@gajae-code/coding-agent 0.18.11 → 0.18.12

package/src/sdk/bus/index.ts

@@ -132,7 +132,7 @@ import {
 	syntheticModelInputError,
 	syntheticNamespaceCollision,
 } from "../model-profile-model";
-import { flushWorktreeOnPromptDeadline } from "../prompt-deadline-flush";
+import { autosaveWorktreeOnPromptDeadline, deadlineFlushSuppressed } from "../prompt-deadline-flush";
 import {
 	createPromptDeadlineLease,
 	isAttributableProgressEventType,
@@ -2659,6 +2659,10 @@ function sdkControlSurface(
 		// the session-wide preflight seam must not be invoked while another
 		// connection's active preflight could be cancelled by it (review P1).
 		noOtherConnectionPreflights?: () => boolean,
+		// True only for an operator terminal abort that the broker control route already
+		// authorized (`TerminalAbortInput.operator`, which a public SDK caller cannot grant):
+		// it addresses the session's active turn, not the requesting connection's own prompt.
+		operatorAuthorized?: boolean,
 	) => Promise<
 		| {
 				ok: true;
@@ -3178,6 +3182,9 @@ function sdkControlSurface(
 				// invoking it (review thread P1).
 				() =>
 					![...pendingPreflightCancellations.values()].some(entry => entry.connectionId !== requesterConnectionId),
+				// Broker-authorized operator authority is the one case where the abort
+				// addresses a turn another connection submitted (see the parameter note).
+				input.operator === true,
 			);
 			// Preflight cancellation happens ONLY for a NEWLY ADMITTED abort,
 			// after the durable admission/replay decision inside
@@ -4281,6 +4288,34 @@ export function boundedCorrelatedAgentEndFrame(frame: Record<string, unknown>):
 	};
 }
 
