@cabane/companion 0.6.38 → 0.6.40

package/dist/cli.js

@@ -2676,8 +2676,18 @@ var DeviceApi = class {
   getAssignments() {
     return this.request("GET", "/api/companion/assignments");
   }
-  beginDrain() {
-    return this.request("POST", "/api/companion/drain", {});
+  // CT1146: report that a dispatch addressed to THIS device can't be run, because
+  // the agent isn't one this device runs (and still wasn't after a forced
+  // assignments refresh). The server clears the Working flag, retires the dispatch
+  // and posts an explanatory system message.
+  //
+  // This rides the DEVICE token deliberately: the agent's own credential is
+  // delivered through the device's assignments, so an agent this device doesn't
+  // roster is exactly an agent it holds no credential for. The device token is the
+  // only thing it can present, which is why this lives on `DeviceApi` rather than
+  // the per-agent `CabaneApi`.
+  reportDispatchDrop(body) {
+    return this.request("POST", "/api/companion/dispatch-drop", body);
   }
   // Per-device liveness ping. Reports the companion build version and the env-var
   // names the operator's secret store exposes (never values), so CT30's UI can
@@ -3458,18 +3468,24 @@ function summarizeToolResult(content) {
   }
   if (Array.isArray(content)) {
     const parts = [];
+    let sawContentEntry = false;
     for (const raw of content) {
       if (typeof raw === "string") {
+        sawContentEntry = true;
         parts.push(raw);
       } else if (raw && typeof raw === "object") {
         const block = raw;
+        if (typeof block.type === "string") sawContentEntry = true;
         if (block.type === "text" && typeof block.text === "string") parts.push(block.text);
       }
     }
     const joined = parts.join("\n").trim();
-    return joined.length > 0 ? truncate(joined, TOOL_IO_MAX_CHARS) : "";
+    if (joined.length > 0) return truncate(joined, TOOL_IO_MAX_CHARS);
+    if (sawContentEntry || content.length === 0) return "";
   }
-  return "";
+  if (typeof content !== "object") return "";
+  if (!Array.isArray(content) && Object.keys(content).length === 0) return "";
+  return summarizeToolIo(content);
 }
 function truncate(s, max) {
   if (s.length <= max) return s;
@@ -8999,8 +9015,6 @@ var CompanionSupervisor = class {
   pollTimer = null;
   refreshing = false;
   stopped = false;
-  draining = false;
-  restartPending = false;
   // CT484: latch so the companion/server version-skew warning is logged once, not
   // on every 30s heartbeat.
   versionSkewWarned = false;
@@ -9084,7 +9098,7 @@ var CompanionSupervisor = class {
   }
   // ---- device-level loops ----
   kickHeartbeat() {
-    if (this.draining || this.inFlightHeartbeat) return;
+    if (this.inFlightHeartbeat) return;
     const pending = this.sendHeartbeat();
     this.inFlightHeartbeat = pending;
     void pending.finally(() => {
@@ -9132,8 +9146,7 @@ var CompanionSupervisor = class {
         // actually landed (`harnessSignals` non-null) — an absent field means "we
         // didn't look this beat" and leaves the server's stored suggestion alone,
         // the same fail-soft contract `models` keeps.
-        ...this.harnessSignals ? { detectedRuntimes: detectedRuntimesFor(deriveHarnessSnapshot(this.harnessSignals)) } : {},
-        ...this.restartPending ? { restarting: true } : {}
+        ...this.harnessSignals ? { detectedRuntimes: detectedRuntimesFor(deriveHarnessSnapshot(this.harnessSignals)) } : {}
       });
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
@@ -9489,7 +9502,6 @@ var CompanionSupervisor = class {
       if (ev.id) wr.cursor.settle(ev.id);
       return;
     }
-    if (this.draining) return;
     const payload = {
       type: "device:dispatch_requested",
       ...wire.payload
@@ -9498,6 +9510,10 @@ var CompanionSupervisor = class {
     if (!agent) {
       agent = await this.recoverRacedAgent(wr, payload);
       if (!agent) {
+        if (this.deviceId && payload.deviceId === this.deviceId) {
+          const reported = await this.reportUnrunnableDispatch(wr, payload);
+          if (!reported) return;
+        }
         if (ev.id) wr.cursor.settle(ev.id);
         return;
       }
@@ -9519,6 +9535,59 @@ var CompanionSupervisor = class {
     await tail;
     if (wr.chains.get(chainKey) === tail) wr.chains.delete(chainKey);
   }
+  // CT1146: tell the server this device cannot run a dispatch it was addressed to.
