@deepseek-harness-tui/dsh-tui 0.10.2 → 0.11.1

package/lib/types/dsh-adapter/channel/session-resume.js

@@ -1,11 +1,13 @@
 import { randomUUID } from 'node:crypto';
 import { SessionId } from '@deepseek-ai/dsh-session';
 import { explicitModelRoute, recordedModelRoute, resolveModelRoute, validateModelRoute } from '../../modelRoute.js';
-import { clearResumeTarget, touchAgentViewSession, touchSession, writeResumeTarget } from '../../sessionHistory.js';
+import { clearResumeTarget, writeResumeTarget, touchAgentViewSession, touchSession } from '../../sessionHistory.js';
+import { mountFailureText } from '../../sessions/resumeFailure.js';
 import { t } from '../../i18n.js';
 import { readModelPref } from '../../modelPrefs.js';
 import { migratePresetPref, readPresetPref } from '../../presetPrefs.js';
 import { agentViewHasTurns } from '../agent-view.js';
+import { occupancyOf, readSessionOwners, reserveMount, reserveNewSession, } from '../../sessionMounts.js';
 import { ensureLegacySessionEventTypes } from '../compat/index.js';
 import { snapshotLiveSessionEvents } from '../compat/liveSession.js';
 import { composePreset, resolvePersistedPreset, resolvePersistedRoute } from '../presets.js';
@@ -18,6 +20,7 @@ export function createSessionResumeActions(ctx, state, options, deps) {
         resetSessionProjection(state, deps.rowIds, deps.resetProjector, deps.resetSubagents, deps.resetJobs);
         state.status = handle.agent.status;
         state.agentId = handle.agent.id;
+        state.sessionId = handle.agent.session.id;
         state.agentPreset = agentPreset;
         if (route !== undefined) {
             state.provider = route.provider;
@@ -39,96 +42,272 @@ export function createSessionResumeActions(ctx, state, options, deps) {
         void deps.refreshSkillCommands();
     };
     /** Resume a persisted session, optionally parking the attached agent for agent-view attachment. */
-    const resume = async (sessionId, kind, keepCurrent, adoption, entrySession) => {
-        const agents = ctx.get('agents');
-        if (!agents) {
-            deps.notify(t('resume-unavailable'), { color: 'error' });
-            return { ok: false, reason: 'unavailable' };
-        }
-        ensureLegacySessionEventTypes();
-        const composed = await composePreset(ctx, await resolvePersistedPreset(ctx, SessionId(sessionId)));
-        const explicitRoute = explicitModelRoute({ provider: options.configuredProvider, model: options.configuredModel });
-        const persistedRoute = await resolvePersistedRoute(ctx, SessionId(sessionId));
-        let handle;
-        try {
-            handle = await deps.binding.prepare(adoption, () => agents.resume({
-                resumeSessionId: SessionId(sessionId),
-                agentOptions: {
-                    provider: explicitRoute?.provider ?? persistedRoute?.provider,
-                    model: explicitRoute?.model ?? persistedRoute?.model,
-                },
-                ...(composed.setup === undefined ? {} : { setup: composed.setup }),
-            }));
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            deps.notify(t('resume-failed', { err: message }), { color: 'error', timeoutMs: 8000 });
-            return { ok: false, reason: 'failed', error: message };
-        }
-        if (!deps.binding.isCurrent(adoption)) {
-            await deps.binding.abandon(handle);
-            return { ok: false, reason: 'cancelled' };
-        }
+    const resume = async (sessionId, kind, keepCurrent, adoption, entrySession, 
+    /**
+     * The ledger reservation this call holds for `sessionId`; ended by this
+     * function on every exit. `settle` on a commit (the agent is in the
+     * registry from then on), `abandon` on every path that ends WITHOUT one —
+     * including a throwing `binding.adopt()` and a setup failure inside its
+     * tail, which revokes the candidate.
