@cabane/companion 0.6.95 → 0.6.97

package/dist/cli.js

@@ -1963,7 +1963,7 @@ function getLogger() {
 }
 
 // src/runtime.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // src/dashboard/server.ts
 import { dirname as dirname5, join as join8 } from "path";
@@ -2524,8 +2524,12 @@ async function warnAboutHarnessReadiness(cfg, deps = {}) {
   warn(`No harness is connected on this device yet, so no agent turn can run here. ${guidance}`);
 }
 
+// src/boot-id.ts
+import { randomUUID } from "crypto";
+var bootId = randomUUID();
+
 // src/supervisor.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // src/api.ts
 var RETRY_BACKOFF_MS = [250, 750];
@@ -3043,9 +3047,10 @@ var DeviceApi = class {
   get base() {
     return this.opts.baseUrl.endsWith("/") ? this.opts.baseUrl.slice(0, -1) : this.opts.baseUrl;
   }
-  async request(method, path, body) {
+  async request(method, path, body, signal) {
     const res = await fetch(`${this.base}${path}`, {
       method,
+      ...signal ? { signal } : {},
       headers: {
         Authorization: `Bearer ${this.opts.deviceToken}`,
         ...body !== void 0 ? { "content-type": "application/json" } : {},
@@ -3072,6 +3077,16 @@ var DeviceApi = class {
   getAssignments() {
     return this.request("GET", "/api/companion/assignments");
   }
+  getRuns(cursor) {
+    const query = new URLSearchParams({ limit: "100", order: "asc" });
+    if (cursor) query.set("cursor", cursor);
+    return this.request(
+      "GET",
+      `/api/companion/runs?${query}`,
+      void 0,
+      AbortSignal.timeout(5e3)
+    );
+  }
   // CT1146: report that a dispatch addressed to THIS device can't be run, because
   // the agent isn't one this device runs (and still wasn't after a forced
   // assignments refresh). The server clears the Working flag, retires the dispatch
@@ -7889,11 +7904,11 @@ import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as st
 import { join as join15 } from "path";
 
 // src/turn-execution.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import { existsSync as existsSync10 } from "fs";
 
