@cabane/companion 0.6.88 → 0.6.89

package/dist/cli.js

@@ -2457,10 +2457,22 @@ var CabaneApi = class {
   // token whose turn has ended. The dispatcher mints it before this call and
   // reuses the same value on its active-run PATCH, so the token's turn id and the
   // pair's `active_turn_id` agree.
-  getTurnContext(conversationId, messageId2, turnId) {
-    const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "");
+  // CT1380: `resumed` says this dispatch is a REPLAY of an interrupted turn, so
+  // the server should hand back `turnSeqFloor` — the turn's committed seq
+  // high-water mark. Only the supervisor knows (it minted the id or recovered
+  // it), so it is passed down rather than inferred here. It gates the COST of
+  // the aggregate, never the tenancy scoping, which the route applies
+  // unconditionally.
+  getTurnContext(conversationId, messageId2, turnId, resumed) {
+    const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "") + (resumed ? "&resumed=1" : "");
     return this.request("GET", `/api/agent/turn-context?${q}`);
   }
+  // CT1380: the local half of a resumed turn's seq floor (see
+  // `Outbox.maxSeqForTurn`). 0 when no outbox is configured — a one-shot CLI or
+  // test has no durable queue, so nothing can be hiding in it.
+  outboxMaxSeqForTurn(turnId) {
+    return this.opts.outbox?.maxSeqForTurn(turnId) ?? 0;
+  }
   // CT714: read a turn's recorded turn-control intent. An EXTERNAL adapter
   // (Codex / opencode) records `reply_to` / `skip_turn` into `turn_intents`
   // server-side (the URL MCP surface) rather than the dispatcher's in-memory
@@ -7967,6 +7979,39 @@ async function writeCodexInstructionsFile(contents) {
   };
 }
 
+// src/turn-seq-floor.ts
+var SeqFloorUnavailable = class extends Error {
+  constructor(detail) {
+    super(`seq_floor_unavailable: ${detail}`);
+    this.detail = detail;
+    this.name = "SeqFloorUnavailable";
+  }
+  detail;
+};
+function resolveSeqFloor(sources, ctx) {
+  const { serverFloor, outboxFloor } = sources;
+  if (serverFloor === void 0) {
+    throw new SeqFloorUnavailable("server sent no committed floor for a resumed turn");
+  }
+  const floor = Math.max(serverFloor, outboxFloor);
+  ctx.log.info(
+    { turnId: ctx.turnId, floor, outboxFloor, serverFloor },
+    "companion: resumed turn \u2014 seq counter seeded above its committed high-water mark"
+  );
+  return floor;
+}
+function readOutboxFloor(read, turnId, log) {
+  try {
+    return read(turnId);
+  } catch (err) {
+    log.error(
+      { turnId, err: err instanceof Error ? err.message : String(err) },
+      "companion: the on-disk outbox floor is unreadable; refusing to resume"
+    );
+    throw new SeqFloorUnavailable("outbox unreadable");
+  }
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
 import { join as join11 } from "path";
@@ -8417,6 +8462,7 @@ var TurnExecution = class {
     this.opts = opts;
     this.supervisor = supervisor;
     this.payload = payload;
+    this.resumed = handleOpts.resumed === true;
     this.dispatchId = payload.messageId;
     this.workspaceId = opts.workspaceId;
     this.turnLog = opts.log.child({
@@ -8439,7 +8485,13 @@ var TurnExecution = class {
   outcome = initialOutcome();
   seqCounter = 0;
   // CT11: per-turn monotonic counter mirroring the in-process dispatcher's.
+  //
+  // CT1380: 0 for a NEW turn only — a resume is seeded in `fetchContext` first.
   nextSeq = () => ++this.seqCounter;
+  // CT1380: a REPLAY, told to us by the supervisor — not derivable here, since
+  // `turnId` is set on every dispatch. `resumedFromSeq` is what it seeded from.