+     */
+    reservation) => {
+        /**
+         * The reservation is ended on EVERY exit from here, so the attempt owns it
+         * for the whole body: `settle` on a commit (the agent is in the registry
+         * from then on), `abandon` on everything else — a throwing
+         * `binding.adopt()`, a setup failure inside its tail, and also a throw from
+         * the preset/route reads below, which used to sit outside any guard and
+         * would have left a pin that republishes the session as ours on every beat.
+         */
+        let committed = false;
         try {
-            await attachSessionToWorkspace(ctx, handle.agent.session.header.cwd ?? state.cwd, SessionId(sessionId));
+            return await runResume();
         }
-        catch (error) {
-            deps.notify(t('resume-attach-failed', { err: error instanceof Error ? error.message : String(error) }), { color: 'warning', timeoutMs: 8000 });
+        finally {
+            if (committed)
+                reservation?.settle();
+            else
+                reservation?.abandon();
         }
-        if (entrySession !== undefined && (!deps.owner.current() || deps.binding.agent.session !== entrySession)) {
-            await deps.binding.abandon(handle);
-            deps.notify(t('resume-session-changed'), { color: 'error' });
-            return { ok: false, reason: 'failed', error: 'live session changed during resume' };
-        }
-        return deps.binding.adopt(handle, adoption, (committed, disposePrevious) => {
-            const previousSessionId = String(committed.agent.session.id);
-            state.cwd = handle.agent.session.header.cwd ?? state.cwd;
-            state.displayCwd = deps.describeWorkspace(state.cwd).description ?? state.cwd;
-            deps.refreshGitBranch();
-            // Reset the input FIFO and pending-decision indicators BEFORE the first
-            // emit (main's bind → clear → refresh order); see the /new tail.
-            deps.clearStagedImages();
-            resetAndBind(handle, composed.agentPreset, explicitRoute ?? recordedModelRoute(snapshotLiveSessionEvents(handle.agent.session)), true);
-            writeResumeTarget(sessionId);
-            touchSession(sessionId);
-            state.emit();
-            const keepPrevious = keepCurrent && committed.handle !== undefined
-                && (committed.handle.agent.status === 'running' || agentViewHasTurns(snapshotLiveSessionEvents(committed.handle.agent.session)));
-            if (committed.handle !== undefined) {
-                if (keepPrevious) {
-                    deps.backgroundHandles.set(previousSessionId, committed.handle);
-                    disposePrevious('park');
+        async function runResume() {
+            const agents = ctx.get('agents');
+            if (!agents) {
+                deps.notify(t('resume-unavailable'), { color: 'error' });
+                return { ok: false, reason: 'unavailable' };
+            }
+            ensureLegacySessionEventTypes();
+            const composed = await composePreset(ctx, await resolvePersistedPreset(ctx, SessionId(sessionId)));
+            const explicitRoute = explicitModelRoute({ provider: options.configuredProvider, model: options.configuredModel });
+            const persistedRoute = await resolvePersistedRoute(ctx, SessionId(sessionId));
+            let handle;
+            try {
+                handle = await deps.binding.prepare(adoption, () => agents.resume({
+                    resumeSessionId: SessionId(sessionId),
+                    agentOptions: {
+                        provider: explicitRoute?.provider ?? persistedRoute?.provider,
+                        model: explicitRoute?.model ?? persistedRoute?.model,
+                    },
+                    ...(composed.setup === undefined ? {} : { setup: composed.setup }),
+                }));
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                deps.notify(t('resume-failed', { err: message }), { color: 'error', timeoutMs: 8000 });
+                return { ok: false, reason: 'failed', error: message };
+            }
+            if (!deps.binding.isCurrent(adoption)) {
+                await deps.binding.abandon(handle);
+                return { ok: false, reason: 'cancelled' };
+            }
+            try {
+                await attachSessionToWorkspace(ctx, handle.agent.session.header.cwd ?? state.cwd, SessionId(sessionId));
+            }
+            catch (error) {
+                deps.notify(t('resume-attach-failed', { err: error instanceof Error ? error.message : String(error) }), { color: 'warning', timeoutMs: 8000 });
+            }
+            if (entrySession !== undefined && (!deps.owner.current() || deps.binding.agent.session !== entrySession)) {
+                await deps.binding.abandon(handle);
+                deps.notify(t('resume-session-changed'), { color: 'error' });
+                return { ok: false, reason: 'failed', error: 'live session changed during resume' };
+            }
+            // `adopt` is a transaction: it revokes the candidate and disposes it when
+            // the tail fails, and it can also refuse before the tail ever runs. Only a
+            // normal return is a commit, which is what the outer finally keys on.
