@gajae-code/coding-agent 0.17.2 → 0.17.5

package/src/sdk/bus/telegram-daemon-cli.ts

@@ -11,6 +11,7 @@ import {
 	isTelegramComplete,
 	type NotificationSettingsReader,
 	parseNotificationSettingsSnapshot,
+	tokenFingerprint,
 } from "./config";
 import { daemonPaths, HEARTBEAT_TTL_MS } from "./daemon-paths";
 import { doctorDaemonIdentityMatches, doctorDaemonOccupancySettled } from "./doctor-daemon-restart";
@@ -317,6 +318,8 @@ export async function runDaemonInternal(argv: string[], deps: RunDaemonInternalD
 	const settings = await resolveDaemonSettings(resolvedAgentDir, deps);
 	const cfg = getNotificationConfig(settings);
 	if (!isProviderEffectivelyEnabled(cfg, "telegram") || !isTelegramComplete(cfg)) return;
+	const initialTokenFingerprint = tokenFingerprint(cfg.botToken);
+	const initialChatId = cfg.chatId;
 	// Startup hygiene: reclaim inert quarantine/staging debris left by crashed
 	// writers so the notifications dir cannot grow unboundedly and slow every
 	// later endpoint scan. Never awaited by startup; a rejection is logged and
@@ -425,6 +428,7 @@ export async function runDaemonInternal(argv: string[], deps: RunDaemonInternalD
 		toolActivity: cfg.toolActivity,
 		topics: cfg.topics,
 		btw: cfg.btw,
+		keepAliveWithoutAttachments: true,
 		pid: deps.processPid ?? process.pid,
 		control: createDaemonControlHooks(settings as Settings),
 		topicRegistryAuthority,
@@ -525,6 +529,31 @@ export async function runDaemonInternal(argv: string[], deps: RunDaemonInternalD
 				// running daemon — a stale or reused PID could match, killing a
 				// foreign process. The stall watchdog below handles non-progress.
 			}
+			// The daemon's startup settings object is intentionally lightweight and
+			// does not watch the config file. Re-resolve it only after the complete
+			// owner proof above. Unknown configuration cannot authorize continued
+			// command ingress with startup credentials.
+			try {
+				const refreshedSettings = await resolveDaemonSettings(resolvedAgentDir, deps);
+				if (!watchdogActive || stopRequested) return;
+				const refreshedCfg = getNotificationConfig(refreshedSettings);
+				if (
+					!isProviderEffectivelyEnabled(refreshedCfg, "telegram") ||
+					!isTelegramComplete(refreshedCfg) ||
+					tokenFingerprint(refreshedCfg.botToken) !== initialTokenFingerprint ||
+					refreshedCfg.chatId !== initialChatId
+				) {
+					stopRequested = true;
+					daemon.requestStop("stop");
+					return;
+				}
+			} catch {
+				if (!watchdogActive || stopRequested) return;
+				stopRequested = true;
+				daemon.requestStop("stop");
+				logger.warn("telegram-daemon: configuration verification failed; stopping command ingress");
+				return;
+			}
 			if (lastHeartbeatAt === undefined || heartbeatAt !== lastHeartbeatAt) {
 				lastHeartbeatAt = heartbeatAt;
 				stalledSince = now();
@@ -536,8 +565,8 @@ export async function runDaemonInternal(argv: string[], deps: RunDaemonInternalD
 				daemon.requestStop("stop");
 			}
 		} catch {
-			// Missing, malformed, or temporarily unreadable state is ambiguous.
-			// Stop only on positive supersession or observed non-progress.
+			// Ambiguous ownership state does not authorize owner replacement.
+			// Configuration verification has its own fail-closed boundary above.
 		} finally {
 			watchdogTickInFlight = false;
 		}

