@aiwayds/dsh-tui-pi 2.12.0 → 2.13.0

package/lib/session.js

@@ -14,6 +14,7 @@ import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { SettingsConflictError } from '@deepseek-ai/dsh-settings';
 import { SessionId, SessionLogOffset } from '@deepseek-ai/dsh-session';
 import { readAppendSystem } from "./append-system.js";
+import { statSync } from 'node:fs';
 import { join } from 'node:path';
 import { descriptorModelRoute, isAgentEnd, isAgentStart, isDcpCompactionNotice, isLlmRetry, isSubagentDescriptor, isTuiPluginInjection } from "./dsh-events.js";
 import { loadModelProfiles, modelProfilesPath, resolvePinnedProfile } from "./model-profiles.js";
@@ -21,7 +22,7 @@ import { installSpawnToolFence, markTuiSurface } from "./subagent-policy.js";
 import { RemoteSessionTail } from "./remote-tail.js";
 import { sessionLogRoot } from "./sessions.js";
 import { estimateContentTokens, estimateTextTokens } from "./tokens.js";
-import { acquireWriterLock, projectKeyFor, releaseOwnedWriterLock, WriterLockedError } from "./writer-lock.js";
+import { projectKeyFor } from "./session-dir.js";
 /**
  * Register the APPEND_SYSTEM.md section on ONE agent's scoped context, so the
  * user's orchestrator identity applies to the TUI's main agent ONLY. A section
@@ -170,12 +171,6 @@ export class DshSessionBridge {
     resuming;
     /** Target id of the in-flight resume — see `resume()`/`getResumingSessionId()`. */
     resumeTargetId;
-    /**
-     * Session dirs whose cross-process writer lock THIS bridge established via
-     * a cold arm. Release is bound to the owning handle's disposal
-     * (`ownWithLock`), so the set itself only tracks double-release safety.
-     */
-    heldLockDirs = new Set();
     /** Active cross-process read-only view (see watchRemote). */
     remoteTail;
     /** Session watched read-only right now. */
@@ -184,12 +179,8 @@ export class DshSessionBridge {
     remoteFollowups = [];
     promotingRemote = false;
     promoteTimer;
-    idleReleaseTimer;
-    /** Writer lock taken for the CURRENTLY bound local agent (see drive arms). */
-    driveLock;
     /** Test seam + tuning for the watcher (interval/decoder injection). */
     remoteTailOptions;
-    idleReleaseDelayMs;
     promoteIntervalMs;
     /** Serializes watch-lifecycle ops against the promotion poll. */
     opChain = Promise.resolve();
@@ -301,11 +292,16 @@ export class DshSessionBridge {
     trackedSessions = new Set();
     /** `${runId}:${seq}` → childId, for `tool-workflow/agent-end` pairing. */
     runSeqToChild = new Map();
+    /**
+     * Session id → the open attempt's turn/step, pinned by `agent/assistant-stream`
+     * start frames so chunk frames (which carry no turn/step) can drive the same
+     * fold paths the old firehose `assistant/chunk` events did. Cleared on end.
+     */
+    openAttempts = new Map();
     constructor(ctx, callbacks, options = {}) {
         this.ctx = ctx;
         this.callbacks = callbacks;
         this.remoteTailOptions = options.remoteTailOptions ?? {};
-        this.idleReleaseDelayMs = options.idleReleaseDelayMs ?? 800;
         this.promoteIntervalMs = options.promoteIntervalMs ?? 1000;
         // Footer shows provider/model from the very first frame — read the cwd
         // pin (if any) else the composed default selection eagerly; a session
@@ -369,13 +365,26 @@ export class DshSessionBridge {
                 this.callbacks.onEvent(event);
             }
         }));
+        // dsh 0.1.5-rc.1: the incremental streaming deltas left the firehose (it
+        // now delivers settlements only) and moved to per-agent
+        // `agent/assistant-stream` frames — start pins the attempt's turn/step,
+        // chunk frames carry the raw deltas, end closes the attempt. Root-scope
+        // listening sees every agent; frames route by session id: the bridge's
+        // own session drives the transcript/typewriter + occupancy estimate,
+        // tracked children fold into the live rows' content tail.