+            const result = deps.binding.adopt(handle, adoption, (committedBinding, disposePrevious) => {
+                const previousSessionId = String(committedBinding.agent.session.id);
+                state.cwd = handle.agent.session.header.cwd ?? state.cwd;
+                state.displayCwd = deps.describeWorkspace(state.cwd).description ?? state.cwd;
+                deps.resetIdeSelection();
+                deps.refreshGitBranch();
+                // Reset the input FIFO and pending-decision indicators BEFORE the first
+                // emit (main's bind → clear → refresh order); see the /new tail.
+                deps.clearStagedImages();
+                resetAndBind(handle, composed.agentPreset, explicitRoute ?? recordedModelRoute(snapshotLiveSessionEvents(handle.agent.session)), true);
+                writeResumeTarget(sessionId);
+                touchSession(sessionId);
+                state.emit();
+                const keepPrevious = keepCurrent && committedBinding.handle !== undefined
+                    && (committedBinding.handle.agent.status === 'running' || agentViewHasTurns(snapshotLiveSessionEvents(committedBinding.handle.agent.session)));
+                if (committedBinding.handle !== undefined) {
+                    if (keepPrevious) {
+                        deps.backgroundHandles.set(previousSessionId, committedBinding.handle);
+                        disposePrevious('park');
+                    }
+                    else {
+                        disposePrevious('dispose');
+                    }
                 }
-                else {
-                    disposePrevious('dispose');
+                if (kind === 'agent-view') {
+                    touchAgentViewSession(sessionId);
+                    touchAgentViewSession(previousSessionId);
                 }
+                deps.notifySessionSwitched(kind, sessionId, previousSessionId);
+                return { ok: true };
+            });
+            committed = true;
+            return result;
+        }
+    };
+    /**
+     * Reserve `sessionId` for a disk resume on THIS terminal.
+     *
+     * Returning a reservation means the caller owns the session in the ledger
+     * until it calls `finish()`. That covers the whole attempt, not just the
+     * `agents.resume` call: the awaits in between (veto, compaction, preset and
+     * route reads) are exactly the window a publisher beat — or a peer — could
+     * otherwise slip into.
+     * @param sessionId - Session about to be resumed from disk.
+     * @returns The reservation, or the refusal to hand back to the caller.
+     */
+    const reserveDiskResume = async (sessionId) => {
+        // Cheap pre-filter for the friendly toast: the authoritative conflict test
+        // runs inside reserveMount, under the ledger lock.
+        const occupancy = occupancyOf(sessionId, readSessionOwners());
+        if (occupancy.kind === 'occupied') {
+            deps.notify(t('resume-session-occupied', { pid: occupancy.pid }), { color: 'error', timeoutMs: 8000 });
+            return { ok: false, result: { ok: false, reason: 'occupied', pid: occupancy.pid } };
+        }
+        const reserved = await reserveMount(sessionId);
+        if (!reserved.ok) {
+            if (reserved.reason === 'occupied') {
+                const pid = reserved.holders[0] ?? 0;
+                deps.notify(t('resume-session-occupied', { pid }), { color: 'error', timeoutMs: 8000 });
+                return { ok: false, result: { ok: false, reason: 'occupied', pid } };
             }
-            if (kind === 'agent-view') {
-                touchAgentViewSession(sessionId);
-                touchAgentViewSession(previousSessionId);
-            }
-            deps.notifySessionSwitched(kind, sessionId, previousSessionId);
-            return { ok: true };
-        });
+            // Both of these are refusals, not conflicts, and neither may be dressed
+            // up as "held by pid 0". The generic failure branch carries the sentence.