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -290,8 +290,14 @@ export const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * first refusal, so an owner still running the generation-178 router keeps
  * killing a session's mirroring after one transient rejection and must be
  * replaced across this upgrade.
+ * Generation 190 acknowledges the protected prompt-deadline boundary change,
+ * so generation-189 owners are replaced instead of retaining the old path.
+ * Generation 192 makes session-host liveness a reference-counted work lease,
+ * so generation-191 owners cannot reap hosts with queued or promoted work.
+ * Generation 193 gates streamed content on negotiated observer capabilities,
+ * so existing owners are replaced before exposing the new observer path.
  */
-export const DAEMON_GENERATION = 187;
+export const DAEMON_GENERATION = 194;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7

package/src/sdk/bus/telegram-daemon.ts

@@ -4087,6 +4087,11 @@ export interface TelegramDaemonOptions {
 	clearIntervalImpl?: typeof clearInterval;
 	btw?: { enabled: boolean };
 	idleTimeoutMs?: number;
+	/**
+	 * Standalone daemon owners keep Telegram command ingress alive while no SDK
+	 * endpoints are attached. Embedded/test daemons retain finite-idle behavior.
+	 */
+	keepAliveWithoutAttachments?: boolean;
 	/** TTL for durable topic-adoption intents (default 10 minutes). Observed, not a fixed contract. */
 	adoptionIntentTtlMs?: number;
 	pid?: number;
@@ -5256,6 +5261,7 @@ export class TelegramNotificationDaemon {
 		this.#frameRouter = this.#createFrameRouter();
 		this.#attachmentRouter = new SessionRouter({
 			agentDir: opts.settings.getAgentDir(),
+			observer: true,
 			deps: {
 				...opts.routerDeps,
 				onNotificationSubscription: subscription => this.#onAttachment(subscription),
@@ -12963,9 +12969,10 @@ export class TelegramNotificationDaemon {
 				const idleElapsed = this.runtime.now() - idleSince >= (this.opts.idleTimeoutMs ?? 60_000);
 				if (this.sessions.size > 0) {
 					idleSince = this.runtime.now();
-				} else if (idleElapsed) {
-					// Zero sessions past the idle window: exit so the owner does not run
-					// forever. An active session resets the idle window above.
+				} else if (!this.opts.keepAliveWithoutAttachments && idleElapsed) {
+					// Zero sessions past the idle window: embedded/test owners exit so
+					// they do not run forever. Standalone owners keep this command
+					// receiver alive until control or owner fencing asks them to stop.
 					this.requestStop("idle_timeout");
 					break;
 				}

package/src/sdk/cli/master-cli.ts

@@ -9,22 +9,25 @@
  */
 import { randomUUID } from "node:crypto";
 import * as path from "node:path";
-import { getAgentDir } from "@gajae-code/utils";
+import { replaceTabs, truncateToWidth } from "@gajae-code/tui";
+import { getAgentDir, sanitizeDisplayLine } from "@gajae-code/utils";
+import { PublicCommandFailure } from "../../cli/public-command-errors";
 import { type IndexedSession, isSessionAuthorityEligible, SessionIndex } from "../broker/session-index";
 import { SdkClientError } from "../client";
 import { dispatchSpawnGlobal } from "../lifecycle/broker-client";
+import { sdkPublicFailure } from "./session-cli";
 
 const MASTER_CAPABILITY_ENV = "GJC_MASTER_CAPABILITY";
 const MASTER_SESSION_ENV = "GJC_MASTER_OWNER_SESSION_ID";
 const SPAWN_TIMEOUT_MS = 120_000;
 
-export class SdkMasterCliError extends Error {
+export class SdkMasterCliError extends PublicCommandFailure {
 	constructor(
 		readonly code: string,
-		message: string,
+		_message: string,
 		readonly exitCode: 1 | 2 = 1,
 	) {
-		super(message);
+		super(sdkPublicFailure(exitCode === 2 ? "usage" : code, undefined, "pre-effect").input);
 		this.name = "SdkMasterCliError";
 	}
 }
@@ -46,8 +49,6 @@ export interface SdkSpawnRendered {
 	sessionId?: string;
 	substrateKind?: string;
 	seed?: { phase?: string; clientRef?: string; commandId?: string; turnId?: string; status?: string };
-	idempotencyKey?: string;
-	error?: { code: string; message: string };
 }
 
 export interface SdkSpawnDependencies {
@@ -143,8 +144,15 @@ function opaque(value: unknown): string | undefined {
 	return typeof value === "string" && value.length > 0 && value.length <= 512 ? value : undefined;
 }
 
