@hellcoder/companion 0.113.3 → 0.113.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellcoder/companion",
-  "version": "0.113.3",
+  "version": "0.113.4",
   "type": "module",
   "description": "Web UI for launching and interacting with Claude Code agents — Moritz Edition (fork of the-companion)",
   "license": "MIT",

package/server/claude-adapter.ts

@@ -496,13 +496,20 @@ export class ClaudeAdapter implements IBackendAdapter {
       // a wedge that may be hypothetical.
       const wedgeKillEnabled = getSettings().wedgeKillEnabled !== false;
       if (proc && proc.exitCode === null && !proc.killed && !wedgeKillEnabled) {
+        const cliStdoutOpen = stdoutFdOpen(proc.pid);
         log.info("claude-adapter", "stdout closed but wedge-kill is disabled; leaving process alone", {
           sessionId: this.sessionId,
           pid: proc.pid,
-          cliStdoutOpen: stdoutFdOpen(proc.pid),
+          cliStdoutOpen,
           proc: captureProcState(proc.pid),
           stderrTail: this.stderrTailForLog(),
         });
+        // Emit the reader-side-EOF WARN on this path too. It previously fired
+        // only from the two kill branches, so operators running with the
+        // wedge-kill switch off — the recommended mitigation — saw these events
+        // only as the benign-sounding info line above and had no signal that the
+        // EOF originated in the server's own read side.
+        this.warnIfReaderSideEof(cliStdoutOpen, proc.pid, false);
       } else if (proc && proc.exitCode === null && !proc.killed) {
         // Which grace applies is decided by whether teardown is actually in
         // progress, NOT by whether the last message happened to be a `result`.
@@ -654,12 +661,22 @@ export class ClaudeAdapter implements IBackendAdapter {
    * the warning attributes the root cause so these events can be counted and
    * the reader-side failure fixed where it lives.
    */
-  private warnIfReaderSideEof(cliStdoutOpen: boolean | null, pid: number | undefined): void {
+  private warnIfReaderSideEof(
+    cliStdoutOpen: boolean | null,
+    pid: number | undefined,
+    killing = true,
+  ): void {
     if (cliStdoutOpen !== true) return;
-    log.warn("claude-adapter", "CLI still holds its stdout open — EOF was reader-side (server stream failure), not a CLI wedge; killing anyway so --resume recovery can proceed", {
-      sessionId: this.sessionId,
-      pid,
-    });
+    log.warn(
+      "claude-adapter",
+      killing
+        ? "CLI still holds its stdout open — EOF was reader-side (server stream failure), not a CLI wedge; killing anyway so --resume recovery can proceed"
+        : "CLI still holds its stdout open — EOF was reader-side (server stream failure), not a CLI wedge; leaving the process alone, but the transport is gone and the session will still relaunch",
+      {
+        sessionId: this.sessionId,
+        pid,
+      },
+    );
   }
 
   private checkSilence(): void {

package/server/ws-bridge-types.ts

@@ -87,10 +87,23 @@ export interface Session {
    */
   turnAwaitingResult?: boolean;
   /**
-   * One-shot guard for the mid-answer continuation nudge, so a turn that keeps
-   * dying cannot be nudged in a loop. Reset when a new user_message is sent.
+   * Number of mid-answer continuation nudges sent since the turn last produced
+   * output, so a turn that keeps dying cannot be nudged in a loop.
+   *
+   * Deliberately counts *consecutive unproductive* nudges rather than nudges
+   * per turn: this was a one-shot boolean, which capped recovery at one nudge
+   * for the whole turn. A second stream failure in the same turn — common on a
+   * loaded host, where the server's own stdout reader EOFs mid-answer — then had
+   * no recovery path at all (`inFlightUserTurn` was already cleared by the first
+   * token, so the replay branch is skipped by design), and the session idled
+   * until a human typed "continue".
+   *
+   * Reset to 0 whenever the turn produces output, because a nudge that was
+   * followed by output demonstrably worked: the next interruption is a fresh
+   * failure, not a loop. Only a nudge that yields nothing counts toward
+   * MAX_CONTINUATION_NUDGES. Reset when a new user_message is sent.
    */
-  continuationSent?: boolean;
+  continuationAttempts?: number;
   /**
    * Set when the last turn failed authentication (expired/invalid credentials).
    * Auto-relaunch is skipped while this is set — relaunching cannot fix auth —

package/server/ws-bridge.test.ts

@@ -2120,8 +2120,11 @@ describe("CLI message routing", () => {
       expect(nudge.content).not.toBe("do a big task");
     });
 
