@bermudi/pi-delegate 0.1.18 → 0.1.20

package/extension.ts

@@ -1,11 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import {
-  handleCancel,
-  handlePoll,
-  handleWait,
-  cancelTicketForShutdown,
-  ticketRegistry,
-} from "./tickets.ts";
+import { registerSubagentBrowser } from "./browser.ts";
+import { getDefaultDelegateRuntime, type DelegateRuntime } from "./runtime.ts";
 import { discoverAgents } from "./agents.ts";
 import { getSubagentManualMarkdown } from "./manual.ts";
 import {
@@ -25,7 +20,6 @@ import { hostCompatError } from "./host-compat.ts";
 import { invalidateHostDepsCache } from "./host.ts";
 import { registerProviderExtensionNotifier } from "./provider-extensions.ts";
 import { recordTreeNavigation, resetLeafTracking } from "./leaf.ts";
-import { closeAllPooledAgents } from "./pool.ts";
 import { reconfigureGlobalConcurrency } from "./concurrency.ts";
 import { reloadDelegateConfig, getMaxConcurrent } from "./config.ts";
 import {
@@ -130,12 +124,20 @@ export function _setShutdownDrainTimeoutForTesting(
   shutdownDrainTimeoutMs = timeoutMs ?? DEFAULT_SHUTDOWN_DRAIN_TIMEOUT_MS;
 }
 
-/** Register the delegate tool and clean up its parent-session resources. */
-export default function delegateExtension(pi: ExtensionAPI): void {
+/** Register the delegate tool and clean up its parent-session resources.
+ *
+ *  Production uses the module default runtime. Tests/embedders may pass a
+ *  fresh runtime as the second argument so all tool execution, status, and
+ *  shutdown operate in an isolated pool/ticket environment. */
+export default function delegateExtension(
+  pi: ExtensionAPI,
+  runtime: DelegateRuntime = getDefaultDelegateRuntime(),
+): void {
   // A /reload can reuse this module instance after the previous runtime closed
   // its SQLite handle. Permit the new runtime to open a fresh backend; stale
   // workers from the old runtime remain blocked from reopening it.
   prepareTelemetryForSession();
+  const browserHistory = registerSubagentBrowser(pi, runtime);
 
   // Async completion arrives as a custom message after the original tool call
   // has returned. Give it the same compact/expanded UI as sync results while
@@ -156,6 +158,8 @@ export default function delegateExtension(pi: ExtensionAPI): void {
     prepareArguments: normalizeDelegateArguments,
 
     async execute(_id, params: DelegateArguments, signal, onUpdate, ctx) {
+      const browserGeneration = browserHistory.generation;
+      const captureBrowser = ctx.mode === "tui" && !params.async;
       // Reload user-edited delegate.json at the start of every execution.
       // Help, poll, cancel, wait, and invalid calls observe new settings, and
       // the global concurrency cap is reconfigured so hot-reloaded maxConcurrent
@@ -237,17 +241,27 @@ export default function delegateExtension(pi: ExtensionAPI): void {
 
       // ── Poll action ───────────────────────────────────────────────────
       if (params.ticketAction === "poll") {
-        const result = handlePoll(params, ctx);
+        const result = runtime.tickets.handlePoll(params, ctx);
         succeedCall();
         return result;
       }
 