+        this.disposers.push(ctx.on('agent/assistant-stream', ({ agent, frame }) => {
+            try {
+                this.onStreamFrame(String(agent.id), frame);
+            }
+            catch {
+                // A malformed frame must never take the bridge down.
+            }
+        }));
         this.disposers.push(ctx.on('agent/status', ({ agent, status }) => {
             if (this.handle === undefined || agent.id !== this.handle.agent.id)
                 return;
             this.running = status === 'running';
             this.callbacks.onStatus(status);
-            if (status === 'idle')
-                this.scheduleIdleRelease();
         }));
         // Round-count reconcile fallback: keep "rounds" and the maxRounds policy
         // live even when a child's own events never bubble to this plugin (see
@@ -657,11 +666,34 @@ export class DshSessionBridge {
     }
     async watchRemoteInner(sessionId) {
         await this.stopRemoteWatch();
-        // Same derivation as acquireSessionLock — no cwd, no view.
+        // The jsonl backend's own dir derivation — no cwd, no view.
         const cwd = await this.headerCwdOf(sessionId);
         if (cwd === undefined)
             throw new Error(`cannot locate the log of ${sessionId} for read-only viewing`);
-        const file = join(sessionLogRoot(), projectKeyFor(cwd), sessionId, 'session.jsonl.zstd');
+        const dir = join(sessionLogRoot(), projectKeyFor(cwd), sessionId);
+        // The artifact name carries the format generation since the V3 format
+        // (session.v3.jsonl[.zstd]); legacy sessions keep session.jsonl[.zstd].
+        // Prefer the current generation, compressed over raw; when nothing is
+        // on disk yet, fall back to the legacy canonical name — the tail
+        // tolerates a not-yet-existing file.
+        const candidates = [
+            'session.v3.jsonl.zstd',
+            'session.v3.jsonl',
+            'session.jsonl.zstd',
+            'session.jsonl',
+        ];
+        let file = join(dir, 'session.jsonl.zstd');
+        for (const name of candidates) {
+            const candidate = join(dir, name);
+            try {
+                statSync(candidate);
+                file = candidate;
+                break;
+            }
+            catch {
+                // Not this name — try the next one.
+            }
+        }
         // The firehose gate uses this id; harmless cross-process (nothing in
         // THIS process will publish for it) and required so a later local agent
         // for the SAME id (post-switch) re-binds cleanly.
@@ -726,40 +758,11 @@ export class DshSessionBridge {
         this.remoteTail = undefined;
     }
     /**
-     * Contract "idle releases the write; next input takes it": when OUR agent
-     * settles with nothing pending locally (own re-wake included), drop the
-     * writer lock so another surface can take over. Delayed once and
-     * re-checked because upstream may latch idle only to immediately replay
-     * a queued wake as a new turn.
-     */
-    scheduleIdleRelease() {
-        if (this.idleReleaseTimer !== undefined)
-            clearTimeout(this.idleReleaseTimer);
-        this.idleReleaseTimer = setTimeout(() => {
-            this.idleReleaseTimer = undefined;
-            if (this.running)
-                return;
-            // Contained: foreign-shaped agents must not let a release timer blow
-            // up the process; when the inbox is unreadable we conservatively keep
-            // the lock.
-            try {
-                if (this.getPendingPrompts().length > 0)
-                    return;
-            }
-            catch {
-                return;
-            }
-            const lock = this.driveLock;
-            if (lock === undefined)
-                return;
-            void this.releaseColdLock(lock);
-        }, this.idleReleaseDelayMs);
-    }
-    /**
-     * Promote poll tick: viewer + queued follow-ups + watched driver idle →
-     * race for the writer lock; winning hands to onRemotePromotable (UI
-     * rebuild via resume + queue drain), losing retries next tick. All async
-     * sequencing stays in THIS loop — never inside event callbacks.
+     * Promote poll tick: viewer + queued follow-ups + watched driver gone →
+     * attempt the takeover (onRemotePromotable rebuilds the UI via resume +
+     * queue drain); an owned session still refuses the resume and we retry
+     * next tick. All async sequencing stays in THIS loop — never inside
+     * event callbacks.