+  //
+  // Returns whether the report LANDED, because that answer decides whether the
+  // caller may settle the cursor. Nothing else on either side ends this turn: the
+  // server's sweep resolves the agent's effective connector, which in a roster
+  // desync still points at this device, so it is never classified `no_device` and
+  // only the silent 12h age backstop touches it. An unreported drop is therefore
+  // indistinguishable from the original defect.
+  //
+  // Bounded retry, because the common failure is transient (a 503 mid-deploy, a
+  // dropped socket) and one more attempt a second later usually lands. Bounded
+  // hard — this runs inline on the event loop, and an unbounded wait here would
+  // wedge the workspace's whole stream.
+  async reportUnrunnableDispatch(wr, payload) {
+    if (!this.deviceApi) return false;
+    const backoffMs = [0, 1e3, 3e3];
+    let lastErr;
+    for (const wait of backoffMs) {
+      if (this.stopped) return false;
+      if (wait > 0) await new Promise((r) => setTimeout(r, wait));
+      try {
+        const { cleared } = await this.deviceApi.reportDispatchDrop({
+          workspaceId: wr.workspaceId,
+          conversationId: payload.conversationId,
+          agentId: payload.agentId,
+          messageId: payload.messageId,
+          reason: "agent_not_on_device"
+        });
+        this.log.warn(
+          {
+            workspaceId: wr.workspaceId,
+            conversationId: payload.conversationId,
+            agentId: payload.agentId,
+            cleared
+          },
+          "companion: dispatch addressed to this device is for an agent it does not run \u2014 reported as unrunnable"
+        );
+        return true;
+      } catch (err) {
+        lastErr = err;
+      }
+    }
+    this.log.error(
+      {
+        workspaceId: wr.workspaceId,
+        conversationId: payload.conversationId,
+        agentId: payload.agentId,
+        err: lastErr instanceof Error ? lastErr.message : String(lastErr)
+      },
+      "companion: could not report an unrunnable dispatch \u2014 leaving it unsettled so a reconnect replays it"
+    );
+    return false;
+  }
   // Pull-on-miss for the assignment-change race: a dispatch arrived for an agent
   // we don't yet run. If it's addressed to THIS device, the assignment just
   // changed under us (the poll hasn't caught it) — force a fresh assignments pull
@@ -9794,50 +9863,6 @@ var CompanionSupervisor = class {
       ...[...this.workspaces.values()].flatMap((wr) => wr.sub ? [wr.sub.finished] : [])
     ]);
   }
-  async drainForRestart(graceMs) {
-    this.restartPending = true;
-    if (this.inFlightHeartbeat) await this.inFlightHeartbeat;
-    if (!this.deviceApi) throw new Error("cannot establish deploy drain before pairing");
-    await this.sendHeartbeat();
-    const drainStartedAt = Date.now();
-    const deadline = Date.now() + Math.max(0, graceMs);
-    let timedOut = false;
-    while (true) {
-      const turns = [...this.workspaces.values()].flatMap((wr) => [...wr.chains.values()]);
-      if (turns.length === 0) break;
-      const remainingMs = deadline - Date.now();
-      if (remainingMs <= 0) {
-        timedOut = true;
-        break;
-      }
-      let timer;
-      await Promise.race([
-        Promise.allSettled(turns),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, remainingMs);
-          timer.unref?.();
-        })
-      ]);
-      if (timer) clearTimeout(timer);
-    }
-    this.log.info(
-      { waitedMs: Date.now() - drainStartedAt, timedOut },
-      timedOut ? "companion: deploy drain grace elapsed; fencing admission for restart" : "companion: deploy drain reached a quiet point; fencing admission for restart"
