@hyperdrive.bot/fleet-server 0.3.155 → 0.3.158

package/dist/server/server/bootstrap.js

@@ -123,6 +123,7 @@ import { formatSystemNotificationPrompt, sendPromptToAgent } from "./agent/agent
 import { SubscriptionStore } from "./ingestion/subscriptions/store.js";
 import { PendingItemStore } from "./ingestion/subscriptions/pending-store.js";
 import { SubscriptionNotifier } from "./ingestion/subscriptions/notifier.js";
+import { registerSubscriptionNudgeRoute } from "./ingestion/subscriptions/nudge-route.js";
 import { SubscriptionPoller } from "./ingestion/subscriptions/poller.js";
 import { createSubscriptionReader } from "./ingestion/subscriptions/reader.js";
 import { resolveSourceGateway } from "./ingestion/adapters.js";
@@ -1061,6 +1062,13 @@ export async function createPaseoDaemon(config, rootLogger) {
         logger.warn({ err: error }, "Subscription payload sweep failed");
     });
     subscriptionPoller.start();
+    // "Poll now", for the sources that can tell instead of only being asked.
+    //
+    // Registered next to `start()` so the timer and its shortcut are read
+    // together: the interval is still the floor that covers a bridge which
+    // crashed, went quiet or never had push at all, and this only removes the
+    // wait when something already knows.
+    registerSubscriptionNudgeRoute(app, { poller: subscriptionPoller, logger });
     // The read-only ingestion PREVIEW collaborators (Story 5.1).
     //
     // Wired beside IngestionService rather than through it, because that service

package/dist/server/server/ingestion/apply.js

@@ -137,6 +137,18 @@ function selectItems(items, itemKeys) {
  */
 export async function dispatchGroup(params) {
     const { filter, group, runId, ledger, schedule, cohorts, cohortId, limiter } = params;
+    // A notify-only filter spawns nothing, and this is the funnel where spawning
+    // happens. Refused BEFORE `ledger.claim`, so the items stay unclaimed and a
+    // subscription can still announce them: claiming first and bailing after
+    // would burn the very items the filter exists to deliver.
+    if (filter.target.type === "notify-only") {
+        await cohorts.markGroup(cohortId, group.key, {
+            status: "skipped",
+            error: "this filter is notify-only: it feeds subscriptions and starts no agent",
+        });
+        limiter.release(filter.id, 1);
+        return false;
+    }
     try {
         const claimed = group.items.filter((item) => ledger.claim(filter.id, item.key, { runId, agentId: null }));
         if (claimed.length === 0) {

package/dist/server/server/ingestion/dry-run.d.ts

@@ -22,7 +22,9 @@ export interface DryRunPlan {
  */
 export interface DryRunDispatcher {
     runUnattendedSession(input: {
-        targetConfig: StoredFilter["target"]["config"];
+        targetConfig: Extract<StoredFilter["target"], {
+            type: "new-agent";
+        }>["config"];
         prompt: string;
         labels: Record<string, string>;
         mcpServersOverride?: Record<string, unknown>;

package/dist/server/server/ingestion/dry-run.js

@@ -84,6 +84,14 @@ export function planDryRun(params) {
  */
 export async function runDryRun(params) {
     const { filter, groups, limiter, dispatcher } = params;
+    // A dry run rehearses the session a match WOULD open. A notify-only filter
+    // opens none, so there is nothing to rehearse and the honest answer is to
+    // say so rather than to open a session the real path never would - which is
+    // the one way a rehearsal can lie about the thing it rehearses. Refused
+    // before `admitDryRun`, so a preview does not spend cap either.
+    if (filter.target.type === "notify-only") {
+        throw new Error("This filter is notify-only: it feeds subscriptions and starts no agent, so there is no session to preview.");
+    }
     // Matches `service.ts`'s run-id minting. A parameter so tests are deterministic;
     // `planDryRun` itself stays free of `randomUUID` so it can stay pure.
     const runIdFactory = params.runIdFactory ?? (() => randomUUID());

