@bivy/bivy 0.10.1-staging.236 → 0.10.1-staging.237

package/dist/control-plane-tasks.js

@@ -79,9 +79,15 @@ export async function claimWork(cfg, id) {
     const res = await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/claim`);
     return res.ok;
 }
+/** Renew ownership and retain the reason a renewal was rejected. Cancellation is
+ *  intentionally distinct from a generic lost lease so an active agent can be
+ *  stopped promptly when the account cancels its Run. */
 export async function renewWorkLease(cfg, id) {
     const res = await cp(cfg, "POST", `/node/work/${encodeURIComponent(id)}/heartbeat`);
-    return res.ok;
+    if (res.ok)
+        return "renewed";
+    const data = (await res.json().catch(() => ({})));
+    return data.reason === "cancelled" ? "cancelled" : "lost";
 }
 export async function completeWork(cfg, id) {
     await transitionWork(cfg, id, "complete");
@@ -119,9 +125,12 @@ export class ControlPlaneTaskPoller {
     runItem;
     maxConcurrent;
     timer;
-    inFlight = new Set();
+    /** Keep the controller alongside the reservation: relay pokes can arrive at
+     *  any point from claim through policy retries and must address the same Run. */
+    inFlight = new Map();
     policy;
     sleep;
+    leaseHeartbeatMs;
     constructor(cfg, runItem, 
     /** Node's cap on concurrently-running queue sessions (0/undefined = unlimited).
      *  Read fresh each tick so the Settings → Nodes value takes effect live. */
@@ -131,6 +140,7 @@ export class ControlPlaneTaskPoller {
         this.maxConcurrent = maxConcurrent;
         this.policy = options.policy;
         this.sleep = options.sleep ?? defaultSleep;
+        this.leaseHeartbeatMs = options.leaseHeartbeatMs ?? 30_000;
     }
     start() {
         void this.tick();
@@ -138,8 +148,16 @@ export class ControlPlaneTaskPoller {
         this.timer.unref?.();
         console.log(`[control-plane-tasks] watching hosted queue for labels [${this.cfg.labels.join(", ")}] (relay push + ${Math.round(this.cfg.pollMs / 1000)}s fallback poll)`);
     }
-    /** Trigger an immediate fetch after a relay push says work may be available. */
-    poke() {
+    /** React to a relay work notification. If it names a Run already executing,
+     *  check its lease immediately (the notification may be its cancellation);
+     *  otherwise fetch the queue as before. The optional id keeps old callers
+     *  that only use poke() fully compatible. */
+    poke(id) {
+        const run = id ? this.inFlight.get(id) : undefined;
+        if (id && run) {
+            void this.checkLease(id, run);
+            return;
+        }
         void this.tick();
     }
     /** Number of queue items currently running on this node. Lets an ephemeral
@@ -193,37 +211,76 @@ export class ControlPlaneTaskPoller {
             // within a single tick: items ran one at a time regardless of `max`, and
             // only overlapping `setInterval` ticks happened to run more than one
             // concurrently.
-            this.inFlight.add(item.id);
-            running.push(this.runOne(item));
+            const run = { controller: new AbortController(), state: "active" };
+            this.inFlight.set(item.id, run);
+            running.push(this.runOne(item, run));
         }
         await Promise.all(running);
     }
-    async runOne(item) {
-        let leaseHeartbeat;
+    async runOne(item, reserved) {
+        // runOne is exercised directly by a few callers/tests, so create a control
+        // when there was no tick reservation. Never replace an existing control.
+        const run = reserved ?? this.inFlight.get(item.id) ?? { controller: new AbortController(), state: "active" };
+        if (!this.inFlight.has(item.id))
+            this.inFlight.set(item.id, run);
         try {
             // Claim first so only one node runs it; skip if another node won (no
             // claim → not ours → don't run or complete it). A heartbeat keeps the
             // finite lease alive; process death stops it and makes the item reclaimable.
-            if (!(await claimWork(this.cfg, item.id)))
+            if (!(await claimWork(this.cfg, item.id)) || run.state !== "active")
                 return;
-            leaseHeartbeat = setInterval(() => void renewWorkLease(this.cfg, item.id), 30_000);
-            leaseHeartbeat.unref?.();
+            run.heartbeat = setInterval(() => void this.checkLease(item.id, run), this.leaseHeartbeatMs);
+            run.heartbeat.unref?.();
             const report = (patch) => reportEvidence(this.cfg, item.id, patch);
             await transitionWork(this.cfg, item.id, "running");
+            if (run.state !== "active")
+                return;
             console.log(`[control-plane-tasks] running ${item.source} item ${item.id}: ${item.title}`);
             // routingReason is a coarse baseline — a manual "Run…" override picked
             // this agent/model explicitly; otherwise it's whatever the queue label
             // routed to. runWorkItem/runIssueTask may layer a more specific reason
             // (e.g. a fallback after an error) on top via the same `report` hook.
             await report({ routingReason: item.runtimeId || item.model ? "manual override" : "queue label" });
-            await this.runWithPolicy(item, report);
+            if (run.state !== "active")
+                return;
+            await this.runWithPolicy(item, report, run);
         }
         finally {
-            if (leaseHeartbeat)
-                clearInterval(leaseHeartbeat);
-            this.inFlight.delete(item.id);
+            if (run.heartbeat)
+                clearInterval(run.heartbeat);
+            // A stale completion must not remove a newer reservation for the same id.
