUNT half (quota,
             // scoped caps, extra usage, subscriptions, Codex/Ollama, usageStale) comes
             // from the daemon's authoritative aggregate, the SESSION half from the relay.
+            //
+            // That split applies on the `else` branch ONLY. When the relay carries
+            // Claude percentages its event goes out verbatim, so the account half —
+            // `codexRateLimits` included — is the BRIDGE's. Usually identical: both
+            // sides run the same plan-aware rollout read. They can differ only when no
+            // plan-matching rollout exists at all, since the daemon additionally holds
+            // a `codex app-server` reading that a session bridge structurally cannot
+            // (no host processes there) — then successive events alternate between a
+            // real Codex window and a voided one. Left as is deliberately: the only
+            // targeted fix is to overwrite the block from `core.buildUsage()` here, and
+            // that is the call which arms the throttled spawn, on the one path whose
+            // whole history is about not clobbering the dashboard. Tracked as issue
+            // #253, not just as this comment.
             if (hasClaudeData) {
                 core.wsServer.broadcast(evt);
             }
@@ -3466,11 +3573,46 @@ export async function startDaemon(opts) {
         // beside it stays empty. #218 taught the per-session QUERY to read Kiro's
         // own transcript; the main timeline is a STREAM, and this is what feeds it.
         try {
-            const kiroIds = passiveSessionObserver.collect([])
-                .filter((s) => typeof s.agentType === 'string' && s.agentType.startsWith('kiro'))
-                .map((s) => s.id);
+            const observedKiro = passiveSessionObserver.collect([])
+                .filter((s) => typeof s.agentType === 'string' && s.agentType.startsWith('kiro'));
+            const kiroIds = observedKiro.map((s) => s.id);
+            const projectBySession = new Map(observedKiro.map((s) => [rawSessionId(s.id), s.projectName]));
+            const currentSessions = new Set(kiroIds.map(rawSessionId));
+            for (const sessionId of kiroApmeSessions) {
+                if (currentSessions.has(sessionId))
+                    continue;
+                apme?.collector.closeRun(sessionId);
+                kiroApmeSessions.delete(sessionId);
+                kiroApmeResponseBySession.delete(sessionId);
+            }
             for (const entry of kiroTimelineFeed.pump(kiroIds)) {
                 core.bridgeTimeline.addEntry(entry);
+                if (!apme || !entry.sessionId)
+                    continue;
+                const sessionId = rawSessionId(entry.sessionId);
+                if (entry.type === 'chat_start') {
+                    if (!apme.collector.getRunId(sessionId)) {
+                        apme.collector.openRun({
+                            sessionId,
+                            agentType: 'kiro-cli',
+                            projectName: projectBySession.get(sessionId) ?? undefined,
+                        });
+                    }
+                    kiroApmeSessions.add(sessionId);
+                    kiroApmeResponseBySession.delete(sessionId);
+                    apme.collector.ingestHook(sessionId, 'user_prompt_submit', {
+                        prompt: entry.detail || entry.raw,
+                        agent_type: 'kiro-cli',
+                        project_name: projectBySession.get(sessionId),
+                    });
+                }
+                else if (entry.type === 'chat_response' && apme.collector.getRunId(sessionId)) {
+                    const piece = entry.detail || entry.raw;
+                    const response = [kiroApmeResponseBySession.get(sessionId), piece].filter(Boolean).join('\n');
+                    kiroApmeResponseBySession.set(sessionId, response);
+                    apme.collector.setTurnResponse(sessionId, response);
+                    apme.collector.noteTurnStop(sessionId);
+                }
             }
         }
         catch (err) {
@@ -4458,12 +4600,7 @@ export async function startDaemon(opts) {
             return;
         }
         if (cmd.type === 'query_usage') {
-            fetchUsageRelayed(port).then((usage) => {
-                if (usage)
-                    core.updateApiUsage(usage);
-                else if (core.cachedApiUsage)
-                    core.apiUsageStale = true;
-            });
+            fetchUsageRelayed(port).then((result) => core.applyUsageResult(result));
         }
     };
     // ── Device-sourced voice ──────────────────────────────────────────────
@@ -5286,15 +5423,7 @@ export async function startDaemon(opts) {
         // Fetch usage on connect if stale
         const cacheAge = Date.now() - core.lastApiFetchTime;
         if (!core.cachedApiUsage || (core.lastApiFetchTime > 0 && cacheAge > 5 * 60 * 1000)) {
-            fetchUsageRelayed(port).then((usage) => {
-                if (usage)
-                    core.updateApiUsage(usage);
-                else {
-                    core.oauthConnected = hasOAuthToken();
-                    if (core.cachedApiUsage)
-                        core.apiUsageStale = true;
-                }
-            });
+            fetchUsageRelayed(port).then((result) => core.applyUsageResult(result));
         }
     });
     core.wsServer.onClientDisconnect((ws) => {
@@ -5511,15 +5640,7 @@ export async function startDaemon(opts) {
     }
     // Initial usage fetch (delayed 10s)
     core.addTimeout(setTimeout(() => {
-        fetchUsageRelayed(port).then((usage) => {
-            if (usage)
-                core.updateApiUsage(usage);
-            else {
-                core.oauthConnected = hasOAuthToken();
-                if (core.cachedApiUsage)
-                    core.apiUsageStale = true;
-            }
-        });
+        fetchUsageRelayed(port).then((result) => core.applyUsageResult(result));
     }, 10_000));
     // Backstop sweep for held PreToolUse approval responses whose per-entry timer
     // somehow didn't fire — resolves anything older than 60s to "ask" so a held