+/** Connection-scoped identity of a queued prompt submission an abort may address. */
+export interface TerminalAbortSubmissionScope {
+	connectionId?: string;
+	terminal: boolean;
+}
+
+/**
+ * Whether a terminal abort addresses this prompt submission.
+ *
+ * An ordinary abort is scoped to the requesting connection's own prompt: `connectionId`
+ * identifies the connection that submitted it, and a submission that already reached a
+ * terminal state is never addressed. Broker-authorized operator authority
+ * (`TerminalAbortInput.operator`, granted only through the broker control route) is the
+ * documented exception — "operator authority changes only connection ownership, never
+ * those settlement proofs" — so it addresses the session's submission even when another
+ * connection submitted it. Without that override every operator abort issued over a
+ * second connection (the SDK client case, where each request is its own connection)
+ * reported no_active_turn while the turn was still running.
+ */
+export function terminalAbortAddressesSubmission(input: {
+	connectionId: string | undefined;
+	operatorAuthorized: boolean;
+	submission: TerminalAbortSubmissionScope;
+}): boolean {
+	if (input.submission.terminal) return false;
+	return input.operatorAuthorized || input.submission.connectionId === input.connectionId;
+}
+
 export function createNotificationsExtension(
 	api: ExtensionAPI,
 	options: {
@@ -6408,21 +6443,12 @@ export function createNotificationsExtension(
 				if (
 					winner.kind === "failed" &&
 					winner.code === "prompt_deadline_exceeded" &&
-					settings?.get("sdk.flushWorktreeOnDeadline") !== false
+					!deadlineFlushSuppressed(settings)
 				) {
-					// `has` is true only for a value the user actually wrote, so this
-					// separates an explicit opt-in from the schema default. The flush only
-					// honours the default inside a linked worktree the session owns.
-					const configured = settings?.get("sdk.flushWorktreeOnDeadline");
-					const hasExplicitSetting =
-						typeof settings?.has === "function"
-							? settings.has("sdk.flushWorktreeOnDeadline")
-							: configured === true;
-					const explicitOptIn = hasExplicitSetting === true && configured === true;
+					// Same opt-in as the session runtime: user/global config or a runtime
+					// override, never a project `.gjc` file or the schema default.
 					await runBoundedDeadlineFlush(signal =>
-						flushWorktreeOnPromptDeadline(ctx.cwd, {
-							agentDir: settings?.getAgentDir(),
-							explicitOptIn,
+						autosaveWorktreeOnPromptDeadline(ctx.cwd, settings, {
 							isCurrent: () =>
 								deadlineAttemptStatus(promptSubmissionKey(correlation), submission, deadlineAttempt) ===
 								"current",
@@ -6736,7 +6762,14 @@ export function createNotificationsExtension(
 				}
 				return { aborted: true, disposition: "cancelled" as const };
 			},
-			async (connectionId, scope, idempotencyKey, preflightCancel, noOtherConnectionPreflights) => {
+			async (
+				connectionId,
+				scope,
+				idempotencyKey,
+				preflightCancel,
+				noOtherConnectionPreflights,
+				operatorAuthorized = false,
+			) => {
 				// Capture the steering snapshot at ADMISSION (before the durable
 				// marker transaction): client steering admitted while the abort
 				// is in flight classifies as post-snapshot and is preserved at
@@ -7098,9 +7131,9 @@ export function createNotificationsExtension(
 						return "failed";
 					}
 				};
-				let active = [...promptSubmissions.entries()].find(
-					([, submission]) => submission.connectionId === connectionId && !submission.terminal,
-				);
+				const addresses = (submission: TerminalAbortSubmissionScope): boolean =>
+					terminalAbortAddressesSubmission({ connectionId, operatorAuthorized, submission });
+				let active = [...promptSubmissions.entries()].find(([, submission]) => addresses(submission));
 				if (!active) {
 					// DURABLY reserve the key even for a no-active-turn abort: the
 					// generic idempotency cache is in-memory only, so after restart
@@ -7130,9 +7163,7 @@ export function createNotificationsExtension(
 					// and the durable no-effect row would block a same-key retry from
 					// stopping it — fall through to the pre-run / active fencing path
 					// when a submission now exists (review thread P1).
-					active = [...promptSubmissions.entries()].find(
-						([, submission]) => submission.connectionId === connectionId && !submission.terminal,
-					);
+					active = [...promptSubmissions.entries()].find(([, submission]) => addresses(submission));
 					if (!active) {
 						// Close the remaining acceptance race: cancel the requester's
 						// preflights HERE, in the same synchronous region as the

package/src/sdk/bus/reconciliation-store.ts

@@ -670,11 +670,22 @@ export interface ReconciliationStore {
 	delete(): Promise<void>;
 }
 
