@gajae-code/coding-agent 0.14.2 → 0.15.0

package/src/sdk/bus/index.ts

@@ -48,6 +48,7 @@ function sdkBusNatives(): NativeSdkBusBindings {
 type NotificationServer = NativeNotificationServer;
 
 import { $credentialEnv, logger, postmortem, VERSION } from "@gajae-code/utils";
+
 import { AsyncJobManager } from "../../async";
 import { Settings, validateSettingPatch } from "../../config/settings";
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from "../../extensibility/extensions";
@@ -100,6 +101,7 @@ import {
 } from "../host";
 import { type AbortScope, type ControlSurface, dispatchControl, TypedControlError } from "../host/control";
 import { BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD } from "../host/control/runtime-gate";
+import { isAutoroutingInactive, markAutoroutingInactive } from "../host/internal-autorouting-state";
 import { CursorRegistry, QueryHandlers, RevisionStore, type SessionSurface } from "../host/query";
 import type { SdkFrame } from "../host/types";
 import {
@@ -209,6 +211,39 @@ const PROMPT_SETTLEMENT_DIAGNOSTIC_MAX_AGE_MS = 86_400_000;
  * provider error cannot flood the log file.
  */
 const PROMPT_TERMINAL_FAILURE_REASON_LOG_MAX = 512;
+/**
+ * #4743: bounded wait for durable reconciliation quiescence during session
+ * teardown. Expiry is OBSERVABLE (owner-release failure), never silently
+ * treated as drained. Read per drain so the env override is effective for
+ * deterministic tests.
+ */
+const sdkReconciliationDrainTimeoutMs = (): number => {
+	const override = Number(process.env.GJC_SDK_RECONCILIATION_DRAIN_TIMEOUT_MS);
+	return override > 0 ? override : 5_000;
+};
+/**
+ * #4743: the two reconciliation failure codes that mean durable state may be
+ * lost. Both must reach the teardown owner; every other owner-release failure
+ * stays retryable through the retained `cleanupRetries` entry.
+ */
+const RECONCILIATION_DURABILITY_FAILURE_CODES: ReadonlySet<string> = new Set([
+	"reconciliation_persist_failed",
+	"reconciliation_drain_timeout",
+]);
+function reconciliationFailureCode(value: unknown): string | undefined {
+	if (typeof value !== "object" || value === null) return undefined;
+	const code = (value as { code?: unknown }).code;
+	return typeof code === "string" && RECONCILIATION_DURABILITY_FAILURE_CODES.has(code) ? code : undefined;
+}
+/**
+ * Flatten an owner-release failure to its durability-failure members. Aggregates
+ * nest (the store batches a drained window's failures, and owner release batches
+ * every release failure), so recursion is required to reach the coded leaves.
+ */
+function reconciliationDurabilityFailures(error: unknown): unknown[] {
+	if (error instanceof AggregateError) return error.errors.flatMap(member => reconciliationDurabilityFailures(member));
+	return reconciliationFailureCode(error) === undefined ? [] : [error];
+}
 type PromptTerminalDiagnostic = {
 	reason?: unknown;
 	loopStopReason?: string;
@@ -1186,6 +1221,11 @@ interface SessionRuntime {
 	/** Aborts and fences side turns while notification delivery is disabled. */
 	disableEphemeralTurns: () => void;
 	waitForGateResolutionQuiescence: () => Promise<void>;
+	/** Awaits durable quiescence of every reconciliation transaction this runtime
+	 *  admitted, joining their producers first. Never swallows evidence: producer
+	 *  and store rejections are returned in `failures`, and a bounded-deadline
+	 *  expiry is returned as `timedOut` (#4743). */
+	drainDurableReconciliation: () => Promise<{ timedOut: boolean; failures: unknown[] }>;
 	trackGateResolution: <T>(resolution: Promise<T>) => Promise<T>;
 	workflowGate?: WorkflowGateEmitter;
 	gatePresentations?: PresentationArbiter;
@@ -2476,6 +2516,10 @@ function sdkControlSurface(
 		discardTerminalAbortSteeringSnapshot?: (token: number) => void;
 		rebindTerminalAbortSteeringSnapshot?: (token: number) => void;
 	},
+	// #4743: registers fire-and-forget reconciliation producers (accepted
+	// executions and post-response publications) so session teardown can join
+	// them before reporting durable quiescence.
+	trackReconciliationProducer?: (producer: Promise<unknown>) => void,
 ): ControlSurface & {
 	cancelPendingPreflights(): Promise<void>;
 	cancelPendingPreflightsForConnection(connectionId: string): Promise<void>;
@@ -2750,6 +2794,10 @@ function sdkControlSurface(
 			}
 			accepting = false;
 			accepted = true;