-    );
-    this.draining = true;
-    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
-    if (this.pollTimer) clearInterval(this.pollTimer);
-    if (this.inFlightHeartbeat) await this.inFlightHeartbeat;
-    await this.deviceApi.beginDrain();
-    for (const wr of this.workspaces.values()) wr.sub?.stop();
-    await Promise.allSettled(
-      [...this.workspaces.values()].flatMap(
-        (wr) => [...wr.agents.values()].map((agent) => agent.api.drainOutbox())
-      )
-    );
-    await this.shutdown();
-    return { drained: !timedOut };
-  }
   async requestStop() {
     await this.shutdown();
     this.exitFn(0);
@@ -10069,14 +10094,7 @@ async function createCompanionRuntime(opts = {}) {
       stop: stop2,
       heartbeatNow: () => supervisor.heartbeatNow(),
       harnesses: () => hub.statusJson().harnesses ?? [],
-      connectHarness,
-      drainForRestart: async (graceMs) => {
-        clearRuntimeStateIfOurs(instanceId);
-        const result = await supervisor.drainForRestart(graceMs);
-        await closeSurfaces(control, dashboard);
-        stopped = true;
-        return result;
-      }
+      connectHarness
     }
   };
 }
@@ -10205,8 +10223,6 @@ function defaultSpawnDetached(args) {
 
 // src/commands/start.ts
 var FORCE_EXIT_MS = 4e3;
-var DEPLOY_REEXEC_EXIT = 75;
-var DEPLOY_GRACE_MS = 6.5 * 60 * 60 * 1e3;
 var MAX_CODES = 3;
 async function start(opts = {}) {
   const interactive = isInteractive();
@@ -10445,31 +10461,6 @@ companion: received ${signal}, shutting down\u2026
     };
     process.on("SIGINT", () => void shutdown("SIGINT"));
     process.on("SIGTERM", () => void shutdown("SIGTERM"));
-    process.on("SIGUSR2", () => {
-      if (shuttingDown) return;
-      shuttingDown = true;
-      const configuredGrace = Number.parseInt(
-        process.env.CABANE_COMPANION_DEPLOY_GRACE_MS ?? String(DEPLOY_GRACE_MS),
-        10
-      );
-      const graceMs = Number.isFinite(configuredGrace) ? configuredGrace : DEPLOY_GRACE_MS;
-      process.stdout.write(`
-companion: deploy drain requested (${graceMs}ms grace)\u2026
-`);
-      void runtime.drainForRestart(graceMs).then(({ drained }) => {
-        process.stdout.write(
-          drained ? "companion: deploy drain complete; re-execing onto the new dist.\n" : "companion: deploy grace expired; re-execing \u2014 unfinished turns resume after restart.\n"
-        );
-        resolve();
-        process.exit(DEPLOY_REEXEC_EXIT);
-      }).catch((err) => {
-        process.stderr.write(
-          `companion: deploy drain failed: ${err instanceof Error ? err.message : String(err)}
-`
-        );
-        process.exit(DEPLOY_REEXEC_EXIT);
-      });
-    });
   });
 }
 

package/dist/runtime.js

@@ -2104,8 +2104,18 @@ var DeviceApi = class {
   getAssignments() {
     return this.request("GET", "/api/companion/assignments");
   }
-  beginDrain() {
-    return this.request("POST", "/api/companion/drain", {});
+  // CT1146: report that a dispatch addressed to THIS device can't be run, because
+  // the agent isn't one this device runs (and still wasn't after a forced
+  // assignments refresh). The server clears the Working flag, retires the dispatch
+  // and posts an explanatory system message.
+  //
+  // This rides the DEVICE token deliberately: the agent's own credential is
+  // delivered through the device's assignments, so an agent this device doesn't
+  // roster is exactly an agent it holds no credential for. The device token is the
+  // only thing it can present, which is why this lives on `DeviceApi` rather than
+  // the per-agent `CabaneApi`.