+            if (this.inFlight.get(item.id) === run)
+                this.inFlight.delete(item.id);
         }
     }
+    checkLease(id, run) {
+        if (run.state !== "active")
+            return Promise.resolve();
+        if (run.leaseCheck)
+            return run.leaseCheck;
+        run.leaseCheck = (async () => {
+            try {
+                const renewal = await renewWorkLease(this.cfg, id);
+                if (renewal === "renewed" || this.inFlight.get(id) !== run || run.state !== "active")
+                    return;
+                run.state = renewal;
+                if (run.heartbeat) {
+                    clearInterval(run.heartbeat);
+                    run.heartbeat = undefined;
+                }
+                run.controller.abort(new Error(renewal === "cancelled" ? "Run cancelled" : "Run lease lost"));
+            }
+            catch (error) {
+                // A transient network error does not prove ownership was lost. Keep the
+                // Run alive and let the next heartbeat retry.
+                console.warn(`[control-plane-tasks] work ${id} heartbeat failed:`, error instanceof Error ? error.message : error);
+            }
+            finally {
+                run.leaseCheck = undefined;
+            }
+        })();
+        return run.leaseCheck;
+    }
     /**
      * Run one item under the run policy: on failure, classify → decide → retry /
      * reroute (rewrite routing for the next attempt) / park (needs_attention) /
@@ -233,17 +290,27 @@ export class ControlPlaneTaskPoller {
      * safe evidence event. With no policy injected this is the historical path:
      * one attempt, any throw fails the run.
      */
-    async runWithPolicy(item, report) {
+    async runWithPolicy(item, report, run) {
         let current = item;
         let attempt = 1;
         let rerouteCount = 0;
         for (;;) {
+            if (run.state !== "active")
+                return;
             try {
-                await this.runItem(current, report);
+                // Functions declared with the historical two arguments remain valid in
+                // TypeScript/JavaScript; cancellation-aware runners can use the third.
+                await this.runItem(current, report, run.controller.signal);
+                if (run.state !== "active")
+                    return;
                 await completeWork(this.cfg, item.id);
                 return;
             }
             catch (error) {
+                // Abort errors are ordinary throws to the policy layer unless guarded.
+                // A cancelled/lost Run has no node-side terminal transition or retry.
+                if (run.state !== "active")
+                    return;
                 const policy = typeof this.policy === "function" ? this.policy(current) : this.policy;
                 const decision = policy?.decide({
                     routing: { runtimeId: current.runtimeId, model: current.model },
@@ -258,6 +325,8 @@ export class ControlPlaneTaskPoller {
                     const summary = `Attempt limit reached (${maxAttempts}); automation parked for review.`;
                     console.warn(`[control-plane-tasks] item ${item.id} needs attention: ${summary}`);
                     await report({ events: [{ at: new Date().toISOString(), kind: "needs_attention", summary, attempt }] });
+                    if (run.state !== "active")
+                        return;
                     await needsAttentionWork(this.cfg, item.id);
                     return;
                 }
@@ -283,15 +352,21 @@ export class ControlPlaneTaskPoller {
                     }
                     if (decision.delayMs > 0)
                         await this.sleep(decision.delayMs);
+                    if (run.state !== "active")
+                        return;
                     continue;
                 }
                 if (decision.action === "park") {
                     console.warn(`[control-plane-tasks] item ${item.id} needs attention (${decision.condition}): ${decision.summary}`);
                     await report({ events: [{ at: new Date().toISOString(), kind: "needs_attention", summary: decision.summary }] });
+                    if (run.state !== "active")
+                        return;
                     await needsAttentionWork(this.cfg, item.id);
                     return;
                 }
                 console.warn(`[control-plane-tasks] item ${item.id} failed:`, error);
+                if (run.state !== "active")
+                    return;
                 await failWork(this.cfg, item.id);
                 return;
             }

package/dist/server.js

@@ -3008,8 +3008,8 @@ function startRelayIfConfigured() {
     terminals.dropClient(RELAY_CLIENT_ID);
     relay = new RelayConnector(config, (msg) => void handleRelayMessage(msg), {
         pairing: pairingStore,
-        onWorkAvailable: () => {
-            controlPlanePoller?.poke();
+        onWorkAvailable: (hint) => {
+            controlPlanePoller?.poke(hint.id);
             // A relay wake also means "something changed for this account" — kick a
             // (debounced) model-auth sync so a peer node answers any pending vault-key
             // request from a freshly-launched ephemeral runner without waiting for its
@@ -4073,12 +4073,18 @@ async function runIssueTaskInner(cfg, issue, source, overrides = {}) {
         throw new Error("worktree was not created for the issue session");
     try {
         emit(record, "started", `Started work on ${cfg.owner}/${cfg.repo}#${issue.number}.`);
-        await runSessionTurn(record, buildTaskPrompt(issue, nodeGithubIssuePrompt()));
+        await runSessionTurn(record, buildTaskPrompt(issue, nodeGithubIssuePrompt()), overrides.signal);
+        if (overrides.signal?.aborted)
+            throw overrides.signal.reason ?? new Error("Run cancelled");
         emit(record, "agent_done", `Agent finished issue #${issue.number}; running deterministic checks.`);
         await reportIssueOutcome(cfg, issue, record, emit, { followUp: false, onEvidence: overrides.onEvidence });
     }
     catch (error) {
-        emit(record, "failed", `GitHub issue #${issue.number} failed: ${error instanceof Error ? error.message : String(error)}`);
+        // Cancellation has its own durable control-plane outcome. Do not append a
+        // misleading execution-failed event after the operator stopped the Run.
