@dsiloed/silo-link 1.19.15 → 1.19.17

package/dist/core/bridge.js

@@ -12,6 +12,9 @@ import { SubscriptionManager } from '../cable/subscription-manager.js';
 import { SessionManager } from '../core/session-manager.js';
 import { MessageQueue } from '../core/message-queue.js';
 import { SiloLinkMcpServer } from '../mcp/server.js';
+import { LaunchBindingRegistry } from '../core/launch-binding.js';
+import { healthMonitor } from '../core/health-monitor.js';
+import { idleCompletionConfig, idleCompletionVerdict } from '../core/idle-completion.js';
 import { WorkspaceManager } from '../core/workspace-manager.js';
 import { UsageLedger } from '../core/usage-ledger.js';
 import { createLauncher } from '../core/launcher-factory.js';
@@ -42,6 +45,9 @@ export class Bridge {
     sessionManager;
     messageQueue;
     launchers = new Map();
+    // Launch → MCP transport bindings shared by the launchers (writers) and the
+    // MCP server / remote_register (readers). See launch-binding.ts.
+    launchBindings = new LaunchBindingRegistry();
     defaultProvider;
     workspaceManager;
     usageLedger;
@@ -129,14 +135,25 @@ export class Bridge {
         const geminiLauncher = createLauncher('gemini', this.config, this.sessionManager, this.dsiloedClient, this.messageQueue, this.workspaceManager, this.usageLedger);
         this.launchers.set('gemini', geminiLauncher);
         const codexLauncher = createLauncher('codex', this.config, this.sessionManager, this.dsiloedClient, this.messageQueue, this.workspaceManager, this.usageLedger);
+        // Stored under 'codex' ONLY. The legacy 'openai' alias is resolved in
+        // getLauncher(); a second Map key made launchers.values() yield the Codex
+        // launcher twice (double startIdleMonitor/destroy/kill/nudge — 2026-08-23).
         this.launchers.set('codex', codexLauncher);
-        this.launchers.set('openai', codexLauncher); // alias
+        for (const l of this.launchers.values())
+            l.setLaunchBindings?.(this.launchBindings);
         // Default launcher is used for auto-launch on inbound messages
         const defaultLauncher = this.getLauncher();
         this.subscriptionManager = new SubscriptionManager(this.cableClient, this.messageQueue, this.sessionManager, defaultLauncher, this.dsiloedClient, 
         // Lets auto-launch relaunch a conversation with its ORIGINAL coding agent
         // (e.g. Codex stays Codex) instead of always the default launcher.
-        (provider) => this.getLauncher(provider));
+        (provider) => this.getLauncher(provider), { staleInboundGraceMs: this.config.stale_inbound_grace_ms });
+        // Health block feeds (see health-monitor.ts): live readers, no copies.
+        healthMonitor.attach({
+            backend: () => this.dsiloedClient.backendHealth.snapshot(),
+            usageLedger: () => this.usageLedger.getAll(),
+            recycles24h: () => this.subscriptionManager.recyclesWithin(24 * 60 * 60 * 1000),
+            jwt: () => this.config.jwt,
+        });
         this.mcpServer = new SiloLinkMcpServer({
             config: this.config,
             sessionManager: this.sessionManager,
@@ -146,6 +163,7 @@ export class Bridge {
             cableClient: this.cableClient,
             workspaceManager: this.workspaceManager,
             launcher: defaultLauncher,
+            launchBindings: this.launchBindings,
             startedAt: () => this.startedAt,
             onModuleLoadFailure: (err) => this.selfHealBrokenInstall(err),
             probeStatus: () => this.probeStatus,
@@ -220,6 +238,11 @@ export class Bridge {
     startupLaunchSanityCheck() {
         const launcher = this.getLauncher();
         const preflight = launcher.preflightLaunchCheck?.();
+        // Boolean-or-null for the backend claude_unresolved detector (fires on
+        // == false): null before preflight runs, false ONLY when a preflight ran
+        // and could not resolve the CLI, true when it did. The resolved path stays
+        // in the log lines below.