+  reportDispatchDrop(body) {
+    return this.request("POST", "/api/companion/dispatch-drop", body);
   }
   // Per-device liveness ping. Reports the companion build version and the env-var
   // names the operator's secret store exposes (never values), so CT30's UI can
@@ -2965,18 +2975,24 @@ function summarizeToolResult(content) {
   }
   if (Array.isArray(content)) {
     const parts = [];
+    let sawContentEntry = false;
     for (const raw of content) {
       if (typeof raw === "string") {
+        sawContentEntry = true;
         parts.push(raw);
       } else if (raw && typeof raw === "object") {
         const block = raw;
+        if (typeof block.type === "string") sawContentEntry = true;
         if (block.type === "text" && typeof block.text === "string") parts.push(block.text);
       }
     }
     const joined = parts.join("\n").trim();
-    return joined.length > 0 ? truncate(joined, TOOL_IO_MAX_CHARS) : "";
+    if (joined.length > 0) return truncate(joined, TOOL_IO_MAX_CHARS);
+    if (sawContentEntry || content.length === 0) return "";
   }
-  return "";
+  if (typeof content !== "object") return "";
+  if (!Array.isArray(content) && Object.keys(content).length === 0) return "";
+  return summarizeToolIo(content);
 }
 function truncate(s, max) {
   if (s.length <= max) return s;
@@ -8506,8 +8522,6 @@ var CompanionSupervisor = class {
   pollTimer = null;
   refreshing = false;
   stopped = false;
-  draining = false;
-  restartPending = false;
   // CT484: latch so the companion/server version-skew warning is logged once, not
   // on every 30s heartbeat.
   versionSkewWarned = false;
@@ -8591,7 +8605,7 @@ var CompanionSupervisor = class {
   }
   // ---- device-level loops ----
   kickHeartbeat() {
-    if (this.draining || this.inFlightHeartbeat) return;
+    if (this.inFlightHeartbeat) return;
     const pending = this.sendHeartbeat();
     this.inFlightHeartbeat = pending;
     void pending.finally(() => {
@@ -8639,8 +8653,7 @@ var CompanionSupervisor = class {
         // actually landed (`harnessSignals` non-null) — an absent field means "we
         // didn't look this beat" and leaves the server's stored suggestion alone,
         // the same fail-soft contract `models` keeps.
-        ...this.harnessSignals ? { detectedRuntimes: detectedRuntimesFor(deriveHarnessSnapshot(this.harnessSignals)) } : {},
-        ...this.restartPending ? { restarting: true } : {}
+        ...this.harnessSignals ? { detectedRuntimes: detectedRuntimesFor(deriveHarnessSnapshot(this.harnessSignals)) } : {}
       });
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
@@ -8996,7 +9009,6 @@ var CompanionSupervisor = class {
       if (ev.id) wr.cursor.settle(ev.id);
       return;
     }
-    if (this.draining) return;
     const payload = {
       type: "device:dispatch_requested",
       ...wire.payload
@@ -9005,6 +9017,10 @@ var CompanionSupervisor = class {
     if (!agent) {
       agent = await this.recoverRacedAgent(wr, payload);
       if (!agent) {
+        if (this.deviceId && payload.deviceId === this.deviceId) {
+          const reported = await this.reportUnrunnableDispatch(wr, payload);
+          if (!reported) return;
+        }
         if (ev.id) wr.cursor.settle(ev.id);
         return;
       }
@@ -9026,6 +9042,59 @@ var CompanionSupervisor = class {
     await tail;
     if (wr.chains.get(chainKey) === tail) wr.chains.delete(chainKey);
   }
+  // CT1146: tell the server this device cannot run a dispatch it was addressed to.
+  //
+  // Returns whether the report LANDED, because that answer decides whether the
+  // caller may settle the cursor. Nothing else on either side ends this turn: the
+  // server's sweep resolves the agent's effective connector, which in a roster
+  // desync still points at this device, so it is never classified `no_device` and
+  // only the silent 12h age backstop touches it. An unreported drop is therefore
+  // indistinguishable from the original defect.
+  //
+  // Bounded retry, because the common failure is transient (a 503 mid-deploy, a
+  // dropped socket) and one more attempt a second later usually lands. Bounded
+  // hard — this runs inline on the event loop, and an unbounded wait here would
+  // wedge the workspace's whole stream.