      */
     maybePromoteRemote() {
         return this.runExclusive(async () => {
@@ -776,26 +779,15 @@ export class DshSessionBridge {
         if (promote === undefined)
             return;
         this.promotingRemote = true;
-        let locked = false;
-        try {
-            await this.acquireSessionLock(id);
-            locked = true;
-        }
-        catch {
-            /* still held / driver alive — retry next poll */
-        }
-        if (!locked) {
-            this.promotingRemote = false;
-            return;
-        }
         await this.stopRemoteWatch(); // ends the view BEFORE any UI rebuild
         try {
             await promote(id);
             this.promotingRemote = false;
         }
         catch {
-            // Took the lock but the rebuild failed: back to spectating; ownership
-            // persists cooperatively so the retry below costs nothing extra.
+            // The takeover failed — the other process still owns the session (the
+            // host lease refused the resume) or the rebuild broke: back to
+            // spectating; a later poll retries once the owner lets go.
             this.promotingRemote = false;
             await this.watchRemote(id).catch(() => { });
         }
@@ -948,8 +940,6 @@ export class DshSessionBridge {
     }
     /** Dispose the live agent (if any) and stop event subscriptions. */
     async dispose() {
-        if (this.idleReleaseTimer !== undefined)
-            clearTimeout(this.idleReleaseTimer);
         await this.stopRemoteWatch();
         for (const dispose of this.disposers.splice(0)) {
             try {
@@ -1036,57 +1026,6 @@ export class DshSessionBridge {
             return undefined;
         }
     }
-    /**
-     * Single-writer guard for COLD arms (create / cold resume) only — the
-     * adopt arm above shares the live instance in-process and must stay
-     * lock-free. Locks sit beside the jsonl log so every process that could
-     * append to it competes on one file; a live foreign holder throws
-     * WriterLockedError (surfaces as "Cannot resume <id>: session is locked
-     * by a live process …"). `knownCwd` skips the header scan for creations,
-     * which always target process.cwd().
-     */
-    async acquireSessionLock(sessionId, knownCwd) {
-        const cwd = knownCwd ?? (await this.headerCwdOf(sessionId));
-        if (cwd === undefined || cwd === '') {
-            // No trustworthy cwd → the derived path would be a decoy the real
-            // writer never touches (fail-open, same policy as the feishu guard):
-            // locking a decoy would silently protect nothing while pretending to.
-            return undefined;
-        }
-        const dir = join(sessionLogRoot(), projectKeyFor(cwd), sessionId);
-        const result = await acquireWriterLock(dir);
-        if (!result.ok)
-            throw new WriterLockedError(result.holder);
-        this.heldLockDirs.add(dir);
-        return { dir };
-    }
-    /** Undo a guard whose arm then failed — transient errors must not pin the session. */
-    async releaseColdLock(lock) {
-        if (lock === undefined)
-            return;
-        this.heldLockDirs.delete(lock.dir);
-        await releaseOwnedWriterLock(lock.dir);
-    }
-    /**
-     * Bind lock release to an owned handle's disposal — every teardown path
-     * already goes through handle.dispose(), so this is the single choke
-     * point; switching away or exiting releases what we established.
-     */
-    ownWithLock(handle, lock) {
-        if (lock === undefined)
-            return handle;
-        const base = handle.dispose.bind(handle);
-        const bridge = this;
-        handle.dispose = async () => {
-            try {
-                await base();
-            }
-            finally {
-                await bridge.releaseColdLock(lock);
-            }
-        };
-        return handle;
-    }
     /**
      * Tear down the current live binding — the shared prelude of every session
      * switch (resume, fork): stop the remote watch, dispose the handle, clear
@@ -1189,36 +1128,27 @@ export class DshSessionBridge {
                 }
                 return adopted;
             }
-            // Cold arm — guarded: without the registry hit above, nothing here can
-            // see whether ANOTHER process owns this id right now. Take the writer
-            // lock beside its jsonl first so a concurrent owner refuses us loudly
-            // instead of two appends interleaving into "corrupt session log".