+function safeSpawnText(value: string): string {
+	return truncateToWidth(replaceTabs(sanitizeDisplayLine(value).replaceAll(/[\u2028\u2029]/gu, " ")), 512);
+}
+
 /** Projects an arbitrary Broker response onto the allowlisted render shape. */
-export function safeSpawnRender(response: unknown): { rendered: SdkSpawnRendered; exitCode: 0 | 1 } {
+export function safeSpawnRender(
+	response: unknown,
+	idempotencyKey?: string,
+): { rendered: SdkSpawnRendered; exitCode: 0 } {
 	const outer = record(response);
 	if (outer?.ok === true) {
 		const result = record(outer.result);
@@ -171,31 +179,29 @@ export function safeSpawnRender(response: unknown): { rendered: SdkSpawnRendered
 		};
 	}
 	const error = record(outer?.error);
-	const code = opaque(error?.code) ?? "spawn_failed";
-	const retryIdempotencyKey = code === "uncertain_after_send" ? opaque(error?.idempotencyKey) : undefined;
-	// Error messages are Broker-typed and never quote request input; an uncertain
-	// post-send result may additionally expose its non-secret replay key.
-	const message =
-		typeof error?.message === "string" && error.message.length <= 512 ? error.message : "session.spawn failed";
-	return {
-		rendered: {
-			code,
-			...(retryIdempotencyKey === undefined ? {} : { idempotencyKey: retryIdempotencyKey }),
-			error: { code, message },
-		},
-		exitCode: 1,
-	};
+	const result = record(outer?.result);
+	const seed = record(result?.seed);
+	const failure = sdkPublicFailure(typeof error?.code === "string" ? error.code : "operation_failed", error);
+	const resultReferences = sdkPublicFailure("operation_failed", result).input.references ?? [];
+	const seedReferences = sdkPublicFailure("operation_failed", seed).input.references ?? [];
+	throw new PublicCommandFailure({
+		...failure.input,
+		references: [
+			...(failure.input.references ?? []),
+			...resultReferences,
+			...seedReferences,
+			...(idempotencyKey === undefined ? [] : [{ kind: "idempotencyKey" as const, value: idempotencyKey }]),
+		],
+	});
 }
 
 export function renderSpawnTable(rendered: SdkSpawnRendered): string {
-	const lines = [`Result: ${rendered.code}`];
-	if (rendered.claimId) lines.push(`Claim: ${rendered.claimId}`);
-	if (rendered.sessionId) lines.push(`Child session: ${rendered.sessionId}`);
-	if (rendered.substrateKind) lines.push(`Substrate: ${rendered.substrateKind}`);
-	if (rendered.seed?.phase) lines.push(`Seed phase: ${rendered.seed.phase}`);
-	if (rendered.seed?.status) lines.push(`Seed status: ${rendered.seed.status}`);
-	if (rendered.error) lines.push(`Error: ${rendered.error.code}: ${rendered.error.message}`);
-	if (rendered.idempotencyKey) lines.push(`Retry idempotency key: ${rendered.idempotencyKey}`);
+	const lines = [`Result: ${safeSpawnText(rendered.code)}`];
+	if (rendered.claimId) lines.push(`Claim: ${safeSpawnText(rendered.claimId)}`);
+	if (rendered.sessionId) lines.push(`Child session: ${safeSpawnText(rendered.sessionId)}`);
+	if (rendered.substrateKind) lines.push(`Substrate: ${safeSpawnText(rendered.substrateKind)}`);
+	if (rendered.seed?.phase) lines.push(`Seed phase: ${safeSpawnText(rendered.seed.phase)}`);
+	if (rendered.seed?.status) lines.push(`Seed status: ${safeSpawnText(rendered.seed.status)}`);
 
