@harness-nexus/cli 0.1.0-alpha.3 → 0.1.0-alpha.4

package/dist/daemon/chat.js

@@ -2,14 +2,20 @@ import { randomUUID } from 'node:crypto';
 import { closeSync, fstatSync, openSync, readSync, readdirSync, readFileSync, statSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { acpPermissionOptionSchema, acpToolCallViewSchema, chatPermissionRespondEventSchema, chatPromptEventSchema, chatSessionCloseEventSchema, chatSessionResyncEventSchema, chatSessionStartEventSchema, chatTurnCancelEventSchema, } from '@harness-nexus/shared';
+import { acpPermissionOptionSchema, acpToolCallViewSchema, chatConfigSetEventSchema, chatPermissionRespondEventSchema, chatPromptEventSchema, chatReconcileEventSchema, adaptersReportRequestSchema, chatSessionCloseEventSchema, chatSessionResyncEventSchema, chatSessionStartEventSchema, chatTurnCancelEventSchema, sessionConfigOptionSchema, sessionModeStateSchema, } from '@harness-nexus/shared';
 import { AcpAgentConnection } from './acp/agent-connection.js';
 import { resolveAcpCommand } from './acp/adapters.js';
+import { auditAdapterLedger, writeAdapterLedgerEntry } from './adapter-ledger.js';
 import { createDshLiveMapper, decodeTranscript, dshHistoryItems, findTranscript, nativeZstd, TranscriptTail, } from './dsh-sessions.js';
 import { TapListener, tapPluginAvailable, tapPluginPath, writeTapPatch, } from './dsh-tap-listener.js';
 const HISTORY_MAX = 2000;
 /** How long after arming the tap plugin may take to say hello (design: 3s). */
 const TAP_HANDSHAKE_MS = 3000;
+/**
+ * codex-acp's unknown-model notice (see `mapAcpUpdate`'s agent_message_chunk
+ * arm). Anchored on the stable prefix; the model id varies.
+ */
+const CODEX_MODEL_METADATA_NOTICE = /^Model metadata for `[^`]*` not found\./;
 /** Node fs surface for TranscriptTail. */
 const nodeTailFs = {
     size(path) {
@@ -49,6 +55,14 @@ export function attachChatHandlers(socket, opts = {}) {
      */
     const closedBeforeReady = new Set();
     const CLOSED_BEFORE_READY_MAX = 64;
+    /**
+     * 9 W11 E — starts currently mid-establishment (spawn → registration).
+     * `chat:reconcile` reports these (when their id is still listed server-side)
+     * as held, and flags UNLISTED ones into `closedBeforeReady` so the
+     * establishment aborts — a row the server no longer knows must not finish
+     * into an unjoinable orphan.
+     */
+    const inFlightStarts = new Set();
     const emitEvent = (session, event) => {
         pushHistory(session, { type: 'event', event });
         socket.emit('chat:event', { sessionId: session.sessionId, event });
@@ -69,6 +83,19 @@ export function attachChatHandlers(socket, opts = {}) {
             items: session.history.slice(-HISTORY_MAX),
         });
     };
+    /**
+     * 9 W9 A — emit the session's FULL merged config snapshot as a
+     * `session_config` stream event (into the ring and the live room). The
+     * browser's selectors settle exclusively through these events — the
+     * daemon-side optimistic merge after `chat:config.set` reuses this path.
+     */
+    const emitConfig = (session) => {
+        emitEvent(session, {
+            kind: 'session_config',
+            ...(session.config.modes !== undefined ? { modes: { ...session.config.modes } } : {}),
+            ...(session.config.options.length > 0 ? { configOptions: session.config.options } : {}),
+        });
+    };
     const teardown = (session, reason) => {
         if (sessions.get(session.sessionId) !== session)
             return;
@@ -79,8 +106,38 @@ export function attachChatHandlers(socket, opts = {}) {
             clearTimeout(p.timer);
         session.permissions.clear();
         session.conn.kill();
+        // 9 W11 A — the kill path does NOT unlink the ledger file: if the daemon
+        // hard-dies inside the SIGTERM→SIGKILL grace, an unlinked file would
+        // lose accounting (the group survives with no record). The audit below
+        // removes it once the group is gone.
         socket.emit('chat:session.closed', { sessionId: session.sessionId, reason });
     };
+    // 9 W11 A — periodic audit: the only runtime remover of ledger files
+    // (entries whose process group is gone), and the backstop for a session
+    // whose group died without the exit event reaching teardown.
