@cluesmith/codev 3.3.1 → 3.3.2

package/dist/agent-farm/servers/tower-routes.js

@@ -35,16 +35,17 @@ import { fetchTeamGitHubData } from '../../lib/team-github.js';
 import { resolveTarget, resolveAgentInRegistry, broadcastMessage, isResolveError } from './tower-messages.js';
 import { handleCommandRoute, COMMAND_ROUTE } from './command-relay.js';
 import { handleCanvasRoute, CANVAS_ROUTE_PREFIX } from './canvas-relay.js';
-import { formatArchitectMessage, formatBuilderMessage, formatUserViaVsCodeMessage } from '../utils/message-format.js';
+import { formatArchitectMessage, formatArchitectToBuilderMessage, formatBuilderMessage, formatUserViaVsCodeMessage, messageTooLargeError, MAX_MESSAGE_BYTES, } from '../utils/message-format.js';
 import { writeMessageToSession, writeEscapeToSession } from './message-write.js';
 import { makeDeliveryPorts, getMailboxDrainer } from './mailbox-wiring.js';
 import { deliverAgentMailSerialized } from './mailbox-delivery.js';
 import { deliverCronMail, CRON_SENDER } from './cron-delivery.js';
 import { enqueue as enqueueMailbox, getById as getMailboxById, markDelivered as markMailboxDelivered, listHeld as listHeldMailbox, dismiss as dismissMailbox, } from '../db/mailbox.js';
-// Spec 1273 per-terminal submission lock — preserved across the Spec 1313 merge for
-// the two explicit human-bypass paths (escape + interrupt), which do NOT route
-// through the mailbox's per-agent serializer and so need their own anti-fusion lock.
-import { submitToSession } from './session-submit.js';
+// Spec 1273 per-terminal submission lock. Originally the anti-fusion lock for the two
+// explicit human-bypass paths (escape + interrupt); since Issue #1365 the gated mailbox
+// delivery path takes it too, so it now serializes the whole write edge of a terminal.
+// The operator paths pass a wait ceiling — see OPERATOR_SUBMIT_WAIT_CEILING_MS.
+import { submitToSession, OPERATOR_SUBMIT_WAIT_CEILING_MS } from './session-submit.js';
 // Spec 1307 `--delay` — Tower-side deferred delivery, re-homed onto the Spec 1313
 // mailbox (the merge that carried this feature was flattened by a later rebase, so it
 // is grafted here explicitly): the due-time callback enqueues to the mailbox and
@@ -1274,17 +1275,24 @@ function liveTargetIdentity(result) {
     const archName = architectNameForTerminal(result.workspacePath, result.terminalId);
     return { toAgent: archName ?? result.agent, isArchitectTarget: archName !== null };
 }
-/** Format a message per sender/target — preserves the pre-1313 formatting rules. */
-function formatMessageForTarget(isArchitectTarget, from, message, raw) {
+/**
+ * Format a message per sender/target — preserves the pre-1313 formatting rules.
+ *
+ * #1574: `toAgent` is the CANONICAL recipient the mailbox row is keyed on (the
+ * architect reverse-map for architect targets, the resolved agent id otherwise),
+ * so the header a recipient reads names the same identity the row was addressed
+ * to. Passing anything else here would make the frame attest to a fiction.
+ */
+function formatMessageForTarget(isArchitectTarget, from, toAgent, message, raw) {
     // #1494: a human's approval relayed by the VS Code extension gets its own
     // header, so the architect can tell it from a peer-architect instruction.
     if (isArchitectTarget && from === VSCODE_USER_SENDER)
-        return formatUserViaVsCodeMessage(message, undefined, raw);
+        return formatUserViaVsCodeMessage(toAgent, message, undefined, raw);
     if (isArchitectTarget && from)
-        return formatBuilderMessage(from, message, undefined, raw); // builder → architect
+        return formatBuilderMessage(from, toAgent, message, undefined, raw); // builder → architect
     if (!isArchitectTarget)
-        return formatArchitectMessage(message, undefined, raw); // any → builder
-    return raw ? message : formatArchitectMessage(message, undefined, false); // unknown → architect
+        return formatArchitectToBuilderMessage(toAgent, message, undefined, raw); // any → builder
+    return raw ? message : formatArchitectMessage(toAgent, message, undefined, false); // unknown → architect
 }
 /**
  * Route a cron notification through the Spec 1313 mailbox + gate — the Tower-wired
@@ -1304,9 +1312,12 @@ export async function deliverCronMessage(task, message, log) {
     const ports = makeDeliveryPorts(log);
     // Preserve the pre-1313 cron framing: a message FROM the `af-cron` pseudo-builder,
     // regardless of whether the target is an architect or a builder.
