@jeffober/thatch 0.2.6 → 0.2.8

package/src/runtime.ts

@@ -177,6 +177,55 @@ export function guardDelivery(
   };
 }
 
+/** What the strand sweep should do, decided purely from enumerated session rows. */
+export interface StrandPlan {
+  /** Machinery sessions (this plugin's extraction children) to delete via the host. */
+  remove: string[];
+  /** Real sessions to relocate out of a dead directory, to their project's canonical checkout. */
+  move: { id: string; to: string }[];
+  /** Rows the sweep saw but deliberately left alone. */
+  skipped: number;
+}
+
+/**
+ * Decides, per session row, whether a stranded session gets deleted
+ * (machinery), moved (a real session whose directory is gone - the same
+ * outcome as opencode's manual "session location unavailable" recovery, minus
+ * the directory picking), or left alone. Everything hinges on the directory
+ * being dead on disk: a session in a live directory is someone's working
+ * state, however it looks. Host-created task children (parentId set) are
+ * always skipped - they are opencode's own records of subagent work,
+ * invisible in top-level session lists, and deleting them would break the
+ * parent transcript's subagent rendering.
+ */
+export function planStrandActions(input: {
+  sessions: { id: string; title: string; directory: string; parentId: string | null; projectId: string | null }[];
+  canonicalByProject: Record<string, string>;
+  pathExists: (path: string) => boolean;
+  /** When false (host has no move endpoint), real sessions count as skipped. */
+  canMove: boolean;
+}): StrandPlan {
+  const plan: StrandPlan = { remove: [], move: [], skipped: 0 };
+  for (const s of input.sessions) {
+    if (input.pathExists(s.directory)) continue;
+    if (isMachinerySessionTitle(s.title)) {
+      plan.remove.push(s.id);
+      continue;
+    }
+    if (s.parentId) {
+      plan.skipped++;
+      continue;
+    }
+    const canonical = s.projectId ? input.canonicalByProject[s.projectId] : undefined;
+    if (input.canMove && canonical && canonical !== s.directory && input.pathExists(canonical)) {
+      plan.move.push({ id: s.id, to: canonical });
+    } else {
+      plan.skipped++;
+    }
+  }
+  return plan;
+}
+
 export async function createRuntime(input: {
   capabilities: HostCapabilities;
   directory: string;
@@ -760,7 +809,25 @@ export async function createRuntime(input: {
     const ownDirectory = row.directory === directory;
     const isStartup = inheritSession !== undefined && row.sessionID === inheritSession;
     if (samePid && !ownDirectory) continue; // live sibling - untouched
-    if (!samePid && !ownDirectory) continue; // another location's instance owns these rows - its own restart cleans them
+    if (!samePid && !ownDirectory) {
+      // Another location's instance owns these rows - its own restart
+      // cleans them. Exception: a directory that no longer exists (a merged
+      // and deleted worktree) will never boot an instance again, so its
+      // journaled extraction children are stranded forever - the opencode
+      // session row is global and outlives this journal. Finalize the child
+      // through the host and drop the journal row; the strand sweep (below)
+      // is the backstop for corpses this journal never knew about.
+      if (row.kind === "child" && !existsSync(row.directory)) {
+        const rec = row.value as { kind?: "extraction" | "task" };
+        if (rec?.kind === "extraction") {
+          void caps.sessionDelete(row.sessionID).catch((err) =>
+            debug("strand-sweep", `dead-directory finalize failed for ${row.sessionID}: ${err}`),
+          );
+          db.runtimeStateDelete(row.kind, row.sessionID);
+        }
+      }
+      continue;
+    }
     if (!samePid && !isStartup) {
       // Watcher definitions survive a restart as DORMANT rows instead of
       // being pruned: the defining session's harness died with the old
@@ -794,6 +861,20 @@ export async function createRuntime(input: {
         // consumption.
         continue;
       }
+      // Restart-window leak fix (same as the child-row branch below): the
+      // child's opencode session row is global and outlives this journal,
+      // so an extraction child whose idle event died with the old process
+      // must be finalized through the host before the row goes. Task
+      // children and kindless pre-marker rows are left to the strand
+      // sweep's title-based pass.
+      if (row.kind === "child") {
+        const rec = row.value as { kind?: "extraction" | "task" };
+        if (rec?.kind === "extraction") {
+          void caps.sessionDelete(row.sessionID).catch((err) =>
+            debug("strand-sweep", `restart finalize failed for ${row.sessionID}: ${err}`),
+          );
+        }
+      }
       db.runtimeStateDelete(row.kind, row.sessionID);
       continue;
     }
@@ -849,6 +930,18 @@ export async function createRuntime(input: {
         if (inheritSession !== undefined && rec?.parentID === inheritSession && Array.isArray(rec.snapshot)) {
           for (const interaction of rec.snapshot) extraction.push(interaction);
         }
+        // Restart-window leak fix: the child's opencode session row is
+        // global and outlives this journal, so an extraction child whose
+        // idle event died with the old process would sit in the session
+        // picker forever (and `-c` can land in it). Finalize through the
+        // host, best-effort. Kindless pre-marker rows are left to the
+        // strand sweep's title-based pass, which never touches
+        // host-created task children.
+        if (rec?.kind === "extraction") {
+          void caps.sessionDelete(row.sessionID).catch((err) =>
+            debug("strand-sweep", `restart finalize failed for ${row.sessionID}: ${err}`),
+          );
+        }
         db.runtimeStateDelete(row.kind, row.sessionID);
         continue;
       }
@@ -1146,6 +1239,102 @@ export async function createRuntime(input: {
   };
   void reconcileRestoredChildren();
 