+            return { ok: false, result: { ok: false, reason: 'failed', error: mountFailureText(reserved) } };
+        }
+        return { ok: true, reservation: reserved.reservation };
     };
-    const resumeInto = (sessionId, kind, keepCurrent) => resume(sessionId, kind, keepCurrent, deps.binding.capture());
-    /** `/resume` keeps the entry capture across its veto/compaction awaits, so a rival switch cannot adopt over newer state. */
-    const resumeTo = async (sessionId) => {
+    /**
+     * Reserve a freshly minted session id for a create on THIS terminal. See
+     * `reserveNewSession`: a new id cannot conflict, so a refusal is a loss of
+     * announcement rather than a reason to stop, and it is warned about.
+     * @param sessionId - Session id minted for the new agent.
+     * @returns The reservation (a no-op when the claim could not be made).
+     */
+    const reserveCreatedSession = async (sessionId) => {
+        const { reservation, failure } = await reserveNewSession(sessionId);
+        if (failure !== undefined && failure.reason !== 'occupied') {
+            deps.notify(mountFailureText(failure), { color: 'warning', timeoutMs: 8000 });
+        }
+        return reservation;
+    };
+    const resumeInto = async (sessionId, kind, keepCurrent) => {
         const adoption = deps.binding.capture();
-        if (state.working) {
-            deps.notify(t('resume-while-working'), { color: 'warning' });
-            return { ok: false, reason: 'working' };
+        const agents = ctx.get('agents');
+        if (!agents) {
+            deps.notify(t('resume-unavailable'), { color: 'error' });
+            return { ok: false, reason: 'unavailable' };
         }
+        // Same reservation as `/resume`: this is the other public door onto the
+        // disk path (`ChannelUi.attachToAgent`), and a mount that skips the ledger
+        // is a mount a peer can race from the outside.
+        const reserved = await reserveDiskResume(sessionId);
+        if (!reserved.ok)
+            return reserved.result;
+        return resume(sessionId, kind, keepCurrent, adoption, undefined, reserved.reservation);
+    };
+    /**
+     * `/resume` — mount a session on THIS terminal, the same non-destructive way
+     * `/agentview` does.
+     *
+     * There used to be two different mount models behind these two commands.
+     * `/agentview` parked the session it left behind (it kept running in this
+     * process and was reachable again from the view), while `/resume` DISPOSED
+     * it, and refused outright while a turn was running. That split was never a
+     * decision about resuming; it was an accident of the two commands growing
+     * separately, and it is what made `/resume` feel like a different product
+     * from the session overview sitting one command away.
+     *
+     * The unified model is the overview's, because it is the one that matches
+     * what a TUI terminal actually is: one process that can host several agent
+     * sessions at once. So:
+     *
+     * - Leaving a session parks it (`keepCurrent`), it does not end it, and the
+     *   parked handle is reachable from the session screen afterwards.
+     * - A running turn is not a refusal. The user is switching what they are
+     *   LOOKING at, not asking the model to stop; the turn keeps running in the
+     *   background and its row keeps reporting progress.
+     *
+     * The one thing that IS refused is a session another TUI process already has
+     * mounted: two processes driving one append-only log interleave its events.
+     * The occupancy check happens BEFORE the resume awaits (which yield), and
+     * the claim is published immediately after it so this process owns the
+     * session before any other process can pass the same check.
+     *
+     * The reservation also outlives those awaits: it is released only when the
+     * attempt ends without a commit. The publisher's beat derives its set from
+     * the agent registry, which does not list the target yet, so a reservation
+     * that was not held across them could be erased by this process's own
+     * heartbeat and handed straight to a peer.
+     */
+    const resumeTo = async (sessionId) => {
+        const adoption = deps.binding.capture();
         const agents = ctx.get('agents');
         if (!agents) {
             deps.notify(t('resume-unavailable'), { color: 'error' });
             return { ok: false, reason: 'unavailable' };
         }
-        if (await deps.sessionSwitchVetoed('resume', sessionId))
+        // The attached session as of entry, so a rival switch that commits while
+        // the awaits below yield cannot be adopted over.