       // ── Cancel action ─────────────────────────────────────────────────
+      if (params.ticketAction === "pause" || params.ticketAction === "resume") {
+        const result = runtime.tickets.handlePause({
+          ticket: params.ticket,
+          ticketAction: params.ticketAction,
+        });
+        syncDelegateStatus(ctx, runtime);
+        succeedCall();
+        return result;
+      }
+
       if (params.ticketAction === "cancel") {
-        const result = handleCancel(params);
+        const result = runtime.tickets.handleCancel(params);
         // A forced cancel flips the ticket to "cancelling" — keep the
         // footer status in step (deduped; the preview path is a no-op).
-        syncDelegateStatus(ctx);
+        syncDelegateStatus(ctx, runtime);
         succeedCall();
         return result;
       }
@@ -255,7 +269,12 @@ export default function delegateExtension(pi: ExtensionAPI): void {
       // ── Wait action ────────────────────────────────────────────────────
       if (params.ticketAction === "wait") {
         try {
-          const result = await handleWait(params, signal, onUpdate, ctx);
+          const result = await runtime.tickets.handleWait(
+            params,
+            signal,
+            onUpdate,
+            ctx,
+          );
           succeedCall();
           return result;
         } catch (err) {
@@ -283,7 +302,7 @@ export default function delegateExtension(pi: ExtensionAPI): void {
         invalidateHostDepsCache();
         // Keep the footer-status pipeline in step exactly as a normal
         // dispatch would (deduped no-op when nothing is running).
-        syncDelegateStatus(ctx);
+        syncDelegateStatus(ctx, runtime);
         return await dispatchDelegate({
           pi,
           params: { ...params, tasks: [bridgeSessionControlTask(params)] },
@@ -297,6 +316,7 @@ export default function delegateExtension(pi: ExtensionAPI): void {
           signal,
           onUpdate,
           callSpan,
+          runtime,
         });
       }
 
@@ -318,14 +338,14 @@ export default function delegateExtension(pi: ExtensionAPI): void {
       // dispatch narrows it to DelegateToolCtx (which has no `ui`). The
       // status push itself is a deduped no-op here; dispatchAsync re-syncs
       // after registering its ticket.
-      syncDelegateStatus(ctx);
+      syncDelegateStatus(ctx, runtime);
 
       // Keep expensive host deps shared within this dispatch, not indefinitely
       // across dispatches: edits to auth/models/settings/context files must be
       // visible without restarting Pi.
       invalidateHostDepsCache();
       try {
-        return await dispatchDelegate({
+        const result = await dispatchDelegate({
           pi,
           params,
           ctx,
@@ -336,10 +356,25 @@ export default function delegateExtension(pi: ExtensionAPI): void {
             tools: pi.getActiveTools(),
           },
           signal,
-          onUpdate,
+          onUpdate: captureBrowser
+            ? (update) => {
+                browserHistory.update(
+                  _id,
+                  update.details,
+                  false,
+                  browserGeneration,
+                );
+                onUpdate?.(update);
+              }
+            : onUpdate,
           callSpan,
+          runtime,
         });
+        if (captureBrowser)
+          browserHistory.update(_id, result.details, true, browserGeneration);
+        return result;
       } catch (err) {
+        if (captureBrowser) browserHistory.fail(_id, err, browserGeneration);
         failCall();
         throw err;
       }
@@ -360,15 +395,15 @@ export default function delegateExtension(pi: ExtensionAPI): void {
   // The turn settling with live tickets is the "looks idle but isn't" moment:
   // warn once per ticket. The footer status carries it from there.
   pi.on("agent_settled", (_event, ctx) => {
-    notifyActiveTicketsOnSettled(ctx);
+    notifyActiveTicketsOnSettled(ctx, runtime);
   });
 
   // Session replacements are cancellable — confirm before killing live work.
   pi.on("session_before_switch", (_event, ctx) =>
-    guardSessionReplacement(ctx, "switch"),
+    guardSessionReplacement(ctx, "switch", runtime),
   );
   pi.on("session_before_fork", (_event, ctx) =>
-    guardSessionReplacement(ctx, "fork"),
+    guardSessionReplacement(ctx, "fork", runtime),
   );
 
