@gajae-code/coding-agent 0.12.5 → 0.12.6

package/src/sdk/acp/adapter.ts

@@ -42,6 +42,9 @@ export type AcpReconnectFailedHandler = (error: SdkClientError) => void;
 export type AcpFrameHandler = (frame: SdkFrame) => void;
 type ReverseRequest = {
 	state: "pending" | "cancelled";
+	connectionId?: string;
+	capability?: string;
+	leaseId?: string;
 	controller?: AbortController;
 	cancelTimer?: NodeJS.Timeout;
 };
@@ -65,6 +68,15 @@ function isLifecycleOperation(operation: string): boolean {
 	);
 }
 
+const MAX_PENDING_REVERSE_PROVIDER_CALLS = 64;
+
+type ProviderCallToken = {
+	method: string;
+	promise?: Promise<unknown>;
+};
+
+const PROVIDER_CLOSE_SETTLEMENT_MS = 1_000;
+
 /**
  * Pure ACP-to-SDK adapter. It deliberately owns neither an AgentSession nor an
  * ACP bridge: all session work is performed through authenticated v3 frames.
@@ -83,10 +95,13 @@ export class AcpSdkAdapter {
 	#reclaiming?: Promise<void>;
 	#reverseRequests = new Map<string, ReverseRequest>();
 	#reconnectFailedHandlers = new Set<AcpReconnectFailedHandler>();
+	#pendingReverseProviderCalls = new Set<ProviderCallToken>();
 	#frameHandlers = new Set<AcpFrameHandler>();
 
 	#reverseCancelTtlMs: number;
 	#closed = false;
+	#closePromise?: Promise<void>;
+	#terminalCleanupUncertain = false;
 
 	constructor(options: AcpSdkAdapterOptions) {
 		this.#client = options.client ?? new SdkClient(options.url, options.token);
@@ -140,10 +155,16 @@ export class AcpSdkAdapter {
 	}
 
 	async close(): Promise<void> {
+		this.#closePromise ??= this.#closeInternal();
+		await this.#closePromise;
+	}
+
+	async #closeInternal(): Promise<void> {
 		if (this.#closed) return;
 		this.#closed = true;
 		if (this.#heartbeat) clearInterval(this.#heartbeat);
-		for (const request of this.#reverseRequests.values()) {
+		for (const [id, request] of this.#reverseRequests) {
+			if (request.state === "pending") this.#sendReverseCancellation(id, request);
 			request.controller?.abort();
 			if (request.cancelTimer) clearTimeout(request.cancelTimer);
 		}
@@ -151,7 +172,21 @@ export class AcpSdkAdapter {
 		this.#unsubscribe?.();
 		this.#unsubscribeReconnect?.();
 		this.#unsubscribeReconnectFailed?.();
-		await this.#client.close();
+
+		const terminalSettled = await this.#awaitTerminalProviderSettlement();
+		let clientError: unknown;
+		try {
+			await this.#client.close();
+		} catch (error) {
+			clientError = error;
+		}
+		if (!terminalSettled) {
+			throw new AcpSdkAdapterError(
+				"ownership_uncertain",
+				"ACP terminal provider cleanup did not settle before adapter close.",
+			);
+		}
+		if (clientError) throw clientError;
 	}
 
 	async prompt(params: JsonObject | string): Promise<unknown> {
@@ -355,7 +390,7 @@ export class AcpSdkAdapter {
 		)
 			return;
 		const controller = new AbortController();
-		const active: ReverseRequest = { state: "pending", controller };
+		const active: ReverseRequest = { state: "pending", connectionId, capability, leaseId, controller };
 		this.#reverseRequests.set(id, active);
 		try {
 			const request = frame.payload as JsonObject | undefined;
@@ -423,19 +458,175 @@ export class AcpSdkAdapter {
 
 	#abortActiveReverseRequests(): void {
 		for (const [id, request] of this.#reverseRequests) {
+			if (request.state === "pending") this.#sendReverseCancellation(id, request);
 			request.state = "cancelled";
 			request.controller?.abort();
 			this.#finishReverse(id, request);
 		}
 	}
 
