@gajae-code/coding-agent 0.13.3 → 0.14.0

package/src/sdk/bus/slack-live-provider.ts

@@ -50,7 +50,7 @@ export interface SlackLiveProviderOptions {
 	fetch?: (input: string, init?: RequestInit) => Promise<Response>;
 	webSocket?: (url: string) => SlackWebSocket;
 	now?: () => number;
-	sleep?: (milliseconds: number) => Promise<void>;
+	sleep?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
 	reconnectDelayMs?: number;
 	maxRateLimitRetries?: number;
 	maxRetryAfterMs?: number;
@@ -93,6 +93,27 @@ function retryAfterMilliseconds(response: Response, body: SlackApiResponse, maxi
 	return Math.min(Math.max(0, Number.isFinite(seconds) ? seconds * 1_000 : 1_000), maximum);
 }
 
+async function sleep(milliseconds: number, signal?: AbortSignal): Promise<void> {
+	if (!signal) {
+		await Bun.sleep(milliseconds);
+		return;
+	}
+	signal.throwIfAborted();
+	const settled = Promise.withResolvers<void>();
+	const timer = setTimeout(settled.resolve, milliseconds);
+	const abort = (): void => {
+		clearTimeout(timer);
+		settled.reject(signal.reason);
+	};
+	signal.addEventListener("abort", abort, { once: true });
+	try {
+		await settled.promise;
+	} finally {
+		clearTimeout(timer);
+		signal.removeEventListener("abort", abort);
+	}
+}
+
 function socketFromGlobal(url: string): SlackWebSocket {
 	return new WebSocket(url);
 }
@@ -118,7 +139,7 @@ export class SlackLiveProvider implements SlackProviderClient, SlackDiagnosticPr
 	readonly #fetch: (input: string, init?: RequestInit) => Promise<Response>;
 	readonly #webSocket: (url: string) => SlackWebSocket;
 	readonly #now: () => number;
-	readonly #sleep: (milliseconds: number) => Promise<void>;
+	readonly #sleep: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
 	readonly #reconnectDelayMs: number;
 	readonly #maxRateLimitRetries: number;
 	readonly #maxRetryAfterMs: number;
@@ -148,8 +169,7 @@ export class SlackLiveProvider implements SlackProviderClient, SlackDiagnosticPr
 		this.#fetch = options.fetch ?? fetch;
 		this.#webSocket = options.webSocket ?? socketFromGlobal;
 		this.#now = options.now ?? Date.now;
-		this.#sleep =
-			options.sleep ?? (async milliseconds => await new Promise<void>(resolve => setTimeout(resolve, milliseconds)));
+		this.#sleep = options.sleep ?? sleep;
 		this.#reconnectDelayMs = Math.max(0, options.reconnectDelayMs ?? DEFAULT_RECONNECT_DELAY_MS);
 		this.#maxRateLimitRetries = Math.max(0, options.maxRateLimitRetries ?? MAX_RATE_LIMIT_RETRIES);
 		this.#maxRetryAfterMs = Math.max(0, options.maxRetryAfterMs ?? MAX_RETRY_AFTER_MS);
@@ -255,13 +275,18 @@ export class SlackLiveProvider implements SlackProviderClient, SlackDiagnosticPr
 		text: string;
 		threadTs?: string;
 		clientMsgId: string;
+		signal?: AbortSignal;
 	}): Promise<SlackPostedMessage> {
-		const response = await this.#api("chat.postMessage", {
-			channel: input.channel,
-			text: input.text,
-			thread_ts: input.threadTs,
-			client_msg_id: input.clientMsgId,
-		});
+		const response = await this.#api(
+			"chat.postMessage",
+			{
+				channel: input.channel,
+				text: input.text,
+				thread_ts: input.threadTs,
+				client_msg_id: input.clientMsgId,
+			},
+			input.signal,
+		);
 		const message = this.#message(response);
 		// A successful HTTP response without a usable receipt can still represent a
 		// remote acceptance. The daemon must reconcile by client_msg_id before retrying.
@@ -273,11 +298,16 @@ export class SlackLiveProvider implements SlackProviderClient, SlackDiagnosticPr
 		channel: string;
 		clientMsgId: string;
 		threadTs?: string;
+		signal?: AbortSignal;
 	}): Promise<SlackMessageSearchResult | null> {
-		const response = await this.#api("conversations.history", { channel: input.channel });
+		const response = await this.#api("conversations.history", { channel: input.channel }, input.signal);
 		const fromHistory = this.#findMessage(response, input.clientMsgId, input.channel);
 		if (fromHistory || !input.threadTs) return fromHistory;
-		const replies = await this.#api("conversations.replies", { channel: input.channel, ts: input.threadTs });
+		const replies = await this.#api(
+			"conversations.replies",
+			{ channel: input.channel, ts: input.threadTs },
+			input.signal,
+		);
 		return this.#findMessage(replies, input.clientMsgId, input.channel);
 	}
 
@@ -393,12 +423,32 @@ export class SlackLiveProvider implements SlackProviderClient, SlackDiagnosticPr
 		return url;
 	}
 