+        if (!overrides.signal?.aborted) {
+            emit(record, "failed", `GitHub issue #${issue.number} failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
         throw error;
     }
 }
@@ -4103,7 +4109,9 @@ async function runIssueFollowUp(cfg, issue, record, emit, overrides = {}) {
         const merge = await mergeBaseIntoBranch(cfg, wt.path, base);
         if (merge.status === "conflicts") {
             emit(record, "resolving_conflicts", `Merge conflicts with ${base} in ${merge.conflicts.length} file(s); asking the agent to resolve them.`, { files: merge.conflicts });
-            await runSessionTurn(record, buildConflictPrompt(base, merge.conflicts));
+            await runSessionTurn(record, buildConflictPrompt(base, merge.conflicts), overrides.signal);
+            if (overrides.signal?.aborted)
+                throw overrides.signal.reason ?? new Error("Run cancelled");
             const resolved = await completeMerge(wt.path, merge.conflicts);
             if (resolved) {
                 emit(record, "conflicts_resolved", `Resolved merge conflicts with ${base}.`);
@@ -4116,12 +4124,16 @@ async function runIssueFollowUp(cfg, issue, record, emit, overrides = {}) {
                 emit(record, "conflicts_unresolved", `Could not automatically resolve conflicts with ${base}; continuing without merging it in.`);
             }
         }
-        await runSessionTurn(record, buildFollowUpPrompt(issue));
+        await runSessionTurn(record, buildFollowUpPrompt(issue), overrides.signal);
+        if (overrides.signal?.aborted)
+            throw overrides.signal.reason ?? new Error("Run cancelled");
         emit(record, "agent_done", `Agent handled the follow-up on issue #${issue.number}; running deterministic checks.`);
         await reportIssueOutcome(cfg, issue, record, emit, { followUp: true, onEvidence: overrides.onEvidence });
     }
     catch (error) {
-        emit(record, "failed", `GitHub issue #${issue.number} follow-up failed: ${error instanceof Error ? error.message : String(error)}`);
+        if (!overrides.signal?.aborted) {
+            emit(record, "failed", `GitHub issue #${issue.number} follow-up failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
         throw error;
     }
 }
@@ -4240,17 +4252,31 @@ function buildConflictPrompt(base, conflicts) {
  * Mirrors how the issue pickup awaited a turn inline; factored out so both the
  * implementation turn and the conflict-resolution turn share it.