   // /tree navigation stays inside the same session: nothing is torn down and
@@ -376,10 +411,12 @@ export default function delegateExtension(pi: ExtensionAPI): void {
   // user moves to. Ask first, and record the new leaf either way so delivery
   // can detect the mismatch (issue #30). `session_tree` also fires for
   // extension-driven ctx.navigateTree, which never reaches the guard.
-  pi.on("session_before_tree", (_event, ctx) => guardTreeNavigation(ctx));
+  pi.on("session_before_tree", (_event, ctx) =>
+    guardTreeNavigation(ctx, runtime),
+  );
   pi.on("session_tree", (event, ctx) => {
     recordTreeNavigation(event.newLeafId);
-    syncDelegateStatus(ctx);
+    syncDelegateStatus(ctx, runtime);
   });
 
   // ── Session shutdown: abort tickets and dispose live pooled sessions ──
@@ -395,7 +432,7 @@ export default function delegateExtension(pi: ExtensionAPI): void {
       // leave a trace. For quit the TUI is already stopped — stderr lands in
       // the scrollback. For reload the TUI survives — warn in place. Switch
       // and fork already passed the confirm guard above.
-      const active = activeTicketSummary();
+      const active = activeTicketSummary(runtime);
       if (active.tickets.length) {
         if (event.reason === "quit") {
           console.error(
@@ -416,15 +453,15 @@ export default function delegateExtension(pi: ExtensionAPI): void {
         }
       }
 
-      for (const ticket of ticketRegistry.values()) {
+      for (const ticket of runtime.tickets.values()) {
         if (ticket.status === "running" || ticket.status === "cancelling") {
-          cancelTicketForShutdown(ticket);
+          runtime.tickets.cancelTicketForShutdown(ticket);
         }
         // Include already-cancelled tickets too: a repeated shutdown event can
         // race the first handler while its workers are still unwinding.
         if (ticket.completion) ticketCompletions.push(ticket.completion);
       }
-      syncDelegateStatus(ctx);
+      syncDelegateStatus(ctx, runtime);
       // The runtime is invalidated right after this handler returns; aborted
       // tickets keep unwinding asynchronously and must find no cached ctx (or
       // captured pi) to touch. The cancelled completion path still writes one
@@ -443,7 +480,7 @@ export default function delegateExtension(pi: ExtensionAPI): void {
       // SQLite still stays open until both cleanup paths finish.
       let poolCleanup: Promise<void>;
       try {
-        poolCleanup = closeAllPooledAgents();
+        poolCleanup = runtime.pool.closeAllPooledAgents();
       } catch (error) {
         console.error("[delegate] pooled-session shutdown start failed", error);
         poolCleanup = Promise.resolve();

package/format.ts

@@ -530,7 +530,10 @@ export function formatCompletedTask(
     if (integration.patchPath)
       parts.push(`full patch: ${integration.patchPath}`);
     if (integration.worktreePath)
-      parts.push(`conflict worktree: ${integration.worktreePath}`);
+      parts.push(`recovery worktree: ${integration.worktreePath}`);
+    if (integration.status === "retained") {
+      parts.push(`not applied: ${integration.reason}`);
+    }
     for (const conflict of integration.conflicts ?? []) {
       parts.push(`conflict: ${conflict.path}: ${conflict.reason}`);
     }
@@ -583,6 +586,7 @@ export function latestActivity(p: TaskProgress): ToolActivity | null {
  *  - "last: read src/bar.ts" after a tool completes and the model is thinking
  *  - "thinking" when no activity has been recorded yet */
 export function formatActivityLabel(p: TaskProgress): string {
+  if (p.paused) return "paused between turns";
   const activity = inFlightActivity(p) ?? latestActivity(p);
   if (!activity) return "thinking";
   const call = sanitizeTerminalLine(
@@ -596,6 +600,7 @@ export function formatActivityLabel(p: TaskProgress): string {
  *  as {@link formatActivityLabel} but adds elapsed time for in-flight tools and
  *  a completion/error icon for finished ones. */
 export function compactActivity(p: TaskProgress): string {
+  if (p.paused) return "paused between turns";
   const activity = inFlightActivity(p) ?? latestActivity(p);
   if (!activity) return "thinking…";
   const call = sanitizeTerminalLine(
@@ -653,18 +658,31 @@ export function findTouchedOverlaps(
   results: readonly {
     attributedFiles?: string[];
     workspace?: WorkspaceMode;
+    serializedGroup?: number;
+    incomplete?: string;
   }[],
 ): string[] {
-  const counts = new Map<string, number>();
+  const owners = new Map<string, (typeof results)[number][]>();
+  const overlaps = new Set<string>();
   for (const r of results) {
-    for (const f of r.attributedFiles ?? []) {
-      counts.set(f, (counts.get(f) ?? 0) + 1);
+    for (const f of new Set(r.attributedFiles ?? [])) {
+      const previous = owners.get(f) ?? [];
+      if (
+        previous.some(
+          (other) =>
+            r.serializedGroup === undefined ||
+            r.serializedGroup !== other.serializedGroup ||
+            r.incomplete !== undefined ||
+            other.incomplete !== undefined,
+        )
+      ) {
+        overlaps.add(f);
+      }
+      previous.push(r);
+      owners.set(f, previous);
     }
   }
-  return [...counts.entries()]
-    .filter(([, count]) => count > 1)
-    .map(([file]) => file)
-    .sort();
+  return [...overlaps].sort();
 }
 