+        healthMonitor.setClaudeResolved(preflight ? (preflight.resolvedPath != null) : null);
         if (preflight && !preflight.resolvedPath) {
             console.error(`  ⚠️  Agent CLI "${preflight.command}" was NOT found on this daemon's PATH or in known install locations.`);
             console.error('      Session launches WILL fail. Start the daemon from a shell where the CLI resolves,');
@@ -234,6 +257,7 @@ export class Bridge {
             catch {
                 return false;
             } })();
+            healthMonitor.setCredentialsPresent(hasEnvAuth || hasCredFile);
             if (!hasEnvAuth && !hasCredFile) {
                 console.error('  ⚠️  No Claude Code credentials visible to this daemon (no CLAUDE_CODE_OAUTH_TOKEN /');
                 console.error('      ANTHROPIC_API_KEY in the environment, no ~/.claude/.credentials.json).');
@@ -246,8 +270,9 @@ export class Bridge {
      * Get a launcher by provider, falling back to the default.
      */
     getLauncher(provider) {
-        if (provider && this.launchers.has(provider)) {
-            return this.launchers.get(provider);
+        const key = provider === 'openai' ? 'codex' : provider; // legacy alias
+        if (key && this.launchers.has(key)) {
+            return this.launchers.get(key);
         }
         return this.launchers.get(this.defaultProvider);
     }
@@ -350,6 +375,8 @@ export class Bridge {
         process.on('SIGINT', shutdown);
         // Start heartbeat broadcast so the frontend knows we're alive
         this.startHeartbeat();
+        // One [HEALTH] line per hour in the file log (the heartbeat carries the same block).
+        healthMonitor.startHourlyLog();
         // Start the auto-updater. Idle = no live coding-session tmux (so an update
         // never kills work mid-flight) and not already shutting down.
         this.autoUpdater = new AutoUpdater({
@@ -389,6 +416,7 @@ export class Bridge {
         this.heartbeatTimer = setInterval(() => {
             this.broadcastAlive();
             this.reconcileDeadPanes();
+            this.sweepIdleCompletions();
         }, 30_000);
     }
     stopHeartbeat() {
@@ -451,6 +479,10 @@ export class Bridge {
             // Whether the MCP POST path (what spawned sessions register through)
             // actually works — 'failing' means daemon-up-but-broken (install swap).
             mcp_post: this.probeStatus,
+            // Daemon health block — see health-monitor.ts. The backend stores it on
+            // the daemon row and derives coded issues (jwt_expiring_soon,
+            // http_403_streak, credentials_missing, updater_unpinned, ...).
+            health: healthMonitor.snapshot(),
             timestamp: Date.now(),
         });
     }
@@ -480,11 +512,57 @@ export class Bridge {
         return [...new Set(ids)];
     }
     /** Tracked sessions (with a server AgentSession row) whose coding-session tmux is alive. */
+    /**
+     * A registered session whose MCP transport is still open has a live CLI
+     * behind it even when no pane carries its conversation's name — the CC
+     * registered by conversation from another pane (the 3337-in-the-3369-pane
+     * case, 2026-08-24). Reporting only pane-named sessions made the backend
+     * reconciler complete such rows every ~10 min, the daemon drop the
+     * registration, the CC re-register, and a new row appear — forever.
+     */
+    sessionHasLiveTransport(s) {
+        if (!s.mcpSessionId || s.mcpSessionId.startsWith('launch-pending-'))
+            return false;
+        return this.mcpServer?.hasTransport?.(s.mcpSessionId) ?? false;
+    }
+    /** Every registered session that is provably alive: pane present OR MCP transport open. Deduped by agent session id. */
     liveAgentSessions() {
         const liveTmux = this.liveTmuxSessionNames();
+        const seen = new Set();
         return this.sessionManager.getAll()
             .filter(s => s.agentSessionId)
-            .filter(s => liveTmux.has(this.codingTmuxName(s)));
+            .filter(s => liveTmux.has(this.codingTmuxName(s)) || this.sessionHasLiveTransport(s))
+            .filter(s => {
+            if (seen.has(s.agentSessionId))
+                return false;
+            seen.add(s.agentSessionId);
+            return true;
+        });
+    }
+    /**
+     * Which pane should a control command for `conversationId` land on?
