@cueloop/daemon 0.1.0-alpha.10 → 0.1.0-alpha.100

package/src/jj-working-tree.ts

@@ -0,0 +1,131 @@
+/** Native Jujutsu capture pinned to one commit after its working-copy snapshot. */
+
+import type { DiffFileContents, DiffFileStatus } from "@cueloop/schema";
+import type { VcsAdapter, VcsDiffSnapshot } from "@cueloop/extension-api";
+
+async function jj(args: string[], cwd: string): Promise<string | null> {
+  try {
+    const child = Bun.spawn(["jj", ...args], { cwd, stdout: "pipe", stderr: "ignore" });
+    const output = await new Response(child.stdout).text();
+
+    return (await child.exited) === 0 ? output : null;
+  } catch {
+    return null;
+  }
+}
+
+const JJ_DIFF_FILES_TEMPLATE = 'status_char ++ "\\x00" ++ path.display() ++ "\\x00"';
+const JJ_FILE_LIST_TEMPLATE = 'path.display() ++ "\\x00"';
+
+function jjSummary(text: string): { path: string; status: DiffFileStatus; curatable: boolean }[] {
+  const tokens = text.split("\0");
+  const changes: { path: string; status: DiffFileStatus; curatable: boolean }[] = [];
+
+  for (let index = 0; index + 1 < tokens.length; index += 2) {
+    const code = tokens[index];
+    const path = tokens[index + 1];
+
+    if (!code || !path) continue;
+    changes.push({
+      path,
+      status: code === "A" ? "added" : code === "D" ? "deleted" : "modified",
+      curatable: code === "A" || code === "M" || code === "D",
+    });
+  }
+
+  return changes;
+}
+
+function isBinary(contents: string): boolean {
+  return contents.includes("\0");
+}
+
+async function jjFileContents(
+  root: string,
+  revision: string,
+  path: string,
+): Promise<string | null> {
+  return jj(["--ignore-working-copy", "file", "show", "-r", revision, "--", path], root);
+}
+
+async function captureJjRevision(repoRoot: string, revset: string): Promise<VcsDiffSnapshot> {
+  const identity = await jj(
+    [
+      "log",
+      "-r",
+      revset,
+      "-T",
+      'change_id ++ "\\n" ++ commit_id ++ "\\n" ++ parents.map(|c| c.commit_id()).join(",") ++ "\\n"',
+      "--no-graph",
+    ],
+    repoRoot,
+  );
+
+  if (!identity) throw new Error(`Jujutsu diff capture failed: could not resolve ${revset}`);
+  const lines = identity.trim().split("\n");
+
+  if (lines.length !== 3) throw new Error(`Jujutsu change is ambiguous: ${revset}`);
+  const [changeId, revisionId, parents] = lines;
+
+  if (!changeId || !revisionId) throw new Error("Jujutsu diff capture failed: invalid identity");
+  const [patch, summary] = await Promise.all([
+    jj(["--ignore-working-copy", "diff", "--git", "-r", revisionId], repoRoot),
+    jj(["--ignore-working-copy", "diff", "-T", JJ_DIFF_FILES_TEMPLATE, "-r", revisionId], repoRoot),
+  ]);
+
+  if (patch === null || summary === null)
+    throw new Error("Jujutsu diff capture failed: could not read pinned revision");
+  const files: DiffFileContents[] = [];
+  const parent = parents?.split(",")[0];
+
+  if (parent && !parents?.includes(",")) {
+    for (const change of jjSummary(summary)) {
+      if (!change.curatable) continue;
+      const oldContents =
+        change.status === "added" ? "" : await jjFileContents(repoRoot, parent, change.path);
+      const newContents =
+        change.status === "deleted" ? "" : await jjFileContents(repoRoot, revisionId, change.path);
+
+      if (oldContents === null || newContents === null) continue;
+      if (isBinary(oldContents) || isBinary(newContents)) continue;
+      files.push({ path: change.path, oldContents, newContents, status: change.status });
+    }
+  }
+
+  return { patch: patch.replace(/\n+$/, ""), files, source: { changeId, revisionId } };
+}
+
+/** Built-in jj adapter uses native change and commit IDs in a colocated checkout. */
+export const jjVcsAdapter: VcsAdapter = {
+  apiVersion: 1,
+  id: "jj",
+  async detect(cwd) {
+    const root = await jj(["--ignore-working-copy", "root"], cwd);
+
+    return root?.trim() ?? null;
+  },
+  captureWorkingDiff(repoRoot) {
+    return captureJjRevision(repoRoot, "@");
+  },
+  async captureChange(repoRoot, changeId) {
+    if (!/^[a-z]{32}$/.test(changeId)) throw new Error(`Jujutsu change ID is invalid: ${changeId}`);
+    if ((await jj(["status"], repoRoot)) === null)
+      throw new Error("Jujutsu diff capture failed: could not snapshot the working copy");
+
+    return captureJjRevision(repoRoot, changeId);
+  },
+  async listChanges(repoRoot) {
+    const summary = await jj(["diff", "-T", JJ_DIFF_FILES_TEMPLATE, "-r", "@"], repoRoot);
+
+    if (summary === null) throw new Error("Jujutsu changes list failed");
+
+    return jjSummary(summary).map(({ path, status }) => ({ path, status }));
+  },
+  async listFiles(repoRoot) {
+    const files = await jj(["file", "list", "-T", JJ_FILE_LIST_TEMPLATE, "-r", "@"], repoRoot);
+
+    if (files === null) throw new Error("Jujutsu project files failed");
+
+    return files.split("\0").filter(Boolean).toSorted().slice(0, 5000);
+  },
+};