+			// #4743: an accepted run owns a durable terminal publication when it
+			// settles; teardown joins it via this latch (never-accepted preflights
+			// produce no durable write and stay unjoined by design).
+			trackReconciliationProducer?.(submissionSettled.promise);
 			pendingPreflightCancellations.delete(key);
 			settlePreflight({ status: "accepted" });
 			if (preflightController.signal.aborted) throw cancellationError;
@@ -2775,10 +2823,14 @@ function sdkControlSurface(
 			);
 		} catch (error) {
 			submissionSettled.resolve();
-			if (accepted && !preflightController.signal.aborted) void onPromptFailed(correlation, error);
+			if (accepted && !preflightController.signal.aborted)
+				trackReconciliationProducer?.(Promise.resolve(onPromptFailed(correlation, error)));
 			else settlePreflight({ status: "rejected", error });
 		}
 		if (submission) {
+			// #4743: the continuation may settle long after teardown (a cancelled
+			// preflight stays pending forever by design), so the EXECUTION is never
+			// joined — only its reconciliation publications are tracked below.
 			void submission.then(
 				() => {
 					if (!accepted)
@@ -2791,7 +2843,8 @@ function sdkControlSurface(
 					submissionSettled.resolve();
 				},
 				error => {
-					if (accepted && !preflightController.signal.aborted) void onPromptFailed(correlation, error);
+					if (accepted && !preflightController.signal.aborted)
+						trackReconciliationProducer?.(Promise.resolve(onPromptFailed(correlation, error)));
 					else settlePreflight({ status: "rejected", error });
 					submissionSettled.resolve();
 				},
@@ -3287,6 +3340,10 @@ function sdkControlSurface(
 								if (skillRecon) {
 									await skillRecon.noteAccepted(correlation, trimmedClientRef, { skillName: meta.name });
 									durableSkillAccepted = true;
+									// #4743: a durably accepted skill owns a terminal
+									// publication; teardown joins this latch (bounded by the
+									// drain deadline).
+									trackReconciliationProducer?.(executionSettled.promise);
 								}
 							} catch (error) {
 								onPromptAcceptFailed(correlation);
@@ -3305,6 +3362,11 @@ function sdkControlSurface(
 				settleReject(error);
 				run = Promise.reject(error);
 			}
+			// #4743: the skill execution itself may outlive teardown (a cancelled
+			// preflight never settles by design), so only its reconciliation
+			// PUBLICATIONS are tracked — created synchronously the moment the
+			// execution settles, so a publication fired during teardown is always
+			// joined before the drain reports quiescence.
 			void run.then(
 				result => {
 					if (phase === "pending") {
@@ -3317,12 +3379,14 @@ function sdkControlSurface(
 							...(trimmedClientRef ? { clientRef: trimmedClientRef } : {}),
 						});
 					} else if (durableSkillAccepted && skillRecon) {
-						void skillRecon.noteTransition(correlation, {
-							type: "agent_end",
-							...(typeof result === "string"
-								? { content: { version: 1, type: "text", text: result, byteLength: 0, truncated: false } }
-								: {}),
-						});
+						trackReconciliationProducer?.(
+							skillRecon.noteTransition(correlation, {
+								type: "agent_end",
+								...(typeof result === "string"
+									? { content: { version: 1, type: "text", text: result, byteLength: 0, truncated: false } }
+									: {}),
+							}),
+						);
 					}
 					executionSettled.resolve();
 				},
@@ -3331,10 +3395,12 @@ function sdkControlSurface(
 						releaseAdmission();
 						settleReject(error);
 					} else if (phase === "accepted" && promptOwned && !preflightController.signal.aborted) {
-						void onPromptFailed(correlation, error);
+						trackReconciliationProducer?.(Promise.resolve(onPromptFailed(correlation, error)));
 					}
 					if (durableSkillAccepted && skillRecon && !preflightController.signal.aborted)
-						void skillRecon.noteTransition(correlation, { type: "agent_failed", error });
+						trackReconciliationProducer?.(
+							skillRecon.noteTransition(correlation, { type: "agent_failed", error }),
+						);
 					executionSettled.resolve();
 				},
 			);
@@ -3953,7 +4019,6 @@ export function createNotificationsExtension(
 		controller?: NotificationSessionController;
 		/** Whether this host mode can own the root SDK endpoint. Default: true. */
 		sdkHostModeSupported?: boolean;
-