 // src/turn-control-tools.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // packages/agent-runtime/src/turn-control/descriptions.ts
 var MAX_ASK_QUESTION_BYTES = 400;
@@ -8045,7 +8060,7 @@ function createTurnControlMcpServer(acts, skipState) {
           }
           return performAct(acts, {
             kind: "ask",
-            callId: randomUUID(),
+            callId: randomUUID2(),
             // CT1350: the swap rides the ask, so the server commits both halves
             // in one transaction — the person never sees neither or both.
             ...args.replaces ? { replaces: args.replaces } : {},
@@ -8087,7 +8102,7 @@ function createTurnControlMcpServer(acts, skipState) {
           }
           return performAct(acts, {
             kind: "wake",
-            callId: randomUUID(),
+            callId: randomUUID2(),
             wake: {
               ...hasAfter ? { afterSeconds: args.afterSeconds } : {},
               ...hasAt ? { at: args.at } : {},
@@ -8111,7 +8126,7 @@ function createTurnControlMcpServer(acts, skipState) {
         },
         async (args) => performAct(acts, {
           kind: "withdraw_ask",
-          callId: randomUUID(),
+          callId: randomUUID2(),
           withdraw: { askId: args.askId, reason: args.reason }
         }),
         { annotations: ACT_TOOL, alwaysLoad: true }
@@ -8122,7 +8137,7 @@ function createTurnControlMcpServer(acts, skipState) {
         CANCEL_WAKE_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.cancel_wake,
         {},
-        async () => performAct(acts, { kind: "cancel_wake", callId: randomUUID() }),
+        async () => performAct(acts, { kind: "cancel_wake", callId: randomUUID2() }),
         { annotations: CANCEL_TOOL, alwaysLoad: true }
       )
     ]
@@ -8755,7 +8770,7 @@ var TurnExecution = class {
       agentId: payload.agentId,
       messageId: payload.messageId
     });
-    this.turnId = handleOpts.turnId ?? randomUUID2();
+    this.turnId = handleOpts.turnId ?? randomUUID3();
   }
   opts;
   supervisor;
@@ -8969,7 +8984,7 @@ var TurnExecution = class {
         await this.opts.api.postTurnMessage(workspaceId, payload.conversationId, {
           body: `${MISSING_SECRET_PREFIX} ${list}`,
           kind: "runtime_notice",
-          turnId: randomUUID2(),
+          turnId: randomUUID3(),
           // CT113: even a turn that fails before it runs answers a message.
           parentMessageId: payload.messageId
         });
@@ -9110,6 +9125,7 @@ var TurnExecution = class {
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
         activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        bootId,
         // CT1380: the durable record that this turn resumed, and from where.
         ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
         // CT33: hand the server this turn's id so the new-run chokepoint's
@@ -10161,6 +10177,11 @@ var CompanionSupervisor = class {
   unrunnableRetryDelaysMs;
   deviceApi = null;
   deviceSub = null;
+  recoveryChecked = false;
+  recovering = false;
+  heartbeated = false;
+  recoveryCursor;
+  recoveredTurns = /* @__PURE__ */ new Set();
   heartbeatTimer = null;
   inFlightHeartbeat = null;
   pollTimer = null;
@@ -10273,6 +10294,7 @@ var CompanionSupervisor = class {
       const connectorReports = this.connectorHealth.reports();
       const opencodeModels = this.config.opencode?.serverUrl ? await enumerateOpencodeModels(this.config.opencode.serverUrl) : null;
       const res = await this.deviceApi.heartbeat({
+        bootId,
         version: COMPANION_VERSION,
         exposedSecretNames: store.names(),
         // Report each runtime only when this device can actually run it:
@@ -10311,6 +10333,8 @@ var CompanionSupervisor = class {
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
       this.checkVersionSkew(res.serverVersion);
+      this.heartbeated = true;
+      void this.recoverRuns();
     } catch (err) {
       this.log.warn(
         { err: err instanceof Error ? err.message : String(err) },
@@ -10374,6 +10398,7 @@ var CompanionSupervisor = class {
         }
         for (const [wsId, list] of byWorkspace) this.reconcileWorkspace(wsId, list);
         pruneCredentials(items.map((i) => i.agentId));
+        void this.recoverRuns();
       } finally {
         this.refreshing = false;
       }
@@ -10803,11 +10828,10 @@ var CompanionSupervisor = class {
   // CT1146: tell the server this device cannot run a dispatch it was addressed to.
   //
   // Returns whether the report LANDED, because that answer decides whether the
-  // caller may settle the cursor. Nothing else on either side ends this turn: the
-  // server's sweep resolves the agent's effective connector, which in a roster
-  // desync still points at this device, so it is never classified `no_device` and
-  // only the silent 12h age backstop touches it. An unreported drop is therefore
-  // indistinguishable from the original defect.
+  // caller may settle the cursor. The server checks the recorded dispatch
+  // destination even if the agent's assignment has moved. Reporting promptly
+  // explains the roster miss; the thirty-minute unanswered-offer deadline is
+  // only the backstop when no report lands.
   //
   // Bounded retry, because the common failure is transient (a 503 mid-deploy, a
   // dropped socket) and one more attempt a second later usually lands. Bounded
@@ -10864,10 +10888,65 @@ var CompanionSupervisor = class {
     await this.refreshAssignments();
     return this.workspaces.get(wr.workspaceId)?.agents.get(payload.agentId);
   }
+  // The server may still hold a run whose SSE event no longer replays.
+  // Read one bounded page per refresh. Only a stored session earns a reclaim;
+  // without one, leave the old boot untouched for the server's restart sweep.
+  async recoverRuns() {
+    if (!this.deviceApi || !this.heartbeated || this.recovering || this.recoveryChecked || this.stopped || noResume())
+      return;
+    this.recovering = true;
+    try {
+      const page = await this.deviceApi.getRuns(this.recoveryCursor);
+      if (this.stopped) return;
+      let assignmentsMissing = false;
+      for (const run of page.runs) {
+        if (run.bootId === bootId || !run.hasSession || this.recoveredTurns.has(run.turnId))
+          continue;
+        const wr = this.workspaces.get(run.workspaceId);
+        const agent = wr?.agents.get(run.agentId);
+        if (!wr || !agent) {
+          assignmentsMissing = true;
+          continue;
+        }
+        const key = `${run.conversationId}|${run.agentId}`;
+        if (wr.chains.has(key)) continue;
+        this.recoveredTurns.add(run.turnId);
+        if (bumpResumeAttempt(run.workspaceId, `restart:${run.turnId}`) > MAX_RESUME_ATTEMPTS)
+          continue;
+        const payload = {
+          type: "device:dispatch_requested",
+          deviceId: this.deviceId,
+          agentId: run.agentId,
+          conversationId: run.conversationId,
+          messageId: run.messageId
+        };
+        const tail = this.runDispatch(
+          wr,
+          { id: "", event: "recovery", data: "" },
+          payload,
+          agent,
+          run.turnId
+        ).catch(
+          (err) => this.log.warn({ err, turnId: run.turnId }, "companion: restart recovery failed")
+        ).finally(() => {
+          if (wr.chains.get(key) === tail) wr.chains.delete(key);
+        });
+        wr.chains.set(key, tail);
+      }
+      if (!assignmentsMissing) {
+        this.recoveryCursor = page.nextCursor ?? void 0;
+        this.recoveryChecked = page.nextCursor === null;
+      }
+    } catch (err) {
+      this.log.warn({ err }, "companion: run recovery read failed (will retry)");
+    } finally {
+      this.recovering = false;
+    }
+  }
   // One turn: the SJ516 F7 / CT26 skip-vs-resume dedupe, the dispatch, then
   // cursor + console summary. Mirrors the old per-workspace `handleEvent`, now
   // scoped to one agent.
-  async runDispatch(wr, ev, payload, agent) {
+  async runDispatch(wr, ev, payload, agent, recoveredTurnId) {
     const workspaceId = wr.workspaceId;
     if (ev.id && hasDispatched(workspaceId, ev.id)) {
       if (hasCompleted(workspaceId, ev.id)) {
@@ -10902,8 +10981,8 @@ var CompanionSupervisor = class {
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    const resumedTurnId = ev.id ? turnIdForEvent(workspaceId, ev.id) : null;
-    const turnId = resumedTurnId ?? randomUUID3();
+    const resumedTurnId = recoveredTurnId ?? (ev.id ? turnIdForEvent(workspaceId, ev.id) : null);
+    const turnId = resumedTurnId ?? randomUUID4();
     if (ev.id) {
       const liveTurnIds = rememberTurnId(workspaceId, ev.id, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
@@ -11326,7 +11405,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID4();
+  const instanceId = randomUUID5();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();