package/src/main.ts

@@ -2,9 +2,12 @@
 
 import { DaemonServer } from "./server";
 
-const idleExitMs = process.env.CUELOOP_IDLE_EXIT_MS ? Number(process.env.CUELOOP_IDLE_EXIT_MS) : undefined;
+const idleExitMs = process.env.CUELOOP_IDLE_EXIT_MS
+  ? Number(process.env.CUELOOP_IDLE_EXIT_MS)
+  : undefined;
 const server = new DaemonServer({ idleExitMs });
 const path = server.start();
+
 if (path === null) {
   // another daemon already owns this home; the client will attach to it
   console.log("cueloop daemon already running for this home");

package/src/operation-receipts.test.ts

@@ -0,0 +1,111 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DaemonCore } from "./api";
+
+test("send message operation receipts survive restart and reject changed payloads", () => {
+  const home = mkdtempSync(join(tmpdir(), "cueloop-operation-"));
+  let core = new DaemonCore(home);
+
+  try {
+    const thread = core.sessionCreate({
+      workspace: { repoRoot: home, branch: "main" },
+      artifact: { type: "plan", content: "Review this", meta: {} },
+    });
+    const accepted = core.sessionSendMessage(thread.id, "comment", "First", undefined, "op-first");
+    const message = structuredClone(accepted.message);
+
+    core.sessionSendMessage(thread.id, "comment", "Second", undefined, "op-second");
+    core.dispose();
+    core = new DaemonCore(home);
+    const replay = core.sessionSendMessage(thread.id, "comment", "First", undefined, "op-first");
+
+    expect(replay.message).toEqual(message);
+    expect(
+      core.sessionGet(thread.id).history?.entries.filter((entry) => entry.type === "message"),
+    ).toHaveLength(2);
+    expect(() =>
+      core.sessionSendMessage(thread.id, "comment", "Changed", undefined, "op-first"),
+    ).toThrow("Operation payload conflict");
+  } finally {
+    core.dispose();
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("receipt capacity never evicts accepted IDs and share blobs omit private receipts", async () => {
+  const { packSessionBlob, unpackSessionBlob } = await import("./share-blob");
+  const home = mkdtempSync(join(tmpdir(), "cueloop-operation-capacity-"));
+  const core = new DaemonCore(home);
+
+  try {
+    const thread = core.sessionCreate({
+      workspace: { repoRoot: home, branch: "main" },
+      artifact: { type: "plan", content: "Review", meta: {} },
+    });
+    const first = structuredClone(
+      core.sessionSendMessage(thread.id, "comment", "First", undefined, "first").message,
+    );
+
+    for (let index = 1; index < 128; index++)
+      core.sessionSendMessage(
+        thread.id,
+        "comment",
+        `Message ${index}`,
+        undefined,
+        `operation-${index}`,
+      );
+    expect(() =>
+      core.sessionSendMessage(thread.id, "comment", "Overflow", undefined, "overflow"),
+    ).toThrow("Operation receipt capacity");
+    expect(
+      core.sessionSendMessage(thread.id, "comment", "First", undefined, "first").message,
+    ).toEqual(first);
+    expect(
+      unpackSessionBlob(packSessionBlob(core.sessionGet(thread.id))).messageOperations,
+    ).toBeUndefined();
+  } finally {
+    core.dispose();
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test("failed receipt persistence never acknowledges an in-memory-only review message", async () => {
+  const { mkdirSync, readdirSync } = await import("node:fs");
+  const { threadsDir } = await import("./paths");
+  const home = mkdtempSync(join(tmpdir(), "cueloop-operation-disk-failure-"));
+  const core = new DaemonCore(home);
+
+  try {
+    const thread = core.sessionCreate({
+      workspace: { repoRoot: home, branch: "main" },
+      artifact: { type: "plan", content: "Review", meta: {} },
+    });
+    const bucket = readdirSync(threadsDir(home))[0]!;
+    const tempPath = join(threadsDir(home), bucket, `${thread.id}.jsonl.tmp`);
+
+    mkdirSync(tempPath);
+    expect(() =>
+      core.sessionSendMessage(thread.id, "comment", "Once", undefined, "persist-once"),
+    ).toThrow();
+    expect(core.sessionGet(thread.id).messageOperations).toBeUndefined();
+    expect(core.sessionGet(thread.id).message).toBeNull();
+    rmSync(tempPath, { recursive: true });
+    const accepted = core.sessionSendMessage(
+      thread.id,
+      "comment",
+      "Once",
+      undefined,
+      "persist-once",
+    );
+
+    expect(accepted.messageOperations).toHaveLength(1);
+    expect(
+      core.sessionSendMessage(thread.id, "comment", "Once", undefined, "persist-once").message,
+    ).toEqual(accepted.message);
+  } finally {
+    core.dispose();
+    rmSync(home, { recursive: true, force: true });
+  }
+});