 		onSdkRequest?: (kind: "control" | "query", connectionId: string, frame: Record<string, unknown>) => void;
 		runBtwTurn?: (question: string, signal: AbortSignal) => Promise<{ replyText: string }>;
 		/** Observes settlement of optional session-branch startup after reconciliation completes. */
@@ -4343,6 +4408,34 @@ export function createNotificationsExtension(
 				logger.warn(`notifications: stop failed: ${String(e)}`);
 			}
 		}
+		// #4743: terminal release must not be reported while a reconciliation
+		// publication this runtime admitted — or the execution that will produce it —
+		// is still in flight. Observe durable quiescence AFTER the endpoint stopped
+		// serving (no new admissions) and BEFORE the terminal release is recorded.
+		// Both failure shapes stay observable as owner-release failures: a drained
+		// window containing a failed write (reconciliation_persist_failed evidence
+		// preserved through the store drain) and a deadline expiry (non-quiescent,
+		// never silently treated as drained).
+		try {
+			const drained = await rt.drainDurableReconciliation();
+			for (const failure of drained.failures) {
+				ownerReleaseFailures.push(failure);
+				logger.warn(`sdk reconciliation publication failed during teardown: ${String(failure)}`);
+			}
+			if (drained.timedOut) {
+				const timeoutError = Object.assign(
+					new Error(
+						`SDK reconciliation drain timed out after ${sdkReconciliationDrainTimeoutMs()}ms; reconciliation state may be non-quiescent.`,
+					),
+					{ code: "reconciliation_drain_timeout" },
+				);
+				ownerReleaseFailures.push(timeoutError);
+				logger.warn("sdk reconciliation drain timed out; proceeding with non-quiescent state");
+			}
+		} catch (e) {
+			ownerReleaseFailures.push(e);
+			logger.warn(`sdk reconciliation drain failed: ${String(e)}`);
+		}
 		lifecycleStartupCapability?.rollback?.recordStop(rt.host.generation, {
 			runtimeRemoved: true,
 			hostStopped: rt.hostStopped && rt.serverStopped,
@@ -4687,6 +4780,26 @@ export function createNotificationsExtension(
 				? createReconciliationStore({ sessionFile, sessionId: String(reconciliationSessionId) })
 				: null;
 		const kindReconciliation = createKindAwareReconciliation({ store: durableStore });
+		// #4743: reconciliation publications and the executions that produce them
+		// are fire-and-forget at their call sites; without joining the PRODUCERS a
+		// drain can observe an empty queue and return just before a still-running
+		// skill enqueues its terminal publication — the teardown race again, by
+		// another route. Every void-ed producer registers here and the teardown
+		// drain joins the set before awaiting store quiescence.
+		const reconciliationProducers = new Set<Promise<unknown>>();
+		const trackReconciliationProducer = (producer: Promise<unknown>): void => {
+			reconciliationProducers.add(producer);
+			// Deliberately a two-arm handler, NOT `finally`: `finally` returns a derived
+			// promise that re-rejects when the producer rejects, and nothing observes
+			// that derived promise — a failed durable write would become an unhandled
+			// rejection and kill the resident process. The two-arm form always resolves,
+			// while the ORIGINAL producer keeps its rejection for the teardown drain to
+			// inspect (#4743).
+			const forget = (): void => {
+				reconciliationProducers.delete(producer);
+			};
+			void producer.then(forget, forget);
+		};
 		// Restart recovery must commit before any prompt is admitted; otherwise a new
 		// admission can race the hydrated full-state replacement.
 		let reconciliationReady: Promise<void> = durableStore ? kindReconciliation.hydrateFromStore() : Promise.resolve();
@@ -6316,6 +6429,8 @@ export function createNotificationsExtension(
 				settleSteer: kindReconciliation.settleSteer,
 			},
 			terminalAbortSeams,
+			// #4743: join fire-and-forget reconciliation producers at teardown.
+			trackReconciliationProducer,
 		);
 		cancelPreflightsForConnection = controlSurface.cancelPendingPreflightsForConnection;
 		const abandonPromptResponse = (connectionId: string, frame: Record<string, unknown>) => {
@@ -6712,6 +6827,7 @@ export function createNotificationsExtension(
 				return { type: "query_response", ...response };
 			},
 		});
+		if (isAutoroutingInactive(api)) markAutoroutingInactive(sdkRuntime.host);
 		host = sdkRuntime.host;
 