+    const auditMs = opts.auditIntervalMs ?? 60_000;
+    if (auditMs > 0) {
+        const auditTimer = setInterval(() => {
+            auditAdapterLedger(home);
+            for (const session of [...sessions.values()]) {
+                if (!session.conn.isGroupAlive())
+                    teardown(session, 'agent-exited');
+            }
+        }, auditMs);
+        auditTimer.unref();
+    }
+    /**
+     * 9 W11 E — disconnect grace window. `HN_TEARDOWN_GRACE_MS` (default 8000;
+     * 0 restores the pre-W11 immediate teardown). Socket.IO reconnects from a
+     * transport blip within ~1s, so holding channels (and in-flight turns) for
+     * the window survives the blip; the server delays its offline reap by the
+     * same window and reconciles on reconnect.
+     */
+    const graceMs = (() => {
+        const raw = Number.parseInt(env.HN_TEARDOWN_GRACE_MS ?? '', 10);
+        return Number.isFinite(raw) ? Math.max(raw, 0) : 8000;
+    })();
+    let graceTimer = null;
     // In-flight tail attachments by native session id (one per session).
     const tailAttaches = new Map();
     /**
@@ -178,6 +235,7 @@ export function attachChatHandlers(socket, opts = {}) {
         ack?.({ accepted: true });
         const { sessionId, target, cwd, resume } = parsed.data;
         void (async () => {
+            inFlightStarts.add(sessionId);
             const cmd = resolveAcpCommand(target, env);
             if (cmd === null) {
                 socket.emit('chat:session.ready', {
@@ -207,8 +265,26 @@ export function attachChatHandlers(socket, opts = {}) {
             if (abortIfClosed())
                 return;
             try {
+                // 9 W11 A — ledger the process group the moment it exists (inside
+                // start, right after the detached spawn and before initialize): a
+                // hard death during establishment still leaves a boot-sweepable
+                // record. The entry is re-written after registration with the native
+                // session id; removal is the audit's job, never a kill path.
+                const ledgerStartedAt = Date.now();
+                let ledgerPgid = null;
+                const onSpawned = (pgid) => {
+                    ledgerPgid = pgid;
+                    writeAdapterLedgerEntry(home, {
+                        pgid,
+                        target,
+                        command: cmd.command,
+                        wireSessionId: sessionId,
+                        startedAt: ledgerStartedAt,
+                    });
+                };
                 const spawnOpts = {
                     cwd,
+                    onSpawned,
                     ...(tapArmed === null
                         ? opts.spawnEnv !== undefined
                             ? { env: opts.spawnEnv }
@@ -233,7 +309,7 @@ export function attachChatHandlers(socket, opts = {}) {
                         tapArmed.hello,
                     ]);
                 }
-                const { conn, agentInfo, sessionCaps } = started;
+                const { conn, agentInfo, sessionCaps, promptCaps } = started;
                 liveConn = conn;
                 // `mcpServers` is sent explicitly (spec: an array): ACP wrappers
                 // (zed 0.23.x AND the @agentclientprotocol one we ship for claude-code)
@@ -246,9 +322,14 @@ export function attachChatHandlers(socket, opts = {}) {
                 // for provider …"). Retry that specific failure a few times.
                 let acpSessionId;
                 let history = [];
+                // 9 W9 A — the establishment response's session-config snapshot
+                // (modes + configOptions). Read from whichever arm established the
+                // session; null when the adapter advertised nothing (or only junk).
+                let establishedConfig = null;
                 if (resume === undefined) {
                     const created = (await establish(conn, 'session/new', { cwd, mcpServers: [] }));
                     acpSessionId = created?.sessionId ?? sessionId;
+                    establishedConfig = takeSessionConfig(created);
                 }
                 else {
                     // 9 W7 — pick the method from the ADVERTISED capability: `load`
@@ -265,18 +346,20 @@ export function attachChatHandlers(socket, opts = {}) {
                             }));
                             acpSessionId = loaded?.sessionId ?? resume.sessionId;
                             history = finishCaptured(captured);
+                            establishedConfig = takeSessionConfig(loaded);
                         }
                         finally {
                             stopCapture();
                         }
                     }
                     else if (sessionCaps.resume) {
-                        await establish(conn, 'session/resume', {
+                        const resumed = (await establish(conn, 'session/resume', {
                             sessionId: resume.sessionId,
                             cwd,
                             mcpServers: [],
-                        });
+                        }));
                         acpSessionId = resume.sessionId;
+                        establishedConfig = takeSessionConfig(resumed);
                         history =
                             target === 'deepseek' ? await dshTranscriptHistory(home, resume.sessionId) : [];
                     }
@@ -293,9 +376,12 @@ export function attachChatHandlers(socket, opts = {}) {
                     sessionId,
                     acpSessionId,
                     target,
+                    command: cmd.command,
+                    startedAt: ledgerStartedAt,
                     conn,
                     busy: false,
                     permissions: new Map(),
+                    config: establishedConfig ?? { options: [] },
                     history: [],
                     wireTextEmitted: false,
                     tailReplayEligible: resume === undefined,
@@ -307,6 +393,18 @@ export function attachChatHandlers(socket, opts = {}) {
                 };
                 sessions.set(sessionId, session);
                 liveConn = null; // registered — teardown owns the connection from here
+                // 9 W11 A — enrich the ledger entry with the native session id (the
+                // adapter report in slice C and post-mortem forensics key off it).