+  // Self-heal for sessions stranded in directories that no longer exist
+  // (merged + deleted worktrees): opencode v2 records the directory on
+  // every session, and opening a stranded one boots a dead path and shows
+  // the "session location unavailable" recovery dialog. Machinery corpses
+  // (this plugin's extraction children, leaked by pre-2.0.22 hosts or a
+  // daemon restart mid-extraction) are deleted; REAL sessions are moved to
+  // their project's canonical checkout - never deleted. Runs at setup and
+  // on an interval, because worktrees die while the daemon lives on. The
+  // host supplies the enumeration (v1: client list; v2: readonly
+  // opencode.db read) and the move/delete endpoints; every leg degrades
+  // silently. Concurrent instances each run their own sweep - the actions
+  // are idempotent (a second delete of the same corpse throws NotFound
+  // into the catch, a second move lands on an already-moved session).
+  let sweepInFlight = false;
+  const sweepStrandedSessions = async (trigger: string): Promise<void> => {
+    // Kill switch read at call time: tests set THATCH_STRAND_SWEEP=off so
+    // the boot sweep never acts on the developer's real opencode.db through
+    // test mocks, and an operator can disarm the sweep without a rebuild.
+    const gate = process.env.THATCH_STRAND_SWEEP;
+    if (gate === "0" || gate === "false" || gate === "off") return;
+    if (disposed || sweepInFlight) return;
+    sweepInFlight = true;
+    try {
+      let enumerated: Awaited<ReturnType<typeof caps.enumerateSessions>> = null;
+      try {
+        enumerated = await caps.enumerateSessions();
+      } catch (err) {
+        debug("strand-sweep", `enumerate failed (${trigger}): ${err}`);
+        return;
+      }
+      if (!enumerated || disposed) return;
+      debug(
+        "strand-sweep",
+        `enumerated ${enumerated.sessions.length} session row(s), ${Object.keys(enumerated.canonicalByProject).length} project(s) [${trigger}]`,
+      );
+      const plan = planStrandActions({
+        sessions: enumerated.sessions,
+        canonicalByProject: enumerated.canonicalByProject,
+        pathExists: (p) => existsSync(p),
+        canMove: typeof caps.sessionMove === "function",
+      });
+      let removed = 0;
+      let moved = 0;
+      for (const id of plan.remove) {
+        if (disposed) return;
+        try {
+          await caps.sessionDelete(id);
+          // The journal row may exist for restart-window children; a
+          // historical corpse has none, and a no-op delete is fine.
+          db.runtimeStateDelete("child", id);
+          removed++;
+        } catch (err) {
+          debug("strand-sweep", `remove failed for ${id} (${trigger}): ${err}`);
+        }
+      }
+      for (const m of plan.move) {
+        if (disposed) return;
+        try {
+          await caps.sessionMove?.(m.id, m.to);
+          moved++;
+        } catch (err) {
+          debug("strand-sweep", `move failed for ${m.id} (${trigger}): ${err}`);
+        }
+      }
+      if (removed + moved > 0) {
+        debug(
+          "strand-sweep",
+          `healed ${removed + moved} stranded session(s): ${moved} moved, ${removed} removed, ${plan.skipped} skipped [${trigger}]`,
+        );
+        try {
+          await caps.showToast({
+            message: `[thatch] healed ${removed + moved} stranded session${removed + moved === 1 ? "" : "s"} from dead worktrees (${moved} moved, ${removed} removed)`,
+            variant: "info",
+            duration: 6000,
+          });
+        } catch {
+          // TUI may not be connected (headless mode).
+        }
+      }
+    } finally {
+      sweepInFlight = false;
+    }
+  };
+  const STRAND_SWEEP_INTERVAL_MS = 6 * 60 * 60 * 1000;
+  let strandSweepTimer: ReturnType<typeof setInterval> | undefined;
+  const armStrandSweep = () => {
+    // Env override read at call time per house convention (test/ops knob).
+    const ms = Number(process.env.THATCH_STRAND_SWEEP_MS) || STRAND_SWEEP_INTERVAL_MS;
+    strandSweepTimer = setInterval(() => {
+      void sweepStrandedSessions("interval");
+    }, ms);
+    strandSweepTimer.unref?.();
+  };
+  void sweepStrandedSessions("boot");
+  armStrandSweep();
+
   // Skills always install to the global opencode config - installing into the
   // worktree would mutate the user's repo (untracked files in git status).
   // A failed install degrades the nudge workflow but must not kill the plugin.
@@ -2283,6 +2472,7 @@ export async function createRuntime(input: {
     dispose: async () => {
       disposed = true;
       stopVersionChecker();
+      if (strandSweepTimer) clearInterval(strandSweepTimer);
       watchers.dispose();
       chatPoller.dispose();
       try {