+        const entrySession = deps.binding.agent.session;
+        // Already attached: this is a no-op, not a switch.
+        //
+        // The live-adoption path below hands `backgroundHandles.get(targetId)` to
+        // `binding.switchTo()`, and a session this terminal is CURRENTLY attached
+        // to has no entry there — its handle is the binding's own `currentHandle`.
+        // Calling it with `undefined` therefore parks nothing, and the adoption's
+        // default disposition disposes the handle that IS running, so a second
+        // Enter on the `current` row stopped the live turn while reporting success.
+        // `attachToAgent()` has always short-circuited here; this is the same rule
+        // for the unified screen's `/resume` path.
+        if (String(sessionId) === String(entrySession.id))
+            return { ok: true };
+        // Switching away starts disposal without blocking the synchronous commit.
+        // Do not adopt that closing Agent (or reopen its still-held JSONL writer).
+        await deps.binding.waitForDisposal(sessionId);
+        if (!deps.binding.isCurrent(adoption))
+            return { ok: false, reason: 'cancelled' };
+        // A live agent of this process is already mounted here; there is nothing
+        // to claim and nothing that can be occupied. Adoption takes the live
+        // handle (parking the current one) with no occupancy round-trip.
+        const live = agents.get?.(SessionId(sessionId));
+        let reservation;
+        if (live === undefined) {
+            const reserved = await reserveDiskResume(sessionId);
+            if (!reserved.ok)
+                return reserved.result;
+            reservation = reserved.reservation;
+        }
+        if (await deps.sessionSwitchVetoed('resume', sessionId)) {
+            reservation?.abandon();
             return { ok: false, reason: 'cancelled' };
+        }
         await deps.settleCompaction();
-        const entrySession = deps.binding.agent.session;
-        return resume(sessionId, 'resume', false, adoption, entrySession);
+        if (!deps.binding.isCurrent(adoption) || deps.binding.agent.session !== entrySession) {
+            reservation?.abandon();
+            return { ok: false, reason: 'cancelled' };
+        }
+        // The target was read BEFORE those awaits. Re-read it in BOTH directions:
+        // the registry can have replaced or dropped that agent while we yielded
+        // (adopting the captured object would hand the screen a session nothing
+        // owns any more), and it can also have GROWN one — a peer action mounting
+        // this very session here means the disk path below would resume a log this
+        // process is already driving. `agent-view-projection.attach` has always made
+        // the first check.
+        const liveNow = agents.get?.(SessionId(sessionId));
+        if (liveNow !== live) {
+            reservation?.abandon();
+            return { ok: false, reason: 'cancelled' };
+        }
+        // A live target is adopted in place — the same path `/agentview` uses, so
+        // the session being left is parked rather than disposed of. Only a target
+        // with no live agent here goes back to the persistence backend.
+        if (live !== undefined)
+            return deps.adoptLive(live);
+        return resume(sessionId, 'agent-view', true, adoption, entrySession, reservation);
     };
     const newSessionWithTarget = async (target) => {
         // The typed workspace target seam still creates a real Agent/session; it
@@ -181,6 +360,10 @@ export function createSessionResumeActions(ctx, state, options, deps) {
             }
             return false;
         }
+        // Reserve BEFORE the factory runs: the moment `agents.create` returns, this
+        // process holds the only write handle on a log no peer has been told about
+        // yet, and the publisher would not name it until its next beat.
+        const reservation = await reserveCreatedSession(sessionId);
         let handle;
         try {
             handle = await deps.binding.prepare(adoption, () => agents.create({
@@ -191,6 +374,7 @@ export function createSessionResumeActions(ctx, state, options, deps) {
             }));
         }
         catch (error) {
+            reservation.abandon();
             if (current()) {
                 const message = error instanceof Error ? error.message : String(error);
                 deps.notify(t('new-session-failed', { err: message }), { color: 'error', timeoutMs: 8000 });
@@ -199,6 +383,7 @@ export function createSessionResumeActions(ctx, state, options, deps) {
         }
         if (!current()) {
             await deps.binding.abandon(handle);
+            reservation.abandon();
             return false;
         }
         try {
@@ -210,30 +395,43 @@ export function createSessionResumeActions(ctx, state, options, deps) {
         }
         if (!current()) {
             await deps.binding.abandon(handle);
+            reservation.abandon();
             return false;
         }
         // Do not catch this synchronous commit tail. A post-commit setup failure
         // is owned by binding.adopt(), which revokes the new live handle and must
         // reject its caller rather than masquerade as an ordinary precommit false.