-            const lock = await this.acquireSessionLock(String(sessionId));
-            let resumed;
-            try {
-                resumed = await this.ctx.agents.resume({
-                    resumeSessionId: sessionId,
-                    agentOptions: this.selection ?? {},
-                    // Install the mutable selection so `/model` can live-switch the route,
-                    // the APPEND_SYSTEM.md section on this agent ONLY (never its
-                    // subagents), and the spawn-tool hide so the agent sees a single
-                    // `use_agent` delegation entry. The surface marker scopes the live
-                    // disableSubagent guard to THIS agent (resume runs setup too, so a
-                    // resumed session is re-marked without relying on persisted meta).
-                    setup: async (agentCtx) => {
-                        markTuiSurface(agentCtx);
-                        installModelSelection(agentCtx, this.selectionRef);
-                        installAppendSystem(agentCtx);
-                        installSpawnToolFence(agentCtx);
-                    },
-                });
-            }
-            catch (error) {
-                await this.releaseColdLock(lock);
-                throw error;
-            }
-            this.driveLock = lock;
-            this.handle = this.ownWithLock(resumed, lock);
+            // Cold arm — cross-process single-writer arbitration is the HOST's
+            // job since 0.1.5: `agents.resume` opens the write handle under the
+            // host's kernel lease, and a session another process drives refuses
+            // here with SessionAlreadyOwnedError (surfaces as the /resume
+            // read-only fallback).
+            this.handle = await this.ctx.agents.resume({
+                resumeSessionId: sessionId,
+                agentOptions: this.selection ?? {},
+                // Install the mutable selection so `/model` can live-switch the route,
+                // the APPEND_SYSTEM.md section on this agent ONLY (never its
+                // subagents), and the spawn-tool hide so the agent sees a single
+                // `use_agent` delegation entry. The surface marker scopes the live
+                // disableSubagent guard to THIS agent (resume runs setup too, so a
+                // resumed session is re-marked without relying on persisted meta).
+                setup: async (agentCtx) => {
+                    markTuiSurface(agentCtx);
+                    installModelSelection(agentCtx, this.selectionRef);
+                    installAppendSystem(agentCtx);
+                    installSpawnToolFence(agentCtx);
+                },
+            });
             this.sessionId = sessionId;
             this.trackedSessions.add(String(sessionId));
             return this.handle;
@@ -1236,9 +1166,9 @@ export class DshSessionBridge {
      * Replay a persisted session log into the transcript and stats — the second
      * half of a resume (call after `resume()`). Stats are rebuilt from zero so
      * the footer reflects the resumed session only; replaying the same log
-     * twice is idempotent. `assistant/chunk` events are skipped: the finalized
-     * `assistant/message` carries the full text, and replaying chunks would
-     * re-run the quadratic streaming assembly for every historical step.
+     * twice is idempotent. V3 logs carry no streaming chunks at all — the
+     * finalized `assistant/message` holds the full text (and its embedded
+     * stream, which replay never needs).
      */
     replay(events) {
         this.stats.inputTokens = 0;
@@ -1254,8 +1184,6 @@ export class DshSessionBridge {
         this.pendingTokens = 0;
         const sessionId = this.sessionId;
         for (const event of events) {
-            if (event.type === 'assistant/chunk')
-                continue;
             // Replay feeds the parent log only — fold its persisted workflow events
             // through the same tracking logic so the agents view is rebuilt; child
             // live events arrive via the subscription after resume.
@@ -1316,20 +1244,11 @@ export class DshSessionBridge {
                 this.stats.contextTokens = this.contextTokens();
                 break;
             }
-            case 'assistant/chunk': {
-                // Streamed output of the in-flight request — the next request's
-                // context grows with it, so the occupancy follows the stream live.
-                // Both text and reasoning deltas are priced: usage.outputTokens
-                // includes reasoning tokens at snapshot time, so the live estimate
-                // must count reasoning too to match that accounting (the next billed
-                // assistant/message corrects the final value anyway).