+    //
+    // #1574: the frame names its recipient, which is only known AFTER resolution —
+    // so it is built per-branch rather than once up front. `base` carries everything
+    // that does not depend on the target.
     const base = {
         body: message,
-        formattedMessage: formatBuilderMessage(CRON_SENDER, message),
         supersedeKey: task.name,
     };
     const live = resolveTarget(task.target, task.workspacePath);
@@ -1314,6 +1325,7 @@ export async function deliverCronMessage(task, message, log) {
         const { toAgent } = liveTargetIdentity(live);
         return deliverCronMail(ports, db, {
             ...base,
+            formattedMessage: formatBuilderMessage(CRON_SENDER, toAgent, message),
             workspacePath: live.workspacePath,
             toAgent,
             terminalId: live.terminalId,
@@ -1327,6 +1339,7 @@ export async function deliverCronMessage(task, message, log) {
         if (!isResolveError(reg)) {
             return deliverCronMail(ports, db, {
                 ...base,
+                formattedMessage: formatBuilderMessage(CRON_SENDER, reg.agent, message),
                 workspacePath: reg.workspacePath,
                 toAgent: reg.agent,
                 terminalId: null,
@@ -1356,8 +1369,26 @@ function holdAndRespond(res, ctx, input, reason) {
         held: true,
         reason,
         mailboxId: row.id,
+        bodyLength: Buffer.byteLength(input.body, 'utf8'),
     });
 }
+/** Machine-readable reason paired with `degraded: true` on an operator send response. */
+const DEGRADED_SUBMIT_REASON = 'submit-wait-ceiling-expired';
+/**
+ * Announce that an operator submission gave up waiting for the per-terminal lock and wrote
+ * unserialized (Issue #1365).
+ *
+ * This is the degraded path, and it is deliberately loud. The ceiling arms only against a
+ * DELIVERY write (behind another operator the wait stays unbounded, as before #1365), so what
+ * expiry falls back to is exactly the pre-#1365 operator-vs-delivery behaviour: two disjoint
+ * locks, no serialization. That one pair is therefore no worse than the old status quo — but
+ * it used to be invisible, and now it is not, here and in the `degraded` flag on the response.
+ */
+function logCeilingExpired(ctx, action, toAgent, terminalId, waitedMs) {
+    ctx.log('WARN', `${action} → ${toAgent} (terminal ${terminalId.slice(0, 8)}...) waited ${waitedMs}ms for an in-flight ` +
+        `write and proceeded UNSERIALIZED — it may interleave with that write. A message long enough to ` +
+        `hold the line this long is the usual cause.`);
+}
 /**
  * Handle a delayed (`--delay`) send (Spec 1307, re-homed onto the Spec 1313 mailbox; round 3
  * durable rework). The row is RESOLVED, authorized (the builder-spoofing check inside
@@ -1420,7 +1451,7 @@ function handleDelayedSend(res, ctx, db, params) {
         sendJson(res, statusCode, { error: errorCode, message: live.message });
         return;
     }
-    const formattedMessage = formatMessageForTarget(isArchitectTarget, from, message, raw);
+    const formattedMessage = formatMessageForTarget(isArchitectTarget, from, toAgent, message, raw);
     // Persist NOW, at request time, with the due time. reason=null → SCHEDULED, not stuck.
     const row = enqueueMailbox(db, {
         workspacePath,
@@ -1462,6 +1493,17 @@ function handleDelayedSend(res, ctx, db, params) {
                     live.write('\x03'); // Ctrl+C only — end the turn; body follows via the gate
                     fired = true;
                     return 0; // no body, no Enter on this path
+                }, undefined, 
+                // The same operator ceiling as the immediate paths (Issue #1365). This one fires
+                // UNATTENDED, so it is the writer most likely to meet a gated delivery mid-pace —
+                // which is precisely why the delayed `^C` must take this lock at all.
