@enderfga/claw-orchestrator 7.12.0 → 7.13.0

package/dist/src/session-manager.js

@@ -142,9 +142,10 @@ import { resolveAlias, isClaudeModel, lookupModel } from './models.js';
 import { isAgyConversationId } from './agy-conversation.js';
 import { Council } from './council.js';
 import { AutoloopRunner } from './autoloop/runner.js';
+import { boundedErrorReason } from './sanitize.js';
 import { ClaudeAgentDispatcher } from './autoloop/dispatcher.js';
-import { DEFAULT_PUSH_POLICY, DEFAULT_SEND_TIMEOUT_MS, validateAutoloopTimeoutConfig } from './autoloop/types.js';
-import { Msg as AutoloopMsg } from './autoloop/messages.js';
+import { DEFAULT_PUSH_POLICY, DEFAULT_SEND_TIMEOUT_MS, MAX_METRIC_HISTORY, validateAutoloopTimeoutConfig, } from './autoloop/types.js';
+import { Msg as AutoloopMsg, } from './autoloop/messages.js';
 import { appendPushLog, notifyUserFallbackChain } from './autoloop/notify.js';
 import { UltraappManager } from './ultraapp/manager.js';
 import { UltraappStore, defaultStoreRoot } from './ultraapp/store.js';
@@ -646,6 +647,128 @@ function readPermissionDenials(evt) {
     }
     return out;
 }
+/** Fixed refusal when a non-fresh boot cannot trust the closed-ledger prefix. */
+const AUTOLOOP_CLOSED_LEDGER_REFUSAL = 'Autoloop resume refused: ledger closed-prefix is incomplete or malformed';
+const REVIEWER_DECISIONS = new Set(['advance', 'hold', 'rollback']);
+/**
+ * One-reader closed-ledger restore for non-fresh `_bootAutoloop`.
+ *
+ * Derives typed `iter` / `metric_history` from the contiguous valid closed
+ * prefix starting at 0. Checkpoint bytes are never progress authority.
+ * Returns null when there is no valid prefix (legacy lone verdict, empty).
+ * Throws {@link AUTOLOOP_CLOSED_LEDGER_REFUSAL} on gap / malformed tail.
+ */
+/** Canonical numeric iter directory names — no leading zeros. */
+const CLOSED_LEDGER_ITER_DIR = /^(0|[1-9][0-9]*)$/;
+function readClosedLedgerRestore(ledgerDir) {
+    const iterRoot = path.join(ledgerDir, 'iter');
+    if (!fs.existsSync(iterRoot))
+        return null;
+    let numericDirs;
+    try {
+        numericDirs = fs
+            .readdirSync(iterRoot)
+            .filter((name) => CLOSED_LEDGER_ITER_DIR.test(name))
+            .map((name) => Number(name))
+            .sort((a, b) => a - b);
+    }
+    catch {
+        return null;
+    }
+    if (numericDirs.length === 0)
+        return null;
+    const present = new Set(numericDirs);
+    const metrics = [];
+    let i = 0;
+    for (;;) {
+        const iterDir = path.join(iterRoot, String(i));
+        if (!fs.existsSync(iterDir)) {
+            // K=-1 / no valid closed prefix: never refuse on higher dirs (base Planner-only).
+            if (i === 0)
+                return null;
+            for (const j of present) {
+                if (j > i)
+                    throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+            }
+            break;
+        }
+        const directivePath = path.join(iterDir, 'directive.json');
+        const verdictPath = path.join(iterDir, 'verdict.json');
+        const hasDirective = fs.existsSync(directivePath);
+        const hasVerdict = fs.existsSync(verdictPath);
+        if (!hasDirective) {
+            if (hasVerdict) {
+                // Legacy lone verdict (or directive-less "closed" appearance).
+                if (i === 0)
+                    return null;
+                throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+            }
+            // Empty/non-closed at 0: prefixless compat before any gap check.
+            if (i === 0)
+                return null;
+            for (const j of present) {
+                if (j > i)
+                    throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+            }
+            break;
+        }
+        if (!hasVerdict) {
+            // Open / directive-only / committed-without-review tail at i.