-    it("does not nudge twice for the same turn", async () => {
-      // A turn that keeps dying must not accumulate nudges.
+    it("does not nudge twice without intervening output", async () => {
+      // A turn that keeps dying with nothing to show must not accumulate nudges:
+      // that shape is indistinguishable from a poison turn that dies on every
+      // resume. The budget only refills once the turn actually produces output
+      // (see the "nudges again after the continued turn produced output" test).
       const { session } = await startTurnWithOutput("s1");
       const sent: string[] = [];
       const attach = () => bridge.attachBackendAdapter("s1", {
@@ -2169,6 +2172,122 @@ describe("CLI message routing", () => {
         .filter((m) => m.type === "user_message" && /continue from where/i.test(m.content || ""));
       expect(nudges).toHaveLength(0);
     });
+
+    /**
+     * The production failure this budget change exists for.
+     *
+     * The nudge guard used to be a one-shot boolean scoped to the whole turn, so
+     * a turn interrupted a SECOND time got no recovery at all: the replay branch
+     * is skipped by design once output has begun (`inFlightUserTurn` is cleared
+     * by the first token), and the boolean blocked the nudge branch. The banner
+     * cleared, the session went idle with a half-written answer, and a human had
+     * to type "continue".
+     *
+     * Observed on companion 0.113.3 (session afdbec35): prompt at 04:20:20 →
+     * stream EOF → nudge at 04:23:32 → the resumed turn streamed for minutes →
+     * stream EOF again → silent reattach → 9m38s dead until a human typed
+     * "continue" at 04:33:12. Both EOFs were reader-side (the CLI still held
+     * fd 1), i.e. the turn was healthy and genuinely worth continuing.
+     */
+    /**
+     * Attaches a mock adapter the way a relaunch does, capturing both what the
+     * bridge sends and the `onBrowserMessage` handler it registers. Emitting
+     * through that handler is how backend output actually reaches the session
+     * state — `handleCLIMessage` only routes for a real ClaudeAdapter, so it
+     * silently drops once a mock is attached.
+     */
+    function attachMockAdapter(sessionId: string) {
+      const sent: string[] = [];
+      let handler: ((msg: unknown) => void) | undefined;
+      bridge.attachBackendAdapter(sessionId, {
+        isConnected: () => true,
+        send: (m: unknown) => { sent.push(typeof m === "string" ? m : JSON.stringify(m)); return true; },
+        disconnect: async () => {},
+        onBrowserMessage: (cb: (msg: unknown) => void) => { handler = cb; },
+        onSessionMeta: () => {},
+        onDisconnect: () => {},
+        onInitError: () => {},
+      } as never, "claude");
+      return {
+        sent,
+        emit: (msg: unknown) => handler?.(msg),
+        nudges: () => sent
+          .map((m) => JSON.parse(m))
+          .filter((m) => m.type === "user_message" && /continue from where/i.test(m.content || "")),
+      };
+    }
+
+    it("nudges again after the continued turn produced output", async () => {
+      const { session } = await startTurnWithOutput("s1");
+
+      // First interruption → nudge, and the budget is now spent.
+      const first = attachMockAdapter("s1");
+      expect(first.nudges()).toHaveLength(1);
+      expect(session.continuationAttempts).toBe(1);
+
+      // The resumed turn makes real progress. That proves the nudge worked, so
+      // the budget refills — the next failure is a new one, not a loop.
+      first.emit({
+        type: "stream_event",
+        event: { type: "content_block_delta", delta: { type: "text_delta", text: "more work" } },
+        session_id: "cli-123",
+        uuid: "se-2",
+      });
+      expect(session.continuationAttempts).toBe(0);
+
+      // Second interruption → must nudge again instead of stranding the turn.
+      // Under the old one-shot boolean this produced zero nudges and the session
+      // idled until a human typed "continue".
+      const second = attachMockAdapter("s1");
+      expect(second.nudges()).toHaveLength(1);
+      expect(session.turnAwaitingResult).toBe(true);
+    });
+
+    it("refills the budget on assistant output, not just stream_event", async () => {
+      // Non-streaming output surfaces as an `assistant` message with no
+      // preceding stream_event, so both handlers must refill the budget or those
+      // turns keep the one-nudge-per-turn bug.
+      const { session } = await startTurnWithOutput("s1");
+
+      const first = attachMockAdapter("s1");
+      expect(session.continuationAttempts).toBe(1);
+
+      first.emit({
+        type: "assistant",
+        message: { role: "assistant", content: [{ type: "text", text: "partial answer" }] },
+        session_id: "cli-123",
+        uuid: "a-1",
+      });
+      expect(session.continuationAttempts).toBe(0);
+
+      expect(attachMockAdapter("s1").nudges()).toHaveLength(1);
+    });
+
+    it("stops nudging when the resumed turn dies without producing output", async () => {
+      // The loop protection the budget preserves: repeated nudges that yield
+      // nothing are indistinguishable from a poison turn, so they must stop at
+      // MAX_CONTINUATION_NUDGES (default 1) rather than retry forever.
+      const { session } = await startTurnWithOutput("s1");
+
+      expect(attachMockAdapter("s1").nudges()).toHaveLength(1);
+      expect(attachMockAdapter("s1").nudges()).toHaveLength(0);
+      expect(attachMockAdapter("s1").nudges()).toHaveLength(0);
+      expect(session.continuationAttempts).toBe(1);
+    });
+
+    it("resets the nudge budget when a new user turn starts", async () => {
+      // A fresh prompt is a fresh turn: whatever happened to the previous one
+      // must not eat this turn's recovery.
+      const { browser, session } = await startTurnWithOutput("s1");
+      attachMockAdapter("s1");
+      expect(session.continuationAttempts).toBe(1);
+
+      await bridge.handleBrowserMessage(browser, JSON.stringify({
+        type: "user_message",
+        content: "next question",
+      }));
+      expect(session.continuationAttempts).toBe(0);
+    });
   });
 
   it("tool_progress: broadcasts", async () => {

package/server/ws-bridge.ts

@@ -64,6 +64,23 @@ const RETRYABLE_BACKEND_MESSAGE_TYPES = new Set<BrowserOutgoingMessage["type"]>(
   "mcp_set_servers",
 ]);
 