 /**
@@ -677,5 +695,5 @@ export function findTouchedOverlaps(
  */
 export function formatTouchedOverlapWarning(overlaps: string[]): string | null {
   if (!overlaps.length) return null;
-  return `WARNING: These tasks reported touching the same file(s): ${overlaps.join(", ")}. Delegate does not isolate or serialize file access and does not roll back completed writes.`;
+  return `WARNING: Tasks without a verified ordering reported touching the same file(s): ${overlaps.join(", ")}. File reports do not prove simultaneous writes or a conflict; completed writes are not rolled back.`;
 }

package/host.ts

@@ -85,7 +85,7 @@ export interface HostDepsOptions {
    * host deps are cached per (agentDir + cwd + systemPrompt): the expensive
    * `reload()` (skills, project AGENTS.md discovery) runs once per distinct combo, then
    * is reused across concurrent subagents. Provider-configured or
-   * allowlisted-extension tasks always receive fresh host deps. For ad-hoc
+   * allowlisted-extension tasks always receive fresh host deps. For inline
    * tasks (no named agent) pass undefined to use the discovered prompt.
    */
   systemPrompt?: string;

package/isolated-workspace.ts

@@ -25,6 +25,7 @@ let removeWorktreeHookForTesting:
       destination: string,
     ) => boolean | undefined | Promise<boolean | undefined>)
   | undefined;
+let beforeSourceApplyHookForTesting: (() => void | Promise<void>) | undefined;
 
 /** @internal Keep tests out of the developer's real ~/.pi directory. */
 export function _setIsolatedArtifactRootForTesting(
@@ -44,6 +45,12 @@ export function _setRemoveWorktreeHookForTesting(
   removeWorktreeHookForTesting = hook;
 }
 
+export function _setBeforeSourceApplyHookForTesting(
+  hook: (() => void | Promise<void>) | undefined,
+): void {
+  beforeSourceApplyHookForTesting = hook;
+}
+
 interface CommandResult {
   stdout: string;
   stderr: string;
@@ -698,9 +705,18 @@ interface IsolatedWorker {
   patchPath: string;
 }
 
+export interface IsolatedReconcileOptions {
+  shouldApplySource?: () => boolean;
+  retainedReason?: string;
+  signal?: AbortSignal;
+}
+
 export interface PreparedIsolatedBatch {
   resolved: ResolvedTask[];
-  reconcile(results: TaskResult[]): Promise<TaskResult[]>;
+  reconcile(
+    results: TaskResult[],
+    options?: IsolatedReconcileOptions,
+  ): Promise<TaskResult[]>;
 }
 
 async function restoreAfterFailedApply(
@@ -732,10 +748,45 @@ async function restoreAfterFailedApply(
   }
 }
 