+            // No closed prefix yet: return null before gap checks (open0+lateriter1 compat).
+            if (i === 0)
+                return null;
+            for (const j of present) {
+                if (j > i)
+                    throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+            }
+            const history = metrics.length > MAX_METRIC_HISTORY ? metrics.slice(metrics.length - MAX_METRIC_HISTORY) : metrics.slice();
+            return { iter: i, metric_history: history };
+        }
+        let raw;
+        try {
+            raw = fs.readFileSync(verdictPath, 'utf8');
+        }
+        catch {
+            // Prefixless unreadable verdict at 0: no-restore / no-refusal (base compat).
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        const verdict = parsed;
+        if (verdict.iter !== i) {
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        if (typeof verdict.decision !== 'string' || !REVIEWER_DECISIONS.has(verdict.decision)) {
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        if (typeof verdict.metric === 'number' && Number.isFinite(verdict.metric)) {
+            metrics.push(verdict.metric);
+        }
+        i += 1;
+    }
+    if (i === 0)
+        return null;
+    const history = metrics.length > MAX_METRIC_HISTORY ? metrics.slice(metrics.length - MAX_METRIC_HISTORY) : metrics.slice();
+    return { iter: i, metric_history: history };
+}
 export class SessionManager {
     sessions = new Map();
     _pendingSessions = new Map();
@@ -1299,7 +1422,7 @@ export class SessionManager {
             // its executor is registered here with a builder closed over `this`
             // rather than living in the kernel.
             kernel.setExecutor('autoloop', makeAutoloopExecutor({
-                boot: (config, secrets, { freshStart }) => this._bootAutoloop({
+                boot: (config, secrets, { freshStart, restoredInput }) => this._bootAutoloop({
                     ...config,
                     // Custom-engine configs never reach the spec, so they come from
                     // the run's in-memory secret bag — supplied at start, and
@@ -1310,6 +1433,7 @@ export class SessionManager {
                     // Always set (including false on resume) — omitting false left a
                     // `_freshStart: true` from config/secrets intact.
                     _freshStart: freshStart,
+                    _restoredInput: restoredInput,
                 }),
                 ready: (key, value) => {
                     const deferred = this._autoloopReady.get(key);
@@ -1846,46 +1970,35 @@ export class SessionManager {
         // Persist final state (TTL-expired sessions already removed by cleanup)
         this._savePersisted();
     }
-    // ─── Codex /goal helpers (codex-app engine only) ─────────────────────
-    /**
-     * Send a `/goal <args>` slash command to a `codex-app` session. Used by
-     * the `codex_goal_*` tools. The server-side parser interprets the slash
-     * command and emits goal-related notifications which the session class
-     * caches.
-     *
-     * Errors clearly when called against a non-`codex-app` session — those
-     * sessions cannot interpret `/goal` (the `codex exec` path has no slash
-     * command surface).
-     */
-    async codexGoalCommand(name, slashArgs, timeoutMs) {
-        const managed = this.sessions.get(name);
-        if (!managed)
-            throw new Error(`Session not found: ${name}`);
-        const session = managed.session;
-        if (typeof session.sendGoalCommand !== 'function') {
-            const engine = managed.config.engine || 'claude';
-            throw new Error(`Session "${name}" uses engine "${engine}" which does not support /goal. ` +
-                `Start a session with engine: "codex-app" to use the goal tools.`);
-        }
-        const result = await session.sendGoalCommand(slashArgs, timeoutMs);
-        return { ok: true, text: result.text, goal: result.goal };
+    // ─── Codex goals (codex-app engine only) ─────────────────────────────
+    /** The live `codex-app` session behind `name`, for the kernel's `goal` node. */
+    codexGoalSession(name) {
+        const session = this.sessions.get(name)?.session;
+        return session instanceof PersistentCodexAppServerSession ? session : undefined;
     }
     /**
-     * Read the cached goal state from a `codex-app` session without sending
-     * any command. Returns null if no goal is set or the session has not yet
-     * received a `thread/goal/updated` notification.
+     * Act on a `codex-app` session's goal through the app-server's
+     * `thread/goal/*` RPCs. Used by the `codex_goal_*` tools; `get` asks the
+     * server rather than a cache.
