@cohortapp/agent-sdk 2.18.7 → 2.18.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cohortapp/agent-sdk",
-  "version": "2.18.7",
+  "version": "2.18.8",
   "description": "Cohort Agent SDK — autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
   "type": "module",
   "bin": {

package/scripts/local-triggers/autoupdate.sh

@@ -417,6 +417,46 @@ restart_daemon(){
   if [ -z "$DAEMON_LABEL" ]; then log "no -daemon plist under ~/Library/LaunchAgents — nothing to kickstart (maestro upgrade installs it; doctor will say)"; return 0; fi
   launchctl kickstart -k "gui/$UID_/$DAEMON_LABEL" >> "$LOG" 2>&1 || log "WARN: kickstart $DAEMON_LABEL nonzero"
 }
+session_beating(){ # is the front door actually ANSWERING, not merely loaded?
+  # `session_reconciled` asks whether the job is loaded and a supervisor process
+  # is alive. Both were true on the seats that went silent: on 2026-09-24 three
+  # front doors had been wedged on an unanswered modal for days with their
+  # supervisors up and their jobs loaded. A process that exists is not a
+  # colleague who answers — the same substitution this gate's daemon half was
+  # rewritten to stop making.
+  local hb="$AGENT_DIR/state/session/heartbeat.json" age
+  [ -f "$hb" ] || return 1
+  age="$(node -e '
+    try {
+      const j = JSON.parse(require("fs").readFileSync(process.argv[1], "utf8"));
+      const t = Date.parse(j && j.ts);
+      process.stdout.write(Number.isFinite(t) ? String(Math.round((Date.now() - t) / 1000)) : "");
+    } catch {}
+  ' "$hb" 2>/dev/null)"
+  [ -n "$age" ] || return 1
+  [ "$age" -le "$SESSION_STALE_S" ]
+}
+
+revive_session(){ # a wedged front door cannot restart itself; restart it FOR it
+  # The upgrade notice asks the session to restart "at an idle moment". A
+  # session sitting on a modal never reaches an idle moment, so the polite ask
+  # is exactly the wrong instrument for the one case that needs it. A hard
+  # kickstart drops a wedged session and the new supervisor launches a fresh
+  # one — which clears the modal by construction and, from this release,
+  # watches the pane so it does not happen again.
+  [ -n "$SESSION_LABEL" ] || return 0
+  # An UNLOADED job is a different fault with a different remedy (`maestro
+  # session start`), and kickstarting a label launchd does not know just fails.
+  # Leave that one to session_reconciled, which already names it.
+  label_loaded "$SESSION_LABEL" || return 0
+  session_beating && return 0
+  log "front door $SESSION_LABEL is loaded but not beating (> ${SESSION_STALE_S}s) — kickstarting it rather than waiting for a session that cannot answer"
+  launchctl kickstart -k "gui/$(id -u)/$SESSION_LABEL" >> "$LOG" 2>&1 \
+    && { log "front door $SESSION_LABEL restarted"; return 0; }
+  log "WARN: could not kickstart $SESSION_LABEL (maestro session restart --force)"
+  return 1
+}
+
 session_reconciled(){ # only asked when a -session plist was generated; never a rollback reason
   label_loaded "$SESSION_LABEL" || { log "reconcile-failed: session job $SESSION_LABEL is not loaded (maestro session start)"; return 1; }
   pgrep -f "$AGENT_DIR/scripts/session/supervisor" >/dev/null 2>&1 || { log "reconcile-failed: $SESSION_LABEL is loaded but no supervisor process is alive for $AGENT_DIR (maestro session status)"; return 1; }
@@ -544,6 +584,12 @@ if [ "$CUR" = "$LATEST" ] || [ "$(printf '%s\n%s\n' "$CUR" "$LATEST" | sort -V |
   if is_healthy; then
     log "healthy on $CUR"
     sibling_job_audit
+    # The up-to-date path is NOT exempt from the front door, for the same
+    # reason it stopped being exempt from the daemon: the seats that went
+    # silent for days were all "up to date". A daemon that beats while the
+    # front door is wedged is a seat that looks perfect from here and answers
+    # nobody.
+    revive_session || true
     if [ -n "$STALE_HOP" ]; then
       # A real version hop: complete it the way an automatic one completes —
       # the notice tells the session to restart itself onto the new code.
@@ -597,6 +643,11 @@ fi
 # installed version, never a LATEST). Fail-open: an unreadable last.json holds
 # nothing.
 FAILED_HOLD_S="${MAESTRO_AUTOUPDATE_FAILED_HOLD_S:-86400}"
+# How long a front door may go without beating before this run restarts it FOR
+# it. Ten minutes: long enough that a busy session is never interrupted (the
+# heartbeat rides every tool use), short enough that a wedged one is measured in
+# minutes rather than the days it took to notice the last three.
+SESSION_STALE_S="${MAESTRO_SESSION_STALE_S:-600}"
 failed_hold_reason(){ # prints "<reason> at <at>" when LATEST failed health within FAILED_HOLD_S
   node -e '
     const [file, latest, holdS] = process.argv.slice(1);
@@ -668,7 +719,11 @@ restart_daemon
 
 if is_healthy; then
   REASON=""
-  if [ -n "$SESSION_LABEL" ] && ! session_reconciled; then REASON="session-reconcile-failed"; fi
+  # Revive BEFORE reconciling: the new code is installed, and a front door that
+  # is not beating must be restarted onto it rather than left holding an inbox
+  # it cannot answer.
+  revive_session || REASON="session-revive-failed"
+  if [ -n "$SESSION_LABEL" ] && ! session_reconciled; then REASON="${REASON:-session-reconcile-failed}"; fi
   log "OK: healthy on $LATEST${REASON:+ ($REASON)}"
   sibling_job_audit
   write_upgrade_notice "$CUR" "$LATEST"