package/src/operation-receipts.ts

@@ -0,0 +1,91 @@
+import type { ThreadAgentState, OperationReceipt, AgentPromptRequest } from "@cueloop/schema";
+import { createHash } from "node:crypto";
+import { DaemonError } from "./errors";
+
+/** Hash normalized payloads rather than persisting another copy of private input. */
+export function operationFingerprint(
+  payload: readonly (string | null | readonly (readonly [string, string])[])[],
+): string {
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+
+/** A duplicate returns its original acceptance even after later operations or restart. */
+export function findOperationReceipt<Result>(
+  receipts: readonly OperationReceipt<Result>[] | undefined,
+  operationId: string | undefined,
+  fingerprint: string,
+): OperationReceipt<Result> | undefined {
+  if (!operationId) return;
+  const receipt = receipts?.find((entry) => entry.operationId === operationId);
+
+  if (receipt && receipt.fingerprint !== fingerprint)
+    throw new DaemonError(
+      "operation_conflict",
+      "Operation payload conflict: use a new operation ID for changed input",
+    );
+  if (!receipt && (receipts?.length ?? 0) >= 128)
+    throw new DaemonError(
+      "operation_capacity",
+      "Operation receipt capacity: create a new Thread before submitting more operations",
+    );
+
+  return receipt;
+}
+
+/** Each accepted prompt freezes the original batch before it can start a harness turn. */
+export function recordPromptOperation(
+  state: ThreadAgentState,
+  before: ThreadAgentState,
+  input: AgentPromptRequest,
+): void {
+  if (!input.operationId) return;
+  const previous = new Set(before.submissions?.map((entry) => entry.id));
+  const accepted = input.retry
+    ? [input.retry]
+    : (state.submissions ?? []).filter((entry) => !previous.has(entry.id)).map((entry) => entry.id);
+
+  if (!accepted.length) throw new DaemonError("invalid_params", "Agent operation requires input");
+  const fingerprint = promptOperationFingerprint(input);
+
+  (state.promptOperations ??= []).push({
+    operationId: input.operationId,
+    fingerprint,
+    result: accepted,
+  });
+}
+
+/** Completion is an immutable fact about acceptance, including across explicit retries. */
+export function settlePromptOperations(state: ThreadAgentState): void {
+  for (const receipt of state.promptOperations ?? []) {
+    if (receipt.outcome || !receipt.result.length) continue;
+    const submissions = receipt.result.map((id) =>
+      state.submissions?.find((entry) => entry.id === id),
+    );
+
+    if (
+      submissions.some((entry) => !entry || entry.status === "queued" || entry.status === "running")
+    )
+      continue;
+    receipt.outcome = submissions.some((entry) => entry?.cancelled)
+      ? "cancelled"
+      : submissions.some((entry) => entry?.status === "failed")
+        ? "failed"
+        : "completed";
+  }
+}
+
+/** Prompt identity hashes only explicit input; a retry does not consume newly pending comments. */
+export function findPromptOperationReceipt(
+  state: ThreadAgentState,
+  input: AgentPromptRequest,
+): OperationReceipt<string[]> | undefined {
+  return findOperationReceipt(
+    state.promptOperations,
+    input.operationId,
+    promptOperationFingerprint(input),
+  );
+}
+
+function promptOperationFingerprint(input: AgentPromptRequest): string {
+  return operationFingerprint([input.text, input.context ?? null, input.retry ?? null]);
+}