+     * 1. the pane named for the conversation itself;
+     * 2. the pane this conversation's REGISTERED session was launched in (its
+     *    MCP transport is bound to a launch for another conversation — the
+     *    wrong-conversation register case);
+     * 3. none.
+     */
+    resolvePaneForConversation(conversationId) {
+        const direct = this.getLauncherForConversation(conversationId);
+        const directProc = direct?.getByConversation(conversationId);
+        if (direct && directProc)
+            return { launcher: direct, conversationId, paneName: directProc.processId };
+        const session = this.sessionManager.getByConversationId(conversationId);
+        const binding = session ? this.launchBindings?.forTransport(session.mcpSessionId) : undefined;
+        if (binding && binding.conversationId !== conversationId) {
+            const bound = this.getLauncherForConversation(binding.conversationId);
+            const boundProc = bound?.getByConversation(binding.conversationId);
+            if (bound && boundProc) {
+                console.log(`[SiloLink] conv ${conversationId} has no pane of its own — its session was launched in ${boundProc.processId} (conv ${binding.conversationId}); routing there`);
+                return { launcher: bound, conversationId: binding.conversationId, paneName: boundProc.processId };
+            }
+        }
+        return null;
     }
     codingTmuxName(s) {
         return `silolink-${s.agentProvider ?? this.defaultProvider}-conv${s.conversationId}`;
@@ -497,6 +575,63 @@ export class Bridge {
     // auto-respawn — reconcile must not yank the session out from under it.
     static DEAD_PANE_GRACE_MS = 10 * 60 * 1000;
     deadPaneSince = new Map();
+    /**
+     * Worker report-back (issue 4): end a session that posted its final report
+     * and got no further work, or that has sat in the poll loop with zero work
+     * for poll_idle_complete_ms. Backend complete (state idle_timeout) FIRST so
+     * the completion relay fires, then the pane is killed and the session
+     * untracked. See idle-completion.ts for the verdict rules.
+     */
+    sweepIdleCompletions() {
+        try {
+            const cfg = idleCompletionConfig(this.config);
+            if (cfg.reportBackIdleMs <= 0 && cfg.pollIdleCompleteMs <= 0)
+                return;
+            const now = Date.now();
+            for (const s of this.sessionManager.getAll()) {
+                const verdict = idleCompletionVerdict(s, cfg, this.messageQueue.hasUndeliveredMessages(s.sessionId), now);
+                if (!verdict)
+                    continue;
+                const idleMin = Math.round(verdict.idleMs / 60000);
+                const reason = `${verdict.reason}:${idleMin}min`;
+                console.log(`[SiloLink] Idle completion: conv ${s.conversationId} session ${s.sessionId} — ${reason} (agent session ${s.agentSessionId ?? 'none'}); completing then killing the pane`);
+                const launcher = this.getLauncherForConversation(s.conversationId) || this.getLauncher(s.agentProvider);
+                // Pane-activity tiebreaker (the lesson of the stale-on-inbound recycler):
+                // MCP silence alone is never proof of idleness. A verdict — poll_idle OR
+                // the default-ON final_report_idle — is only acted on when the pane shows
+                // no progress. A worker that posted final:true and then kept working
+                // (a commit, a summary write, an Agent subprocess) is silent on the MCP
+                // side but visibly active in its pane; killing it there is the recycler
+                // bug (conv 3337, six times). A truly parked pane is not "actively
+                // thinking", so this still completes it.
+                if (typeof launcher.isSessionWedged === 'function') {
+                    const pane = launcher.isSessionWedged(s.conversationId);
+                    if (pane.reason === 'pane-active') {
+                        console.log(`[SiloLink] Idle completion deferred: conv ${s.conversationId} is ${verdict.reason} ${idleMin}min but pane ${pane.paneName} is active`);
+                        continue;
+                    }
+                    // 'polling' is the one pane verdict that is BOTH alive and idle: the
+                    // CLI is parked in remote_poll, so its pane churn is not work. Act.