+	#sendReverseCancellation(id: string, request: ReverseRequest): void {
+		if (!request.connectionId || !request.leaseId) return;
+		try {
+			const cancellation = this.#client.send({
+				type: "reverse_cancel",
+				id,
+				connectionId: request.connectionId,
+				leaseId: request.leaseId,
+			});
+			void Promise.resolve(cancellation).catch(() => {});
+		} catch {
+			// Cancellation is best effort while local retirement remains authoritative.
+		}
+	}
+
+	async #awaitTerminalProviderSettlement(): Promise<boolean> {
+		const deadline = Date.now() + PROVIDER_CLOSE_SETTLEMENT_MS;
+		for (;;) {
+			const pending = [...this.#pendingReverseProviderCalls].filter(token =>
+				["terminal.create", "terminal.kill", "terminal.release"].includes(token.method),
+			);
+			if (pending.length === 0) return !this.#terminalCleanupUncertain;
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) return false;
+			const promises = pending.flatMap(token => (token.promise ? [token.promise] : []));
+			if (promises.length === 0) {
+				await Bun.sleep(Math.min(remaining, 1));
+				continue;
+			}
+			await Promise.race([Promise.allSettled(promises), Bun.sleep(remaining)]);
+		}
+	}
+
+	#reserveProviderCalls(method: string): { call: ProviderCallToken; cleanup: ProviderCallToken[] } {
+		const cleanup =
+			method === "terminal.create"
+				? ([{ method: "terminal.kill" }, { method: "terminal.release" }] satisfies ProviderCallToken[])
+				: [];
+		const required = 1 + cleanup.length;
+		if (this.#pendingReverseProviderCalls.size + required > MAX_PENDING_REVERSE_PROVIDER_CALLS)
+			throw new AcpSdkAdapterError("acp_reverse_capacity", "ACP reverse provider call capacity reached.");
+		const call: ProviderCallToken = { method };
+		this.#pendingReverseProviderCalls.add(call);
+		for (const token of cleanup) this.#pendingReverseProviderCalls.add(token);
+		return { call, cleanup };
+	}
+
+	#releaseReservedProviderCalls(tokens: readonly ProviderCallToken[]): void {
+		for (const token of tokens) {
+			if (!token.promise) this.#pendingReverseProviderCalls.delete(token);
+		}
+	}
+
+	#startProviderCall(
+		method: string,
+		payload: JsonObject,
+		signal: AbortSignal | undefined,
+		token: ProviderCallToken,
+	): Promise<unknown> {
+		let providerCall: Promise<unknown>;
+		try {
+			if (!this.#connection) throw new AcpSdkAdapterError("acp_reverse_unavailable");
+			if (this.#connection.request)
+				providerCall = Promise.resolve(this.#connection.request(method, payload, { cancellationSignal: signal }));
+			else {
+				const target = this.#connection[method];
+				if (typeof target !== "function")
+					throw new AcpSdkAdapterError("acp_reverse_unsupported", `ACP client does not support ${method}.`);
+				providerCall = Promise.resolve((target as (params: JsonObject) => Promise<unknown>)(payload));
+			}
+		} catch (error) {
+			if (token.method === "terminal.kill" || token.method === "terminal.release")
+				this.#terminalCleanupUncertain = true;
+			this.#pendingReverseProviderCalls.delete(token);
+			return Promise.reject(error);
+		}
+		token.promise = providerCall;
+		void providerCall.then(
+			() => this.#pendingReverseProviderCalls.delete(token),
+			() => {
+				if (token.method === "terminal.kill" || token.method === "terminal.release")
+					this.#terminalCleanupUncertain = true;
+				this.#pendingReverseProviderCalls.delete(token);
+			},
+		);
+		return providerCall;
+	}
+
 	async #forwardReverse(method: string, payload: JsonObject, signal: AbortSignal): Promise<unknown> {