-        return deps.binding.adopt(handle, adoption, (committed, disposePrevious) => {
-            const previousSessionId = String(committed.agent.session.id);
-            // The target only becomes shared channel state inside the successful
-            // adoption tail. A losing prepared handle therefore cannot publish or
-            // roll back another workspace's cwd.
-            state.cwd = targetCwd;
-            state.displayCwd = targetDisplayCwd ?? deps.describeWorkspace(targetCwd).description ?? targetCwd;
-            // Reset the input FIFO and the pending-decision indicators BEFORE the
-            // first emit: a submit enqueued from a session-changed subscriber must
-            // land on a fresh chain instead of behind the replaced session's parked
-            // promise (main's bind → clear → refresh order).
-            deps.clearStagedImages();
-            resetAndBind(handle, composed.agentPreset, route, false);
-            clearResumeTarget();
-            touchSession(handle.agent.id);
-            disposePrevious('dispose');
-            deps.notifySessionSwitched('new', String(handle.agent.id), previousSessionId);
-            return true;
-        });
+        let committed = false;
+        try {
+            const result = deps.binding.adopt(handle, adoption, (committedBinding, disposePrevious) => {
+                const previousSessionId = String(committedBinding.agent.session.id);
+                // The target only becomes shared channel state inside the successful
+                // adoption tail. A losing prepared handle therefore cannot publish or
+                // roll back another workspace's cwd.
+                state.cwd = targetCwd;
+                state.displayCwd = targetDisplayCwd ?? deps.describeWorkspace(targetCwd).description ?? targetCwd;
+                deps.resetIdeSelection();
+                // Reset the input FIFO and the pending-decision indicators BEFORE the
+                // first emit: a submit enqueued from a session-changed subscriber must
+                // land on a fresh chain instead of behind the replaced session's parked
+                // promise (main's bind → clear → refresh order).
+                deps.clearStagedImages();
+                resetAndBind(handle, composed.agentPreset, route, false);
+                clearResumeTarget();
+                touchSession(handle.agent.id);
+                disposePrevious('dispose');
+                deps.notifySessionSwitched('new', String(handle.agent.id), previousSessionId);
+                return true;
+            });
+            committed = true;
+            return result;
+        }
+        finally {
+            if (committed)
+                reservation.settle();
+            else
+                reservation.abandon();
+        }
     };
     const newSession = () => newSessionWithTarget();
     return { resumeInto, resumeTo, newSession, newSessionWithTarget };

package/lib/types/dsh-adapter/channel/session-rewind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-rewind.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/session-rewind.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,wBAAwB,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAQvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEvD,KAAK,OAAO,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACtD,KAAK,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,CAAA;AAgB/E,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE;IACJ,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IACpC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;IACjF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9B,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAAA;IAC1K,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1F,IAEa,KAAK,OAAO,EAAE,OAAM,MAAM,GAAG,IAAW,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwFhF"}
+{"version":3,"file":"session-rewind.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/session-rewind.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,wBAAwB,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAA;AASvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEvD,KAAK,OAAO,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACtD,KAAK,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,CAAA;AAgB/E,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE;IACJ,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IACpC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;IACjF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9B,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAAA;IAC1K,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1F,IAEa,KAAK,OAAO,EAAE,OAAM,MAAM,GAAG,IAAW,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsGhF"}

package/lib/types/dsh-adapter/channel/session-rewind.js

@@ -6,6 +6,7 @@ import { dispatchTuiDecision } from '../extension-events.js';
 import { normalizeRewindDoneSummary } from './decisions.js';
 import { composePreset, runningPresetOf } from '../presets.js';
 import { attachSessionToWorkspace } from '../workspace.js';
+import { reserveNewSession } from '../../sessionMounts.js';
 async function waitForTurnEnd(session, fromSeq, timeoutMs) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
@@ -65,6 +66,10 @@ export function createRewindToAction(ctx, state, deps) {
             return null;
         }
         const composed = await composePreset(ctx, runningPresetOf(deps.binding.agent.session));
+        // Announce the id before the factory: the rewind creates the child's log
+        // here, and the publisher only learns the id from the registry on its next
+        // beat.