  */
-async function runSessionTurn(record, prompt) {
+async function runSessionTurn(record, prompt, signal) {
+    if (signal?.aborted)
+        throw signal.reason ?? new Error("Run cancelled");
+    let unsubscribe = () => { };
     const finished = new Promise((resolve) => {
-        const off = record.session.subscribe((event) => {
-            if (event.type === "agent_end") {
-                off();
+        unsubscribe = record.session.subscribe((event) => {
+            if (event.type === "agent_end")
                 resolve();
-            }
         });
     });
-    await turnWatchdog.promptWithWatchdog(record, prompt);
-    await finished;
+    let rejectCancellation = () => { };
+    const cancelled = new Promise((_resolve, reject) => { rejectCancellation = reject; });
+    const onAbort = () => {
+        abortSessionRecord(record);
+        rejectCancellation(signal?.reason ?? new Error("Run cancelled"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+        await turnWatchdog.promptWithWatchdog(record, prompt);
+        await (signal ? Promise.race([finished, cancelled]) : finished);
+    }
+    finally {
+        signal?.removeEventListener("abort", onAbort);
+        unsubscribe();
+    }
 }
 async function anthropicHeadersFromNodeCredential() {
     const cred = await createCredentialStore(credsDir).getCredential("anthropic");
@@ -4621,7 +4647,9 @@ async function continueCorrelatedSession(item, prompt, report, opts) {
         throw new Error(`Repository policy requires ${safety.sandbox}; refusing to continue a session opened as ${currentSandbox}`);
     }
     record.approvalMode = safety.approval;
-    await runSessionTurn(record, prompt);
+    await runSessionTurn(record, prompt, opts?.signal);
+    if (opts?.signal?.aborted)
+        throw opts.signal.reason ?? new Error("Run cancelled");
     if (record.worktree && !opts?.isMessage && !opts?.resumeOnMissing) {
         await branchPublish.maybePushWorktreeBranch(record);
         await prDetection.maybeDetectPullRequest(record);
@@ -4655,7 +4683,9 @@ function lastUserMessageText(record) {
     }
     return "";
 }
-async function runWorkItem(item, report) {
+async function runWorkItem(item, report, signal) {
+    if (signal.aborted)
+        throw signal.reason ?? new Error("Run cancelled");
     // Scheduled, manual, and webhook-triggered automations carry the operator's
     // instructions as an E2E template (`bivy-room-v1:<node>:<ciphertext>`) only the
     // assigned node can read. The envelope prefix is Bivy's own and never appears
@@ -4739,6 +4769,7 @@ async function runWorkItem(item, report) {
             sandbox: normalizeSandboxTier(item.sandbox),
             approvalMode: approvalModeFrom(item.approvalMode),
             onEvidence: report,
+            signal,
         });
         return;
     }
@@ -4757,7 +4788,7 @@ async function runWorkItem(item, report) {
             throw new Error(`Linear work item has an invalid repo "${repoSlug}"`);
         // Case B: a re-dispatch the control plane correlated to an existing session
         // continues it as a normal chat instead of starting cold (mirrors GitHub).
-        if (await continueCorrelatedSession(item, buildLinearTaskPrompt(issue), report))
+        if (await continueCorrelatedSession(item, buildLinearTaskPrompt(issue), report, { signal }))
             return;
         const githubToken = await resolveGitHubToken();
         if (!githubToken)
@@ -4784,7 +4815,9 @@ async function runWorkItem(item, report) {
             catch { }
         }
         await report({ output: { sessionId: record.id, branch }, events: [{ at: new Date().toISOString(), kind: "branch", summary: "Linear issue working branch and session created.", ref: branch, url: issue.url }] });
-        await runSessionTurn(record, buildLinearTaskPrompt(issue));
+        await runSessionTurn(record, buildLinearTaskPrompt(issue), signal);
+        if (signal.aborted)
+            throw signal.reason ?? new Error("Run cancelled");
         await branchPublish.maybePushWorktreeBranch(record);
         await prDetection.maybeDetectPullRequest(record);
         await report({ output: { sessionId: record.id, branch, prUrl: record.prUrl }, events: record.prUrl ? [{ at: new Date().toISOString(), kind: "pull_request", summary: "Pull request opened.", ref: branch, url: record.prUrl }] : undefined });
@@ -4815,7 +4848,7 @@ async function runWorkItem(item, report) {
     // Scheduled runs targeting an existing session are STRICT: the message must
     // land in that session (resumed from disk if needed), never silently in a new
     // one — so a session that can't be resumed fails the run instead.
-    if (await continueCorrelatedSession(item, request, report, { resumeOnMissing: item.source === "schedule", isMessage }))
+    if (await continueCorrelatedSession(item, request, report, { resumeOnMissing: item.source === "schedule", isMessage, signal }))
         return;
     const requestedSandbox = normalizeSandboxTier(item.sandbox);
     // Prepare an explicit repository before resolving its policy. Otherwise a
@@ -4858,7 +4891,9 @@ async function runWorkItem(item, report) {
                 "When finished, commit and push your changes, then open a pull request with a clear title and description. If you cannot open it, leave the changes committed on this branch.",
             ].join("\n")
             : request;
-    await runSessionTurn(record, prompt);
+    await runSessionTurn(record, prompt, signal);
+    if (signal.aborted)
+        throw signal.reason ?? new Error("Run cancelled");
     if (!isMessage && record.worktree) {
         await branchPublish.maybePushWorktreeBranch(record);
         await prDetection.maybeDetectPullRequest(record);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bivy/bivy",
-  "version": "0.10.1-staging.236",
+  "version": "0.10.1-staging.237",
   "type": "module",
   "license": "AGPL-3.0-only",
   "description": "Run coding agents on machines you own. Open-source, self-hostable agent workspace.",