+                {
+                    waitCeilingMs: OPERATOR_SUBMIT_WAIT_CEILING_MS,
+                    onCeilingExpired: (waitedMs) => logCeilingExpired(ctx, 'delayed interrupt ^C', toAgent, terminalId, waitedMs),
+                    // This is the one operator path whose write can be a NO-OP (the liveness re-check
+                    // above). A degraded no-op raced nobody, so it must not bump the bypass counter —
+                    // that would make a concurrent delivery hold and re-deliver for nothing.
+                    wroteBytes: () => fired,
                 })
                     .then(() => ctx.log('INFO', fired
                     ? `Delayed interrupt ^C fired → ${toAgent} (terminal ${terminalId.slice(0, 8)}...); body delivers via the gate`
@@ -1488,6 +1530,7 @@ function handleDelayedSend(res, ctx, db, params) {
         deliverAfter,
         mailboxId: row.id,
         notBefore,
+        bodyLength: Buffer.byteLength(params.message, 'utf8'),
     });
 }
 async function handleSend(req, res, ctx) {
@@ -1505,6 +1548,17 @@ async function handleSend(req, res, ctx) {
         res.end(JSON.stringify({ error: 'INVALID_PARAMS', message: 'Missing or empty "message" field' }));
         return;
     }
+    // Issue #1573: refuse an over-large body LOUDLY, here at the route rather than only at the
+    // CLI — `/api/send` is a public local route, and the CLI is not its only caller. Nothing
+    // downstream bounded message size, so an oversized body used to be paced onto the line one
+    // line at a time and reported delivered whatever the composer made of it. Rejecting is the
+    // only honest option: truncating would reproduce #1564 on purpose.
+    const bodyLength = Buffer.byteLength(message, 'utf8');
+    if (bodyLength > MAX_MESSAGE_BYTES) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'MESSAGE_TOO_LARGE', message: messageTooLargeError(bodyLength) }));
+        return;
+    }
     // Optional fields
     const from = typeof body.from === 'string' ? body.from : undefined;
     const workspace = typeof body.workspace === 'string' ? body.workspace : undefined;
@@ -1571,7 +1625,7 @@ async function handleSend(req, res, ctx) {
                     workspacePath: reg.workspacePath,
                     toAgent: reg.agent,
                     body: message,
-                    formattedMessage: formatMessageForTarget(reg.kind === 'architect', from, message, raw),
+                    formattedMessage: formatMessageForTarget(reg.kind === 'architect', from, reg.agent, message, raw),
                     fromAgent: from ?? null,
                     fromWorkspace: senderWorkspace,
                     noEnter,
@@ -1609,7 +1663,7 @@ async function handleSend(req, res, ctx) {
             workspacePath: result.workspacePath,
             toAgent,
             body: message,
-            formattedMessage: formatMessageForTarget(isArchitectTarget, from, message, raw),
+            formattedMessage: formatMessageForTarget(isArchitectTarget, from, toAgent, message, raw),
             fromAgent: from ?? null,
             fromWorkspace: senderWorkspace,
             noEnter,
@@ -1634,7 +1688,7 @@ async function handleSend(req, res, ctx) {
             workspacePath: result.workspacePath,
             toAgent,
             body: message,
-            formattedMessage: formatMessageForTarget(isArchitectTarget, from, message, raw),
+            formattedMessage: formatMessageForTarget(isArchitectTarget, from, toAgent, message, raw),
             fromAgent: from ?? null,
             fromWorkspace: senderWorkspace,
             noEnter,
@@ -1650,7 +1704,17 @@ async function handleSend(req, res, ctx) {
     if (escape) {
         // Awaited: the response must not claim delivery before the ESC and its
         // Enter have actually been written (Spec 1273 verify).
-        await submitToSession(result.terminalId, () => writeEscapeToSession(session, noEnter));
+        // Issue #1365: escape is an operator submission — it blocks behind an in-flight write
+        // (including a gated mailbox delivery, which now takes this same lock) so its ESC and
+        // Enter can no longer truncate a delivery mid-pace, but only up to the wait ceiling.
