@jpcasabiancai/cayenne 0.5.1 → 0.5.3

package/dist/cli.js

@@ -301,7 +301,8 @@ var init_repositories = __esm({
     });
     RepositoryList = z4.object({
       repositories: z4.array(RepositoryListItem).max(2e3),
-      connected: z4.boolean()
+      connected: z4.boolean(),
+      reason: z4.literal("github_not_installed").optional()
     });
     REPOSITORY_LIST_ERRORS = [
       "unauthorized",
@@ -325,7 +326,12 @@ var init_repositories = __esm({
       fullName: z4.string().min(1)
     });
     RepoSessionTokenRequest = z4.strictObject({ sessionId: z4.uuid() });
-    REPO_READ_ONLY_REASONS = ["not_connected", "no_expiry", "scope_refused"];
+    REPO_READ_ONLY_REASONS = [
+      "not_connected",
+      "no_expiry",
+      "scope_refused",
+      "github_not_installed"
+    ];
     RepoReadOnlyReason = z4.enum(REPO_READ_ONLY_REASONS);
     RepoSessionToken = z4.discriminatedUnion("connected", [
       z4.object({
@@ -354,6 +360,7 @@ var init_repositories = __esm({
       "not_recent",
       "not_found",
       "not_installed",
+      "github_not_installed",
       "archived",
       "repository_mismatch",
       "not_configured",
@@ -460,7 +467,7 @@ var init_skills = __esm({
 
 // ../../packages/shared/src/protocol/integrations.ts
 import { z as z6 } from "zod";
-var INTEGRATION_PROVIDERS, AUTH_KINDS, both, PROVIDER_META, IntegrationProviderSchema, AuthKindSchema, ProviderConfigPublic, ConnectStartRequest, ConnectStartResponse, ConnectCompleteRequest, DisconnectRequest, MessageResourceKind, ReplyRequest, ReplyResponse, ResourceList, SetSubscriptionsRequest, INBOX_ERROR_CODES, InboxErrorCode, CONVERSATION_KINDS, ConversationKind;
+var INTEGRATION_PROVIDERS, AUTH_KINDS, both, PROVIDER_META, IntegrationProviderSchema, AuthKindSchema, ProviderConfigPublic, ConnectStartRequest, ConnectStartResponse, ConnectCompleteRequest, DisconnectRequest, GithubInstallationId, GithubAccountLogin, GithubAccountType, GithubAvatarUrl, GithubInstallation, GithubAvailableInstallation, GithubInstallationList, GithubBindRequest, GithubBindResponse, GithubUnbindRequest, GithubUnbindResponse, MessageResourceKind, ReplyRequest, ReplyResponse, ResourceList, SetSubscriptionsRequest, INBOX_ERROR_CODES, InboxErrorCode, CONVERSATION_KINDS, ConversationKind;
 var init_integrations = __esm({
   "../../packages/shared/src/protocol/integrations.ts"() {
     "use strict";
@@ -513,9 +520,10 @@ var init_integrations = __esm({
       github: {
         label: "GitHub",
         badge: "GH",
-        paths: { native: { stage: 1 }, composio: { stage: 3, toolkit: "github" }, platform: null },
-        capabilities: { messages: [], tasks: both() },
-        webhook: { fn: "github-webhook", params: ["ws"] }
+        // The Cayenne GitHub App (D57), a team workspace's platform path; Composio is Stage 3.