-                const chunk = event.data.chunk;
-                if ((chunk?.type === 'text-delta' || chunk?.type === 'reasoning-delta') && chunk.text !== '') {
-                    this.pendingTokens += estimateTextTokens(chunk.text ?? '');
-                    this.stats.contextTokens = this.contextTokens();
-                }
+            case 'assistant/attempt':
+                // A settled attempt that produced no surface message (failed, retried,
+                // cancelled). No transcript, stats, or occupancy effect — the next
+                // billed assistant/message carries the step's real usage.
                 break;
-            }
             case 'tool/result':
                 // Tool results enter the next request — priced into the occupancy.
                 this.pendingTokens += estimateToolResultTokens(event.data);
@@ -1344,6 +1263,69 @@ export class DshSessionBridge {
                 break;
         }
     }
+    /**
+     * One `agent/assistant-stream` frame of any session in the process (dsh
+     * 0.1.5-rc.1 moved the live deltas off the firehose). Chunk frames carry no
+     * turn/step — the attempt's start frame pinned them in {@link openAttempts}.
+     */
+    onStreamFrame(sessionKey, frame) {
+        if (frame.type === 'start') {
+            this.openAttempts.set(sessionKey, { turn: frame.turn, step: frame.step });
+            return;
+        }
+        if (frame.type === 'end') {
+            this.openAttempts.delete(sessionKey);
+            return;
+        }
+        const chunk = frame.chunk;
+        if ((chunk.type !== 'text-delta' && chunk.type !== 'reasoning-delta') || (chunk.text ?? '') === '') {
+            return;
+        }
+        const delta = chunk.text ?? '';
+        if (this.sessionId !== undefined && sessionKey === String(this.sessionId)) {
+            // The bridge's own session: the occupancy estimate follows the stream
+            // (both text and reasoning are priced — usage.outputTokens includes
+            // reasoning tokens at snapshot time), and the transcript's typewriter
+            // plus the think/tool phase machine stay live between settlements.
+            const attempt = this.openAttempts.get(sessionKey);
+            const turn = attempt?.turn ?? 0;
+            const step = attempt?.step ?? 0;
+            this.pendingTokens += estimateTextTokens(delta);
+            this.stats.contextTokens = this.contextTokens();
+            this.callbacks.onStreamDelta?.(turn, step, chunk);
+            return;
+        }
+        if (this.trackedSessions.has(sessionKey) && this.childSessions.has(sessionKey)) {
+            this.foldChildStreamDelta(sessionKey, delta);
+        }
+    }
+    /**
+     * Fold one streaming delta of a tracked CHILD into the live row: the
+     * content tail (text AND reasoning — never a tool name, always the child's
+     * own output) and the pending-occupancy estimate. The assembled
+     * `assistant/message` later replaces the tail with the authoritative last
+     * line and resets the estimate against real usage.
+     */
+    foldChildStreamDelta(sessionId, delta) {
+        const view = this.agentViews.get(sessionId);
+        if (view === undefined)
+            return;
+        const buffer = bumpChildStream(this.childStreams.get(sessionId) ?? '', delta);
+        this.childStreams.set(sessionId, buffer);
+        const lastLine = lastBufferLine(buffer);
+        this.childPending.set(sessionId, (this.childPending.get(sessionId) ?? 0) + estimateTextTokens(delta));
+        const contextTokens = this.childContextTokens(sessionId);
+        const lineChanged = lastLine !== undefined && lastLine !== view.lastLine;
+        const contextChanged = contextTokens !== view.contextTokens;
+        if (lineChanged || contextChanged) {
+            this.agentViews.set(sessionId, {
+                ...view,
+                ...(lineChanged ? { lastLine } : {}),
+                ...(contextChanged ? { contextTokens } : {}),
+            });
+            this.emitLive();
+        }
+    }
     /**
      * The current context-occupancy estimate: the latest assistant/message's
      * billed input (uncached + cache read + cache write) and output, plus the
@@ -1534,41 +1516,6 @@ export class DshSessionBridge {
                     }
                     this.childStreams.delete(sessionId);
                 }
-                else if (event.type === 'assistant/chunk') {
-                    // Live content tail: fold the child's streaming deltas (text AND
-                    // reasoning) so the compact row's last line refreshes while the
-                    // child works — never a tool name, always its own output. The
-                    // assembled assistant/message later replaces it with the
-                    // authoritative last line.