+     *
+     * Errors clearly when called against a non-`codex-app` session — `codex
+     * exec` has no goal surface.
      */
-    codexGoalGet(name) {
-        const managed = this.sessions.get(name);
-        if (!managed)
-            throw new Error(`Session not found: ${name}`);
-        const session = managed.session;
-        if (!('goal' in session)) {
-            const engine = managed.config.engine || 'claude';
-            throw new Error(`Session "${name}" uses engine "${engine}" which does not track goal state. ` +
-                `Start a session with engine: "codex-app" to use the goal tools.`);
+    async codexGoal(name, op) {
+        const session = this._getCodexAppSession(name, '/goal');
+        switch (op.action) {
+            case 'set':
+                return { ok: true, goal: await session.setGoal({ objective: op.objective, tokenBudget: op.tokenBudget }) };
+            case 'pause':
+                return { ok: true, goal: await session.setGoal({ status: 'paused' }) };
+            case 'resume':
+                return { ok: true, goal: await session.setGoal({ status: 'active' }) };
+            case 'clear':
+                await session.clearGoal();
+                return { ok: true, goal: null };
+            case 'get':
+                return { ok: true, goal: await session.getGoal() };
         }
-        return { ok: true, goal: session.goal ?? null };
     }
     // ─── Codex app-server v2 RPCs (codex-app engine only, Codex 0.137) ────────
     //
@@ -2557,6 +2670,12 @@ export class SessionManager {
         if (engine === 'codex') {
             return session.threadId;
         }
+        // `sessionId` on a codex-app session is a label of ours; `thread/resume`
+        // needs the app-server's own thread id, and silently opened a new thread
+        // when handed the label.
+        if (engine === 'codex-app') {
+            return session.codexThreadId;
+        }
         return session.sessionId;
     }
     _storedResumeId(engine, id) {
@@ -2566,6 +2685,8 @@ export class SessionManager {
             return id && !/^codex-\d+-/.test(id) ? id : undefined;
         if (engine === 'grok')
             return id && !/^grok-\d+-/.test(id) ? id : undefined;
+        if (engine === 'codex-app')
+            return id && !id.startsWith('codex-app-') ? id : undefined;
         return id;
     }
     _listMdFiles(dir) {
@@ -3086,6 +3207,13 @@ export class SessionManager {
         if (!fs.existsSync(ledgerDir)) {
             fs.mkdirSync(ledgerDir, { recursive: true });
         }
+        // Non-fresh boots: restore typed progress from the contiguous closed ledger
+        // prefix before any dispatcher/runner/session work. Refusal throws here so
+        // no Planner start or checkpoint publish occurs.
+        let closedLedgerRestore = null;
+        if (opts._freshStart !== true) {
+            closedLedgerRestore = readClosedLedgerRestore(ledgerDir);
+        }
         // Per-run policy object — mutable so Planner's update_push_policy is visible
         // to the runner without re-wiring.
         const pushPolicy = JSON.parse(JSON.stringify(DEFAULT_PUSH_POLICY));
@@ -3132,6 +3260,10 @@ export class SessionManager {
             run_id: opts.runId,
             workspace: opts.workspace,
             ledger_dir: ledgerDir,
+            persistCheckpoint: () => {
+                const publish = this._autoloopPublishers.get(runId);
+                return publish ? publish() : false;
+            },
             push_policy: pushPolicy,
             notifyUser: async (level, summary, detail, channel) => {
                 const result = await notifyUserFallbackChain({
@@ -3156,7 +3288,18 @@ export class SessionManager {
             activityLeaseMs: opts.activityLeaseMs,
             autoloopHardTimeoutMs: opts.autoloopHardTimeoutMs,
         });
+        // Background resume/deadline/stall paths emit 'error' after a void catch.
+        // Without a listener, Node turns that into an unhandled rejection.
