@ctrl-spc/cs 0.7.0 → 0.7.2

package/dist/panel3/spawn.js

@@ -120,8 +120,9 @@
  * with exactly the authority that level has.
  */
 import { spawn as spawnChild } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { agentPath } from '../agents.js';
-import { ensureCodexRunHome, removeCodexRunHome } from '../codex-home.js';
+import { ensureCodexRunHome, ensurePanel3CodexOwnerHome, removeCodexRunHome, } from '../codex-home.js';
 import { windowsSafeSpawn } from '../win-shell.js';
 const AGENT_VAR = 'CTRL_SPC_V3_AGENT';
 /**
@@ -168,9 +169,14 @@ const allowedTools = (level) => [`mcp__${SERVER}__*`, ...(level === 1 ? [] : COD
  * checked without starting a process — which is how the allowlist is proved,
  * and how it stays provable after this task.
  */
-export function agentArgs(level, toolsUrl, agent = harness(), platform = process.platform) {
+export function agentArgs(level, toolsUrl, agent = harness(), platform = process.platform, ownerSession) {
     if (agent === 'codex')
-        return codexArgs(level, toolsUrl, platform);
+        return codexArgs(level, toolsUrl, platform, ownerSession);
+    const session = ownerSession
+        ? ownerSession.resumeSessionId
+            ? ['--resume', ownerSession.resumeSessionId]
+            : ['--session-id', ownerSession.freshSessionId ?? randomUUID()]
+        : [];
     return [
         // `-p` with the prompt on stdin. See the header.
         '-p',
@@ -180,6 +186,7 @@ export function agentArgs(level, toolsUrl, agent = harness(), platform = process
         '--setting-sources', '',
         '--tools', builtIns(level),
         '--allowedTools', allowedTools(level),
+        ...session,
         /* STATED WHERE THERE IS SOMETHING TO STATE. `acceptEdits` grants file edits
            to a headless process with nobody at a prompt to approve them, and it is
            passed only to the levels that have a file tool to use it with: at level 1
@@ -214,16 +221,18 @@ export function agentArgs(level, toolsUrl, agent = harness(), platform = process
  * `--json` makes the answer an `agent_message` item read out of the stream
  * rather than whatever prose happened to reach stdout (see `codexAnswer`).
  */
-function codexArgs(level, toolsUrl, platform) {
+function codexArgs(level, toolsUrl, platform, ownerSession) {
+    const resume = ownerSession?.resumeSessionId;
     return [
         'exec',
+        ...(resume ? ['resume', resume, '-'] : []),
         // The prompt arrives on stdin, exactly as it does for claude: `codex exec`
         // reads it from there when no prompt argument is given.
         '--json',
         // The level 1 scratch directory is not a repository, and neither need a
         // working copy be.
         '--skip-git-repo-check',
-        '--ephemeral',
+        ...(ownerSession ? [] : ['--ephemeral']),
         '--ignore-rules',
         /* The current Windows Desktop runtime can define the run's one MCP server
            on argv. Keeping the machine's real CODEX_HOME lets its installed sandbox
@@ -234,7 +243,10 @@ function codexArgs(level, toolsUrl, platform) {
             '--ignore-user-config',
             '-c', 'model="gpt-5.5"',
             '-c', 'features.apps=false',
-            '-c', 'features.multi_agent=false',
+            // The same closing `codex-home.ts` writes into the per-run config, and
+            // for the same measured reason: `features.multi_agent=false` parses and
+            // leaves the tool reachable.