+        let escapeDegraded = false;
+        await submitToSession(result.terminalId, () => writeEscapeToSession(session, noEnter), undefined, {
+            waitCeilingMs: OPERATOR_SUBMIT_WAIT_CEILING_MS,
+            onCeilingExpired: (waitedMs) => {
+                escapeDegraded = true;
+                logCeilingExpired(ctx, 'ESC', toAgent, result.terminalId, waitedMs);
+            },
+        });
         broadcastMessage({
             type: 'message',
             from: { project: path.basename(senderWorkspace), agent: from ?? 'unknown' },
@@ -1660,10 +1724,16 @@ async function handleSend(req, res, ctx) {
             timestamp: new Date().toISOString(),
         });
         ctx.log('INFO', `Interrupt (ESC) sent: ${from ?? 'unknown'} → ${toAgent} (terminal ${result.terminalId.slice(0, 8)}...)`);
-        sendJson(res, 200, { ok: true, terminalId: result.terminalId, resolvedTo: toAgent, deferred: false });
+        sendJson(res, 200, {
+            ok: true,
+            terminalId: result.terminalId,
+            resolvedTo: toAgent,
+            deferred: false,
+            ...(escapeDegraded ? { degraded: true, degradedReason: DEGRADED_SUBMIT_REASON } : {}),
+        });
         return;
     }
-    const formattedMessage = formatMessageForTarget(isArchitectTarget, from, message, raw);
+    const formattedMessage = formatMessageForTarget(isArchitectTarget, from, toAgent, message, raw);
     // NB: `--delay` (deliverAfter) is handled earlier by handleDelayedSend, before this
     // immediate-path block — a delayed send is resolved + persisted at request time and does
     // not fall through here.
@@ -1701,15 +1771,29 @@ async function handleSend(req, res, ctx) {
         // during the 100 ms gap. `writeMessageToSession(..., 100)` schedules the text 100 ms after
         // the ^C (the settle) and returns the completion offset, so the lock is held until the
         // whole interrupt is on the wire; uncontended, it runs at once.
-        //   Scope of the guarantee: this serializes interrupt against interrupt/escape — the only
-        //   /api/send writers that take this per-terminal lock. It does NOT serialize against a
-        //   concurrent mailbox/backstop delivery (which writes through the per-AGENT serializer, a
-        //   disjoint lock); interrupt is the explicit gate-bypassing human action, and closing that
-        //   cross-path race would require the mailbox write edge to take this lock too (a separate,
-        //   larger change — flagged, not done here).
+        //   Scope of the guarantee (Issue #1365 — this used to end at "interrupt vs interrupt/escape"):
+        //   the gated mailbox delivery path now takes this SAME per-terminal lock, so an interrupt is
+        //   serialized against a concurrent delivery too. That closes the case where a `^C` landed
+        //   inside a delivery's own text→Enter window, clearing the composer while every byte still
+        //   reported success — the row read `delivered` for a message the agent never saw. The lock
+        //   order is per-agent → per-terminal (the delivery takes this one as a leaf), never the
+        //   reverse, so there is no cycle. See session-submit.ts for the full boundary.
+        // Whether this interrupt gave up waiting and wrote unserialized. It must reach the SENDER,
+        // not just the Tower log (codex review of PR #1492): the row above was claimed `delivered`
+        // before the write, so a degraded interrupt would otherwise report an unqualified success
+        // for a body that may have interleaved with the delivery it skipped. We keep the
+        // claim-first tradeoff (un-claiming risks a double delivery — see above) and tell the
+        // truth about it instead.
+        let degraded = false;
         await submitToSession(result.terminalId, () => {
             session.write('\x03'); // Ctrl+C
             return writeMessageToSession(session, formattedMessage, noEnter, 100);
+        }, undefined, {
+            waitCeilingMs: OPERATOR_SUBMIT_WAIT_CEILING_MS,
+            onCeilingExpired: (waitedMs) => {
+                degraded = true;
+                logCeilingExpired(ctx, 'interrupt', toAgent, result.terminalId, waitedMs);
+            },
         });
         broadcastMessage({
             type: 'message',
@@ -1729,6 +1813,9 @@ async function handleSend(req, res, ctx) {
             held: false,
             mailboxId: row.id,
             reason: null,
+            bodyLength,
+            // Additive and present only when it happened, so older clients are unaffected.
+            ...(degraded ? { degraded: true, degradedReason: DEGRADED_SUBMIT_REASON } : {}),
         });
         return;
     }
@@ -1775,6 +1862,7 @@ async function handleSend(req, res, ctx) {
             held: false,
             mailboxId: row.id,
             reason: null,
+            bodyLength,
         });
         return;
     }
@@ -1793,6 +1881,7 @@ async function handleSend(req, res, ctx) {
         held: true,
         reason,
         mailboxId: row.id,
+        bodyLength,
     });
 }
 /**