+                }
+                try {
+                    launcher.captureUsageForConversation(s.conversationId);
+                }
+                catch { /* best-effort */ }
+                const done = s.agentSessionId
+                    ? this.dsiloedClient.completeAgentSession(s.agentSessionId, { state: 'idle_timeout', reason })
+                    : Promise.resolve();
+                done.catch(() => { }).finally(() => {
+                    launcher.killByConversation(s.conversationId, reason);
+                    this.messageQueue.clearSession(s.sessionId);
+                    this.sessionManager.unregister(s.sessionId);
+                    this.launchBindings.forgetConversation(s.conversationId);
+                });
+            }
+        }
+        catch (err) {
+            console.error('[SiloLink] sweepIdleCompletions failed:', err);
+        }
+    }
     reconcileDeadPanes() {
         try {
             const liveTmux = this.liveTmuxSessionNames();
@@ -504,7 +639,7 @@ export class Bridge {
             for (const s of this.sessionManager.getAll()) {
                 if (!s.agentSessionId)
                     continue;
-                if (liveTmux.has(this.codingTmuxName(s))) {
+                if (liveTmux.has(this.codingTmuxName(s)) || this.sessionHasLiveTransport(s)) {
                     this.deadPaneSince.delete(s.sessionId);
                     continue;
                 }
@@ -542,7 +677,7 @@ export class Bridge {
      * no duplicate registration, no takeover. Best-effort: on any failure we
      * fall back to the old model-driven registration path.
      */
-    async preRegisterLaunchedSession(conversationId, sessionName, llmAgentId, launchAgentSessionId) {
+    async preRegisterLaunchedSession(conversationId, sessionName, llmAgentId, launchAgentSessionId, launchCorrelationId) {
         try {
             // Respawn/relaunch for a conversation we already track. The in-memory
             // session stays, but the SERVER made a NEW AgentSession row for this
@@ -572,6 +707,8 @@ export class Bridge {
                     console.log(`[SiloLink] Relaunch on conv ${conversationId}: agent session ${tracked.agentSessionId ?? 'none'} → ${launchAgentSessionId}`);
                     tracked.agentSessionId = launchAgentSessionId;
                 }
+                if (launchCorrelationId)
+                    tracked.launchCorrelationId = launchCorrelationId;
                 return;
             }
             const session = {
@@ -585,6 +722,7 @@ export class Bridge {
                 createdAt: new Date(),
                 lastActivity: new Date(),
                 llmAgentId,
+                launchCorrelationId,
             };
             // register() consumes the pendingProvider set earlier in the launch
             // handler, so the session carries the right agentProvider for the
@@ -706,6 +844,7 @@ export class Bridge {
         console.log('\nSiloLink shutting down...');
         // Stop heartbeat, self-probe, auto-updater, and notify frontend
         this.stopHeartbeat();
+        healthMonitor.stop();
         if (this.probeTimer) {
             clearInterval(this.probeTimer);
             this.probeTimer = null;
@@ -954,9 +1093,9 @@ export class Bridge {
             if (outcome === 'rejected') {
                 console.warn(`  Agent session ${target.agentSessionId} (conv ${target.conversationId}) is unreportable — settling the ledger entry instead of retrying it forever`);
             }
-            // Anything other than 'failed' is terminal: settle. 'failed' is kept so a
-            // transient outage or a later capability grant can still recover the usage.
-            if (outcome !== 'failed' && entryMatches) {
+            // Anything other than 'failed'/'blocked' is terminal: settle. Both are kept
+            // so a transient outage or a later capability grant can still recover the usage.
+            if (outcome !== 'failed' && outcome !== 'blocked' && entryMatches) {
                 this.usageLedger.remove(target.conversationId);
             }
         }
@@ -1081,6 +1220,10 @@ export class Bridge {
                     if (convId) {
                         this.sessionManager.setPendingProvider(convId, providerName);
                     }
+                    // Backend linkage for the pane: rides on the launch binding so
+                    // remote_register can hand it back (the backend adopts the
+                    // pre-created row instead of creating a second one).