+            '-c', 'agents.enabled=false',
             '-c', `mcp_servers.${SERVER}.url=${JSON.stringify(toolsUrl)}`,
             '-c', `mcp_servers.${SERVER}.default_tools_approval_mode="approve"`,
             '-c', 'windows.sandbox="unelevated"',
@@ -245,7 +257,9 @@ function codexArgs(level, toolsUrl, platform) {
            `danger-full-access`. Level 1 has no file tool to use it with, so it gets
            the read-only sandbox instead — see the block comment above for what that
            does and does not buy. */
-        '-s', level === 1 ? 'read-only' : 'workspace-write',
+        ...(resume
+            ? ['-c', `sandbox_mode=${JSON.stringify(level === 1 ? 'read-only' : 'workspace-write')}`]
+            : ['-s', level === 1 ? 'read-only' : 'workspace-write']),
         /* The write sandbox sandboxes the NETWORK too, and an agent handed a
            credential that can then reach nothing is a dead end. Only where there is
            a write sandbox to say it about. */
@@ -320,7 +334,7 @@ const MAX_OUTPUT_CHARS = 1_000_000;
  * spawn can fail hand back a message that carries one — node's own spawn error
  * reads `spawn /Users/…/claude ENOENT`, and an EACCES from the synchronous throw
  * names the file too — and both of these become a run's `failed_because`, which
- * `cs3 show` prints and a coordinator can repeat to the person.
+ * `cs show` prints and a coordinator can repeat to the person.
  *
  * `workingCopy()` above already makes this argument for the checkout and the
  * fix is the same one: the CODE is what a person acts on, it is not a path, and
@@ -363,9 +377,10 @@ function tail(text, chars = 500) {
  * process still alive" after the daemon that started it has been killed. So the
  * caller gets the pid immediately, writes it, and then waits.
  */
-export function startAgent(prompt, level, toolsUrl, cwd) {
+export function startAgent(prompt, level, toolsUrl, cwd, ownerSession) {
     const failed = (reason) => ({
         pid: null,
+        session: Promise.resolve(null),
         answered: Promise.resolve({ ok: false, reason }),
     });
     let agent;
@@ -377,7 +392,10 @@ export function startAgent(prompt, level, toolsUrl, cwd) {
         // `harness()`: running the other one instead is the lie, not the failure.
         return failed(err.message);
     }
-    const ARGS = agentArgs(level, toolsUrl, agent);
+    const launchedOwnerSession = ownerSession && !ownerSession.resumeSessionId
+        ? { ...ownerSession, freshSessionId: randomUUID() }
+        : ownerSession;
+    const ARGS = agentArgs(level, toolsUrl, agent, process.platform, launchedOwnerSession);
     const bin = agentPath(agent);
     if (!bin) {
         return failed(`${agent} is not installed on this machine`);
@@ -387,10 +405,12 @@ export function startAgent(prompt, level, toolsUrl, cwd) {
        isolates its configuration and grants this run's one server on argv. */
     const windowsCodex = agent === 'codex' && process.platform === 'win32';
     const home = agent === 'codex' && !windowsCodex
-        // `false`: v3 closes codex's own subagent tool, the same depth-stops-at-
-        // three rule `CODE_TOOLS` enforces for claude below. v2's callers never
-        // pass this and keep today's behaviour; see `codex-home.ts`.
-        ? ensureCodexRunHome({ url: toolsUrl }, null, runKey(toolsUrl), false)
+        ? ownerSession
+            ? ensurePanel3CodexOwnerHome({ url: toolsUrl }, ownerSession.ownerId)
+            // `false`: v3 closes codex's own subagent tool, the same depth-stops-at-
+            // three rule `CODE_TOOLS` enforces for claude below. v2's callers never
+            // pass this and keep today's behaviour; see `codex-home.ts`.
+            : ensureCodexRunHome({ url: toolsUrl }, null, runKey(toolsUrl), false)
         : null;
     if (agent === 'codex' && !windowsCodex && !home) {
         return failed('codex is not signed in on this machine, so a run cannot be given this product\'s tools '
@@ -419,10 +439,24 @@ export function startAgent(prompt, level, toolsUrl, cwd) {
     catch (err) {
         // NOT `err.message`, which names the binary's absolute path. See
         // `couldNotStart`.