package/src/paths.ts

@@ -18,6 +18,35 @@ export function sessionsDir(home = cueloopHome()): string {
   return join(home, "sessions");
 }
 
+/** Thread files live here, one JSONL per thread, under a per-project bucket. */
+export function threadsDir(home = cueloopHome()): string {
+  return join(home, "threads");
+}
+
+/** A git commit is lowercase hex; anything else is not a real root commit. */
+const COMMIT_SHA = /^[0-9a-f]{7,64}$/;
+
+/**
+ * The per-project bucket for a workspace: its durable root-commit SHA, or a shared standalone bucket.
+ * A value that is not a commit SHA (including path-traversal segments an IPC caller could smuggle in)
+ * is refused to the standalone bucket, so a bucket name can never escape the threads directory.
+ */
+export function threadBucket(rootCommit: string | undefined, home = cueloopHome()): string {
+  const bucket =
+    rootCommit && COMMIT_SHA.test(rootCommit) ? rootCommit.slice(0, 12) : "_standalone";
+
+  return join(threadsDir(home), bucket);
+}
+
+/** Where the one-time migration parks the old whole-record JSON files, so a downgrade can still read them. */
+export function migratedSessionsDir(home = cueloopHome()): string {
+  return join(home, "sessions.migrated");
+}
+
+export function reportsDir(home = cueloopHome()): string {
+  return join(home, "reports");
+}
+
 export function pidPath(home = cueloopHome()): string {
   return join(home, "cueloop.pid");
 }
@@ -25,3 +54,23 @@ export function pidPath(home = cueloopHome()): string {
 export function lockPath(home = cueloopHome()): string {
   return join(home, "cueloop.lock");
 }
+
+/** The secret a connection presents to be the owner; written by the daemon, mode 0600. */
+export function ownerTokenPath(home = cueloopHome()): string {
+  return join(home, "owner.token");
+}
+
+/** Adapter scratch for Herdr handles; the disk name stays stable across tab and pane support. */
+export function herdrThreadSurfacesPath(home = cueloopHome()): string {
+  return join(home, "herdr-tabs.json");
+}
+
+/** Ghostty-native terminal IDs are adapter scratch, not Thread state. */
+export function ghosttyThreadSurfacesPath(home = cueloopHome()): string {
+  return join(home, "ghostty-thread-surfaces.json");
+}
+
+/** Harness bindings and Message deliveries, stored independently of Thread records. */
+export function harnessStatePath(home = cueloopHome()): string {
+  return join(home, "harness-state.json");
+}