+  resumed;
+  resumedFromSeq;
   turnContext;
   resolvedMcpServers;
   effectiveCwd;
@@ -8485,6 +8537,10 @@ var TurnExecution = class {
       await this.acquireLease();
       await this.selectAdapter();
     } catch (err) {
+      if (err instanceof SeqFloorUnavailable) {
+        this.supervisor.releaseAbort(this.turnId, this.abortController);
+        return this.concludeBeforeRun(err.message, err.message);
+      }
       if (err instanceof TurnConcluded) {
         this.supervisor.releaseAbort(this.turnId, this.abortController);
         return this.admitted ? this.concludeAdmittedRun(err.reason, err.errorReason) : this.concludeBeforeRun(err.reason, err.errorReason);
@@ -8563,12 +8619,14 @@ var TurnExecution = class {
   }
   async fetchContext() {
     const { payload, turnId, turnLog } = this;
+    const outboxFloor = this.resumed ? readOutboxFloor((id) => this.opts.api.outboxMaxSeqForTurn(id), turnId, turnLog) : 0;
     let turnContext;
     try {
       turnContext = await this.opts.api.getTurnContext(
         payload.conversationId,
         payload.messageId,
-        turnId
+        turnId,
+        this.resumed
       );
     } catch (err) {
       const status2 = err instanceof ApiError ? err.status : 0;
@@ -8585,6 +8643,11 @@ var TurnExecution = class {
       throw this.concluded(fetchReason, fetchReason);
     }
     this.turnContext = turnContext;
+    if (this.resumed) {
+      const sources = { serverFloor: turnContext.turnSeqFloor, outboxFloor };
+      this.resumedFromSeq = resolveSeqFloor(sources, { turnId, log: turnLog });
+      this.seqCounter = Math.max(this.seqCounter, this.resumedFromSeq);
+    }
   }
   gateTrigger() {
     const { payload, turnLog } = this;
@@ -8815,6 +8878,8 @@ ${reason}`,
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
         activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        // CT1380: the durable record that this turn resumed, and from where.
+        ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
         // CT33: hand the server this turn's id so the new-run chokepoint's
         // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
         // already emitted a "preparing" activity row for this turn above (it
@@ -9563,6 +9628,35 @@ var Outbox = class {
     );
     return entries;
   }
+  // CT1380: the highest `seq` this turn has queued but not yet delivered — the
+  // half of a resumed turn's seq floor the SERVER CANNOT SEE. A commit that
+  // failed transiently before the crash is sitting in this directory with its
+  // seq already spent, and the restart's drain is fire-and-forget
+  // (`drain.kick()`, never awaited), so `maxSeqForTurn` on the server can report
+  // below it and the resumed run would mint that number a second time.
+  //
+  // Reads the directory rather than `list()` because only the filename matters:
+  // `<turnId>__<seq>.json` carries both halves of the key, so a corrupt body
+  // can't hide a spent seq from the floor. Returns 0 for a turn with nothing
+  // queued, which is the overwhelmingly common case.
+  // THROWS rather than returning 0 when the directory exists but cannot be
+  // read. 0 is a claim ("this turn has nothing queued"), and an unreadable
+  // directory cannot support it — a queued entry holding seq N would be
+  // invisible and the resumed run would mint N again. A missing directory is
+  // different: it is positive evidence that nothing was ever queued here.
+  maxSeqForTurn(turnId) {
+    const dir2 = this.dir();
+    if (!existsSync12(dir2)) return 0;
+    const names = readdirSync3(dir2);
+    const prefix = `${encodeURIComponent(turnId)}__`;
+    let max = 0;
+    for (const name of names) {
+      if (!name.startsWith(prefix) || !name.endsWith(".json")) continue;
+      const seq = Number(name.slice(prefix.length, -".json".length));
+      if (Number.isInteger(seq) && seq > max) max = seq;
+    }
+    return max;
+  }
   // Remove a delivered (or terminally-discarded) entry. No-op if already gone.
   remove(turnId, seq) {
     try {
@@ -10479,7 +10573,10 @@ var CompanionSupervisor = class {
         "companion: resuming an interrupted turn under its original id"
       );
     }
-    const result = await agent.dispatcher.handle(payload, { turnId });
+    const result = await agent.dispatcher.handle(payload, {
+      turnId,
+      resumed: resumedTurnId !== null
+    });
     if (ev.id) markCompleted(workspaceId, ev.id);
     if (ev.id) wr.cursor.settle(ev.id);
     const durationS = (result.durationMs / 1e3).toFixed(1);

package/dist/runtime.js

@@ -1875,10 +1875,22 @@ var CabaneApi = class {
   // token whose turn has ended. The dispatcher mints it before this call and
   // reuses the same value on its active-run PATCH, so the token's turn id and the
   // pair's `active_turn_id` agree.