package/src/session-db.ts

@@ -60,8 +60,11 @@ export function resolveOpencodeDbPath(): string | null {
  * database - the same pick the TUI makes from client.session.list(), which
  * the v2 plugin context cannot call (its session domain has no list) and
  * which would arrive too late for the runtime's synchronous rehydration
- * partition regardless. Null when the db is unavailable or no top-level
- * session exists in the directory.
+ * partition regardless. Prefers the v2 `session_v2` table when the database
+ * has one: v2-era sessions live there and the legacy `session` table only
+ * holds pre-migration rows, so a v1-table read under a v2 daemon would
+ * resolve -c from years-old sessions. Null when the db is unavailable or no
+ * top-level session exists in the directory.
  */
 export function mostRecentTopLevelSessionId(directory: string): string | null {
   const dbPath = resolveOpencodeDbPath();
@@ -73,11 +76,18 @@ export function mostRecentTopLevelSessionId(directory: string): string | null {
     return null;
   }
   try {
-    const row = db
-      .query(
-        "SELECT id FROM session WHERE directory = ? AND (parent_id IS NULL OR parent_id = '') ORDER BY time_updated DESC LIMIT 1",
-      )
-      .get(directory) as { id: string } | null;
+    const v2 = hasV2SessionTables(db);
+    const row = v2
+      ? (db
+          .query(
+            "SELECT id FROM session_v2 WHERE directory = ? AND (parent_id IS NULL OR parent_id = '') ORDER BY time_updated DESC LIMIT 1",
+          )
+          .get(directory) as { id: string } | null)
+      : (db
+          .query(
+            "SELECT id FROM session WHERE directory = ? AND (parent_id IS NULL OR parent_id = '') ORDER BY time_updated DESC LIMIT 1",
+          )
+          .get(directory) as { id: string } | null);
     return row?.id ?? null;
   } catch {
     return null;
@@ -86,6 +96,88 @@ export function mostRecentTopLevelSessionId(directory: string): string | null {
   }
 }
 