+        paths: { native: null, composio: { stage: 3, toolkit: "github" }, platform: { stage: 1 } },
+        capabilities: { messages: [], tasks: ["composio", "platform"] },
+        webhook: { fn: "github-webhook", params: [] }
       },
       monday: {
         label: "Monday.com",
@@ -577,11 +585,49 @@ var init_integrations = __esm({
     ConnectStartRequest = z6.strictObject({
       workspaceId: z6.uuid(),
       provider: IntegrationProviderSchema,
-      acknowledged: z6.boolean().optional()
+      acknowledged: z6.boolean().optional(),
+      intent: z6.enum(["connect", "install"]).optional()
+    }).superRefine((r, ctx) => {
+      if (r.intent === "install" && r.provider !== "github") {
+        ctx.addIssue({ code: "custom", path: ["intent"], message: "install is GitHub only" });
+      }
     });
     ConnectStartResponse = z6.object({ url: z6.url({ protocol: /^https$/ }) });
     ConnectCompleteRequest = z6.strictObject({ pendingId: z6.uuid() });
     DisconnectRequest = z6.strictObject({ integrationId: z6.uuid() });
+    GithubInstallationId = z6.number().int().positive();
+    GithubAccountLogin = z6.string().min(1).max(100);
+    GithubAccountType = z6.enum(["Organization", "User"]);
+    GithubAvatarUrl = z6.url({
+      protocol: /^https$/,
+      hostname: /^avatars[.]githubusercontent[.]com$/
+    });
+    GithubInstallation = z6.object({
+      id: z6.uuid(),
+      installationId: GithubInstallationId,
+      accountLogin: GithubAccountLogin,
+      accountType: GithubAccountType,
+      avatarUrl: GithubAvatarUrl,
+      addedBy: z6.object({ id: z6.uuid(), displayName: z6.string().nullable() }).nullable(),
+      createdAt: z6.string()
+    });
+    GithubAvailableInstallation = z6.object({
+      installationId: GithubInstallationId,
+      accountLogin: GithubAccountLogin,
+      accountType: GithubAccountType,
+      avatarUrl: GithubAvatarUrl
+    });
+    GithubInstallationList = z6.object({
+      bound: z6.array(GithubInstallation),
+      available: z6.array(GithubAvailableInstallation)
+    });
+    GithubBindRequest = z6.strictObject({
+      workspaceId: z6.uuid(),
+      installationId: GithubInstallationId
+    });
+    GithubBindResponse = z6.object({ binding: GithubInstallation });
+    GithubUnbindRequest = z6.strictObject({ workspaceId: z6.uuid(), bindingId: z6.uuid() });
+    GithubUnbindResponse = z6.object({ orphaned: z6.number().int().nonnegative() });
     MessageResourceKind = z6.enum(["clickup_team", "teams_channel", "teams_chat"]);
     ReplyRequest = z6.strictObject({
       messageId: z6.uuid(),
@@ -2126,27 +2172,45 @@ async function updateRunner(db, runnerId, columns) {
 }
 async function stamp(db, runnerId, status, what) {
   const { data, error } = await db.from("runners").update({ status, last_seen_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", runnerId).select("id");
-  if (error) logger.warn({ runnerId, err: error.message }, `${what} write failed`);
-  else if (!data || data.length === 0) logger.warn({ runnerId }, `${what} matched no runner row`);
+  if (error) {
+    logger.warn({ runnerId, err: error.message }, `${what} write failed`);
+    return "error";
+  }
+  return data && data.length > 0 ? "ok" : "missing";
 }
 function startHeartbeat(db, runnerId, intervalMs, refresh, published, current) {
   const seed = published ? RunnerCapabilities.safeParse(published) : null;
   let last = seed?.success ? JSON.stringify(seed.data) : null;
   let stopped = false;
   let writes = Promise.resolve();
-  const tick = () => stamp(db, runnerId, "online", "heartbeat").catch(
-    (err) => logger.warn({ runnerId, err }, "heartbeat write failed")
-  );
+  let misses = 0;
+  const tick = async () => {
+    let outcome;
+    try {
+      outcome = await stamp(db, runnerId, "online", "heartbeat");
+    } catch (err) {
+      logger.warn({ runnerId, err }, "heartbeat write failed");
+      return;
+    }
+    if (outcome === "missing") {
+      if (misses === 0) logger.warn({ runnerId }, "heartbeat matched no runner row");
+      misses += 1;
+    } else if (outcome === "ok" && misses > 0) {
+      logger.info({ runnerId, misses }, "heartbeat matched its runner row again");
+      misses = 0;
+    }
+  };