package/dist/server/server/ingestion/subscriptions/nudge-route.d.ts

@@ -0,0 +1,42 @@
+import type { Express } from "express";
+import type { Logger } from "pino";
+import type { SubscriptionPoller } from "./poller.js";
+export declare const SUBSCRIPTION_NUDGE_PATH = "/ingestion/subscriptions/nudge";
+/**
+ * The shortest distance between two nudges that both do work.
+ *
+ * A chatty group can produce dozens of messages a minute, and each webhook
+ * would otherwise cost a full source read. Single-flight already collapses
+ * CONCURRENT nudges, but sequential ones arriving a second apart would each
+ * run a complete scan, so a busy chat would turn a 5-minute poll into a
+ * hundred. Five seconds keeps the latency a human would call instant while
+ * bounding the cost at twelve reads a minute in the worst case.
+ */
+export declare const DEFAULT_NUDGE_MIN_INTERVAL_MS = 5000;
+/**
+ * "Poll now", for a source that knows something changed.
+ *
+ * The poller exists because most sources can only be asked. A few can TELL:
+ * `wacli sync --webhook` POSTs every message as it arrives, so waiting up to a
+ * full interval to discover it is latency bought for nothing. This route is
+ * how a bridge that already has push says so, without either side learning the
+ * other's data model - the payload is ignored entirely, and the answer to
+ * "what changed?" is still the ordinary poll.
+ *
+ * Deliberately NOT a source-specific endpoint. It takes no body, names no app
+ * and carries no event: a bridge that can prove it should be listened to gets
+ * to say "now", and everything else about which items matched stays where it
+ * already is. That also means a second bridge needs no new route.
+ *
+ * Authentication is the daemon's ordinary bearer middleware. This path is not
+ * in `BEARER_AUTH_BYPASS_PATHS` and must never be added to it: an unauthorated
+ * caller could otherwise drive source reads at will, which is a rate-limit and
+ * cost amplifier against the aggregator, not merely a noisy endpoint.
+ */
+export declare function registerSubscriptionNudgeRoute(app: Express, deps: {
+    poller: Pick<SubscriptionPoller, "tick">;
+    logger: Logger;
+    now?: () => number;
+    minIntervalMs?: number;
+}): void;
+//# sourceMappingURL=nudge-route.d.ts.map

package/dist/server/server/ingestion/subscriptions/nudge-route.js

@@ -0,0 +1,67 @@
+export const SUBSCRIPTION_NUDGE_PATH = "/ingestion/subscriptions/nudge";
+/**
+ * The shortest distance between two nudges that both do work.
+ *
+ * A chatty group can produce dozens of messages a minute, and each webhook
+ * would otherwise cost a full source read. Single-flight already collapses
+ * CONCURRENT nudges, but sequential ones arriving a second apart would each
+ * run a complete scan, so a busy chat would turn a 5-minute poll into a
+ * hundred. Five seconds keeps the latency a human would call instant while
+ * bounding the cost at twelve reads a minute in the worst case.
+ */
+export const DEFAULT_NUDGE_MIN_INTERVAL_MS = 5000;
+/**
+ * "Poll now", for a source that knows something changed.
+ *
+ * The poller exists because most sources can only be asked. A few can TELL:
+ * `wacli sync --webhook` POSTs every message as it arrives, so waiting up to a
+ * full interval to discover it is latency bought for nothing. This route is
+ * how a bridge that already has push says so, without either side learning the
+ * other's data model - the payload is ignored entirely, and the answer to
+ * "what changed?" is still the ordinary poll.
+ *
+ * Deliberately NOT a source-specific endpoint. It takes no body, names no app
+ * and carries no event: a bridge that can prove it should be listened to gets
+ * to say "now", and everything else about which items matched stays where it
+ * already is. That also means a second bridge needs no new route.
+ *
+ * Authentication is the daemon's ordinary bearer middleware. This path is not
+ * in `BEARER_AUTH_BYPASS_PATHS` and must never be added to it: an unauthorated
+ * caller could otherwise drive source reads at will, which is a rate-limit and
+ * cost amplifier against the aggregator, not merely a noisy endpoint.
+ */
+export function registerSubscriptionNudgeRoute(app, deps) {
+    const now = deps.now ?? (() => Date.now());
+    const minIntervalMs = deps.minIntervalMs ?? DEFAULT_NUDGE_MIN_INTERVAL_MS;
+    let lastRanAt = Number.NEGATIVE_INFINITY;
+    app.post(SUBSCRIPTION_NUDGE_PATH, (_req, res) => {
+        const at = now();
+        if (at - lastRanAt < minIntervalMs) {
+            // 202, not 429: the caller did nothing wrong and needs no backoff. The
+            // event is covered by the tick that just ran or is about to, so the
+            // honest answer is "accepted, and folded into another read".
+            res.status(202).json({ ran: false, reason: "coalesced" });
+            return;
+        }
+        lastRanAt = at;
+        // Answered BEFORE the tick, on purpose. A webhook sender is not waiting to
+        // learn what matched, and `wacli` gives up on a slow endpoint; holding the
+        // response for a full source read would turn a slow aggregator into
+        // dropped deliveries upstream.
+        res.status(202).json({ ran: true });
+        void deps.poller
+            .tick()
+            .then((summary) => {
+            deps.logger.info({ ...summary, trigger: "nudge" }, "Subscription poll tick (nudged)");
+            return summary;
+        })
+            .catch((error) => {
+            // The response is already sent, so this is the only place the failure
+            // can surface. A bare catch here would make a wedged nudge path
+            // indistinguishable from a quiet one, which is the exact bug the tick
+            // logging in this same release exists to remove.
+            deps.logger.warn({ err: error }, "Nudged subscription poll tick failed");
+        });
+    });
+}
+//# sourceMappingURL=nudge-route.js.map