+                if (ledgerPgid !== null) {
+                    writeAdapterLedgerEntry(home, {
+                        pgid: ledgerPgid,
+                        target,
+                        command: cmd.command,
+                        wireSessionId: sessionId,
+                        nativeSessionId: acpSessionId,
+                        startedAt: ledgerStartedAt,
+                    });
+                }
                 wireSession(session, emitEvent);
                 conn.onExit(() => {
                     // Crash/quit outside our control — end the channel honestly.
@@ -348,11 +446,17 @@ export function attachChatHandlers(socket, opts = {}) {
                 // pending attach, so it cannot be active without the tail.
                 ensureTail(session);
                 emitHistory(session, history);
+                // 9 W9 A — the authoritative config snapshot rides AFTER the replayed
+                // history (a load's replay patches settle first; last write wins) and
+                // enters the ring, so a resync restores the selectors.
+                if (establishedConfig !== null)
+                    emitConfig(session);
                 socket.emit('chat:session.ready', {
                     sessionId,
                     nativeSessionId: acpSessionId,
                     ...(agentInfo.name !== undefined ? { agentName: agentInfo.name } : {}),
                     ...(agentInfo.version !== undefined ? { agentVersion: agentInfo.version } : {}),
+                    promptCapabilities: promptCaps,
                 });
             }
             catch (e) {
@@ -363,7 +467,7 @@ export function attachChatHandlers(socket, opts = {}) {
                     error: e instanceof Error ? e.message : String(e),
                 });
             }
-        })();
+        })().finally(() => inFlightStarts.delete(sessionId));
     });
     // ---- server → daemon: prompt / cancel / permission / disconnect / resync ----
     socket.on('chat:message.send', (payload, ack) => {
@@ -405,6 +509,44 @@ export function attachChatHandlers(socket, opts = {}) {
         // The pending session/prompt resolves as 'cancelled' → turn_result fires.
         void session.conn.request('session/cancel', {}, 5000).catch(() => { });
     });
+    // 9 W9 A — switch the live session's permission mode / one config option.
+    // NOT busy-gated: dsh pins the selection per PROMPT (a mid-turn set applies
+    // to the next turn) and the UI disables the selectors during a turn anyway.
+    socket.on('chat:config.set', (payload, ack) => {
+        const parsed = chatConfigSetEventSchema.safeParse(payload);
+        if (!parsed.success) {
+            ack?.({ error: 'proto:invalid' });
+            return;
+        }
+        const session = sessions.get(parsed.data.sessionId);
+        if (session === undefined) {
+            ack?.({ error: 'unknown-session' });
+            return;
+        }
+        const set = parsed.data;
+        const request = set.kind === 'mode' ? 'session/set_mode' : 'session/set_config_option';
+        const params = set.kind === 'mode'
+            ? { sessionId: session.acpSessionId, modeId: set.modeId }
+            : { sessionId: session.acpSessionId, configId: set.configId, value: set.value };
+        void session.conn.request(request, params, 15000).then(() => {
+            // Optimistic daemon-side merge: adapters confirm/correct through
+            // config pushes, but codex does not reliably push after a set —
+            // without this the selector would sit on the stale value.
+            if (set.kind === 'mode') {
+                session.config.modes = {
+                    currentModeId: set.modeId,
+                    availableModes: session.config.modes?.availableModes ?? [],
+                };
+            }
+            else {
+                session.config.options = session.config.options.map((o) => o.id === set.configId ? { ...o, currentValue: set.value } : o);
+            }
+            emitConfig(session);
+            ack?.({ accepted: true });
+        }, (e) => {
+            ack?.({ error: e instanceof Error ? e.message : String(e) });
+        });
+    });
     socket.on('chat:permission.respond', (payload, ack) => {
         const parsed = chatPermissionRespondEventSchema.safeParse(payload);
         if (!parsed.success) {
@@ -468,10 +610,93 @@ export function attachChatHandlers(socket, opts = {}) {
         }
         ack?.({ accepted: true });
     });
-    socket.on('disconnect', () => {
-        // Channels die with the daemon's connection; the native sessions survive.