-  getTurnContext(conversationId, messageId2, turnId) {
-    const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "");
+  // CT1380: `resumed` says this dispatch is a REPLAY of an interrupted turn, so
+  // the server should hand back `turnSeqFloor` — the turn's committed seq
+  // high-water mark. Only the supervisor knows (it minted the id or recovered
+  // it), so it is passed down rather than inferred here. It gates the COST of
+  // the aggregate, never the tenancy scoping, which the route applies
+  // unconditionally.
+  getTurnContext(conversationId, messageId2, turnId, resumed) {
+    const q = `conversationId=${encodeURIComponent(conversationId)}&messageId=${encodeURIComponent(messageId2)}` + (turnId ? `&turnId=${encodeURIComponent(turnId)}` : "") + (resumed ? "&resumed=1" : "");
     return this.request("GET", `/api/agent/turn-context?${q}`);
   }
+  // CT1380: the local half of a resumed turn's seq floor (see
+  // `Outbox.maxSeqForTurn`). 0 when no outbox is configured — a one-shot CLI or
+  // test has no durable queue, so nothing can be hiding in it.
+  outboxMaxSeqForTurn(turnId) {
+    return this.opts.outbox?.maxSeqForTurn(turnId) ?? 0;
+  }
   // CT714: read a turn's recorded turn-control intent. An EXTERNAL adapter
   // (Codex / opencode) records `reply_to` / `skip_turn` into `turn_intents`
   // server-side (the URL MCP surface) rather than the dispatcher's in-memory
@@ -7464,6 +7476,39 @@ async function writeCodexInstructionsFile(contents) {
   };
 }
 
+// src/turn-seq-floor.ts
+var SeqFloorUnavailable = class extends Error {
+  constructor(detail) {
+    super(`seq_floor_unavailable: ${detail}`);
+    this.detail = detail;
+    this.name = "SeqFloorUnavailable";
+  }
+  detail;
+};
+function resolveSeqFloor(sources, ctx) {
+  const { serverFloor, outboxFloor } = sources;
+  if (serverFloor === void 0) {
+    throw new SeqFloorUnavailable("server sent no committed floor for a resumed turn");
+  }
+  const floor = Math.max(serverFloor, outboxFloor);
+  ctx.log.info(
+    { turnId: ctx.turnId, floor, outboxFloor, serverFloor },
+    "companion: resumed turn \u2014 seq counter seeded above its committed high-water mark"
+  );
+  return floor;
+}
+function readOutboxFloor(read, turnId, log) {
+  try {
+    return read(turnId);
+  } catch (err) {
+    log.error(
+      { turnId, err: err instanceof Error ? err.message : String(err) },
+      "companion: the on-disk outbox floor is unreadable; refusing to resume"
+    );
+    throw new SeqFloorUnavailable("outbox unreadable");
+  }
+}
+
 // src/prepared.ts
 import { mkdirSync as mkdirSync8, readFileSync as readFileSync6, rmSync as rmSync5, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
 import { join as join11 } from "path";
@@ -7914,6 +7959,7 @@ var TurnExecution = class {
     this.opts = opts;
     this.supervisor = supervisor;
     this.payload = payload;
+    this.resumed = handleOpts.resumed === true;
     this.dispatchId = payload.messageId;
     this.workspaceId = opts.workspaceId;
     this.turnLog = opts.log.child({
@@ -7936,7 +7982,13 @@ var TurnExecution = class {
   outcome = initialOutcome();
   seqCounter = 0;
   // CT11: per-turn monotonic counter mirroring the in-process dispatcher's.
+  //
+  // CT1380: 0 for a NEW turn only — a resume is seeded in `fetchContext` first.
   nextSeq = () => ++this.seqCounter;
+  // CT1380: a REPLAY, told to us by the supervisor — not derivable here, since
+  // `turnId` is set on every dispatch. `resumedFromSeq` is what it seeded from.