-        if (home)
+        if (home && !ownerSession)
             removeCodexRunHome(home);
         return failed(couldNotStart(err, agent));
     }
+    let resolveSession;
+    let sessionSettled = false;
+    const session = new Promise((resolve) => { resolveSession = resolve; });
+    const observeSession = (value) => {
+        if (sessionSettled)
+            return;
+        sessionSettled = true;
+        resolveSession(value);
+    };
+    if (!ownerSession)
+        observeSession(null);
+    else if (agent === 'claude') {
+        observeSession(launchedOwnerSession?.resumeSessionId ?? launchedOwnerSession?.freshSessionId ?? null);
+    }
     const answered = new Promise((resolve) => {
         let stdout = '';
         let stderr = '';
@@ -447,11 +481,32 @@ export function startAgent(prompt, level, toolsUrl, cwd) {
             /* THE CREDENTIAL COPY GOES WHEN THE RUN DOES. `codex-home.ts` calls this
                the primary reclaim and the startup sweep the backstop; a home left
                behind holds a copy of the user's codex credential. */
-            if (home)
+            if (home && !ownerSession)
                 removeCodexRunHome(home);
+            if (!sessionSettled)
+                observeSession(null);
             resolve(answer);
         };
-        child.stdout?.on('data', (d) => { stdout = collect(stdout, String(d)); });
+        child.stdout?.on('data', (d) => {
+            stdout = collect(stdout, String(d));
+            if (ownerSession && agent === 'codex' && !sessionSettled) {
+                for (const line of stdout.split('\n')) {
+                    try {
+                        const event = JSON.parse(line);
+                        if (event.type === 'thread.started' && typeof event.thread_id === 'string') {
+                            const id = event.thread_id;
+                            if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id)) {
+                                observeSession(id);
+                                break;
+                            }
+                        }
+                    }
+                    catch {
+                        // The final answer parser owns protocol validity. This observer only finds one event.
+                    }
+                }
+            }
+        });
         child.stderr?.on('data', (d) => { stderr = collect(stderr, String(d)); });
         /* ENOENT and friends. The process never ran, and that is what is reported —
            WITHOUT the message, which is where node puts the binary's absolute path.
@@ -459,14 +514,24 @@ export function startAgent(prompt, level, toolsUrl, cwd) {
         child.on('error', (err) => {
             finish({ ok: false, reason: couldNotStart(err, agent) });
         });
-        child.on('close', (code) => {
+        child.on('close', (code, signal) => {
             /* ═══ THREE OUTCOMES, AND ONLY ONE OF THEM IS AN ANSWER. ═══ A non-zero
                exit and an exit of zero that said nothing are both failures, and
                neither may be returned as an empty answer: the daemon would write a
                blank agent turn and the card would read as answered. That is the
                forbidden state ux.md is about, reached by treating silence as
                success. */
-            if (code !== 0) {
+            if (signal !== null) {
+                /* ═══ A SIGNALLED PROCESS HAS NO EXIT CODE, AND SAYING IT "EXITED NULL"
+                   IS NOT TRUE. ═══ `code` is null exactly when a signal ended the
+                   process, and this daemon is the only thing that signals one: the
+                   person's Stop (`killStopped`) and the person's correction
+                   (`redirectedProcess`). Both reach here, both are printed, and the
+                   second one can reach `failed_because` and a person's card if the
+                   respawn behind it is refused. Naming the signal is the whole fix. */
+                finish({ ok: false, reason: `${agent} was ended by ${signal}${tail(stderr) || tail(stdout)}` });
+            }
+            else if (code !== 0) {
                 /* STDOUT WHEN STDERR IS EMPTY, because `claude -p` prints its own
                    failure on stdout and exits non-zero having written nothing to
                    stderr. Reporting only "exited 1" would throw away the one sentence
@@ -499,5 +564,5 @@ export function startAgent(prompt, level, toolsUrl, cwd) {
         child.stdin?.on('error', () => { });
         child.stdin?.end(prompt);
     });
-    return { pid: child.pid ?? null, answered };
+    return { pid: child.pid ?? null, session, answered };
 }