+/**
+ * How many continuation nudges a mid-answer-interrupted turn may get *without
+ * producing any output in between*. The counter resets on the turn's next output
+ * (see `continuationAttempts`), so this only bounds a turn that dies again
+ * having emitted nothing — not a turn that is interrupted repeatedly while
+ * making progress.
+ *
+ * Default 1 keeps the loop protection exactly as strict as the boolean it
+ * replaces for the ambiguous case (nudge → died with nothing to show → could be
+ * a poison turn), while making the budget *per interruption* instead of per
+ * turn. Raise it on hosts where the transport flaps hard enough that a resumed
+ * turn sometimes dies before its first token.
+ */
+const MAX_CONTINUATION_NUDGES = Number(
+  process.env.COMPANION_MAX_CONTINUATION_NUDGES || "1",
+);
+
 export class WsBridge {
   private static readonly PROCESSED_CLIENT_MSG_ID_LIMIT = 1000;
   /** Maximum number of queued browser→backend messages per session to prevent unbounded memory growth. */
@@ -565,6 +582,10 @@ export class WsBridge {
         // The turn is producing output — it was delivered, so drop the in-flight
         // replay copy (no need to re-send it after a future relaunch).
         session.inFlightUserTurn = undefined;
+        // Output after a continuation nudge proves the nudge worked, so give the
+        // turn a fresh nudge budget: a later interruption is a new failure, not
+        // the same one looping. Guarded so the common path writes nothing.
+        if (session.continuationAttempts) session.continuationAttempts = 0;
         const assistantMsg = { ...msg, timestamp: msg.timestamp || Date.now() };
         this.appendHistory(session, assistantMsg);
         this.persistSession(session);
@@ -573,6 +594,10 @@ export class WsBridge {
 
       if (msg.type === "stream_event") {
         session.inFlightUserTurn = undefined;
+        // Same as the assistant branch: progress clears the nudge budget. This is
+        // the earliest output signal, so it is what makes a resumed turn that
+        // streams for minutes before failing again eligible for another nudge.
+        if (session.continuationAttempts) session.continuationAttempts = 0;
         companionBus.emit("message:stream_event", { sessionId: session.id, message: msg });
       }
 
@@ -794,7 +819,7 @@ export class WsBridge {
       // relaunch, defeating inFlightTurnReplayed.
       !session.inFlightUserTurn &&
       session.turnAwaitingResult &&
-      !session.continuationSent
+      (session.continuationAttempts ?? 0) < MAX_CONTINUATION_NUDGES
     ) {
       // The turn died AFTER it had begun answering. `--resume` restores the
       // transcript but does not restart the turn, so without this the session
@@ -803,13 +828,24 @@ export class WsBridge {
       // Re-sending the original prompt is wrong here: work already happened and
       // replaying it would redo tool calls. A continuation nudge asks the model
       // to finish from where the transcript stops instead.
-      session.continuationSent = true;
+      //
+      // Budgeted per *unproductive* nudge, not per turn: the counter resets as
+      // soon as the continued turn emits output (see the assistant/stream_event
+      // handlers), so a turn interrupted repeatedly still recovers each time
+      // while a turn that dies without producing anything stops after
+      // MAX_CONTINUATION_NUDGES. Unbounded looping is not a risk here anyway —
+      // a nudge can only fire on adapter attach, and attaches are already
+      // rate-limited by the orchestrator's MAX_AUTO_RELAUNCHES and
+      // MAX_RELAUNCHES_PER_WINDOW caps.
+      session.continuationAttempts = (session.continuationAttempts ?? 0) + 1;
       session.pendingMessages.unshift(JSON.stringify({
         type: "user_message",
         content: "Your previous response was interrupted before it finished. Continue from where you left off — do not repeat work that is already in the transcript.",
       }));
       log.info("ws-bridge", "Nudging interrupted turn to continue after relaunch", {
         sessionId,
+        attempt: session.continuationAttempts,
+        maxAttempts: MAX_CONTINUATION_NUDGES,
       });
       this.broadcastToBrowsers(session, {
         type: "error",
@@ -1350,7 +1386,7 @@ export class WsBridge {
       // token: this stays set until the turn actually finishes, so an interrupt
       // *mid-answer* is still recognisable as an unfinished turn.
       session.turnAwaitingResult = true;
-      session.continuationSent = false;
+      session.continuationAttempts = 0;
       // A fresh turn is an attempt to make progress (e.g. after the user
       // re-authenticated), so clear any stale auth-block — a genuine crash on
       // this new turn should be allowed to auto-relaunch again.