 		if (!method || !this.#connection) throw new AcpSdkAdapterError("acp_reverse_unavailable");
-		if (this.#connection.request)
-			return await this.#connection.request(method, payload, { cancellationSignal: signal });
-		const target = this.#connection[method];
-		if (typeof target !== "function")
-			throw new AcpSdkAdapterError("acp_reverse_unsupported", `ACP client does not support ${method}.`);
-		return await (target as (params: JsonObject) => Promise<unknown>)(payload);
+		if (signal.aborted) throw new AcpSdkAdapterError("request_cancelled", "Reverse request was cancelled.");
+		const reservation = this.#reserveProviderCalls(method);
+		const providerCall = this.#startProviderCall(method, payload, signal, reservation.call);
+		const cancelled = Promise.withResolvers<{ status: "cancelled" }>();
+		const onAbort = () => cancelled.resolve({ status: "cancelled" });
+		signal.addEventListener("abort", onAbort, { once: true });
+		if (signal.aborted) cancelled.resolve({ status: "cancelled" });
+		let outcome:
+			| { status: "resolved"; result: unknown }
+			| { status: "rejected"; error: unknown }
+			| { status: "cancelled" };
+		try {
+			outcome = await Promise.race([
+				providerCall.then(
+					result => ({ status: "resolved" as const, result }),
+					error => ({ status: "rejected" as const, error }),
+				),
+				cancelled.promise,
+			]);
+		} finally {
+			signal.removeEventListener("abort", onAbort);
+		}
+		if (outcome.status === "cancelled" || signal.aborted) {
+			if (method === "terminal.create") {
+				void providerCall
+					.then(
+						result => this.#cleanupCancelledTerminalCreate(result, reservation.cleanup),
+						() => {
+							this.#releaseReservedProviderCalls(reservation.cleanup);
+						},
+					)
+					.catch(() => {
+						this.#terminalCleanupUncertain = true;
+						this.#releaseReservedProviderCalls(reservation.cleanup);
+					});
+			} else this.#releaseReservedProviderCalls(reservation.cleanup);
+			throw new AcpSdkAdapterError("request_cancelled", "Reverse request was cancelled.");
+		}
+		this.#releaseReservedProviderCalls(reservation.cleanup);
+		if (outcome.status === "rejected") throw outcome.error;
+		return outcome.result;
+	}
+
+	async #cleanupCancelledTerminalCreate(result: unknown, cleanupTokens: readonly ProviderCallToken[]): Promise<void> {
+		const terminalId =
+			result && typeof result === "object" && typeof (result as { terminalId?: unknown }).terminalId === "string"
+				? (result as { terminalId: string }).terminalId
+				: undefined;
+		if (!terminalId || !this.#connection) {
+			this.#terminalCleanupUncertain = true;
+			this.#releaseReservedProviderCalls(cleanupTokens);
+			return;
+		}
+		for (const [index, method] of (["terminal.kill", "terminal.release"] as const).entries()) {
+			const token = cleanupTokens[index];
+			if (!token) continue;
+			let providerCall: Promise<unknown>;
+			try {
+				providerCall = this.#startProviderCall(method, { terminalId }, AbortSignal.timeout(500), token);
+			} catch {
+				this.#terminalCleanupUncertain = true;
+				this.#releaseReservedProviderCalls([token]);
+				continue;
+			}
+			const cleanupOutcome = await Promise.race([
+				providerCall.then(
+					() => "settled" as const,
+					() => "failed" as const,
+				),
+				Bun.sleep(500).then(() => "timeout" as const),
+			]);
+			if (cleanupOutcome === "failed") this.#terminalCleanupUncertain = true;
+		}
 	}
 }