package/dist/runtime.js

@@ -1,5 +1,5 @@
 // src/runtime.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // src/config.ts
 import {
@@ -1942,8 +1942,12 @@ async function verifyRuntime(state, requestImpl = controlRequest) {
   return body.instance_id === state.instanceId ? "ours" : "stale";
 }
 
+// src/boot-id.ts
+import { randomUUID } from "crypto";
+var bootId = randomUUID();
+
 // src/supervisor.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // src/api.ts
 var RETRY_BACKOFF_MS = [250, 750];
@@ -2461,9 +2465,10 @@ var DeviceApi = class {
   get base() {
     return this.opts.baseUrl.endsWith("/") ? this.opts.baseUrl.slice(0, -1) : this.opts.baseUrl;
   }
-  async request(method, path, body) {
+  async request(method, path, body, signal) {
     const res = await fetch(`${this.base}${path}`, {
       method,
+      ...signal ? { signal } : {},
       headers: {
         Authorization: `Bearer ${this.opts.deviceToken}`,
         ...body !== void 0 ? { "content-type": "application/json" } : {},
@@ -2490,6 +2495,16 @@ var DeviceApi = class {
   getAssignments() {
     return this.request("GET", "/api/companion/assignments");
   }
+  getRuns(cursor) {
+    const query = new URLSearchParams({ limit: "100", order: "asc" });
+    if (cursor) query.set("cursor", cursor);
+    return this.request(
+      "GET",
+      `/api/companion/runs?${query}`,
+      void 0,
+      AbortSignal.timeout(5e3)
+    );
+  }
   // CT1146: report that a dispatch addressed to THIS device can't be run, because
   // the agent isn't one this device runs (and still wasn't after a forced
   // assignments refresh). The server clears the Working flag, retires the dispatch
@@ -7386,11 +7401,11 @@ import { existsSync as existsSync11, readdirSync as readdirSync2, statSync as st
 import { join as join15 } from "path";
 
 // src/turn-execution.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import { existsSync as existsSync10 } from "fs";
 