+  async reportUnrunnableDispatch(wr, payload) {
+    if (!this.deviceApi) return false;
+    const backoffMs = [0, 1e3, 3e3];
+    let lastErr;
+    for (const wait of backoffMs) {
+      if (this.stopped) return false;
+      if (wait > 0) await new Promise((r) => setTimeout(r, wait));
+      try {
+        const { cleared } = await this.deviceApi.reportDispatchDrop({
+          workspaceId: wr.workspaceId,
+          conversationId: payload.conversationId,
+          agentId: payload.agentId,
+          messageId: payload.messageId,
+          reason: "agent_not_on_device"
+        });
+        this.log.warn(
+          {
+            workspaceId: wr.workspaceId,
+            conversationId: payload.conversationId,
+            agentId: payload.agentId,
+            cleared
+          },
+          "companion: dispatch addressed to this device is for an agent it does not run \u2014 reported as unrunnable"
+        );
+        return true;
+      } catch (err) {
+        lastErr = err;
+      }
+    }
+    this.log.error(
+      {
+        workspaceId: wr.workspaceId,
+        conversationId: payload.conversationId,
+        agentId: payload.agentId,
+        err: lastErr instanceof Error ? lastErr.message : String(lastErr)
+      },
+      "companion: could not report an unrunnable dispatch \u2014 leaving it unsettled so a reconnect replays it"
+    );
+    return false;
+  }
   // Pull-on-miss for the assignment-change race: a dispatch arrived for an agent
   // we don't yet run. If it's addressed to THIS device, the assignment just
   // changed under us (the poll hasn't caught it) — force a fresh assignments pull
@@ -9301,50 +9370,6 @@ var CompanionSupervisor = class {
       ...[...this.workspaces.values()].flatMap((wr) => wr.sub ? [wr.sub.finished] : [])
     ]);
   }
-  async drainForRestart(graceMs) {
-    this.restartPending = true;
-    if (this.inFlightHeartbeat) await this.inFlightHeartbeat;
-    if (!this.deviceApi) throw new Error("cannot establish deploy drain before pairing");
-    await this.sendHeartbeat();
-    const drainStartedAt = Date.now();
-    const deadline = Date.now() + Math.max(0, graceMs);
-    let timedOut = false;
-    while (true) {
-      const turns = [...this.workspaces.values()].flatMap((wr) => [...wr.chains.values()]);
-      if (turns.length === 0) break;
-      const remainingMs = deadline - Date.now();
-      if (remainingMs <= 0) {
-        timedOut = true;
-        break;
-      }
-      let timer;
-      await Promise.race([
-        Promise.allSettled(turns),
-        new Promise((resolve) => {
-          timer = setTimeout(resolve, remainingMs);
-          timer.unref?.();
-        })
-      ]);
-      if (timer) clearTimeout(timer);
-    }
-    this.log.info(
-      { waitedMs: Date.now() - drainStartedAt, timedOut },
-      timedOut ? "companion: deploy drain grace elapsed; fencing admission for restart" : "companion: deploy drain reached a quiet point; fencing admission for restart"
-    );
-    this.draining = true;
-    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
-    if (this.pollTimer) clearInterval(this.pollTimer);
-    if (this.inFlightHeartbeat) await this.inFlightHeartbeat;
-    await this.deviceApi.beginDrain();
-    for (const wr of this.workspaces.values()) wr.sub?.stop();
-    await Promise.allSettled(
-      [...this.workspaces.values()].flatMap(
-        (wr) => [...wr.agents.values()].map((agent) => agent.api.drainOutbox())
-      )
-    );
-    await this.shutdown();
-    return { drained: !timedOut };
-  }
   async requestStop() {
     await this.shutdown();
     this.exitFn(0);
@@ -9576,14 +9601,7 @@ async function createCompanionRuntime(opts = {}) {
       stop,
       heartbeatNow: () => supervisor.heartbeatNow(),
       harnesses: () => hub.statusJson().harnesses ?? [],
-      connectHarness,
-      drainForRestart: async (graceMs) => {
-        clearRuntimeStateIfOurs(instanceId);
-        const result = await supervisor.drainForRestart(graceMs);
-        await closeSurfaces(control, dashboard);
-        stopped = true;
-        return result;
-      }
+      connectHarness
     }
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.38",
+  "version": "0.6.40",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",