 	return lines.join("\n");
 }
@@ -207,7 +213,7 @@ export function renderSpawnTable(rendered: SdkSpawnRendered): string {
 export async function runSdkSpawn(
 	args: SdkSpawnArgs,
 	dependencies: Partial<SdkSpawnDependencies> = {},
-): Promise<{ rendered: SdkSpawnRendered; exitCode: 0 | 1 }> {
+): Promise<{ rendered: SdkSpawnRendered; exitCode: 0 }> {
 	const deps: SdkSpawnDependencies = {
 		env: dependencies.env ?? process.env,
 		dispatch: dependencies.dispatch ?? brokerSpawnDispatch,
@@ -246,14 +252,19 @@ export async function runSdkSpawn(
 			},
 			idempotencyKey,
 		);
-		return safeSpawnRender(response);
+		return safeSpawnRender(response, idempotencyKey);
 	} catch (error) {
-		if (error instanceof SdkClientError && error.code === "uncertain_after_send") {
-			return safeSpawnRender({
-				ok: false,
-				error: { code: error.code, message: error.message, idempotencyKey },
+		if (error instanceof PublicCommandFailure) throw error;
+		if (error instanceof SdkClientError) {
+			const failure = sdkPublicFailure(error.code, error.details);
+			throw new PublicCommandFailure({
+				...failure.input,
+				references: [...(failure.input.references ?? []), { kind: "idempotencyKey", value: idempotencyKey }],
 			});
 		}
-		throw error;
+		throw new PublicCommandFailure({
+			kind: "operation_failed",
+			references: [{ kind: "idempotencyKey", value: idempotencyKey }],
+		});
 	}
 }

package/src/sdk/cli/rows.ts

@@ -90,27 +90,50 @@ export function tailItemKey(item: SdkTailItemV1): string {
 	return `${item.kind}\u0000${JSON.stringify(item.payload)}`;
 }
 
-/** Holds positioned live frames until the checkpoint can stamp their authoritative revision. */
+/**
+ * Holds positioned live frames until the checkpoint can stamp their
+ * authoritative revision, and keeps stamping after it.
+ *
+ * A positioned frame (generation+seq) that carries no revision after the
+ * checkpoint used to abort the whole tail with protocol_error. The host emits
+ * such frames whenever its transcript provider is momentarily unavailable
+ * (`eventRevision` returns undefined), which is ordinary during a turn - and
+ * one such frame turned a live, answering session into one no consumer could
+ * observe: every poll failed, the caller held the turn, and after five minutes
+ * reported it failed while the answer sat in the transcript (2026-09-17/18,
+ * five sessions). A frame is never a reason to lose the tail.
+ *
+ * The stamp is the LATEST revision observed, not the checkpoint's: revisions
+ * advance during a turn, and lifecycle order is compared revision-first. A
+ * terminal frame stamped with the initial checkpoint revision would sort
+ * before a start that carried a later one, and `--until-idle` would wait on a
+ * turn that had already ended.
+ */
 export class TailRevisionBuffer {
 	#pending: SdkTailItemV1[] = [];
-	#resolved = false;
+	#revision: number | undefined;
 
 	push(item: SdkTailItemV1): SdkTailItemV1[] {
-		if (item.revision !== undefined || item.generation === undefined || item.seq === undefined) return [item];
-		if (!this.#resolved) {
+		if (item.revision !== undefined) {
+			if (this.#revision === undefined || item.revision > this.#revision) this.#revision = item.revision;
+			return [item];
+		}
+		if (item.generation === undefined || item.seq === undefined) return [item];
+		if (this.#revision === undefined) {
 			this.#pending.push(item);
 			return [];
 		}
-		throw new Error("A positioned live tail item arrived without an authoritative revision after checkpoint.");
+		item.revision = this.#revision;
+		return [item];
 	}
 
 	resolve(revision: number): SdkTailItemV1[] {
 		if (!Number.isSafeInteger(revision) || revision < 0)
 			throw new Error("Tail revision must be a non-negative integer.");
-		this.#resolved = true;
+		if (this.#revision === undefined || revision > this.#revision) this.#revision = revision;
 		const pending = this.#pending;
 		this.#pending = [];
-		for (const item of pending) item.revision = revision;
+		for (const item of pending) item.revision = this.#revision;
 		return pending;
 	}
 }