-        for (const session of [...sessions.values()])
-            teardown(session, 'daemon-disconnected');
+    // 9 W11 C — the adapter report: present-tense process truth from the live
+    // sessions map (the LEDGER is crash accounting, not a status surface; a
+    // report built from it could list processes that already died). Instant by
+    // construction — no spawn, no round-trip beyond the socket.
+    socket.on('adapters:report', (payload, ack) => {
+        const parsed = adaptersReportRequestSchema.safeParse(payload);
+        if (!parsed.success) {
+            ack?.({ error: 'proto:invalid' });
+            return;
+        }
+        ack?.({ accepted: true });
+        socket.emit('adapters:report:result', {
+            requestId: parsed.data.requestId,
+            adapters: [...sessions.values()].map((s) => ({
+                wireSessionId: s.sessionId,
+                target: s.target,
+                pgid: s.conn.pgid ?? 0,
+                nativeSessionId: s.acpSessionId,
+                startedAt: s.startedAt,
+                command: s.command,
+            })),
+        });
+    });
+    // 9 W11 E — the server's live rows for this machine, sent on EVERY /ctl
+    // (re)connect. Drop what it disowned; report what we still hold.
+    socket.on('chat:reconcile', (payload, ack) => {
+        const parsed = chatReconcileEventSchema.safeParse(payload);
+        if (!parsed.success) {
+            ack?.({ error: 'proto:invalid' });
+            return;
+        }
+        const listed = new Set(parsed.data.sessionIds);
+        // A session whose row is gone server-side (reaped past the server's
+        // grace, or the server restarted) is unjoinable and invisible — no tab,
+        // no closer — tear it down now instead of leaking the adapter.
+        for (const session of [...sessions.values()]) {
+            if (!listed.has(session.sessionId))
+                teardown(session, 'reconciled');
+        }
+        // The same orphan risk exists MID-ESTABLISHMENT: flag unlisted starts so
+        // they abort at their checkpoints (the close-consume path).
+        for (const id of inFlightStarts) {
+            if (listed.has(id))
+                continue;
+            if (closedBeforeReady.size >= CLOSED_BEFORE_READY_MAX)
+                closedBeforeReady.clear();
+            closedBeforeReady.add(id);
+        }
+        // Held = registered sessions + establishments in flight for rows the
+        // server still knows (reporting an unlisted in-flight start as held
+        // would keep a ghost row alive).
+        const held = [...sessions.keys(), ...[...inFlightStarts].filter((id) => listed.has(id))];
+        ack?.({ held: held.slice(0, 64) });
+    });
+    // A reconnect within the grace window revives every channel: cancel the
+    // pending teardown BEFORE the server's reconcile lands (its list decides
+    // what survives; the grace only buys time for the reconnect itself).
+    socket.on('connect', () => {
+        if (graceTimer !== null) {
+            clearTimeout(graceTimer);
+            graceTimer = null;
+        }
+    });
+    socket.on('disconnect', (reason) => {
+        // 9 W11 E — a deliberate stop ('io client disconnect': SIGTERM → stop())
+        // or the kill-switch (HN_TEARDOWN_GRACE_MS=0) tears down immediately,
+        // exactly as before. A transport blip instead HOLDS every channel for
+        // the grace window: Socket.IO reconnects within ~1s, the server mirrors
+        // the grace on its reap, and a mid-grace turn keeps running against the
+        // local adapter (packets buffer; the viewer resyncs on rejoin).
+        if (graceMs <= 0 || reason === 'io client disconnect') {
+            if (graceTimer !== null) {
+                clearTimeout(graceTimer);
+                graceTimer = null;
+            }
+            for (const session of [...sessions.values()])
+                teardown(session, 'daemon-disconnected');
+            return;
+        }
+        if (graceTimer !== null)
+            return; // already armed by an earlier blip cycle
+        graceTimer = setTimeout(() => {
+            graceTimer = null;
+            for (const session of [...sessions.values()])
+                teardown(session, 'daemon-disconnected');
+        }, graceMs);
+        graceTimer.unref();
     });
 }
 /**
@@ -559,13 +784,37 @@ function wireSession(session, emitEvent) {
     conn.setNotificationHandler((method, params) => {
         if (method !== 'session/update')
             return;
+        const update = (params.update ?? {});
+        // 9 W9 A — session-config pushes merge into the daemon's snapshot and
+        // re-emit it in full (needs the session state, so they are intercepted
+        // BEFORE the stateless mapping below).