 // src/turn-control-tools.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // packages/agent-runtime/src/turn-control/descriptions.ts
 var MAX_ASK_QUESTION_BYTES = 400;
@@ -7542,7 +7557,7 @@ function createTurnControlMcpServer(acts, skipState) {
           }
           return performAct(acts, {
             kind: "ask",
-            callId: randomUUID(),
+            callId: randomUUID2(),
             // CT1350: the swap rides the ask, so the server commits both halves
             // in one transaction — the person never sees neither or both.
             ...args.replaces ? { replaces: args.replaces } : {},
@@ -7584,7 +7599,7 @@ function createTurnControlMcpServer(acts, skipState) {
           }
           return performAct(acts, {
             kind: "wake",
-            callId: randomUUID(),
+            callId: randomUUID2(),
             wake: {
               ...hasAfter ? { afterSeconds: args.afterSeconds } : {},
               ...hasAt ? { at: args.at } : {},
@@ -7608,7 +7623,7 @@ function createTurnControlMcpServer(acts, skipState) {
         },
         async (args) => performAct(acts, {
           kind: "withdraw_ask",
-          callId: randomUUID(),
+          callId: randomUUID2(),
           withdraw: { askId: args.askId, reason: args.reason }
         }),
         { annotations: ACT_TOOL, alwaysLoad: true }
@@ -7619,7 +7634,7 @@ function createTurnControlMcpServer(acts, skipState) {
         CANCEL_WAKE_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.cancel_wake,
         {},
-        async () => performAct(acts, { kind: "cancel_wake", callId: randomUUID() }),
+        async () => performAct(acts, { kind: "cancel_wake", callId: randomUUID2() }),
         { annotations: CANCEL_TOOL, alwaysLoad: true }
       )
     ]
@@ -8252,7 +8267,7 @@ var TurnExecution = class {
       agentId: payload.agentId,
       messageId: payload.messageId
     });
-    this.turnId = handleOpts.turnId ?? randomUUID2();
+    this.turnId = handleOpts.turnId ?? randomUUID3();
   }
   opts;
   supervisor;
@@ -8466,7 +8481,7 @@ var TurnExecution = class {
         await this.opts.api.postTurnMessage(workspaceId, payload.conversationId, {
           body: `${MISSING_SECRET_PREFIX} ${list}`,
           kind: "runtime_notice",
-          turnId: randomUUID2(),
+          turnId: randomUUID3(),
           // CT113: even a turn that fails before it runs answers a message.
           parentMessageId: payload.messageId
         });
@@ -8607,6 +8622,7 @@ var TurnExecution = class {
     try {
       await this.opts.api.setActiveRun(workspaceId, payload.conversationId, payload.agentId, {
         activeRunStartedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        bootId,
         // CT1380: the durable record that this turn resumed, and from where.
         ...this.resumedFromSeq !== void 0 ? { resumedFromSeq: this.resumedFromSeq } : {},
         // CT33: hand the server this turn's id so the new-run chokepoint's
@@ -9658,6 +9674,11 @@ var CompanionSupervisor = class {
   unrunnableRetryDelaysMs;
   deviceApi = null;
   deviceSub = null;
+  recoveryChecked = false;
+  recovering = false;
+  heartbeated = false;
+  recoveryCursor;
+  recoveredTurns = /* @__PURE__ */ new Set();
   heartbeatTimer = null;
   inFlightHeartbeat = null;
   pollTimer = null;
@@ -9770,6 +9791,7 @@ var CompanionSupervisor = class {
       const connectorReports = this.connectorHealth.reports();
       const opencodeModels = this.config.opencode?.serverUrl ? await enumerateOpencodeModels(this.config.opencode.serverUrl) : null;
       const res = await this.deviceApi.heartbeat({
+        bootId,
         version: COMPANION_VERSION,
         exposedSecretNames: store.names(),
         // Report each runtime only when this device can actually run it:
@@ -9808,6 +9830,8 @@ var CompanionSupervisor = class {
       this.hub.setDevice({ deviceId: res.deviceId });
       this.deviceId = res.deviceId;
       this.checkVersionSkew(res.serverVersion);
+      this.heartbeated = true;
+      void this.recoverRuns();
     } catch (err) {
       this.log.warn(
         { err: err instanceof Error ? err.message : String(err) },
@@ -9871,6 +9895,7 @@ var CompanionSupervisor = class {
         }
         for (const [wsId, list] of byWorkspace) this.reconcileWorkspace(wsId, list);
         pruneCredentials(items.map((i) => i.agentId));
+        void this.recoverRuns();
       } finally {
         this.refreshing = false;
       }
@@ -10300,11 +10325,10 @@ var CompanionSupervisor = class {
   // CT1146: tell the server this device cannot run a dispatch it was addressed to.
   //
   // Returns whether the report LANDED, because that answer decides whether the