package/src/pr-poller.test.ts

@@ -0,0 +1,102 @@
+import { describe, expect, test } from "bun:test";
+import { PrReviewPoller } from "./pr-poller";
+
+/** Build a poller whose head sha is controllable, with the timer effectively disabled. */
+function refs(baseSha: string, headSha: string) {
+  return { baseSha, headSha };
+}
+
+function makePoller(initialRefs: ReturnType<typeof refs> | null) {
+  let currentRefs = initialRefs;
+  const advanced: Array<{ sessionId: string; refs: ReturnType<typeof refs> }> = [];
+  const poller = new PrReviewPoller(
+    (sessionId, nextRefs) => advanced.push({ sessionId, refs: nextRefs }),
+    async () => currentRefs,
+    1_000_000,
+  );
+
+  return {
+    poller,
+    advanced,
+    setRefs: (next: ReturnType<typeof refs> | null) => {
+      currentRefs = next;
+    },
+  };
+}
+
+describe("PrReviewPoller", () => {
+  test("the first observation is a silent baseline", async () => {
+    const { poller, advanced } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([]);
+    poller.close();
+  });
+
+  test("a moved head fires once; an unchanged head stays quiet", async () => {
+    const { poller, advanced, setRefs } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+
+    setRefs(refs("base1", "sha2"));
+    await poller.refreshHead("s1");
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([{ sessionId: "s1", refs: refs("base1", "sha2") }]);
+    poller.close();
+  });
+
+  test("a persisted reviewed head exposes a move on the first check after restart", async () => {
+    const { poller, advanced } = makePoller(refs("base1", "sha2"));
+
+    poller.trackPr("s1", "https://github.com/org/repo/pull/1", refs("base1", "sha1"));
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([{ sessionId: "s1", refs: refs("base1", "sha2") }]);
+    poller.close();
+  });
+
+  test("a failed head read never fires and keeps the last baseline", async () => {
+    const { poller, advanced, setRefs } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+
+    setRefs(null);
+    await poller.refreshHead("s1");
+    setRefs(refs("base1", "sha2"));
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([{ sessionId: "s1", refs: refs("base1", "sha2") }]);
+    poller.close();
+  });
+
+  test("untrack stops further checks", async () => {
+    const { poller, advanced, setRefs } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+    poller.untrackPr("s1");
+
+    setRefs(refs("base1", "sha2"));
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([]);
+    poller.close();
+  });
+
+  test("a moved base fires while the head stays unchanged", async () => {
+    const { poller, advanced, setRefs } = makePoller(refs("base1", "sha1"));
+
+    poller.trackPr("s1", "org/repo#1");
+    await poller.refreshHead("s1");
+    setRefs(refs("base2", "sha1"));
+    await poller.refreshHead("s1");
+
+    expect(advanced).toEqual([{ sessionId: "s1", refs: refs("base2", "sha1") }]);
+    poller.close();
+  });
+});

package/src/pr-poller.ts

@@ -0,0 +1,73 @@
+/**
+ * Polls each open PR review for new commits. A remote PR has no push signal, so
+ * this checks its base/head pair on an interval and only exposes refresh when
+ * either side moved. Best-effort: a missing or failing gh keeps the last refs.
+ */
+
+import { prRefs, type PullRequestRefs } from "./gh";
+
+/** One cheap refs check per interval; the expensive full-diff pull happens only on a move. */
+const PR_POLL_INTERVAL_MS = 30_000;
+
+interface PrPoll {
+  pr: string;
+  lastRefs: PullRequestRefs | null;
+  timer: ReturnType<typeof setInterval>;
+}
+
+export class PrReviewPoller {
+  private readonly polls = new Map<string, PrPoll>();
+
+  constructor(
+    private readonly onPrAdvance: (sessionId: string, refs: PullRequestRefs) => void,
+    private readonly refs: (pr: string) => Promise<PullRequestRefs | null> = prRefs,
+    private readonly intervalMs: number = PR_POLL_INTERVAL_MS,
+  ) {}
+
+  /** Start polling a PR review. Idempotent per session; the persisted reviewed head is the baseline. */
+  trackPr(sessionId: string, pr: string, reviewedRefs: PullRequestRefs | null = null): void {
+    if (this.polls.has(sessionId)) return;
+    const timer = setInterval(() => void this.refreshHead(sessionId), this.intervalMs);
+
+    // the poll timer must not by itself keep the daemon alive against idle-exit
+    timer.unref?.();
+    this.polls.set(sessionId, { pr, lastRefs: reviewedRefs, timer });
+    void this.refreshHead(sessionId);
+  }
+
+  /** Check the PR refs once; fire onPrAdvance only when they moved off a known baseline. */
+  async refreshHead(sessionId: string): Promise<void> {
+    const poll = this.polls.get(sessionId);
+
+    if (!poll) return;
+    const refs = await this.refs(poll.pr).catch(() => null);
+
+    if (refs === null) return;
+    // the await yields; re-read so an untrack during the call is honoured
+    const current = this.polls.get(sessionId);
+
+    if (!current) return;
+    if (current.lastRefs === null) {
+      current.lastRefs = refs;
+
+      return;
+    }
+    if (refs.baseSha === current.lastRefs.baseSha && refs.headSha === current.lastRefs.headSha)
+      return;
+    current.lastRefs = refs;
+    this.onPrAdvance(sessionId, refs);
+  }
+
+  untrackPr(sessionId: string): void {
+    const poll = this.polls.get(sessionId);
+
+    if (!poll) return;
+    clearInterval(poll.timer);
+    this.polls.delete(sessionId);
+  }
+
+  close(): void {
+    for (const poll of this.polls.values()) clearInterval(poll.timer);
+    this.polls.clear();
+  }
+}