+        if (update.sessionUpdate === 'current_mode_update') {
+            const modeId = typeof update.currentModeId === 'string' && update.currentModeId !== ''
+                ? update.currentModeId
+                : null;
+            if (modeId !== null) {
+                session.config.modes = {
+                    currentModeId: modeId,
+                    availableModes: session.config.modes?.availableModes ?? [],
+                };
+                emitEvent(session, { kind: 'session_config', modes: { ...session.config.modes } });
+            }
+            return;
+        }
+        if (update.sessionUpdate === 'config_option_update') {
+            const options = takeConfigOptions(update.configOptions);
+            if (options !== null) {
+                session.config.options = options;
+                emitEvent(session, { kind: 'session_config', configOptions: options });
+            }
+            return;
+        }
         // dsh commits block-level text at turn end — while a streaming source is
         // live (the transcript tail OR the 9 W7.1 event tap), its deltas already
         // streamed this content AND its mapper emits the complete blocks for
         // steps whose deltas it never saw, so the wire's committed chunk is
         // redundant in every case; letting it through would double-render the
         // message. Tools/usage still flow (idempotent by callId / field-merged).
-        const update = (params.update ?? {});
         if ((session.tail !== null || session.tap !== null) &&
             (update.sessionUpdate === 'agent_message_chunk' ||
                 update.sessionUpdate === 'agent_thought_chunk')) {
@@ -681,12 +930,72 @@ async function attachTranscriptTail(home, acpSessionId, onEvent, onFatal) {
     }
     return null;
 }
+/**
+ * 9 W9 A — validate an adapter's `configOptions` array down to the
+ * platform's bounded view: only `type:'select'` rows survive (the three
+ * shipped adapters expose mode/model/effort as selects; boolean options from
+ * future adapters are dropped rather than half-surfaced). Null = nothing
+ * usable in the payload.
+ */
+export function takeConfigOptions(raw) {
+    if (!Array.isArray(raw))
+        return null;
+    const out = [];
+    for (const row of raw) {
+        if (typeof row !== 'object' || row === null)
+            continue;
+        const r = row;
+        if (r['type'] !== undefined && r['type'] !== 'select')
+            continue;
+        const parsed = sessionConfigOptionSchema.safeParse(r);
+        if (parsed.success)
+            out.push(parsed.data);
+    }
+    return out.length > 0 ? out : null;
+}
+/**
+ * 9 W9 A — the session-config slice of an establishment response
+ * (`session/new` / `load` / `resume`): `modes` + `configOptions`, each
+ * independently validated. Null = the adapter advertised nothing usable.
+ */
+export function takeSessionConfig(result) {
+    const r = (result ?? {});
+    const modes = sessionModeStateSchema.safeParse(r['modes']);
+    const options = takeConfigOptions(r['configOptions']);
+    if (!modes.success && options === null)
+        return null;
+    return {
+        ...(modes.success ? { modes: modes.data } : {}),
+        options: options ?? [],
+    };
+}
 /** Map one ACP `session/update` params object; null = drop (user echo). */
 export function mapAcpUpdate(params) {
     const update = (params.update ?? {});
     switch (update.sessionUpdate) {
-        case 'agent_message_chunk':
-            return { kind: 'message_delta', delta: chunkText(update) };
+        // 9 W9 A — config pushes on the CAPTURE path (session/load replay: no
+        // session state to merge into, so the adapter's patch maps verbatim).
+        case 'current_mode_update': {
+            const modeId = typeof update.currentModeId === 'string' && update.currentModeId !== ''
+                ? update.currentModeId
+                : null;
+            return modeId === null ? null : { kind: 'session_config', modes: { currentModeId: modeId } };
+        }
+        case 'config_option_update': {
+            const options = takeConfigOptions(update.configOptions);
+            return options === null ? null : { kind: 'session_config', configOptions: options };
+        }
+        case 'agent_message_chunk': {
+            const delta = chunkText(update);
+            // codex-acp announces an unknown gateway model id by streaming a
+            // diagnostic AS AN ASSISTANT CHUNK, so it lands mid-transcript as if the
+            // model had said it. It is not model output; drop it. (The underlying
+            // condition — codex's built-in registry not knowing the custom model id —
+            // is what makes it fall back to a default context window; a root-level
+            // `model_context_window` in config.toml overrides that window, verified
+            // against codex-acp 0.16, but does not silence this notice.)
+            return CODEX_MODEL_METADATA_NOTICE.test(delta) ? null : { kind: 'message_delta', delta };
+        }
         case 'agent_thought_chunk':
             return { kind: 'thought_delta', delta: chunkText(update) };
         case 'tool_call':