package/src/sdk/broker/broker.ts

@@ -24,7 +24,7 @@ import {
 	redactBrokerDiscovery,
 } from "./discovery";
 import { deriveIdempotencyIdentity } from "./identity";
-import { executeLifecycle, isCanonicalSessionId } from "./lifecycle";
+import { canonicalDeleteLocatorPath, executeLifecycle, isCanonicalSessionId } from "./lifecycle";
 
 import {
 	type LifecycleDurableEffectsReceipt,
@@ -71,6 +71,7 @@ export type BrokerErrorCode =
 export type BrokerCleanupIdentity = {
 	dev: string;
 	ino: string;
+	nlink?: string;
 	size: number;
 	mtimeNs: string;
 	sha256: string;
@@ -102,6 +103,7 @@ export type BrokerArtifactTree = {
 
 export type BrokerCleanupEvidence = {
 	phase: "artifacts" | "transcript" | "metadata" | "lifecycle";
+	cleanupReceiptVersion?: 1;
 	/** Ledger-bound deletion target; never reconstructed from a retry request. */
 	sessionsRoot?: string;
 	transcriptPath?: string;
@@ -110,6 +112,7 @@ export type BrokerCleanupEvidence = {
 	sessionId?: string;
 	artifactsIdentity?: BrokerCleanupIdentity;
 	transcriptIdentity?: BrokerCleanupIdentity;
+	transcriptParentIdentity?: { dev: string; ino: string };
 	/** Identity-bound lifecycle metadata marker retained when exact cleanup is deferred. */
 	metadataIdentity?: BrokerCleanupIdentity;
 	metadataPath?: string;
@@ -122,9 +125,17 @@ export type BrokerCleanupEvidence = {
 	/** Append-only terminal proof for lifecycle metadata cleanup. */
 	metadataCompleted?: true;
 	detachedArtifactsPath?: string;
+	retainedArtifactsSuccessorPath?: string;
+	retainedArtifactsPlaceholderPath?: string;
+	retainedArtifactsUnknownPath?: string;
+	retainedArtifactsSideAuthority?: "none" | "retained";
 	detachedTranscriptPath?: string;
+	retainedTranscriptSuccessorPath?: string;
+	retainedTranscriptPlaceholderPath?: string;
+	retainedTranscriptUnknownPath?: string;
 	/** Durable proof that artifact cleanup completed before transcript mutation. */
 	artifactsRemoved?: boolean;
+	artifactsAbsentAtAuthorization?: true;
 	/** Preauthorized no-replace artifact quarantine path persisted before detach. */
 	plannedArtifactsPath?: string;
 	/** Identity-bound artifact tree authority persisted before broker detach and replayed exactly. */
@@ -133,6 +144,7 @@ export type BrokerCleanupEvidence = {
 	plannedTranscriptPath?: string;
 	/** Fully identity-bound startup-failure cleanup plan, persisted before any detach. */
 	lifecycleFiles?: BrokerLifecycleCleanupFile[];
+	lifecycleParentIdentity?: { dev: string; ino: string };
 	/** Delete metadata receipts authorize only the canonical marker/ready sibling pair. */
 	lifecycleDeleteMetadata?: true;
 };
@@ -157,6 +169,14 @@ function isCleanupPending(response: BrokerResponse): boolean {
 	return !response.ok && response.error.code === "cleanup_pending" && response.error.cleanup !== undefined;
 }
 
+function cleanupFromResponse(response: unknown): BrokerCleanupEvidence | undefined {
+	return isBrokerResponse(response) && !response.ok ? response.error.cleanup : undefined;
+}
+function pendingCleanupSessionId(response: BrokerResponse): string | undefined {
+	if (response.ok || response.error.code !== "cleanup_pending") return undefined;
+	return typeof response.error.cleanup?.sessionId === "string" ? response.error.cleanup.sessionId : undefined;
+}
+
 function lifecycleResponseState(response: BrokerResponse): LifecycleState {
 	if (response.ok) return "terminal_ok";
 	if (isCleanupPending(response)) return "effect_started";
@@ -165,8 +185,8 @@ function lifecycleResponseState(response: BrokerResponse): LifecycleState {
 
 type InputNormalization = { input: Record<string, unknown> } | BrokerResponse;
 