+                    launcher.setLaunchLinkage?.({ agentSessionId: cmd.agent_session_id, launchCorrelationId: cmd.launch_correlation_id });
                     const launched = await launcher.launchInternal('control-channel', convId);
                     console.log(`[SiloLink] Launch command result: ${launched ? 'started' : 'FAILED (or already running)'}`);
                     // Track the session from the moment the tmux spawns instead of waiting
@@ -1090,13 +1233,17 @@ export class Bridge {
                     // session never appeared in heartbeat active_agent_session_ids and
                     // server-side death detection reaped a healthy working CC mid-task.
                     if (launched && convId) {
-                        await this.preRegisterLaunchedSession(convId, name, cmd.llm_agent_id, cmd.agent_session_id);
+                        await this.preRegisterLaunchedSession(convId, name, cmd.llm_agent_id, cmd.agent_session_id, cmd.launch_correlation_id);
+                        // Pin the minted resume id on the pre-registered session right away.
+                        launcher.syncResumeId?.(convId);
                     }
                     // A failed launch used to be invisible to the platform: the daemon had
                     // already posted "Starting session...", so the conversation (and any
                     // orchestration stage waiting on it) just went silent until a watchdog
                     // timed out hours later. Tell the conversation AND the control channel.
                     if (!launched && convId) {
+                        // Surface the failure in the health block (backend launch_failed_recent).
+                        healthMonitor.noteLaunchFailure(`session launch failed for conversation ${convId} (agent CLI missing/unlaunchable, tmux failure, or duplicate in-flight launch)`);
                         this.dsiloedClient.postMessage(convId, '**[SiloLink]** ⚠️ Session launch FAILED on this machine (agent CLI missing/unlaunchable, tmux failure, or a duplicate in-flight launch). Check the daemon log. The daemon is healthy; retry by sending another message.').catch(err => console.error('[SiloLink] Failed to post launch-failure message:', err));
                         const failPayload = {
                             type: 'session_launch_failed',
@@ -1273,9 +1420,26 @@ export class Bridge {
             case 'interrupt': {
                 const intConvId = cmd.conversation_id;
                 if (intConvId) {
-                    const intLauncher = this.getLauncherForConversation(intConvId) || this.getLauncher();
-                    const interrupted = await intLauncher.interrupt(intConvId);
-                    console.log(`[SiloLink] Interrupt command result: ${interrupted ? 'sent' : 'no session found'}`);
+                    const target = this.resolvePaneForConversation(intConvId);
+                    if (target) {
+                        const interrupted = await target.launcher.interrupt(target.conversationId);
+                        console.log(`[SiloLink] Interrupt command result: ${interrupted ? `sent to ${target.paneName}` : 'no session found'}`);
+                        break;
+                    }
+                    const intSession = this.sessionManager.getByConversationId(intConvId);
+                    if (intSession) {
+                        this.messageQueue.enqueue(intSession.sessionId, {
+                            id: Date.now(),
+                            role: 'system',
+                            content: 'INTERRUPT: the user interrupted you. Stop your current task now, then check remote_poll for their latest message and follow those instructions instead.',
+                            senderName: cmd.requested_by || 'SiloLink',
+                            receivedAt: new Date(),
+                        });
+                        console.log(`[SiloLink] interrupt for conv ${intConvId}: no pane, delivered via message queue to session ${intSession.sessionId}`);
+                    }
+                    else {
+                        console.warn(`[SiloLink] interrupt for conv ${intConvId}: no pane and no registered session — nothing to interrupt`);
+                    }
                 }
                 else {
                     // Interrupt all sessions across all launchers
@@ -1304,13 +1468,23 @@ export class Bridge {
                             senderName: cmd.requested_by || 'SiloLink',
                             receivedAt: new Date(),
                         });
-                        // Also nudge via tmux in case the session isn't polling
-                        const nudgeLauncher = this.getLauncherForConversation(nudgeConvId) || this.getLauncher();
-                        nudgeLauncher.nudge();
-                        console.log(`[SiloLink] Nudge sent to session ${session.sessionId} (conversation ${nudgeConvId})`);
+                    }
+                    // Also nudge via tmux in case the session isn't polling. The pane is
+                    // resolved through the session's launch binding when the conversation
+                    // has no pane of its own (registered from another pane) — previously
+                    // the keystroke was silently discarded in that case.