   const timer = setInterval(() => void tick(), intervalMs);
   const write = async (caps) => {
     const json = JSON.stringify(caps);
     if (stopped || json === last) return;
     try {
-      const { error } = await db.from("runners").update({ capabilities: caps }).eq("id", runnerId);
+      const { data, error } = await db.from("runners").update({ capabilities: caps }).eq("id", runnerId).select("id");
       if (error) {
         logger.warn({ runnerId, err: error.message }, "capability refresh failed");
         return;
       }
+      if (!data || data.length === 0) return;
       last = json;
     } catch (err) {
       logger.warn({ runnerId, err }, "capability refresh failed");
@@ -2182,7 +2246,9 @@ function startHeartbeat(db, runnerId, intervalMs, refresh, published, current) {
   };
 }
 async function markOffline(db, runnerId) {
-  await stamp(db, runnerId, "offline", "markOffline");
+  if (await stamp(db, runnerId, "offline", "markOffline") === "missing") {
+    logger.warn({ runnerId }, "markOffline matched no runner row");
+  }
 }
 var UNCLAIMED_PROFILE, IDENTITY_ATTEMPTS, IDENTITY_RETRY_MS, wait, CAPABILITIES_REFRESH_MS;
 var init_registry2 = __esm({
@@ -2811,7 +2877,7 @@ var init_dispatcher = __esm({
 
 // src/commands/source.ts
 import { LRUCache } from "lru-cache";
-var STOPPING, REJOIN_MIN_MS, REJOIN_MAX_MS, SOCKET_RESET_MS, DRAIN_WHILE_DOWN_MS, DRAIN_READ_TIMEOUT_MS, LOST, messageOf2, byCreatedAt, GIT_READ_KINDS, GIT_WORKTREE_KINDS, laneOf, CommandSource;
+var STOPPING, REJOIN_MIN_MS, REJOIN_MAX_MS, SOCKET_RESET_MS, DRAIN_WHILE_DOWN_MS, DRAIN_READ_TIMEOUT_MS, DORMANT_PROBE_MS, LOST, messageOf2, byCreatedAt, GIT_READ_KINDS, GIT_WORKTREE_KINDS, laneOf, CommandSource;
 var init_source = __esm({
   "src/commands/source.ts"() {
     "use strict";
@@ -2823,6 +2889,7 @@ var init_source = __esm({
     SOCKET_RESET_MS = 6e4;
     DRAIN_WHILE_DOWN_MS = 5e3;
     DRAIN_READ_TIMEOUT_MS = 5e3;
+    DORMANT_PROBE_MS = 6e4;
     LOST = /* @__PURE__ */ new Set(["CHANNEL_ERROR", "TIMED_OUT", "CLOSED"]);
     messageOf2 = (err) => err instanceof Error ? err.message : String(err);
     byCreatedAt = (a, b) => Date.parse(a.created_at) - Date.parse(b.created_at) || a.id.localeCompare(b.id);
@@ -2850,6 +2917,8 @@ var init_source = __esm({
         this.now = opts.now ?? Date.now;
         this.secrets = opts.secrets ?? secrets;
         this.timings = opts.timings;
+        this.owner = opts.owner;
+        this.onOwnRowVisibility = opts.onOwnRowVisibility;
       }
       db;
       runnerId;
@@ -2887,11 +2956,18 @@ var init_source = __esm({
       downDrain = null;
       /** Whether the live channel's last status was `SUBSCRIBED`. */
       subscribed = false;
+      /**
+       * The last probe of this runner's own row found it invisible (S-42, 0039): no joins, no drain
+       * timer, a probe every `DORMANT_PROBE_MS`. Set with one error line, cleared with one info line.
+       */
+      dormant = false;
       /** Drain reads that failed in a row; only the first of a streak is logged as an error. */
       drainFailures = 0;
       /** Broadcasts and pointers held back while a drain is in flight; see `drain()` for why. */
       pending = [];
       timings;
+      owner;
+      onOwnRowVisibility;
       /** Join `runner:{id}` at once; no connectedness check, since `subscribe` connects the socket. */
       async start() {
         this.drainWhileDown();
@@ -2963,9 +3039,15 @@ var init_source = __esm({
           this.attempts = 0;
           this.socketDownSince = null;
           this.subscribed = true;
+          if (this.dormant) this.wake();
           void this.drain();
         } else if (LOST.has(status)) {
           this.subscribed = false;
+          if (this.dormant) {
+            this.abandon(ch);
+            this.goDormant();
+            return;
+          }
           this.drainWhileDown();
           this.abandon(ch);
           this.scheduleRejoin(status);
@@ -3012,6 +3094,16 @@ var init_source = __esm({
        * instance is created. A socket that is down gets a `connect()` and no join: it buffers every
        * push while down and flushes them all on reopen, so a join per attempt through a long outage
        * would arrive as a burst of joins and leaves.