 		// Install the runtime before either transport can expose the host. session_start
@@ -6742,6 +6858,66 @@ export function createNotificationsExtension(
 			enableNotifications: () => {},
 			disposeGateTerminalController: () => {},
 			disposeAckRecoveryParticipant: () => {},
+			// #4743: session teardown must observe durable quiescence of every
+			// reconciliation transaction this runtime admitted, INCLUDING the ones
+			// whose producers (accepted skill/prompt executions and their post-
+			// response publications) are still running when teardown starts — an
+			// empty queue proves nothing about work that has not been enqueued yet.
+			// Order: join producers → join kind-aware mutations → join the store
+			// chain (which also surfaces persistence-failure evidence). All under a
+			// finite deadline whose expiry is reported as a NON-QUIESCENT result so
+			// the caller records an owner-release failure instead of silently
+			// treating a hung write as drained.
+			drainDurableReconciliation: async (): Promise<{ timedOut: boolean; failures: unknown[] }> => {
+				// One failed write surfaces twice by design — once as the producer's
+				// rejection and once through the store's failure window — and both carry
+				// the same coded error object, so identity dedupe keeps the reported
+				// evidence at one entry per real failure without dropping distinct ones.
+				const seen = new Set<unknown>();
+				const failures: unknown[] = [];
+				const record = (failure: unknown): void => {
+					if (seen.has(failure)) return;
+					seen.add(failure);
+					failures.push(failure);
+				};
+				const quiescent = (async () => {
+					while (true) {
+						const producers = [...reconciliationProducers];
+						// `allSettled` joins ALL producers even when one rejects, but its
+						// results are INSPECTED: a rejected terminal publication is evidence
+						// the caller must see, not something the join consumes before the
+						// store's own failure window opens (#4743).
+						for (const settled of await Promise.allSettled(producers))
+							if (settled.status === "rejected") record(settled.reason);
+						// Both drains below surface store-recorded persistence failures by
+						// rejecting; collect and keep draining so one failed write cannot
+						// hide a later producer's work from the join.
+						try {
+							await kindReconciliation.drain();
+						} catch (e) {
+							record(e);
+						}
+						// Direct store writes (terminal-scope response-state advance) bypass
+						// the kind-aware chain; join them too.
+						try {
+							await durableStore?.drain?.();
+						} catch (e) {
+							record(e);
+						}
+						await Bun.sleep(0);
+						if ([...reconciliationProducers].every(producer => producers.includes(producer))) {
+							return { timedOut: false, failures };
+						}
+					}
+				})();
+				return await Promise.race([
+					quiescent,
+					// A deadline expiry reports the failures observed SO FAR alongside the
+					// timeout: evidence already collected must not be dropped because the
+					// remaining wait ran out.
+					Bun.sleep(sdkReconciliationDrainTimeoutMs()).then(() => ({ timedOut: true, failures })),
+				]);
+			},
 			disposeGateEmitterListener: () => {},
 			trackGateResolution,
 			waitForGateResolutionQuiescence: async () => {
@@ -8889,6 +9065,11 @@ export function createNotificationsExtension(
 			return false;
 		});
 		if (startupWasPending) void settledControllerStop;
+		// #4743: a durability failure has no later retry cycle at terminal quit, so it
+		// must reach the teardown owner instead of being logged into silence. Held
+		// until the controller queue below is joined so the failure never truncates
+		// the rest of teardown.
+		let reconciliationTeardownFailure: Error | undefined;
 		try {
 			await stopSession(id);
 		} catch (error) {
@@ -8898,11 +9079,27 @@ export function createNotificationsExtension(
 			// shutdown. On terminal quit there is no later retry cycle, so log at
 			// error severity (matching the postmortem cleanup precedent).
 			logger.error(`notifications: SDK notification runtime cleanup failed: ${String(error)}`);
+			// Endpoint-release failures (host/server stop) stay swallowed: they are
+			// retryable through the retained cleanupRetries entry and observable in
+			// lifecycle rollback proof. Reconciliation durability failures are not —
+			// a committed publication that never reached disk, or a drain whose
+			// deadline expired, is state loss the owner must be told about.
+			const durable = reconciliationDurabilityFailures(error);
+			if (durable.length > 0)
+				reconciliationTeardownFailure = Object.assign(
+					new Error(
+						`SDK reconciliation teardown failed for session ${id}: ${durable
+							.map(failure => reconciliationFailureCode(failure) ?? "unknown")
+							.join(", ")}.`,
+					),
+					{ code: "sdk_reconciliation_teardown_failed", failures: durable },
+				);
 		}
 		// Keep shutdown nonblocking only while native startup is genuinely
 		// pending (the `/notify on` path); otherwise await the controller queue so
 		// completed-start reconciliation and its replacement-token cleanup are
 		// joined before lifecycle shutdown returns.
 		if (!startupWasPending) await settledControllerStop;
+		if (reconciliationTeardownFailure) throw reconciliationTeardownFailure;
 	});
 }