+        runner.on('error', (err) => {
+            this.logger.error?.(`[autoloop/${runId}] background runner task failed: ${boundedErrorReason(err)}`);
+        });
         runnerRef = runner;
+        if (closedLedgerRestore) {
+            runner.state.iter = closedLedgerRestore.iter;
+            runner.state.metric_history = closedLedgerRestore.metric_history.slice();
+        }
+        if (opts._restoredInput)
+            runner.loadRestoredInput(opts._restoredInput);
         try {
             await runner.start();
             // A reconstructed migration becomes externally visible only after its
@@ -3164,7 +3307,6 @@ export class SessionManager {
             // this inside the startup try makes an append failure follow the same
             // cleanup path as any other failed resume.
             opts._commitTimeoutMigration?.();
-            await this._recoverCommittedCoderIteration(opts.workspace, ledgerDir, runId, runner, dispatcher);
         }
         catch (err) {
             try {
@@ -3178,7 +3320,17 @@ export class SessionManager {
             runner.stop();
             throw err;
         }
-        return { runner, dispatcher, ledgerDir, pushPolicy };
+        // Committed-iteration recovery runs after publisher registration, the
+        // initial-publish check and notice reconciliation (see afterPublishReconcile
+        // in makeAutoloopExecutor) — never inside boot before that gate.
+        return {
+            runner,
+            dispatcher,
+            ledgerDir,
+            pushPolicy,
+            abort: () => runner.markCancelledByKernel(),
+            afterPublishReconcile: () => this._recoverCommittedCoderIteration(opts.workspace, ledgerDir, runId, runner, dispatcher),
+        };
     }
     /**
      * If the durable ledger has a committed Coder iteration with no Reviewer
@@ -3219,8 +3371,12 @@ export class SessionManager {
             return;
         this.logger.info?.(`[autoloop/${runId}] recovering committed iter ${n} into Reviewer`);
         await dispatcher.ensureReviewerForCommittedRecovery();
-        runner.markSubagentsSpawned();
+        // Keep a reconciled chat_notice_pending pause so Planner-bound follow-ups
+        // park until the notice is recorded; live spawn_subagents stays unchanged.
+        runner.markSubagentsSpawned({ preservePause: true });
         runner.state.iter = n;
+        // Queue only — never await the physical Reviewer turn. Readiness and the
+        // cancellation observer must install before any model transport settles.
         void runner
             .send(AutoloopMsg.reviewRequest(n, {
             iter: n,
@@ -3308,12 +3464,21 @@ export class SessionManager {
             this._autoloopStarting.delete(tag);
         }
     }
+    /**
+     * Durably accept a chat message for a live run's Planner and return the
+     * envelope to deliver. Throws, with nothing accepted, when the run cannot
+     * checkpoint it. Internal: callers pass the result to `runner.send`.
+     */
+    acceptAutoloopChat(runId, text) {
+        return this._liveAutoloop(runId).runner.acceptChat(text);
+    }
     /**
      * Inject a user chat message into a v2 run's Planner. Returns the Planner's
      * natural-language reply.
      */
     async autoloopChat(runId, text) {
         const ctx = this._liveAutoloop(runId);
+        const env = this.acceptAutoloopChat(runId, text);
         let reply = '';
         const onReply = (...args) => {
             const t = args[0];
@@ -3322,7 +3487,7 @@ export class SessionManager {
         };
         ctx.dispatcher.on('planner_reply', onReply);
         try {
-            await ctx.runner.send(AutoloopMsg.chat(ctx.runner.state.iter, { text }));
+            await ctx.runner.send(env);
         }
         finally {
             ctx.dispatcher.off('planner_reply', onReply);
@@ -3433,8 +3598,16 @@ export class SessionManager {
         }
         const live = this.kernel.handle(runId, LEGACY_NODE);
         if (live) {
-            if (!hasTimeoutIncrease)
+            if (!hasTimeoutIncrease) {
+                // Ordinary and activity-lease pauses have no uncertain in-flight
+                // dispatch. A pending send timeout stays the historical no-op until
+                // an explicit timeout increase names that dispatch.
+                if (live.runner.state.status === 'paused' && live.runner.state.pending_dispatch === null) {
+                    live.runner.resumePaused();
+                    this._autoloopPublishers.get(runId)?.();
+                }
                 return live.runner.state;
+            }
             const pending = live.runner.state.pending_dispatch;
             if (live.runner.state.status !== 'paused' || !pending) {
                 throw new Error(`Autoloop run '${runId}' is not awaiting a recoverable send timeout`);