+export interface ReconciliationStoreInstrumentationEvent {
+	at: number;
+	phase: "enqueued" | "started" | "completed" | "failed";
+	operation?: string;
+	substep?: string;
+	error?: string;
+	/** Detailed information about lock acquisition, promise identity, db state, etc. */
+	detail?: string;
+}
+
 export function createReconciliationStore(options: {
 	sessionFile: string | null | undefined;
 	sessionId: string;
 	fs?: ReconciliationStoreFs;
 	now?: () => number;
+	onInstrumentationForTests?: (event: ReconciliationStoreInstrumentationEvent) => void;
 }): ReconciliationStore {
 	const fileFs = options.fs ?? nodeFs;
 	const now = options.now ?? Date.now;
@@ -701,20 +712,56 @@ export function createReconciliationStore(options: {
 		const directory = path.dirname(filePath);
 		let temporary: string | undefined;
 		try {
+			try {
+				options.onInstrumentationForTests?.({ at: Date.now(), phase: "started", substep: "mkdir" });
+			} catch {}
 			await fileFs.mkdir(directory, { recursive: true, mode: 0o700 });
+			try {
+				options.onInstrumentationForTests?.({ at: Date.now(), phase: "completed", substep: "mkdir" });
+			} catch {}
 			temporary = `${filePath}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`;
+			try {
+				options.onInstrumentationForTests?.({ at: Date.now(), phase: "started", substep: "writeFile" });
+			} catch {}
 			await fileFs.writeFile(temporary, `${JSON.stringify(document)}\n`, { mode: 0o600 });
 			try {
+				options.onInstrumentationForTests?.({ at: Date.now(), phase: "completed", substep: "writeFile" });
+			} catch {}
+			try {
+				try {
+					options.onInstrumentationForTests?.({ at: Date.now(), phase: "started", substep: "open" });
+				} catch {}
 				const handle = await fileFs.open(temporary, "r+");
 				try {
+					options.onInstrumentationForTests?.({ at: Date.now(), phase: "completed", substep: "open" });
+				} catch {}
+				try {
+					try {
+						options.onInstrumentationForTests?.({ at: Date.now(), phase: "started", substep: "sync" });
+					} catch {}
 					await handle.sync();
+					try {
+						options.onInstrumentationForTests?.({ at: Date.now(), phase: "completed", substep: "sync" });
+					} catch {}
 				} finally {
+					try {
+						options.onInstrumentationForTests?.({ at: Date.now(), phase: "started", substep: "close" });
+					} catch {}
 					await handle.close();
+					try {
+						options.onInstrumentationForTests?.({ at: Date.now(), phase: "completed", substep: "close" });
+					} catch {}
 				}
 			} catch {
 				// fsync optional on some fs seams
 			}
+			try {
+				options.onInstrumentationForTests?.({ at: Date.now(), phase: "started", substep: "rename" });
+			} catch {}
 			await fileFs.rename(temporary, filePath);
+			try {
+				options.onInstrumentationForTests?.({ at: Date.now(), phase: "completed", substep: "rename" });
+			} catch {}
 		} catch (error) {
 			// Every persistence-path failure (mkdir included) is evidence a drained
 			// window must surface, never silently treat as quiescent (#4743).
@@ -723,6 +770,9 @@ export function createReconciliationStore(options: {
 				code: "reconciliation_persist_failed",
 			});
 			unreportedPersistFailures.push(coded);
+			try {
+				options.onInstrumentationForTests?.({ at: Date.now(), phase: "failed", error: coded.message });
+			} catch {}
 			throw coded;
 		}
 	};
@@ -795,7 +845,26 @@ export function createReconciliationStore(options: {
 	const transact = async (
 		mutator: (records: DurableReconciliationRecord[]) => DurableReconciliationRecord[],
 	): Promise<void> => {
+		const promiseId = `reconcil-transact-${randomUUID().slice(0, 8)}`;
+		const enqueueTime = Date.now();
 		const run = async () => {
+			const lockWaitMs = Date.now() - enqueueTime;
+			try {
+				options.onInstrumentationForTests?.({
+					at: enqueueTime,
+					phase: "enqueued",
+					operation: "transact",
+					detail: `promise=${promiseId}`,
+				});
+			} catch {}
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "started",
+					operation: "transact",
+					detail: `promise=${promiseId} lock-wait=${lockWaitMs}ms`,
+				});
+			} catch {}
 			const next = mutator(memory.map(r => ({ ...r })));
 			await writeAtomic({
 				version: RECONCILIATION_STORE_VERSION,
@@ -805,19 +874,55 @@ export function createReconciliationStore(options: {
 				...(terminalKeyMemory.length > 0 ? { evictedTerminalKeys: terminalKeyMemory } : {}),
 			});
 			memory = next;
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "completed",
+					operation: "transact",
+					detail: `promise=${promiseId}`,
+				});
+			} catch {}
 		};
 		const pending = chain.then(run, run);
-		chain = pending.then(
+		const settled = pending.then(
 			() => undefined,
 			() => undefined,
 		);
-		await pending;
+		chain = settled;
+		try {
+			await pending;
+		} catch (error) {
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "failed",
+					operation: "transact",
+					detail: `promise=${promiseId} lock-wait=${Date.now() - enqueueTime}ms`,
+					error: error instanceof Error ? error.message : String(error),
+				});
+			} catch {}
+			throw error;
+		}
 	};
 