+       *
+       * On a connected socket, this runner's own row is read before the join (BACKLOG S-42, 0039). A
+       * channel lost while the socket is up is either transient or a refusal: once the owner is
+       * removed from the runner's workspace, Realtime closes `runner:{id}` and answers every rejoin
+       * `CHANNEL_ERROR`, the same status an outage reports. The row tells the two apart without
+       * matching Realtime's error text, for one REST read per attempt: `runners_select` is
+       * `is_member(workspace_id)` and a runner never lives in a personal space (0034), so the row is
+       * visible to the owner exactly while `owns_runner` holds. Invisible, or a row that no longer names
+       * this owner in its workspace (`owner`) → dormant (see `goDormant`). A read that fails says nothing
+       * either way, and never blocks recovery: the attempt joins.
        */
       async rejoin() {
         await this.removal;
@@ -3023,6 +3115,13 @@ var init_source = __esm({
             return;
           }
           this.socketDownSince = null;
+          const visible = await this.ownRowVisible();
+          if (this.stopped) return;
+          if (visible === false) {
+            this.goDormant();
+            return;
+          }
+          if (visible && this.dormant) this.wake();
           const ch = this.runnerChannel();
           if (this.abandoned.has(ch)) {
             this.log.warn({ attempt: this.attempts }, "runner channel still held after leaving it");
@@ -3040,6 +3139,63 @@ var init_source = __esm({
           this.scheduleRejoin("JOIN_FAILED");
         }
       }
+      /**
+       * Whether the owner this daemon logs in as can see this runner's row, still naming them in the
+       * workspace it registered in: `true`, `false`, or `null` when the read failed, threw or timed out
+       * (bounded like a drain read). Never rejects.
+       */
+      async ownRowVisible() {
+        try {
+          const { data, error } = await this.db.from("runners").select("id, user_id, workspace_id").eq("id", this.runnerId).abortSignal(AbortSignal.timeout(DRAIN_READ_TIMEOUT_MS)).maybeSingle();
+          if (!error) {
+            if (data === null) return false;
+            const { owner } = this;
+            return !owner || data.user_id === owner.userId && data.workspace_id === owner.workspaceId;
+          }
+          this.log.warn({ err: error.message }, "could not read this runner's own row; rejoining");
+        } catch (err) {
+          this.log.warn({ err: messageOf2(err) }, "could not read this runner's own row; rejoining");
+        }
+        return null;
+      }
+      /**
+       * Stop asking for commands nobody may send (S-42, 0039): no join (Realtime would refuse it), no
+       * drain timer (RLS hides every row), and one error line on entering, not one per probe. The next
+       * attempt is a probe `DORMANT_PROBE_MS` away, in the rejoin slot so `stop()` clears it, and it
+       * does not move the backoff.
+       */
+      goDormant() {
+        this.stopDrainWhileDown();
+        if (!this.dormant) {
+          this.dormant = true;
+          this.log.error(
+            { runnerId: this.runnerId },
+            "this runner's own row is not visible to its owner, or no longer names this owner in its workspace: the owner left the runner's workspace, or the row was deleted or replaced; commands are paused until it is visible again"
+          );
+          this.tell(false);
+        }
+        if (this.rejoinTimer) return;
+        this.rejoinTimer = setTimeout(() => {
+          this.rejoinTimer = null;
+          void this.rejoin();
+        }, DORMANT_PROBE_MS);
+      }
+      /** The row is visible again: rejoin from the backoff's first step, draining meanwhile. */
+      wake() {
+        this.dormant = false;
+        this.attempts = 0;
+        this.log.info({ runnerId: this.runnerId }, "runner row visible again; rejoining");
+        this.drainWhileDown();
+        this.tell(true);
+      }
+      /** `onOwnRowVisibility`, kept from ever breaking the source. */
+      tell(visible) {
+        try {
+          this.onOwnRowVisibility?.(visible);
+        } catch (err) {
+          this.log.warn({ visible, err: messageOf2(err) }, "own-row visibility listener threw");
+        }
+      }
       /**
        * Ask a down socket to connect. Once attempts have found it down for `SOCKET_RESET_MS`, tear it