+/** True when the database carries opencode v2's session tables. */
+function hasV2SessionTables(db: Database): boolean {
+  const row = db
+    .query("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'session_v2'")
+    .get() as { name: string } | undefined;
+  return row?.name === "session_v2";
+}
+
+/** One session row as the stranded-session sweep sees it (host-agnostic shape). */
+export interface SweepSessionRow {
+  id: string;
+  title: string;
+  directory: string;
+  /** Host link for subagent children; null for top-level sessions. */
+  parentId: string | null;
+  /** v2 project id (joins to the project table's canonical worktree). Null on v1 rows. */
+  projectId: string | null;
+}
+
+/** Everything the strand sweep needs from one readonly pass over opencode.db. */
+export interface SweepEnumeration {
+  sessions: SweepSessionRow[];
+  /** Project id -> canonical checkout directory. Empty on v1 (no project rows read). */
+  canonicalByProject: Record<string, string>;
+}
+
+/**
+ * Enumerates every session row opencode has, plus each project's canonical
+ * checkout directory, in one readonly pass. Prefers the v2 tables
+ * (session_v2 + project) and falls back to the v1 `session` table when the
+ * database predates them. Returns null when the db is missing, unreadable,
+ * or its schema has drifted past these column names - the strand sweep
+ * treats null as "nothing known, do nothing". The sweep's deletions and
+ * moves go through the host's own session endpoints; this read only ever
+ * NAMES candidates, so a stale or partial read can never corrupt anything.
+ */
+export function enumerateSweepSessions(): SweepEnumeration | null {
+  const dbPath = resolveOpencodeDbPath();
+  if (!dbPath) return null;
+  let db: Database;
+  try {
+    db = new Database(dbPath, { readonly: true });
+  } catch {
+    return null;
+  }
+  try {
+    const v2 = hasV2SessionTables(db);
+    const sessions: SweepSessionRow[] = v2
+      ? (db
+          .query("SELECT id, title, directory, parent_id, project_id FROM session_v2")
+          .all() as { id: string; title: string | null; directory: string; parent_id: string | null; project_id: string | null }[]
+        ).map((r) => ({
+          id: r.id,
+          title: r.title ?? "",
+          directory: r.directory,
+          parentId: r.parent_id ?? null,
+          projectId: r.project_id ?? null,
+        }))
+      : (db
+          .query("SELECT id, title, directory, parent_id FROM session")
+          .all() as { id: string; title: string | null; directory: string; parent_id: string | null }[]).map((r) => ({
+          id: r.id,
+          title: r.title ?? "",
+          directory: r.directory,
+          parentId: r.parent_id ?? null,
+          projectId: null,
+        }));
+    const canonicalByProject: Record<string, string> = {};
+    if (v2) {
+      const projectRows = db
+        .query("SELECT id, worktree FROM project")
+        .all() as { id: string; worktree: string }[];
+      for (const r of projectRows) canonicalByProject[r.id] = r.worktree;
+    }
+    return { sessions, canonicalByProject };
+  } catch {
+    return null;
+  } finally {
+    db.close();
+  }
+}
+
 export interface SessionRow {
   id: string;
   title: string;

package/src/tool-defs.ts

@@ -2139,7 +2139,10 @@ const chatRegisterDef: ToolDef = {
 
 /** Lists registered sessions with liveness. Stale means the session's host
  *  process has not heartbeat-ed it recently - it is gone or hung. Fresh
- *  rows split into open (a tab is open now) and recent (no known tab). */
+ *  rows split into open (a tab is open now) and recent (no known tab).
+ *  The three sections render unguarded by design, unlike the CLI's
+ *  --recent/--stale guards: an agent choosing a recipient always needs
+ *  the full directory, including the tab-less rows it may still reach. */
 const chatListDef: ToolDef = {
   name: "chat_list",
   description:
@@ -2159,7 +2162,7 @@ const chatListDef: ToolDef = {
     }
     const unread = ctx.db.unreadChatCount(identity.sessionID);
     const openTabs = ctx.openTabs?.() ?? new Set<string>();
-    const { active, stale } = splitChatRoster(sortChatRoster(sessions));
+    const { active, recent, stale } = splitChatRoster(sortChatRoster(sessions), Date.now(), null, openTabs);
     const line = (s: (typeof sessions)[number]) => {
       const self = s.session_id === identity.sessionID;
       const liveness = chatLiveness(s, Date.now(), openTabs);
@@ -2177,6 +2180,15 @@ const chatListDef: ToolDef = {
     if (active.length > 0) {
       sections.push(`# Active Sessions\n\n${active.map(line).join("\n")}`);
     }
+    if (recent.length > 0) {
+      sections.push(
+        `# Recent Sessions\n\n` +
+          `_These sessions are alive but have no open tab: a wake may not reach them ` +
+          `until their tab reopens, though headless subordinates may still read mail ` +
+          `on their own turns._\n\n` +
+          `${recent.map(line).join("\n")}`,
+      );
+    }
     if (stale.length > 0) {
       sections.push(
         `# Stale Sessions\n\n` +