+        const { reservation } = await reserveNewSession(String(childId));
         let handle;
         try {
             handle = await deps.binding.prepare(adoption, () => agents.create(liveSessionCreateOptions({
@@ -87,11 +92,13 @@ export function createRewindToAction(ctx, state, deps) {
             })));
         }
         catch {
+            reservation.abandon();
             deps.notify(t('rewind-create-failed'), { color: 'error' });
             return null;
         }
         if (!deps.binding.isCurrent(adoption)) {
             await deps.binding.abandon(handle);
+            reservation.abandon();
             return null;
         }
         try {
@@ -102,27 +109,38 @@ export function createRewindToAction(ctx, state, deps) {
         }
         if (!deps.owner.current()) {
             await deps.binding.abandon(handle);
+            reservation.abandon();
             return null;
         }
-        const sourceSessionId = deps.adoptForkedAgent(handle, adoption, snapshotLiveSessionEvents(handle.agent.session), composed.agentPreset, childId);
+        // `adoptForkedAgent` is the commit: the child is the session this process
+        // now drives, so the reservation hands over to the registry. It THROWS when
+        // the adoption transaction revokes the candidate, so it is guarded.
         try {
-            void dispatchTuiDecision(ctx, 'tui/rewind-done', {
-                text: row.text,
-                mode,
-                boundarySeq: boundary,
-                sourceSessionId,
-                childSessionId: String(childId),
-                sessionId: String(childId),
-                cwd: state.cwd,
-            }, normalizeRewindDoneSummary).then(summary => {
-                if (typeof summary === 'string')
-                    deps.notify(summary, { timeoutMs: 6000 });
-            }).catch((error) => ctx.logger.warn('dsh-tui: tui/rewind-done dispatch failed: %o', error));
+            const sourceSessionId = deps.adoptForkedAgent(handle, adoption, snapshotLiveSessionEvents(handle.agent.session), composed.agentPreset, childId);
+            reservation.settle();
+            try {
+                void dispatchTuiDecision(ctx, 'tui/rewind-done', {
+                    text: row.text,
+                    mode,
+                    boundarySeq: boundary,
+                    sourceSessionId,
+                    childSessionId: String(childId),
+                    sessionId: String(childId),
+                    cwd: state.cwd,
+                }, normalizeRewindDoneSummary).then(summary => {
+                    if (typeof summary === 'string')
+                        deps.notify(summary, { timeoutMs: 6000 });
+                }).catch((error) => ctx.logger.warn('dsh-tui: tui/rewind-done dispatch failed: %o', error));
+            }
+            catch (error) {
+                ctx.logger.warn('dsh-tui: tui/rewind-done dispatch failed: %o', error);
+            }
+            deps.notifySessionSwitched('rewind', String(childId), sourceSessionId);
+            return row.text;
         }
         catch (error) {
-            ctx.logger.warn('dsh-tui: tui/rewind-done dispatch failed: %o', error);
+            reservation.abandon();
+            throw error;
         }
-        deps.notifySessionSwitched('rewind', String(childId), sourceSessionId);
-        return row.text;
     };
 }

package/lib/types/dsh-adapter/channel/session-tree-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-tree-actions.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/session-tree-actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,wBAAwB,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAA;AASvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,KAAK,OAAO,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACtD,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,CAAA;AAYnF,+GAA+G;AAC/G,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE;IACJ,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IACpC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC,CAAA;IACjF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9B,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAAA;IAC1K,qBAAqB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACnG,IAEa,WAAW,MAAM,EAAE,KAAK,MAAM,EAAE,OAAM,QAAQ,GAAG,MAAiB,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4G1G"}
