@aiwayds/dsh-tui-pi 0.28.0 → 1.0.0

package/lib/repair-dialog.js

@@ -0,0 +1,153 @@
+/**
+ * The /resume repair confirmation dialog — shown when a picked session's
+ * log fails to load with a corrupt-log error (src/log-repair.ts
+ * `isCorruptLogError`). Repairing rewrites user data on disk, so it is
+ * NEVER done implicitly: this dialog is the explicit confirmation gate.
+ *
+ * Two options, in the spec's button order:
+ *   1. Repair & resume — run the guarded in-place repair, then re-enter the
+ *      selected row's resume path.
+ *   2. Cancel — leave the log untouched; /resume reports the original error.
+ * ↑↓ moves the selection, `1`/`2` select directly, Enter confirms, Esc
+ * cancels — the exact keymap of the submit routing dialog (route-dialog.ts),
+ * whose pure-reducer split this file mirrors so the decision matrix stays
+ * unit-testable without a terminal. Framing/focus follow the shared overlay
+ * contract: PanelHost framing, close re-focuses the CURRENT editor instance
+ * through `restoreFocus`.
+ */
+import { getKeybindings } from '@earendil-works/pi-tui';
+import { PanelHost, panelThemeFns } from "./panels.js";
+import { BOLD, RESET, ansiFg } from "./theme/index.js";
+import { clipToWidth, wrapText } from "./text.js";
+/** The two choices in display order; index 0 is preselected. */
+export const REPAIR_CONFIRM_OPTIONS = [
+    { id: 'repair', title: 'Repair & resume', hint: 'rebuild the log in place, then enter the session' },
+    { id: 'cancel', title: 'Cancel', hint: 'leave the log untouched' },
+];
+/** The fixed body copy (spec wording): what happened, what repair does, what is kept. */
+export const REPAIR_CONFIRM_MESSAGE = 'Resume log is corrupted (likely from a historical double-writer). '
+    + 'Repair it in place? The original is kept as .corrupt-bak.';
+/** Footer hint — hardcoded like every other panel footer (English-only). */
+export const REPAIR_CONFIRM_FOOTER = '↑↓ select · 1/2 pick · Enter confirm · Esc cancel';
+export function initialRepairConfirmState() {
+    return { selected: 0 };
+}
+/**
+ * Apply one raw key sequence to the dialog state. Unknown keys are no-ops;
+ * anything after a settle is ignored (single terminal outcome guard).
+ */
+export function updateRepairConfirm(state, data) {
+    if (state.settled !== undefined)
+        return state;
+    const kb = getKeybindings();
+    if (kb.matches(data, 'tui.select.cancel'))
+        return { ...state, settled: 'cancel' };
+    if (kb.matches(data, 'tui.input.submit'))
+        return { ...state, settled: 'confirm' };
+    if (kb.matches(data, 'tui.select.up')) {
+        return { ...state, selected: Math.max(0, state.selected - 1) };
+    }
+    if (kb.matches(data, 'tui.select.down')) {
+        return { ...state, selected: Math.min(REPAIR_CONFIRM_OPTIONS.length - 1, state.selected + 1) };
+    }
+    // Digit direct-select (1-based): selects the row, Enter still confirms —
+    // same select-then-confirm split as the routing dialog.
+    const digit = /^([1-9])$/.exec(data);
+    if (digit !== null) {
+        const index = Number(digit[1]) - 1;
+        if (index < REPAIR_CONFIRM_OPTIONS.length)
+            return { ...state, selected: index };
+    }
+    return state;
+}
+/** Resolved dialog outcome: the chosen action, or undefined on cancel. */
+export function repairConfirmOutcome(state) {
+    if (state.settled !== 'confirm')
+        return undefined;
+    return REPAIR_CONFIRM_OPTIONS[state.selected]?.id;
+}
+/**
+ * The framed overlay component. Renders the fixed body copy plus the two
+ * option rows; every key goes through {@link updateRepairConfirm}, and the
+ * first terminal key fires `onFinish` exactly once.