package/src/sdk/bus/kind-aware-reconciliation.ts

@@ -89,6 +89,8 @@ export interface KindAwareReconciliation {
 	activeCount(kind: ReconciliationKind): number;
 	/** Hydrate from durable store (call once at session host start). */
 	hydrateFromStore(): Promise<void>;
+	/** Await quiescence of every admitted mutation and the durable store (#4743). */
+	drain(): Promise<void>;
 }
 
 export function createKindAwareReconciliation(
@@ -534,6 +536,19 @@ export function createKindAwareReconciliation(
 		);
 		await pending;
 	};
+	const drain = async (): Promise<void> => {
+		while (true) {
+			const observed = mutationChain;
+			await observed;
+			// A noteTransition/noteAccepted admitted in a later microtask must still
+			// be joined before teardown reports durable quiescence (#4743).
+			await Bun.sleep(0);
+			if (mutationChain === observed) {
+				await store?.drain?.();
+				return;
+			}
+		}
+	};
 
 	return {
 		admit,
@@ -551,6 +566,7 @@ export function createKindAwareReconciliation(
 		reserveSteer,
 		settleSteer,
 		lookupSteer,
+		drain,
 	};
 }
 

package/src/sdk/bus/reconciliation-store.ts

@@ -625,13 +625,21 @@ export function createReconciliationStore(options: {
 	let terminalMemory: DurableTerminalScopeRecord[] = [];
 	let terminalKeyMemory: EvictedTerminalKeyEntry[] = [];
 	let chain: Promise<void> = Promise.resolve();
+	// #4743: transaction tails neutralize rejection on the serialization chain and
+	// publications are enqueued fire-and-forget, so a failed write has no observer
+	// at all. Retain every persistence failure until a drain reports it, then clear
+	// it: surface-once means no failure is lost (even one that landed before
+	// teardown began) and no later drain is permanently poisoned by a failure an
+	// owner has already been told about.
+	let unreportedPersistFailures: unknown[] = [];
 