+{"version":3,"file":"session-tree-actions.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/session-tree-actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,wBAAwB,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAUvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9C,KAAK,OAAO,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AACtD,KAAK,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,CAAA;AAYnF,+GAA+G;AAC/G,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE;IACJ,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;IACpC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC,CAAA;IACjF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC9B,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,YAAY,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,CAAA;IAC1K,qBAAqB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACnG,IAEa,WAAW,MAAM,EAAE,KAAK,MAAM,EAAE,OAAM,QAAQ,GAAG,MAAiB,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyH1G"}

package/lib/types/dsh-adapter/channel/session-tree-actions.js

@@ -6,6 +6,7 @@ import { readPersistedSession } from '../compat/persistence.js';
 import { closeLiveForkTurn } from '../compat/liveSession.js';
 import { composePreset, resolvePersistedPreset, runningPresetOf } from '../presets.js';
 import { attachSessionToWorkspace } from '../workspace.js';
+import { reserveNewSession } from '../../sessionMounts.js';
 import { forkTarget, rewindTarget, turnUserText } from '../sessionTree.js';
 async function waitForTurnEnd(session, fromSeq, timeoutMs) {
     const deadline = Date.now() + timeoutMs;
@@ -85,6 +86,9 @@ export function createTreeRewindAction(ctx, state, deps) {
         if (target.closeTurn !== undefined && !closeAfterCreate) {
             appendInterruptedTurnEnd(seed, target.closeTurn);
         }
+        // Announce the id before the factory: the child's log is created here, and
+        // the publisher only learns the id from the registry on its next beat.
+        const { reservation } = await reserveNewSession(String(childId));
         let handle;
         try {
             handle = await deps.binding.prepare(adoption, () => agents.create(liveSessionCreateOptions({
@@ -112,11 +116,13 @@ export function createTreeRewindAction(ctx, state, deps) {
             })));
         }
         catch {
+            reservation.abandon();
             deps.notify(t('rewind-create-failed'), { color: 'error' });
             return null;
         }
         if (!deps.binding.isCurrent(adoption)) {
             await deps.binding.abandon(handle);
+            reservation.abandon();
             return null;
         }
         try {
@@ -127,12 +133,22 @@ export function createTreeRewindAction(ctx, state, deps) {
         }
         if (!deps.owner.current() || deps.binding.agent.session !== entrySession) {
             await deps.binding.abandon(handle);
+            reservation.abandon();
             deps.notify(t('rewind-session-changed'), { color: 'error' });
             return null;
         }
         const replay = closeAfterCreate || mode === 'rewind' ? snapshotLiveSessionEvents(handle.agent.session) : seed;
-        const sourceSessionId = deps.adoptForkedAgent(handle, adoption, replay, composed.agentPreset, childId);
-        deps.notifySessionSwitched(mode === 'fork' ? 'fork' : 'rewind', String(childId), sourceSessionId);
-        return restoredText;
+        // `adoptForkedAgent` is the commit, and it THROWS when the adoption
+        // transaction revokes the candidate.
+        try {
+            const sourceSessionId = deps.adoptForkedAgent(handle, adoption, replay, composed.agentPreset, childId);
+            reservation.settle();
+            deps.notifySessionSwitched(mode === 'fork' ? 'fork' : 'rewind', String(childId), sourceSessionId);
+            return restoredText;
+        }
+        catch (error) {
+            reservation.abandon();
+            throw error;
+        }
     };
 }

package/lib/types/dsh-adapter/channel/settings-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-host.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/settings-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAKvD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,GAAE,MAAM,IAAsB,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC,CAqT5K"}
+{"version":3,"file":"settings-host.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/channel/settings-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAMvD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,GAAE,MAAM,IAAsB,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC,CAqT5K"}