+ */
+export class RepairConfirmPanel {
+    theme;
+    onFinish;
+    requestRenderFn;
+    state = initialRepairConfirmState();
+    constructor(theme, onFinish, requestRender) {
+        this.theme = theme;
+        this.onFinish = onFinish;
+        this.requestRenderFn = requestRender;
+    }
+    invalidate() { }
+    render(width) {
+        const fns = panelThemeFns(this.theme);
+        const wrap = Math.max(2, width - 2);
+        // Word-wrap the body FIRST, then paint (iron rule: width math runs on
+        // plain text, ANSI goes on after clipping).
+        const lines = [
+            fns.accent(BOLD + clipToWidth('● Corrupted resume log', wrap) + RESET),
+            ...wrapText(REPAIR_CONFIRM_MESSAGE, wrap).map(segment => fns.muted(clipToWidth(segment, wrap))),
+            '',
+        ];
+        for (let i = 0; i < REPAIR_CONFIRM_OPTIONS.length; i++) {
+            const option = REPAIR_CONFIRM_OPTIONS[i];
+            const marker = i === this.state.selected ? '▸' : ' ';
+            const row = clipToWidth(`${marker} ${i + 1}. ${option.title} — ${option.hint}`, wrap);
+            lines.push(i === this.state.selected
+                ? ansiFg(this.theme.palette.accent) + BOLD + row + RESET
+                : fns.muted(row));
+        }
+        lines.push('');
+        lines.push(fns.subtle(clipToWidth(REPAIR_CONFIRM_FOOTER, wrap)));
+        return lines;
+    }
+    handleInput(data) {
+        const previous = this.state;
+        this.state = updateRepairConfirm(this.state, data);
+        if (this.state === previous)
+            return;
+        if (this.state.settled === undefined) {
+            this.requestRenderFn();
+            return;
+        }
+        this.onFinish(repairConfirmOutcome(this.state));
+    }
+}
+/**
+ * Open the repair confirmation dialog for one corrupt resume target.
+ * Resolves `'repair'` when the user explicitly confirmed, `'cancelled'`
+ * otherwise (Esc, or an overlay that failed to mount — treated as cancel so
+ * a half-mounted dialog can never imply consent). Closing always hands
+ * focus back through `restoreFocus` before the promise settles.
+ */
+export function openRepairConfirmDialog(tui, theme, restoreFocus) {
+    return new Promise(resolve => {
+        let settled = false;
+        const settle = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(outcome);
+        };
+        // A half-mounted overlay must not strand the keyboard: PanelHost's
+        // onError closes + calls restoreFocus, then we settle as cancelled.
+        const host = new PanelHost(tui, theme, () => {
+            restoreFocus();
+            settle('cancelled');
+        });
+        const finish = (outcome) => {
+            host.close();
+            restoreFocus();
+            settle(outcome === 'repair' ? 'repair' : 'cancelled');
+        };
+        const panel = new RepairConfirmPanel(theme, outcome => finish(outcome), () => tui.requestRender());
+        // maxHeight is a hard slice in pi-tui: ~9 content rows + 5 frame rows
+        // must fit or the bottom border (and footer) is cut. 75% of the 24-row
+        // e2e floor is 18 — the same headroom the /resume picker reserves.