+                    const target = this.resolvePaneForConversation(nudgeConvId);
+                    if (target) {
+                        const nudged = target.launcher.nudgeConversation
+                            ? target.launcher.nudgeConversation(target.conversationId, nudgeMessage)
+                            : target.launcher.nudge();
+                        console.log(`[SiloLink] Nudge sent to ${target.paneName}${session ? ` + queued for session ${session.sessionId}` : ''} (conversation ${nudgeConvId}, keystroke ${nudged ? 'sent' : 'not sent'})`);
+                    }
+                    else if (session) {
+                        console.log(`[SiloLink] nudge for conv ${nudgeConvId}: no pane, delivered via message queue to session ${session.sessionId}`);
                     }
                     else {
-                        console.log(`[SiloLink] Nudge: no session found for conversation ${nudgeConvId}`);
+                        console.warn(`[SiloLink] nudge for conv ${nudgeConvId}: no pane and no registered session — nudge dropped`);
                     }
                 }
                 else {
@@ -1374,14 +1548,34 @@ export class Bridge {
                     reply({ success: false, error: 'keys must be printable ASCII or a tmux key token' });
                     break;
                 }
-                const sendLauncher = this.getLauncherForConversation(sendConvId) || this.getLauncher();
-                const proc = sendLauncher.getByConversation(sendConvId);
-                if (!proc) {
-                    const errMsg = `no active session for conversation ${sendConvId}`;
-                    console.log(`[SiloLink] send_keys: ${errMsg}`);
+                const sendTarget = this.resolvePaneForConversation(sendConvId);
+                if (!sendTarget) {
+                    // No pane anywhere for this conversation. Submitted TEXT can still
+                    // reach a registered session through its poll loop; bare key tokens
+                    // cannot, and must not vanish silently.
+                    const keysSession = this.sessionManager.getByConversationId(sendConvId);
+                    if (keysSession && rawKeys && appendEnter && isPrintable && !isToken) {
+                        this.messageQueue.enqueue(keysSession.sessionId, {
+                            id: Date.now(),
+                            role: 'system',
+                            content: rawKeys,
+                            senderName: cmd.requested_by || 'SiloLink',
+                            receivedAt: new Date(),
+                        });
+                        console.log(`[SiloLink] send_keys for conv ${sendConvId}: no pane, delivered via message queue to session ${keysSession.sessionId}`);
+                        reply({ success: true, delivered_via: 'message_queue', session_id: keysSession.sessionId, keys: rawKeys, enter: true });
+                        break;
+                    }
+                    const errMsg = keysSession
+                        ? `no pane for conversation ${sendConvId} (session ${keysSession.sessionId} is registered but raw keys need a pane)`
+                        : `no active session for conversation ${sendConvId}`;
+                    console.warn(`[SiloLink] send_keys: ${errMsg}`);
                     reply({ success: false, error: errMsg });
                     break;
                 }
+                const sendLauncher = sendTarget.launcher;
+                const sendPaneConvId = sendTarget.conversationId;
+                const proc = { processId: sendTarget.paneName };
                 // TEXT + Enter goes through the verified path: a separate Enter plus
                 // submit verification/retry. Sending both in one `tmux send-keys` and
                 // trusting its exit code is what let a swallowed Enter strand an
@@ -1390,7 +1584,7 @@ export class Bridge {
                 // Bare key tokens (Escape, C-c, arrows) and keys-without-Enter keep the
                 // raw path — there is no submitted text to verify.
                 if (rawKeys && appendEnter && isPrintable && !isToken) {
-                    const sent = sendLauncher.sendTextAndSubmit(sendConvId, rawKeys);
+                    const sent = sendLauncher.sendTextAndSubmit(sendPaneConvId, rawKeys);
                     if (sent) {
                         console.log(`[SiloLink] send_keys: ${JSON.stringify(rawKeys)} + verified Enter → ${proc.processId} (from: ${cmd.requested_by || 'unknown'})`);
                         reply({ success: true, session: proc.processId, keys: rawKeys, enter: true, verified: true });