-function isBrokerResponse(value: InputNormalization): value is BrokerResponse {
-	return "ok" in value;
+function isBrokerResponse(value: unknown): value is BrokerResponse {
+	return typeof value === "object" && value !== null && "ok" in value && typeof value.ok === "boolean";
 }
 
 function normalizeAliasedString(
@@ -224,11 +244,12 @@ function normalizeBrokerInput(operation: string, input: Record<string, unknown>)
 		typeof input.target === "object" && input.target !== null && !Array.isArray(input.target)
 			? (input.target as Record<string, unknown>)
 			: undefined;
+	const normalizeLifecycleDirectory = operation === "session.delete" ? canonicalDeleteLocatorPath : path.resolve;
 	const cwd = normalizeAliasedString(
 		{ cwd: input.cwd, path: input.path, targetPath: target?.path },
 		"cwd",
 		["path", "targetPath"],
-		value => path.resolve(value),
+		normalizeLifecycleDirectory,
 	);
 	if (cwd.error) return error("invalid_input", cwd.error);
 	if (cwd.value !== undefined) {
@@ -239,7 +260,7 @@ function normalizeBrokerInput(operation: string, input: Record<string, unknown>)
 		{ stateRoot: input.stateRoot, targetStateRoot: target?.stateRoot },
 		"stateRoot",
 		["targetStateRoot"],
-		value => path.resolve(value),
+		normalizeLifecycleDirectory,
 	);
 	if (stateRoot.error) return error("invalid_input", stateRoot.error);
 	if (stateRoot.value !== undefined && (!cwd.value || stateRoot.value !== path.join(cwd.value, ".gjc", "state")))
@@ -254,6 +275,11 @@ function normalizeBrokerInput(operation: string, input: Record<string, unknown>)
 		if (Object.keys(normalizedTarget).length > 0) normalized.target = normalizedTarget;
 		else delete normalized.target;
 	}
+	if (operation === "session.delete") {
+		const sessionPath = normalizeAliasedString(input, "sessionPath", [], canonicalDeleteLocatorPath);
+		if (sessionPath.error) return error("invalid_input", sessionPath.error);
+		if (sessionPath.value !== undefined) normalized.sessionPath = sessionPath.value;
+	}
 	return { input: normalized };
 }
 function canonicalJson(value: unknown): string {
@@ -798,7 +824,61 @@ export class Broker {
 			.update(canonicalJson(lifecycleTarget(operation, input)))
 			.digest("hex");
 		const identity = await deriveIdempotencyIdentity(this.settings.agentDir, operation, idempotencyKey, target);
-		const requestHash = createHash("sha256").update(canonicalJson({ operation, input })).digest("hex");
+		let reconstructedDeleteCleanup: BrokerCleanupEvidence | undefined;
+		if (operation === "session.delete" && input.cwd === undefined && input.sessionPath === undefined) {
+			const entry = this.ledger.get(identity);
+			const cleanup = cleanupFromResponse(entry?.response) ?? cleanupFromResponse(entry?.unresolvedCleanupResponse);
+			reconstructedDeleteCleanup = cleanup;
+			const requestedSessionId = typeof input.sessionId === "string" ? input.sessionId : undefined;
+			if (!cleanup) {
+				if (requestedSessionId && this.ledger.hasUncertainCleanupForSession(requestedSessionId, identity))
+					return error(
+						"terminal_uncertain",
+						"Session cleanup authority is uncertain and cannot be deleted safely",
+					);
+				const pending = requestedSessionId
+					? this.ledger.findCleanupPendingBySessionId(requestedSessionId, identity)
+					: undefined;
+				if (pending) {
+					const pendingResponse = cleanupFromResponse(pending.response)
+						? pending.response
+						: pending.unresolvedCleanupResponse;
+					if (isBrokerResponse(pendingResponse)) return pendingResponse;
+					return error(
+						"terminal_uncertain",
+						"Session cleanup authority is pending under another lifecycle identity",
+					);
+				}
+				if (entry) {