package/dist/server/server/ingestion/subscriptions/poller.d.ts

@@ -32,6 +32,17 @@ export interface PollSummary {
     sourcesRead: number;
     /** Filters evaluated against those reads, which costs CPU and not network. */
     filtersMatched: number;
+    /**
+     * ITEMS a filter accepted, which `filtersMatched` does not say.
+     *
+     * The two are read together or not at all. `filtersMatched: 1, itemsMatched: 0`
+     * is a filter that ran and rejected everything, which is where a mistyped
+     * `field` lands; `filtersMatched: 0` is a filter that never ran at all. Those
+     * are different bugs and the old summary could not tell them apart, which is
+     * exactly what made a wrong `field` cost an hour to find: a filter rooted at
+     * the item instead of the payload matches nothing, silently, forever.
+     */
+    itemsMatched: number;
     notified: number;
 }
 /**

package/dist/server/server/ingestion/subscriptions/poller.js

@@ -60,11 +60,25 @@ export class SubscriptionPoller {
      */
     async tick() {
         if (this.running) {
-            return { sourcesRead: 0, filtersMatched: 0, notified: 0 };
+            // Not silent. Single-flight is correct, but a tick that is ALWAYS skipped
+            // means the previous one never returned, and a wedged poller must not
+            // read as a quiet one.
+            this.options.logger.warn("Subscription poll tick skipped: the previous tick is still running");
+            return { sourcesRead: 0, filtersMatched: 0, itemsMatched: 0, notified: 0 };
         }
         this.running = true;
+        const startedAt = this.now();
         try {
-            return await this.runTick();
+            const summary = await this.runTick();
+            // Every tick, at info, unconditionally.
+            //
+            // A summary logged only when something happened is the same trap this
+            // line exists to remove: "nothing matched" and "no tick ran" would still
+            // look identical from the outside. One line per interval is cheap next to
+            // the runtime metrics this daemon already emits twice a minute, and it is
+            // the only evidence that the loop is alive at all.
+            this.options.logger.info({ ...summary, elapsedMs: this.now() - startedAt }, "Subscription poll tick");
+            return summary;
         }
         finally {
             this.running = false;
@@ -73,7 +87,12 @@ export class SubscriptionPoller {
     async runTick() {
         const { subscriptions, filterResolver, sourceStore, gatewayResolver, logger } = this.options;
         const armed = (await subscriptions.list()).filter((s) => s.status === "armed");
-        const summary = { sourcesRead: 0, filtersMatched: 0, notified: 0 };
+        const summary = {
+            sourcesRead: 0,
+            filtersMatched: 0,
+            itemsMatched: 0,
+            notified: 0,
+        };
         if (armed.length === 0) {
             return summary;
         }
@@ -131,6 +150,7 @@ export class SubscriptionPoller {
                         now: () => now,
                     });
                     summary.filtersMatched += 1;
+                    summary.itemsMatched += matched.length;
                     if (matched.length === 0)
                         continue;
                     const results = await this.options.notifier.notifyForFilter(filter, matched);