+async function retainAcceptedProposals(
+  group: IsolatedGroup,
+  workers: Map<number, IsolatedWorker>,
+  results: TaskResult[],
+  accepted: Map<number, string[]>,
+  pristineRoot: string,
+  reason: string,
+): Promise<void> {
+  let cleanupIssue:
+    { status: "failed"; reason: string; recoveryPath: string } | undefined;
+  try {
+    await requireWorktreeRemoved(group.sourceRoot, pristineRoot);
+  } catch (error) {
+    cleanupIssue = {
+      status: "failed",
+      reason: error instanceof Error ? error.message : String(error),
+      recoveryPath: pristineRoot,
+    };
+  }
+  for (const [taskIndex, proposedFiles] of accepted) {
+    const worker = workers.get(taskIndex)!;
+    results[taskIndex]!.integration = {
+      status: "retained",
+      reason,
+      proposedFiles,
+      appliedFiles: [],
+      baselineRef: group.baselineRef,
+      proposalRef: worker.proposalRef,
+      patchPath: worker.patchPath,
+      ...(cleanupIssue ? { cleanupIssue } : {}),
+    };
+  }
+}
+
 async function reconcileGroup(
   group: IsolatedGroup,
   workers: Map<number, IsolatedWorker>,
   results: TaskResult[],
+  options: IsolatedReconcileOptions,
 ): Promise<void> {
   let integratedCommit = group.baselineCommit;
   const accepted = new Map<number, string[]>();
@@ -948,6 +999,17 @@ async function reconcileGroup(
     await requireWorktreeRemoved(group.sourceRoot, pristineRoot);
     return;
   }
+  if (options.shouldApplySource && !options.shouldApplySource()) {
+    await retainAcceptedProposals(
+      group,
+      workers,
+      results,
+      accepted,
+      pristineRoot,
+      options.retainedReason ?? "Source application was cancelled.",
+    );
+    return;
+  }
 
   const currentTree = await snapshotTree(
     group.sourceRoot,
@@ -995,6 +1057,18 @@ async function reconcileGroup(
     group.baselineCommit,
     integratedCommit,
   );
+  await beforeSourceApplyHookForTesting?.();
+  if (options.shouldApplySource && !options.shouldApplySource()) {
+    await retainAcceptedProposals(
+      group,
+      workers,
+      results,
+      accepted,
+      pristineRoot,
+      options.retainedReason ?? "Source application was cancelled.",
+    );
+    return;
+  }
   const applyIndex = path.join(group.artifactRoot, "apply.index");
   await fs.promises.rm(applyIndex, { force: true });
   const env = {
@@ -1010,12 +1084,25 @@ async function reconcileGroup(
       cwd: group.sourceRoot,
       env,
     });
+    if (options.shouldApplySource && !options.shouldApplySource()) {
+      await retainAcceptedProposals(
+        group,
+        workers,
+        results,
+        accepted,
+        pristineRoot,
+        options.retainedReason ?? "Source application was cancelled.",
+      );
+      return;
+    }
     await git(["apply", "--binary", "--index", finalPatch], {
       cwd: group.sourceRoot,
       env,
+      signal: options.signal,
     });
   } catch (error) {
     const recoveryRoot = path.join(group.artifactRoot, "failed-apply-files");
+    let rollbackSucceeded = true;
     try {
       await restoreAfterFailedApply(
         group.sourceRoot,
@@ -1024,11 +1111,23 @@ async function reconcileGroup(
         recoveryRoot,
       );
     } catch (rollbackError) {
+      rollbackSucceeded = false;
       console.error(
         "[delegate] isolated apply rollback failed; recovery artifacts retained",
         rollbackError,
       );
     }
+    if (options.signal?.aborted && rollbackSucceeded) {
+      await retainAcceptedProposals(
+        group,
+        workers,
+        results,
+        accepted,
+        pristineRoot,
+        options.retainedReason ?? "Source application was cancelled.",
+      );
+      return;
+    }
     for (const [taskIndex] of accepted) {
       const integration = results[taskIndex]!.integration!;
       const worker = workers.get(taskIndex)!;
@@ -1145,24 +1244,35 @@ async function cleanupCompletedGroupRefs(
   group: IsolatedGroup,
   workers: Map<number, IsolatedWorker>,
   results: readonly TaskResult[],
-): Promise<void> {
+): Promise<boolean> {
   const disposableProposalRefs: string[] = [];
   let retainsRecoveryArtifacts = false;
+  let retainsPrivateRefs = false;
 
