@cohortapp/agent-sdk 2.14.0 → 2.15.0

package/lib/telemetry/collect.mjs

@@ -1060,7 +1060,27 @@ export function sessionLiveness(hb, nowMs, opts = {}) {
   const staleMs = Number.isFinite(opts.staleMs) ? opts.staleMs : SESSION_STALE_MS;
   const ts = typeof hb.ts === "number" ? hb.ts : Date.parse(hb.ts);
   const age = nowMs - ts;
-  const live = Number.isFinite(age) && age >= 0 && age <= staleMs;
+  // SYMMETRIC around now, matching lib/session/liveness.mjs#heartbeatLiveness,
+  // which this used to contradict: it accepted `-staleMs < age < staleMs` while
+  // this demanded `age >= 0`, so the same heartbeat could be live to the session
+  // runtime and dead to the beat.
+  //
+  // The asymmetry was not theoretical. A039 flapped between live and not-live
+  // across consecutive beats on 2026-09-10/11 while its session kept running,
+  // because a heartbeat written microseconds before the wall clock stepped back
+  // reads as future-dated, and ANY future dating failed `age >= 0`. The seat is
+  // within 30 s of the server, so this is ordinary same-machine clock motion
+  // (NTP correcting a box 95 days up), not a broken clock — and a front-door
+  // signal that flickers is worse than none, because it is the one field an
+  // operator uses to decide whether to walk to a machine.
+  //
+  // Beyond the window a future heartbeat is still NOT live, and sessionNote
+  // reports it as such ("last beat is in the future (clock skew)") rather than
+  // silently believing a timestamp it cannot trust.
+  // Strict on BOTH edges, because that is what heartbeatLiveness does
+  // (`age >= staleMs` and `age <= -staleMs` are each "not live"). An edge that
+  // differs by one millisecond is still two answers to one question.
+  const live = Number.isFinite(age) && Math.abs(age) < staleMs;
   return { frontDoor: "session", sessionLive: live };
 }
 

package/lib/telemetry/collect.test.mjs

@@ -33,6 +33,8 @@ import {
   ramLabel,
   collectSpend24h,
   collectInventory,
+  sessionLiveness,
+  SESSION_STALE_MS,
   _internals,
 } from "./collect.mjs";
 
@@ -1218,3 +1220,55 @@ test("collectStatus: machine.sessionNote appears ONLY when the front door is dow
     }
   } finally { rmSync(root, { recursive: true, force: true }); }
 });
+
+/**
+ * The front-door signal must not flicker while the session is running.
+ *
+ * This function and `lib/session/liveness.mjs#heartbeatLiveness` answer one
+ * question — "is the main session alive" — and they used to disagree: the
+ * runtime accepted a heartbeat up to `staleMs` either side of now, this one
+ * demanded `age >= 0`. So a heartbeat written microseconds before the wall
+ * clock stepped back read as future-dated and flipped the seat to DOWN, while
+ * the session carried on. A039 did exactly that across consecutive beats on
+ * 2026-09-10/11 with its session healthy and its clock within 30 s of the
+ * server. Symmetric now, and pinned here because the asymmetry was invisible:
+ * every test used a past-dated heartbeat.
+ */
+test("sessionLiveness tolerates clock skew symmetrically, and reports a far-future beat as not live", () => {
+  const now = Date.parse("2026-09-11T12:00:00Z");
+  const at = (ms) => ({ ts: new Date(now - ms).toISOString() });
+
+  // Fresh, and a beat from the recent past: live, as before.
+  assert.equal(sessionLiveness(at(0), now).sessionLive, true);
+  assert.equal(sessionLiveness(at(30_000), now).sessionLive, true);
+
+  // THE REGRESSION: a beat dated slightly in the FUTURE is the clock moving,
+  // not the session dying. Both of these used to return false.
+  assert.equal(sessionLiveness(at(-1), now).sessionLive, true, "1 ms ahead is not a dead session");
+  assert.equal(sessionLiveness(at(-30_000), now).sessionLive, true, "30 s ahead is ordinary clock motion");
+
+  // The window is symmetric and OPEN at both edges — the runtime's rule.
+  assert.equal(sessionLiveness(at(SESSION_STALE_MS - 1), now).sessionLive, true);
+  assert.equal(sessionLiveness(at(-(SESSION_STALE_MS - 1)), now).sessionLive, true);
+  assert.equal(sessionLiveness(at(SESSION_STALE_MS), now).sessionLive, false, "too old");
+  assert.equal(sessionLiveness(at(-SESSION_STALE_MS), now).sessionLive, false, "too far ahead to believe");
+
+  // The front door is still named in every case a heartbeat exists.
+  assert.equal(sessionLiveness(at(10 * SESSION_STALE_MS), now).frontDoor, "session");
+  // No heartbeat at all remains the daemon's lane.
+  assert.deepEqual(sessionLiveness(null, now), { frontDoor: "daemon", sessionLive: false });
+});
+
+test("sessionLiveness agrees with the session runtime's own window", async () => {
+  const { heartbeatLiveness, STALE_MS } = await import("../session/liveness.mjs");
+  assert.equal(STALE_MS, SESSION_STALE_MS, "one window, two readers");
+  const now = Date.parse("2026-09-11T12:00:00Z");
+  for (const offset of [0, 1_000, -1_000, 45_000, -45_000, STALE_MS, -STALE_MS, STALE_MS + 1, -(STALE_MS + 1)]) {
+    const hb = { ts: new Date(now - offset).toISOString(), pid: 0 };
+    assert.equal(
+      sessionLiveness(hb, now).sessionLive,
+      heartbeatLiveness(hb, { now }).live,
+      `the two readers disagree at offset ${offset} ms`
+    );
+  }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cohortapp/agent-sdk",
-  "version": "2.14.0",
+  "version": "2.15.0",
   "description": "Cohort Agent SDK — autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
   "type": "module",
   "bin": {