 	const transactTerminalScopes = async (
 		mutator: (scopes: DurableTerminalScopeRecord[]) => DurableTerminalScopeRecord[],
 	): Promise<void> => {
 		const run = async () => {
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "enqueued",
+					operation: "transactTerminalScopes",
+				});
+			} catch {}
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "started",
+					operation: "transactTerminalScopes",
+				});
+			} catch {}
 			const next = mutator(terminalMemory.map(s => ({ ...s })));
 			await writeAtomic({
 				version: RECONCILIATION_STORE_VERSION,
@@ -827,13 +932,33 @@ export function createReconciliationStore(options: {
 				...(terminalKeyMemory.length > 0 ? { evictedTerminalKeys: terminalKeyMemory } : {}),
 			});
 			terminalMemory = next;
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "completed",
+					operation: "transactTerminalScopes",
+				});
+			} catch {}
 		};
 		const pending = chain.then(run, run);
-		chain = pending.then(
+		const settled = pending.then(
 			() => undefined,
 			() => undefined,
 		);
-		await pending;
+		chain = settled;
+		try {
+			await pending;
+		} catch (error) {
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "failed",
+					operation: "transactTerminalScopes",
+					error: error instanceof Error ? error.message : String(error),
+				});
+			} catch {}
+			throw error;
+		}
 	};
 
 	const transactTerminalState = async (
@@ -843,6 +968,20 @@ export function createReconciliationStore(options: {
 		},
 	): Promise<void> => {
 		const run = async () => {
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "enqueued",
+					operation: "transactTerminalState",
+				});
+			} catch {}
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "started",
+					operation: "transactTerminalState",
+				});
+			} catch {}
 			const next = mutator({
 				scopes: terminalMemory.map(s => ({ ...s })),
 				keys: terminalKeyMemory.map(k => ({ ...k })),
@@ -856,19 +995,53 @@ export function createReconciliationStore(options: {
 			});
 			terminalMemory = next.scopes;
 			terminalKeyMemory = next.keys;
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "completed",
+					operation: "transactTerminalState",
+				});
+			} catch {}
 		};
 		const pending = chain.then(run, run);
-		chain = pending.then(
+		const settled = pending.then(
 			() => undefined,
 			() => undefined,
 		);
-		await pending;
+		chain = settled;
+		try {
+			await pending;
+		} catch (error) {
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "failed",
+					operation: "transactTerminalState",
+					error: error instanceof Error ? error.message : String(error),
+				});
+			} catch {}
+			throw error;
+		}
 	};
 
 	const transactTerminalKeys = async (
 		mutator: (keys: EvictedTerminalKeyEntry[]) => EvictedTerminalKeyEntry[],
 	): Promise<void> => {
 		const run = async () => {
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "enqueued",
+					operation: "transactTerminalKeys",
+				});
+			} catch {}
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "started",
+					operation: "transactTerminalKeys",
+				});
+			} catch {}
 			const next = mutator(terminalKeyMemory.map(k => ({ ...k })));
 			await writeAtomic({
 				version: RECONCILIATION_STORE_VERSION,
@@ -878,13 +1051,33 @@ export function createReconciliationStore(options: {
 				...(next.length > 0 ? { evictedTerminalKeys: next } : {}),
 			});
 			terminalKeyMemory = next;
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "completed",
+					operation: "transactTerminalKeys",
+				});
+			} catch {}
 		};
 		const pending = chain.then(run, run);
-		chain = pending.then(
+		const settled = pending.then(
 			() => undefined,
 			() => undefined,
 		);
-		await pending;
+		chain = settled;
+		try {
+			await pending;
+		} catch (error) {
+			try {
+				options.onInstrumentationForTests?.({
+					at: Date.now(),
+					phase: "failed",
+					operation: "transactTerminalKeys",
+					error: error instanceof Error ? error.message : String(error),
+				});
+			} catch {}
+			throw error;
+		}
 	};
 