 	const writeAtomic = async (document: ReconciliationStoreDocument): Promise<void> => {
 		if (!filePath) return;
 		const directory = path.dirname(filePath);
-		await fileFs.mkdir(directory, { recursive: true, mode: 0o700 });
-		const temporary = `${filePath}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`;
+		let temporary: string | undefined;
 		try {
+			await fileFs.mkdir(directory, { recursive: true, mode: 0o700 });
+			temporary = `${filePath}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`;
 			await fileFs.writeFile(temporary, `${JSON.stringify(document)}\n`, { mode: 0o600 });
 			try {
 				const handle = await fileFs.open(temporary, "r+");
@@ -645,10 +653,14 @@ export function createReconciliationStore(options: {
 			}
 			await fileFs.rename(temporary, filePath);
 		} catch (error) {
-			await fileFs.unlink(temporary).catch(() => {});
-			throw Object.assign(error instanceof Error ? error : new Error("reconciliation persist failed"), {
+			// Every persistence-path failure (mkdir included) is evidence a drained
+			// window must surface, never silently treat as quiescent (#4743).
+			if (temporary !== undefined) await fileFs.unlink(temporary).catch(() => {});
+			const coded = Object.assign(error instanceof Error ? error : new Error("reconciliation persist failed"), {
 				code: "reconciliation_persist_failed",
 			});
+			unreportedPersistFailures.push(coded);
+			throw coded;
 		}
 	};
 
@@ -834,7 +846,17 @@ export function createReconciliationStore(options: {
 				// a later microtask. Yield once and require the queue tail to remain
 				// stable before reporting durable quiescence.
 				await Bun.sleep(0);
-				if (chain === observed) return;
+				if (chain === observed) {
+					// Transaction tails neutralize rejections on `chain`, so a failed
+					// publication would otherwise be indistinguishable from a completed
+					// one. Claim the retained evidence (clearing it so exactly one drain
+					// reports each failure) and reject instead of claiming quiescence.
+					if (unreportedPersistFailures.length === 0) return;
+					const claimed = unreportedPersistFailures;
+					unreportedPersistFailures = [];
+					if (claimed.length === 1) throw claimed[0];
+					throw new AggregateError(claimed, "Reconciliation persistence failed during the drained window.");
+				}
 			}
 		},
 		loadTerminalScopes: async () => {

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -273,8 +273,15 @@ export const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * reaction settlement for Telegram notification delivery (#4528).
  * Generation 169 delivers every ring-positioned session event live through the
  * bounded, capability-gated directed subscriber leg used by replay.
+ * Generation 172 fences the SessionRouter idle-poll/change-stamp rollout (#4689).
+ * The daemon constructs a SessionRouter, and the router's idle tick no longer
+ * re-acquires the machine-global session-index lock on every 2s pass: unchanged
+ * polls are stat-only and staleness retirement moved to a 30s sweep. A daemon
+ * still running the pre-#4689 router keeps the old hot polling loop and its
+ * lock contention, so an already-running owner must be replaced rather than
+ * retained across this upgrade.
  */
-export const DAEMON_GENERATION = 171;
+export const DAEMON_GENERATION = 172;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
@@ -360,5 +367,8 @@ export const DAEMON_GENERATION = 171;
  * Epoch 85 removes direct relay attachment and prohibits lifecycle controls on every adapter.
  * Epoch 86 removes public discovery/client exports and retires cross-process raw transports.
  * Epoch 87 preserves accepted Telegram delivery ambiguity and advances poisoned poll cursors.
+ * Epoch 88 requires the #4689 SessionRouter idle-poll contract: generation alone
+ * does not force replacement, so the serving boundary advances to guarantee a
+ * pre-#4689 daemon cannot keep serving with the old per-tick locked rescan.
  */
-export const SERVING_EPOCH = 87;
+export const SERVING_EPOCH = 88;