-	async #api(operation: string, body: Record<string, string | undefined>): Promise<SlackApiResponse> {
-		const result = await this.#request(operation, this.#botToken, body, true);
+	async #api(
+		operation: string,
+		body: Record<string, string | undefined>,
+		signal?: AbortSignal,
+	): Promise<SlackApiResponse> {
+		const result = await this.#request(operation, this.#botToken, body, true, signal);
 		if (result.ok === true) return result;
 		throw new SlackProviderError("web_api", operation);
 	}
 
+	async #sleepUntilAbort(milliseconds: number, signal?: AbortSignal): Promise<void> {
+		if (!signal) {
+			await this.#sleep(milliseconds);
+			return;
+		}
+		signal.throwIfAborted();
+		const aborted = Promise.withResolvers<void>();
+		const abort = (): void => aborted.reject(signal.reason);
+		signal.addEventListener("abort", abort, { once: true });
+		try {
+			await Promise.race([this.#sleep(milliseconds, signal), aborted.promise]);
+		} finally {
+			signal.removeEventListener("abort", abort);
+		}
+	}
+
 	async #request(
 		operation: string,
 		token: string,
@@ -450,7 +500,7 @@ export class SlackLiveProvider implements SlackProviderClient, SlackDiagnosticPr
 				throw new SlackProviderError("rate_limited", operation, response.status, retryAfterMs);
 			}
 			const startedAt = this.#now();
-			await this.#sleep(retryAfterMs);
+			await this.#sleepUntilAbort(retryAfterMs, signal);
 			if (this.#now() - startedAt > this.#maxRetryAfterMs) {
 				throw new SlackProviderError("rate_limited", operation, response.status, retryAfterMs);
 			}

package/src/sdk/bus/slack-provider.ts

@@ -49,11 +49,13 @@ export interface SlackProviderClient {
 		text: string;
 		threadTs?: string;
 		clientMsgId: string;
+		signal?: AbortSignal;
 	}): Promise<SlackPostedMessage>;
 	findMessageByClientMsgId?(input: {
 		channel: string;
 		clientMsgId: string;
 		threadTs?: string;
+		signal?: AbortSignal;
 	}): Promise<SlackMessageSearchResult | null>;
 	/**
 	 * Prove that an operator-supplied timestamp addresses a real message in the
@@ -92,6 +94,7 @@ export class SlackProvider {
 		text: string;
 		threadTs?: string;
 		clientMsgId: string;
+		signal?: AbortSignal;
 	}): Promise<SlackPostedMessage> {
 		return await this.client.postMessage(input);
 	}
@@ -100,6 +103,7 @@ export class SlackProvider {
 		channel: string;
 		clientMsgId: string;
 		threadTs?: string;
+		signal?: AbortSignal;
 	}): Promise<SlackMessageSearchResult | null> {
 		return (await this.client.findMessageByClientMsgId?.(input)) ?? null;
 	}

package/src/sdk/bus/slack-thread-binding.ts

@@ -7,20 +7,16 @@
  *  2. *Daemon*: only the running owner may mutate mappings, and only while it is
  *     still the exact owner (`ownerId`/`pid`/`incarnation`/daemon generation)
  *     captured before the request was published.
- *  3. *Session*: the SDK session must be attachable right now — indexed, live,
- *     non-terminal, with a readable, non-stale endpoint whose pid matches the
- *     indexed host and whose generation has not rolled.
+ *  3. *Session*: the running daemon supplies a redacted Router authority proving
+ *     the exact session and endpoint generation; this module never resolves an
+ *     endpoint or retains its credentials.
  *
  * Provider verification happens before any lock is taken, and the mapping commit
- * re-proves session authority inside the store lock, so an authority that
- * changes mid-flight leaves no mapping behind.
+ * re-proves daemon and session authority inside the store lock, so an authority
+ * that changes mid-flight leaves no mapping behind.
  */
 
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
 import type { Settings } from "../../config/settings";
-import type { SessionIndex } from "../broker/session-index";
-import { readSdkSessionEndpoint, type SdkSessionEndpoint, type SdkSessionEndpointScope } from "../client/discovery";
 import {
 	type ChatDaemonCommandOwner,
 	type ChatDaemonCommandSubmission,
@@ -116,100 +112,6 @@ export function assertBoundedSlackRootTs(rootTs: string): void {
 		);
 }
 