+        host.open(panel, '70%', '75%');
+    });
+}
+//# sourceMappingURL=repair-dialog.js.map

package/lib/repair-dialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repair-dialog.js","sourceRoot":"","sources":["../src/repair-dialog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,cAAc,EAA4B,MAAM,wBAAwB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEjD,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAA4E;IAC7G,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,kDAAkD,EAAE;IACpG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE;CACnE,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GACjC,oEAAoE;MAClE,2DAA2D,CAAA;AAE/D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,mDAAmD,CAAA;AAYxF,MAAM,UAAU,yBAAyB;IACvC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,IAAY;IACzE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC7C,MAAM,EAAE,GAAG,cAAc,EAAE,CAAA;IAC3B,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IACjF,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IACjF,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAA;IAChE,CAAC;IACD,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAA;IAChG,CAAC;IACD,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,GAAG,sBAAsB,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACjF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACjD,OAAO,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,KAAK,CAAU;IACf,QAAQ,CAAoD;IAC5D,eAAe,CAAY;IACpC,KAAK,GAAuB,yBAAyB,EAAE,CAAA;IAE/D,YACE,KAAe,EACf,QAA4D,EAC5D,aAAyB;QAEzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,eAAe,GAAG,aAAa,CAAA;IACtC,CAAC;IAED,UAAU,KAAU,CAAC;IAErB,MAAM,CAAC,KAAa;QAClB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;QACnC,sEAAsE;QACtE,4CAA4C;QAC5C,MAAM,KAAK,GAAa;YACtB,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC,wBAAwB,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;YACtE,GAAG,QAAQ,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/F,EAAE;SACH,CAAA;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAE,CAAA;YACzC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;YACpD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAA;YACrF,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK;gBACxD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QAChE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAM;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,EAAE,CAAA;YACtB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAQ,EACR,KAAe,EACf,YAAwB;IAExB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,CAAC,OAA+B,EAAQ,EAAE;YACvD,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,CAAC,OAAO,CAAC,CAAA;QAClB,CAAC,CAAA;QACD,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YAC1C,YAAY,EAAE,CAAA;YACd,MAAM,CAAC,WAAW,CAAC,CAAA;QACrB,CAAC,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,CAAC,OAAwC,EAAQ,EAAE;YAChE,IAAI,CAAC,KAAK,EAAE,CAAA;YACZ,YAAY,EAAE,CAAA;YACd,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QACvD,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAClC,KAAK,EACL,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAC1B,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAC1B,CAAA;QACD,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/session.d.ts

@@ -19,6 +19,13 @@ export interface BridgeCallbacks {
     onEvent(event: SessionEvent): void;
     /** Whole-agent lifecycle transition. */
     onStatus(status: 'idle' | 'running'): void;
+    /**
+     * Watched remote session is idle and queued follow-ups await: the bridge
+     * already took the writer lock; rebind locally (like a manual /resume)
+     * then drain takePendingRemoteFollowups(). Throw ⇒ back to watching;
+     * the poll retries. Absent ⇒ queuing still works, waits for manual resume.
+     */
+    onRemotePromotable?(sessionId: string): Promise<void>;
     /** Live snapshot of tracked subagent (child session) rows, on any change. */
     onLive(agents: readonly AgentView[]): void;
     /**
@@ -58,6 +65,30 @@ export declare class DshSessionBridge {
     private resuming;
     /** Target id of the in-flight resume — see `resume()`/`getResumingSessionId()`. */
     private resumeTargetId;
+    /**
+     * Session dirs whose cross-process writer lock THIS bridge established via
+     * a cold arm. Release is bound to the owning handle's disposal
+     * (`ownWithLock`), so the set itself only tracks double-release safety.