+  resumed;
+  resumedFromSeq;
   turnContext;
   resolvedMcpServers;
   effectiveCwd;
@@ -7982,6 +8034,10 @@ var TurnExecution = class {
       await this.acquireLease();
       await this.selectAdapter();
     } catch (err) {
+      if (err instanceof SeqFloorUnavailable) {
+        this.supervisor.releaseAbort(this.turnId, this.abortController);
+        return this.concludeBeforeRun(err.message, err.message);
+      }
       if (err instanceof TurnConcluded) {
         this.supervisor.releaseAbort(this.turnId, this.abortController);
         return this.admitted ? this.concludeAdmittedRun(err.reason, err.errorReason) : this.concludeBeforeRun(err.reason, err.errorReason);
@@ -8060,12 +8116,14 @@ var TurnExecution = class {
   }
   async fetchContext() {
     const { payload, turnId, turnLog } = this;
+    const outboxFloor = this.resumed ? readOutboxFloor((id) => this.opts.api.outboxMaxSeqForTurn(id), turnId, turnLog) : 0;
     let turnContext;
     try {
       turnContext = await this.opts.api.getTurnContext(
         payload.conversationId,
         payload.messageId,
-        turnId
+        turnId,
+        this.resumed
       );
     } catch (err) {
       const status = err instanceof ApiError ? err.status : 0;
@@ -8082,6 +8140,11 @@ var TurnExecution = class {
       throw this.concluded(fetchReason, fetchReason);
     }
     this.turnContext = turnContext;
+    if (this.resumed) {
+      const sources = { serverFloor: turnContext.turnSeqFloor, outboxFloor };
+      this.resumedFromSeq = resolveSeqFloor(sources, { turnId, log: turnLog });
+      this.seqCounter = Math.max(this.seqCounter, this.resumedFromSeq);
+    }
   }
   gateTrigger() {
     const { payload, turnLog } = this;
@@ -8312,6 +8375,8 @@ ${reason}`,
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
         activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        // CT1380: the durable record that this turn resumed, and from where.
+        ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
         // CT33: hand the server this turn's id so the new-run chokepoint's
         // `closeAbandonedTurns` sweep excludes it. The prepare hook may have
         // already emitted a "preparing" activity row for this turn above (it
@@ -9060,6 +9125,35 @@ var Outbox = class {
     );
     return entries;
   }
+  // CT1380: the highest `seq` this turn has queued but not yet delivered — the
+  // half of a resumed turn's seq floor the SERVER CANNOT SEE. A commit that
+  // failed transiently before the crash is sitting in this directory with its
+  // seq already spent, and the restart's drain is fire-and-forget
+  // (`drain.kick()`, never awaited), so `maxSeqForTurn` on the server can report
+  // below it and the resumed run would mint that number a second time.
+  //
+  // Reads the directory rather than `list()` because only the filename matters:
+  // `<turnId>__<seq>.json` carries both halves of the key, so a corrupt body
+  // can't hide a spent seq from the floor. Returns 0 for a turn with nothing
+  // queued, which is the overwhelmingly common case.
+  // THROWS rather than returning 0 when the directory exists but cannot be
+  // read. 0 is a claim ("this turn has nothing queued"), and an unreadable
+  // directory cannot support it — a queued entry holding seq N would be
+  // invisible and the resumed run would mint N again. A missing directory is
+  // different: it is positive evidence that nothing was ever queued here.
+  maxSeqForTurn(turnId) {
+    const dir2 = this.dir();
+    if (!existsSync12(dir2)) return 0;
+    const names = readdirSync3(dir2);
+    const prefix = `${encodeURIComponent(turnId)}__`;
+    let max = 0;
+    for (const name of names) {
+      if (!name.startsWith(prefix) || !name.endsWith(".json")) continue;
+      const seq = Number(name.slice(prefix.length, -".json".length));
+      if (Number.isInteger(seq) && seq > max) max = seq;
+    }
+    return max;
+  }
   // Remove a delivered (or terminally-discarded) entry. No-op if already gone.
   remove(turnId, seq) {
     try {
@@ -9976,7 +10070,10 @@ var CompanionSupervisor = class {
         "companion: resuming an interrupted turn under its original id"
       );
     }
-    const result = await agent.dispatcher.handle(payload, { turnId });
+    const result = await agent.dispatcher.handle(payload, {
+      turnId,
+      resumed: resumedTurnId !== null
+    });
     if (ev.id) markCompleted(workspaceId, ev.id);
     if (ev.id) wr.cursor.settle(ev.id);
     const durationS = (result.durationMs / 1e3).toFixed(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.88",
+  "version": "0.6.89",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",