-/** Proven right to bind one session at one endpoint generation. */
-async function defaultStatEndpoint(endpointPath: string): Promise<{ mtimeMs: number } | undefined> {
-	const stat = await fs.stat(endpointPath).catch(() => undefined);
-	return stat ? { mtimeMs: stat.mtimeMs } : undefined;
-}
-
-export interface SlackSessionBindingAuthority {
-	sessionId: string;
-	endpointGeneration: number;
-	pid: number;
-	repo: string;
-	/**
-	 * The exact endpoint this authority was proven against. Callers must use it
-	 * rather than re-reading discovery: a second read can observe a different
-	 * process whose endpoint generation happens to repeat, and the numeric
-	 * generation alone cannot tell the two apart.
-	 */
-	endpoint: SdkSessionEndpoint;
-	scope: SdkSessionEndpointScope;
-	endpointMtimeMs: number;
-}
-
-export interface SessionBindingAuthorityInput {
-	sessionIndex: SessionIndex;
-	sessionId: string;
-	readEndpoint?: (
-		repo: string,
-		sessionId: string,
-		scope?: SdkSessionEndpointScope,
-	) => Promise<SdkSessionEndpoint | null>;
-	statEndpoint?: (endpointPath: string) => Promise<{ mtimeMs: number } | undefined>;
-}
-
-/**
- * Resolve exact discovery/attachment authority for one session.
- *
- * `IndexedSession.live` alone is only pid liveness, which a terminated or
- * unregistered session can still satisfy through pid reuse or a stale record.
- * Adoption additionally requires an intact index replay, a non-terminal record,
- * and a discovery endpoint that is present, well-formed, not marked stale, and
- * owned by the same host pid the index recorded.
- */
-export async function resolveSessionBindingAuthority(
-	input: SessionBindingAuthorityInput,
-): Promise<SlackSessionBindingAuthority | undefined> {
-	await input.sessionIndex.refresh();
-	const listing = input.sessionIndex.listSessions();
-	// A truncated replay cannot prove the tail is free of a terminal or
-	// unregistration event, so a degraded index is never binding authority.
-	if (listing.warnings.length > 0) return undefined;
-	const session = listing.sessions.find(candidate => candidate.sessionId === input.sessionId);
-	if (!session?.live || session.terminalUncertain) return undefined;
-	if (!Number.isSafeInteger(session.endpointGeneration) || session.endpointGeneration <= 0) return undefined;
-	if (!Number.isSafeInteger(session.pid) || session.pid <= 0) return undefined;
-	// Same scope derivation the runtime's attach() fence uses. Reading a
-	// `.gjc/state/chat/sdk` session at the default scope would either miss it or
-	// prove the wrong endpoint, so an underivable scope is not authority.
-	const repo = path.resolve(session.locator.repo);
-	const defaultStateRoot = path.join(repo, ".gjc", "state");
-	const indexedStateRoot = path.resolve(session.locator.stateRoot);
-	const scope: SdkSessionEndpointScope | undefined =
-		indexedStateRoot === defaultStateRoot
-			? "default"
-			: indexedStateRoot === path.join(defaultStateRoot, "chat")
-				? "chat"
-				: undefined;
-	if (!scope || session.endpointMtimeMs === undefined) return undefined;
-
-	let endpoint: SdkSessionEndpoint | null;
-	try {
-		endpoint = await (input.readEndpoint ?? readSdkSessionEndpoint)(session.locator.repo, input.sessionId, scope);
-	} catch {
-		// A malformed discovery record is not authority for anything.
-		return undefined;
-	}
-	if (!endpoint || endpoint.stale === true || !endpoint.url || !endpoint.token) return undefined;
-	if (endpoint.pid === undefined || endpoint.pid !== session.pid) return undefined;
-
-	// The endpoint file must be the exact one the index observed. Without this
-	// the numeric generation is the only fence, and it repeats across processes.
-	const stat = await (input.statEndpoint ?? defaultStatEndpoint)(endpoint.path);
-	if (!stat || stat.mtimeMs !== session.endpointMtimeMs) return undefined;
-
-	return {
-		sessionId: input.sessionId,
-		endpointGeneration: session.endpointGeneration,
-		pid: session.pid,
-		repo: session.locator.repo,
-		endpoint,
-		scope,
-		endpointMtimeMs: session.endpointMtimeMs,
-	};
-}
-
 /** States in which a mapping still owns its session's root claim. */
 function holdsRootClaim(record: SlackConversation): boolean {
 	return record.state === "active" || record.state === "posting_root" || record.state === "resumed_root";
@@ -224,6 +126,7 @@ export interface SlackThreadClaimInput {
 	sessionId: string;
 	rootTs: string;
 	endpointGeneration: number;
+	attachmentAuthorityId?: string;
 	/**
 	 * Re-proves session authority inside the store lock, immediately before
 	 * commit. It may be invoked more than once for one claim: authority here is
@@ -281,7 +184,8 @@ export async function claimSlackThreadBinding(input: SlackThreadClaimInput): Pro
 		bound?.state !== "active" ||
 		bound.sessionId !== input.sessionId ||
 		bound.rootTs !== input.rootTs ||
-		bound.endpointGeneration !== input.endpointGeneration
+		bound.endpointGeneration !== input.endpointGeneration ||
+		bound.attachmentAuthorityId !== input.attachmentAuthorityId
 	)
 		throw new SlackThreadBindingError("binding_failed", "Slack root binding could not be claimed.");
 	return bound;
@@ -380,6 +284,7 @@ function claimTransaction(
 			rootTs: input.rootTs,
 			sessionId: input.sessionId,
 			endpointGeneration: input.endpointGeneration,
+			...(input.attachmentAuthorityId === undefined ? {} : { attachmentAuthorityId: input.attachmentAuthorityId }),
 			updatedAt: now(),
 			seenEventIds: current?.seenEventIds ?? [],
 			seenContextIds: current?.seenContextIds ?? [],