+					if (isBrokerResponse(entry.response)) return entry.response;
+					return error("terminal_uncertain", "Existing session.delete ledger evidence lacks replayable authority");
+				}
+				if (requestedSessionId) {
+					await this.index.refresh();
+					if (this.index.listSessions().sessions.some(session => session.sessionId === requestedSessionId))
+						return error(
+							"terminal_uncertain",
+							"Indexed session requires durable locator authority before deletion",
+						);
+				}
+				return { ok: true, result: requestedSessionId ? { sessionId: requestedSessionId } : undefined };
+			}
+			if (
+				cleanup &&
+				cleanup.sessionId === requestedSessionId &&
+				typeof cleanup.cwd === "string" &&
+				typeof cleanup.transcriptPath === "string"
+			)
+				input = {
+					sessionId: cleanup.sessionId,
+					cwd: cleanup.cwd,
+					stateRoot: path.join(cleanup.cwd, ".gjc", "state"),
+					sessionPath: cleanup.transcriptPath,
+				};
+		}
+		const storedRequestHash = reconstructedDeleteCleanup ? this.ledger.get(identity)?.requestHash : undefined;
+		const requestHash =
+			storedRequestHash ?? createHash("sha256").update(canonicalJson({ operation, input })).digest("hex");
 		const prev = this.#chains.get(target) ?? Promise.resolve();
 		let release!: () => void;
 		const current = new Promise<void>(resolve => (release = resolve));
@@ -812,8 +892,8 @@ export class Broker {
 			const begun = await this.ledger.begin(identity, requestHash);
 			if (begun.kind === "replay") {
 				const replay = begun.entry.response as BrokerResponse;
-				if (!(!replay.ok && replay.error.cleanup)) return replay;
-				const cleanup = replay.error.cleanup;
+				const cleanup = cleanupFromResponse(replay) ?? reconstructedDeleteCleanup;
+				if (!cleanup) return replay;
 				const outcome = await executeLifecycle(this, operation, input, identity, cleanup);
 				const response = outcome.response;
 				await this.ledger.transition(identity, lifecycleResponseState(response), {
@@ -828,11 +908,13 @@ export class Broker {
 				return error("idempotency_conflict", "idempotency key was used with a different request");
 			if (begun.kind === "terminal_uncertain") {
 				const replay = (begun.entry.response ?? beforeBegin?.response) as BrokerResponse | undefined;
-				if (!replay || replay.ok || !replay.error.cleanup)
+				const cleanup = (replay ? cleanupFromResponse(replay) : undefined) ?? reconstructedDeleteCleanup;
+				if (!cleanup)
 					return replay ?? error("terminal_uncertain", "prior lifecycle operation outcome is uncertain");
-				const outcome = await executeLifecycle(this, operation, input, identity, replay.error.cleanup);
+				const outcome = await executeLifecycle(this, operation, input, identity, cleanup);
 				const response = outcome.response;
 				await this.ledger.transition(identity, lifecycleResponseState(response), {
+					...(pendingCleanupSessionId(response) ? { intendedSessionId: pendingCleanupSessionId(response) } : {}),
 					response,
 					responseDigest: createHash("sha256").update(canonicalJson(response)).digest("hex"),
 					...(outcome.durableEffects ? { durableEffects: outcome.durableEffects } : {}),
@@ -844,6 +926,7 @@ export class Broker {
 			const outcome = await executeLifecycle(this, operation, input, identity);
 			const response = outcome.response;
 			await this.ledger.transition(identity, lifecycleResponseState(response), {
+				...(pendingCleanupSessionId(response) ? { intendedSessionId: pendingCleanupSessionId(response) } : {}),
 				resultSessionId:
 					response.ok && typeof (response.result as { sessionId?: unknown } | undefined)?.sessionId === "string"
 						? (response.result as { sessionId: string }).sessionId