-                    const chunk = event.data.chunk;
-                    if (chunk?.type === 'text-delta' || chunk?.type === 'reasoning-delta') {
-                        const delta = chunk.text ?? '';
-                        if (delta !== '') {
-                            const buffer = bumpChildStream(this.childStreams.get(sessionId) ?? '', delta);
-                            this.childStreams.set(sessionId, buffer);
-                            const lastLine = lastBufferLine(buffer);
-                            // Streamed output (text AND reasoning) grows the child's current
-                            // context too — usage.outputTokens includes reasoning tokens at
-                            // snapshot, so the live estimate prices both; the compact X/Y
-                            // follows live.
-                            const wasPending = this.childPending.get(sessionId) ?? 0;
-                            const lineChanged = lastLine !== undefined && lastLine !== view.lastLine;
-                            // The outer guard already narrowed to text/reasoning deltas, so
-                            // this branch is unconditional.
-                            this.childPending.set(sessionId, wasPending + estimateTextTokens(delta));
-                            const contextTokens = this.childContextTokens(sessionId);
-                            const contextChanged = contextTokens !== view.contextTokens;
-                            if (lineChanged || contextChanged) {
-                                this.agentViews.set(sessionId, {
-                                    ...view,
-                                    ...(lineChanged ? { lastLine } : {}),
-                                    ...(contextChanged ? { contextTokens } : {}),
-                                });
-                                changed = true;
-                            }
-                        }
-                    }
-                }
                 else if (event.type === 'user/message') {
                     // The child's own prompts/injects enter its next request — the
                     // occupancy follows (the content tail is never touched here). A
@@ -1777,11 +1724,8 @@ export class DshSessionBridge {
      */
     async createSession(fork) {
         this.seedSelectionFromDefault();
-        // Mint the id HERE so the pre-create lock covers exactly the directory
-        // agents.create is about to persist into (same cold-arm guard as resume).
         const sessionId = crypto.randomUUID();
         const cwd = process.cwd();
-        const lock = await this.acquireSessionLock(sessionId, cwd);
         // A fork records ITS OWN preset (what the new session composes under —
         // possibly none, keeping meta.agentPreset absent); a plain create
         // records the current selection.
@@ -1793,35 +1737,26 @@ export class DshSessionBridge {
             ...presetMeta,
             ...(fork !== undefined ? { parentSession: fork.parentSessionId, isSeeded: true } : {}),
         };
-        let handle;
-        try {
-            handle = await this.ctx.agents.create({
-                sessionId: SessionId(sessionId),
-                meta,
-                ...(fork === undefined ? {} : {
-                    seed: fork.seed,
-                    inheritedEventCount: SessionLogOffset(fork.seed.length),
-                }),
-                agentOptions: this.selection ?? {},
-                // Install the mutable selection so `/model` can live-switch the route,
-                // the APPEND_SYSTEM.md section on this agent ONLY (never its
-                // subagents), and the spawn-tool hide so the agent sees a single
-                // `use_agent` delegation entry. The surface marker scopes the live
-                // disableSubagent guard to THIS agent.
-                setup: async (agentCtx) => {
-                    markTuiSurface(agentCtx);
-                    installModelSelection(agentCtx, this.selectionRef);
-                    installAppendSystem(agentCtx);
-                    installSpawnToolFence(agentCtx);
-                },
-            });
-        }
-        catch (error) {
-            await this.releaseColdLock(lock);
-            throw error;
-        }
-        this.driveLock = lock;
-        return this.ownWithLock(handle, lock);
+        return await this.ctx.agents.create({
+            sessionId: SessionId(sessionId),
+            meta,
+            ...(fork === undefined ? {} : {
+                seed: fork.seed,
+                inheritedEventCount: SessionLogOffset(fork.seed.length),
+            }),
+            agentOptions: this.selection ?? {},
+            // Install the mutable selection so `/model` can live-switch the route,
+            // the APPEND_SYSTEM.md section on this agent ONLY (never its
+            // subagents), and the spawn-tool hide so the agent sees a single
+            // `use_agent` delegation entry. The surface marker scopes the live
+            // disableSubagent guard to THIS agent.
+            setup: async (agentCtx) => {
+                markTuiSurface(agentCtx);
+                installModelSelection(agentCtx, this.selectionRef);
+                installAppendSystem(agentCtx);
+                installSpawnToolFence(agentCtx);
+            },
+        });
     }
     /** The model selection shown in the footer (live value after `/model`). */
     getSelection() {