+     */
+    private readonly heldLockDirs;
+    /** Active cross-process read-only view (see watchRemote). */
+    private remoteTail;
+    /** Session watched read-only right now. */
+    private remoteWatchId;
+    /** Follow-ups typed while watching — sent once promotion wins the lock. */
+    private readonly remoteFollowups;
+    private promotingRemote;
+    private promoteTimer;
+    private idleReleaseTimer;
+    /** Writer lock taken for the CURRENTLY bound local agent (see drive arms). */
+    private driveLock;
+    /** Test seam + tuning for the watcher (interval/decoder injection). */
+    private readonly remoteTailOptions;
+    private readonly idleReleaseDelayMs;
+    private readonly promoteIntervalMs;
+    /** Serializes watch-lifecycle ops against the promotion poll. */
+    private opChain;
+    private runExclusive;
     private readonly disposers;
     private sessionId;
     /** Agent preset id to pass to `meta.agentPreset` on the next `createSession`. */
@@ -153,7 +184,14 @@ export declare class DshSessionBridge {
     private readonly trackedSessions;
     /** `${runId}:${seq}` → childId, for `tool-workflow/agent-end` pairing. */
     private readonly runSeqToChild;
-    constructor(ctx: Context, callbacks: BridgeCallbacks);
+    constructor(ctx: Context, callbacks: BridgeCallbacks, options?: {
+        remoteTailOptions?: {
+            intervalMs?: number;
+            decode?(file: string): Promise<string>;
+        };
+        idleReleaseDelayMs?: number;
+        promoteIntervalMs?: number;
+    });
     /**
      * Re-derive each tracked child's round count from its own session log
      * (`ctx.sessions`), the authoritative append-only facts. The firehose
@@ -198,6 +236,38 @@ export declare class DshSessionBridge {
     isChildLogTruncated(childId: string): boolean;
     /** Queue one user prompt, creating the session lazily on first use. */
     prompt(text: string): Promise<void>;
+    /** While a remote watch is active input QUEUES instead of driving. */
+    isReadOnlyView(): boolean;
+    /** Follow-ups typed while watching, oldest first; takes them all. */
+    takePendingRemoteFollowups(): string[];
+    /**
+     * READ-ONLY cross-process view: another dsh process drives this session
+     * (the single-writer guard refused our cold resume), so sync DISPLAY from
+     * its persisted log instead — poll-decode, emit durable events through
+     * the same render pipeline a live session uses. Contract: latency ≈ poll
+     * interval, streaming detail omitted, every turn's final assistant
+     * message arrives. Replaces any prior binding; ends via stopRemoteWatch
+     * on dispose or the next resume.
+     */
+    watchRemote(sessionId: string): Promise<void>;
+    private watchRemoteInner;
+    private stopRemoteWatch;
+    /**
+     * Contract "idle releases the write; next input takes it": when OUR agent
+     * settles with nothing pending locally (own re-wake included), drop the
+     * writer lock so another surface can take over. Delayed once and
+     * re-checked because upstream may latch idle only to immediately replay
+     * a queued wake as a new turn.
+     */
+    private scheduleIdleRelease;
+    /**
+     * Promote poll tick: viewer + queued follow-ups + watched driver idle →
+     * race for the writer lock; winning hands to onRemotePromotable (UI
+     * rebuild via resume + queue drain), losing retries next tick. All async
+     * sequencing stays in THIS loop — never inside event callbacks.
+     */
+    private maybePromoteRemote;
+    private maybePromoteRemoteInner;
     /** The live agent, creating the session lazily when needed. */
     ensureAgent(): Promise<Agent>;
     /** The live agent when a session already exists (no creation side effect). */
@@ -239,6 +309,31 @@ export declare class DshSessionBridge {
      * an empty `onLive` is emitted so the renderer drops the agents block.
      */
     detachCurrent(): Promise<void>;
+    /**
+     * Historical cwd for a session, from the persistence header list — the
+     * log lives under THAT project key. All access best-effort: an absent
+     * service or odd host yields undefined and the arm stays UNGUARDED
+     * (fail-open, never locks a decoy), never breaks the resume.
+     */
+    private headerCwdOf;
+    /**
+     * Single-writer guard for COLD arms (create / cold resume) only — the
+     * adopt arm above shares the live instance in-process and must stay
+     * lock-free. Locks sit beside the jsonl log so every process that could
+     * append to it competes on one file; a live foreign holder throws
+     * WriterLockedError (surfaces as "Cannot resume <id>: session is locked
+     * by a live process …"). `knownCwd` skips the header scan for creations,
+     * which always target process.cwd().
+     */
+    private acquireSessionLock;
+    /** Undo a guard whose arm then failed — transient errors must not pin the session. */
+    private releaseColdLock;
+    /**
+     * Bind lock release to an owned handle's disposal — every teardown path
+     * already goes through handle.dispose(), so this is the single choke
+     * point; switching away or exiting releases what we established.
+     */
+    private ownWithLock;
     /**
      * Resume a persisted session: tear down the live agent (disposers are kept —
      * the session-id filter re-binds to the resumed id) and load the persisted