-  // caller may settle the cursor. Nothing else on either side ends this turn: the
-  // server's sweep resolves the agent's effective connector, which in a roster
-  // desync still points at this device, so it is never classified `no_device` and
-  // only the silent 12h age backstop touches it. An unreported drop is therefore
-  // indistinguishable from the original defect.
+  // caller may settle the cursor. The server checks the recorded dispatch
+  // destination even if the agent's assignment has moved. Reporting promptly
+  // explains the roster miss; the thirty-minute unanswered-offer deadline is
+  // only the backstop when no report lands.
   //
   // Bounded retry, because the common failure is transient (a 503 mid-deploy, a
   // dropped socket) and one more attempt a second later usually lands. Bounded
@@ -10361,10 +10385,65 @@ var CompanionSupervisor = class {
     await this.refreshAssignments();
     return this.workspaces.get(wr.workspaceId)?.agents.get(payload.agentId);
   }
+  // The server may still hold a run whose SSE event no longer replays.
+  // Read one bounded page per refresh. Only a stored session earns a reclaim;
+  // without one, leave the old boot untouched for the server's restart sweep.
+  async recoverRuns() {
+    if (!this.deviceApi || !this.heartbeated || this.recovering || this.recoveryChecked || this.stopped || noResume())
+      return;
+    this.recovering = true;
+    try {
+      const page = await this.deviceApi.getRuns(this.recoveryCursor);
+      if (this.stopped) return;
+      let assignmentsMissing = false;
+      for (const run of page.runs) {
+        if (run.bootId === bootId || !run.hasSession || this.recoveredTurns.has(run.turnId))
+          continue;
+        const wr = this.workspaces.get(run.workspaceId);
+        const agent = wr?.agents.get(run.agentId);
+        if (!wr || !agent) {
+          assignmentsMissing = true;
+          continue;
+        }
+        const key = `${run.conversationId}|${run.agentId}`;
+        if (wr.chains.has(key)) continue;
+        this.recoveredTurns.add(run.turnId);
+        if (bumpResumeAttempt(run.workspaceId, `restart:${run.turnId}`) > MAX_RESUME_ATTEMPTS)
+          continue;
+        const payload = {
+          type: "device:dispatch_requested",
+          deviceId: this.deviceId,
+          agentId: run.agentId,
+          conversationId: run.conversationId,
+          messageId: run.messageId
+        };
+        const tail = this.runDispatch(
+          wr,
+          { id: "", event: "recovery", data: "" },
+          payload,
+          agent,
+          run.turnId
+        ).catch(
+          (err) => this.log.warn({ err, turnId: run.turnId }, "companion: restart recovery failed")
+        ).finally(() => {
+          if (wr.chains.get(key) === tail) wr.chains.delete(key);
+        });
+        wr.chains.set(key, tail);
+      }
+      if (!assignmentsMissing) {
+        this.recoveryCursor = page.nextCursor ?? void 0;
+        this.recoveryChecked = page.nextCursor === null;
+      }
+    } catch (err) {
+      this.log.warn({ err }, "companion: run recovery read failed (will retry)");
+    } finally {
+      this.recovering = false;
+    }
+  }
   // One turn: the SJ516 F7 / CT26 skip-vs-resume dedupe, the dispatch, then
   // cursor + console summary. Mirrors the old per-workspace `handleEvent`, now
   // scoped to one agent.
-  async runDispatch(wr, ev, payload, agent) {
+  async runDispatch(wr, ev, payload, agent, recoveredTurnId) {
     const workspaceId = wr.workspaceId;
     if (ev.id && hasDispatched(workspaceId, ev.id)) {
       if (hasCompleted(workspaceId, ev.id)) {
@@ -10399,8 +10478,8 @@ var CompanionSupervisor = class {
         "companion: re-dispatching interrupted turn (resume after restart)"
       );
     }
-    const resumedTurnId = ev.id ? turnIdForEvent(workspaceId, ev.id) : null;
-    const turnId = resumedTurnId ?? randomUUID3();
+    const resumedTurnId = recoveredTurnId ?? (ev.id ? turnIdForEvent(workspaceId, ev.id) : null);
+    const turnId = resumedTurnId ?? randomUUID4();
     if (ev.id) {
       const liveTurnIds = rememberTurnId(workspaceId, ev.id, turnId);
       if (liveTurnIds > TURN_ID_OVERFLOW_WARN) {
@@ -10823,7 +10902,7 @@ async function createCompanionRuntime(opts = {}) {
     opencodeServerUrl: cfg.opencode?.serverUrl,
     codex: isCodexEnabled(cfg)
   });
-  const instanceId = randomUUID4();
+  const instanceId = randomUUID5();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const pre = readLiveRuntimeState();
   if (pre && await verifyRuntime(pre) === "stale") clearRuntimeState();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.95",
+  "version": "0.6.97",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",