   for (const taskIndex of group.taskIndexes) {
-    const status = results[taskIndex]?.integration?.status;
-    if (status === "conflict" || status === "apply_failed") {
+    const integration = results[taskIndex]?.integration;
+    const status = integration?.status;
+    if (!integration) {
+      retainsRecoveryArtifacts = true;
+      retainsPrivateRefs = true;
+    } else if (
+      status === "retained" ||
+      status === "conflict" ||
+      status === "apply_failed"
+    ) {
       retainsRecoveryArtifacts = true;
+      retainsPrivateRefs = true;
     } else if (
       status === "applied_unverified" ||
       status === "no_changes" ||
       status === "discarded"
     ) {
+      if (integration.cleanupIssue) retainsRecoveryArtifacts = true;
       disposableProposalRefs.push(workers.get(taskIndex)!.proposalRef);
     }
   }
 
-  const refs = retainsRecoveryArtifacts
+  const refs = retainsPrivateRefs
     ? disposableProposalRefs
     : [...disposableProposalRefs, group.baselineRef];
   try {
@@ -1172,6 +1282,7 @@ async function cleanupCompletedGroupRefs(
     // turn a successfully applied source change into a reported failure.
     console.error("[delegate] failed to clean completed isolated refs", error);
   }
+  return retainsRecoveryArtifacts;
 }
 
 /** Prepare detached worktrees from one synthetic commit per Git root. The
@@ -1315,11 +1426,14 @@ export async function prepareIsolatedBatch(
 
   return {
     resolved: translated,
-    async reconcile(results: TaskResult[]): Promise<TaskResult[]> {
+    async reconcile(
+      results: TaskResult[],
+      options: IsolatedReconcileOptions = {},
+    ): Promise<TaskResult[]> {
       for (const group of groupsByRoot.values()) {
         try {
           try {
-            await reconcileGroup(group, workers, results);
+            await reconcileGroup(group, workers, results, options);
           } catch (error) {
             console.error(
               "[delegate] isolated group reconciliation failed",
@@ -1332,13 +1446,45 @@ export async function prepareIsolatedBatch(
               error,
             );
           }
-          await cleanupCompletedGroupRefs(group, workers, results);
+          const retainsRecoveryArtifacts = await cleanupCompletedGroupRefs(
+            group,
+            workers,
+            results,
+          );
+          if (!retainsRecoveryArtifacts) {
+            try {
+              await fs.promises.rm(group.artifactRoot, {
+                recursive: true,
+                force: true,
+              });
+            } catch (error) {
+              console.error(
+                `[delegate] failed to remove completed isolated artifacts '${group.artifactRoot}'`,
+                error,
+              );
+            }
+          }
         } finally {
           // Unblocks and serializes any safety-confirmed quarantine cleanups
           // only after all candidate/source/ref work for this group is done.
           group.finishReconciliation();
         }
       }
+      try {
+        await fs.promises.rmdir(batchArtifactRoot);
+      } catch (error) {
+        if (!(
+          error instanceof Error &&
+          "code" in error &&
+          ((error as NodeJS.ErrnoException).code === "ENOENT" ||
+            (error as NodeJS.ErrnoException).code === "ENOTEMPTY")
+        )) {
+          console.error(
+            `[delegate] failed to remove isolated batch directory '${batchArtifactRoot}'`,
+            error,
+          );
+        }
+      }
       return results;
     },
   };