 	const deleteStore = async (): Promise<void> => {

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -301,8 +301,10 @@ export const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * Generation 202 joins queued-removal terminal publication before ordinary
  * abort acknowledgement, replacing owners that still acknowledge cancellation
  * before its terminal record is durable.
+ * Generation 203 replaces owners that still treat a project `.gjc` file as an
+ * explicit deadline-autosave opt-in for a primary checkout.
  */
-export const DAEMON_GENERATION = 202;
+export const DAEMON_GENERATION = 204;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7

package/src/sdk/cli/session-cli.ts

@@ -258,17 +258,32 @@ function normalizeSessionFailure(error: unknown, args: SdkSessionCliArgs): Publi
 }
 
 /** Lifecycle terminality/retryability is not, by itself, proof of an effect outcome. */
+/**
+ * Lifecycle codes the broker produces when it refuses the request payload itself. Input shape is
+decided before the request can be dispatched, and an outcome the broker cannot establish comes
+back as `terminal_uncertain` instead, so these codes never stand for an applied operation. They
+still collapse into `operation_failed` below, which cannot say why the request was refused, so
+the refusal class survives as one fixed diagnostic.
+ */
+const LIFECYCLE_INPUT_REFUSAL_CODES = new Set(["invalid_input", "invalid_request"]);
+
 export function lifecyclePublicFailure(outcome: Extract<SessionLifecycleResult, { ok: false }>): PublicCommandFailure {
 	const failure = sdkPublicFailure(outcome.error.code);
 	// The service emits retryable protocol_error only when requestSent is explicitly false.
 	const proof: PublicEffectProof =
 		outcome.certainty === "retryable" && outcome.error.code === "protocol_error" ? "pre-send" : "unknown";
-	// `operation_failed` cannot distinguish a conflict from any other failed operation, so
-	// the conflict survives as one fixed diagnostic. The broker message itself is never
-	// rendered: it may carry request keys, paths, or credentials, and its cause is not
-	// decidable from the code alone.
+	// `operation_failed` cannot distinguish a conflict or an input refusal from any other failed
+	// operation, so each survives as one fixed diagnostic. The broker message itself is never
+	// rendered: it may carry request keys, paths, or credentials, and its cause is not decidable
+	// from the code alone.
+	let diagnostic: PublicCommandDiagnosticCode | undefined;
+	if (outcome.error.code === "idempotency_conflict") {
+		diagnostic = "lifecycle_idempotency_conflict";
+	} else if (LIFECYCLE_INPUT_REFUSAL_CODES.has(outcome.error.code)) {
+		diagnostic = "lifecycle_input_refused";
+	}
 	const diagnostics: readonly PublicCommandDiagnosticCode[] | undefined =
-		outcome.error.code === "idempotency_conflict" ? ["lifecycle_idempotency_conflict"] : undefined;
+		diagnostic === undefined ? undefined : [diagnostic];
 	return new PublicCommandFailure({
 		...failure.input,
 		...(diagnostics === undefined ? {} : { diagnostics }),
@@ -2209,7 +2224,7 @@ async function runRawControl(
 	input: JsonRecord,
 	args: SdkSessionCliArgs,
 ): Promise<unknown> {
-	const invalid = validateAdapterControl(operation, input);
+	const invalid = validateAdapterControl(operation, input, { allowUltrafastTier: true });
 	if (invalid) throw new SdkSessionCliError(invalid.code, invalid.message, 2);
 	await ensureBroker({ agentDir });
 	const operatorRequest = operatorAbortBrokerRequest(sessionId, operation, input, args);