package/dist/server/server/session/chat/chat-ingestion-session.js

@@ -262,7 +262,11 @@ export class ChatIngestionSession {
                     cohortId: result.cohortId,
                     collapse: result.collapse,
                     report: result.report,
-                    targetCwd: filter.target.config.cwd,
+                    // Empty for a notify-only filter, which has no working directory
+                    // because it opens no session. The per-group skip reason in `report`
+                    // is what says why, so this stays a blank rather than a fabricated
+                    // path the user could mistake for somewhere work happened.
+                    targetCwd: filter.target.type === "new-agent" ? filter.target.config.cwd : "",
                     error: null,
                 },
             });

package/dist/server/utils/git-command-cache.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Per-repo cache for read-only git commands the daemon repeats many times a second
+ * (config --get, rev-parse, symbolic-ref, show-ref, ...). Every git spawn from the
+ * daemon used to cost about 100ms of blocked event loop, and the same questions
+ * were asked over and over.
+ *
+ * Correctness first:
+ * - Repo location answers are cached until the `.git` entry changes.
+ * - Config and ref answers are keyed by a fingerprint of cheap stat() calls (HEAD,
+ *   the ref files named in the command, packed-refs, FETCH_HEAD, repo/worktree/
+ *   global config) AND expire after a short TTL (PASEO_GIT_CACHE_TTL_MS, 5s). The
+ *   TTL is the backstop for what the fingerprint cannot see: include/includeIf
+ *   targets, vendor system configs, and updates to nested ref files
+ *   (refs/heads/feature/x) that do not touch any watched directory.
+ * - Working tree commands (status, ls-files --others, diff --shortstat) are never
+ *   cached: identical concurrent calls share one spawn, nothing more.
+ * - Anything with `@{...}` (upstream/push/reflog) is not cached at all.
+ * - Reftable repos are not cached.
+ * Any git command not on the read-only list invalidates the repo's entries.
+ */
+type CommandClass = 
+/** Answer depends only on where the repository is. */
+"location"
+/** Depends on config files. */
+ | "config"
+/** Depends on HEAD and refs. */
+ | "refs"
+/** Depends on the working tree: single-flight only, never kept after settling. */
+ | "worktree";
+export interface GitRepoDirs {
+    /** The `.git` entry (dir or gitfile) found walking up from cwd. */
+    dotGit: string;
+    /** Worktree-specific git dir (holds HEAD and index). */
+    gitDir: string;
+    /** Shared git dir (holds config, refs, packed-refs). */
+    commonDir: string;
+}
+export interface GitCacheStats {
+    hits: number;
+    misses: number;
+    coalesced: number;
+    invalidations: number;
+}
+export declare function isGitCacheEnabled(): boolean;
+export declare function isReadOnlyCommand(args: readonly string[]): boolean;
+/** Classify a command, or return null when it must not be cached. */
+export declare function classifyGitCommand(args: readonly string[]): CommandClass | null;
+export declare class GitCommandCache {
+    private readonly entries;
+    private readonly dirsByCwd;
+    private readonly generations;
+    readonly stats: GitCacheStats;
+    clear(): void;
+    /**
+     * Walk up from cwd to the `.git` entry and resolve worktree gitfiles and
+     * `commondir`. Pure filesystem work, no git spawn; cached per cwd briefly and
+     * re-validated by the `.git` entry still existing.
+     */
+    resolveRepoDirs(cwd: string): GitRepoDirs | null;
+    run<T>(args: readonly string[], cwd: string, env: Record<string, string | undefined> | undefined, extraKey: string, execute: () => Promise<T>): Promise<T>;
+    invalidate(commonDir: string): void;
+    private evictIfNeeded;
+}
+export declare function findRepoDirs(cwd: string): GitRepoDirs | null;
+export declare function getSharedGitCommandCache(): GitCommandCache;
+export {};
+//# sourceMappingURL=git-command-cache.d.ts.map