        * down first: `connect()` returns early while the client still holds a conn, and a conn whose
@@ -3774,13 +3930,14 @@ function writeShim(path, body) {
 function shellQuote(value) {
   return `'${value.replaceAll("'", String.raw`'\''`)}'`;
 }
-var READ_ONLY_NOT_CONNECTED, READ_ONLY_NO_EXPIRY, READ_ONLY_SCOPE_REFUSED, READ_ONLY_UNAVAILABLE, CREDENTIAL_HELPER, NO_SSH_TEXT, READ_ONLY_IDENTITY, GH_SHIM, NO_SSH_SHIM, GIT_NOT_FOUND_TEXT, GH_CONFIG, READONLY_BIN, NO_SSH, GIT_HOME, GIT_BIN, NETRC_NAME, CURLRC_NAME, NETRC_VALUE_KEYS;
+var READ_ONLY_NOT_CONNECTED, READ_ONLY_NO_EXPIRY, READ_ONLY_GITHUB_NOT_INSTALLED, READ_ONLY_SCOPE_REFUSED, READ_ONLY_UNAVAILABLE, CREDENTIAL_HELPER, NO_SSH_TEXT, READ_ONLY_IDENTITY, GH_SHIM, NO_SSH_SHIM, GIT_NOT_FOUND_TEXT, GH_CONFIG, READONLY_BIN, NO_SSH, GIT_HOME, GIT_BIN, NETRC_NAME, CURLRC_NAME, NETRC_VALUE_KEYS;
 var init_credentials = __esm({
   "src/repos/credentials.ts"() {
     "use strict";
     init_introspect();
     READ_ONLY_NOT_CONNECTED = "Cayenne: this repository chat is read-only because you have not connected GitHub. Connect it in Settings \u2192 Integrations, then send your next message here.";
-    READ_ONLY_NO_EXPIRY = `Cayenne: this repository chat is read-only on this runner because your GitHub token never expires, and Cayenne lends only expiring tokens to another member's runner. Ask a workspace admin to turn on "Expire user authorization tokens" for the workspace's GitHub App, reconnect GitHub in Settings \u2192 Integrations, then send your next message here.`;
+    READ_ONLY_NO_EXPIRY = "Cayenne: this repository chat is read-only on this runner because your GitHub token never expires, and Cayenne lends only expiring tokens to another member's runner. Reconnect GitHub in Settings \u2192 Integrations to get a token that expires, then send your next message here.";
+    READ_ONLY_GITHUB_NOT_INSTALLED = "Cayenne: this repository chat is read-only because this repository's GitHub organisation is not connected to this workspace. Add it in Settings \u2192 Integrations, then send your next message here.";
     READ_ONLY_SCOPE_REFUSED = "Cayenne: this repository chat is read-only because GitHub would not give your token access to this repository; your GitHub account may not have access to it. Send another message here once it does.";
     READ_ONLY_UNAVAILABLE = "Cayenne: this repository chat could not get your GitHub token, so pushing is off for now. Send another message to retry.";
     CREDENTIAL_HELPER = String.raw`!f() { test "$1" = get || exit 0; if [ -n "$GH_TOKEN" ]; then echo username=x-access-token; echo "password=$GH_TOKEN"; else printf '%s\n' "$CAYENNE_READ_ONLY" >&2; exit 1; fi; }; f`;
@@ -6093,13 +6250,16 @@ async function failureCode(error, signal) {
 function cloneRefusal(code, slug) {
   switch (code) {
     case "not_installed":
-      return `VALIDATION: ${slug} is not in the workspace's GitHub App installation`;
+      return `VALIDATION: ${slug} is not in the Cayenne GitHub App's installation`;
+    // D57: the repository's installation is not bound to this workspace, or there is none.
+    case "github_not_installed":
+      return `VALIDATION: ${slug}'s GitHub organisation is not connected to this workspace; add it in Settings \u2192 Integrations`;
     case "repository_mismatch":
       return `VALIDATION: ${slug} was renamed or replaced on GitHub; pick it again`;
     case "bad_default_branch":
       return `VALIDATION: ${slug}'s default branch is not a branch name Cayenne accepts`;
     case "permissions_pending":
-      return "PROVIDER_ERROR: the workspace GitHub App needs Contents access; an admin must approve the new permissions on GitHub";
+      return "PROVIDER_ERROR: the Cayenne GitHub App needs Contents access; an admin must approve the new permissions on GitHub";
     // Also a private key GitHub refuses or a deleted App: only an admin can fix either.
     case "not_configured":
       return "PROVIDER_ERROR: GitHub is not set up correctly for this workspace; ask an admin";
@@ -6211,10 +6371,12 @@ var init_roster = __esm({
         });
         return this.inflight;
       }
-      /** The runner owner while a member, or a listed member who still is one. */
+      /**
+       * The runner owner, or a listed member who is still a workspace member — and nobody at all
+       * while the owner is not a member of the runner's workspace (0039).
+       */
       serves(userId) {
-        if (userId === this.deps.runnerUserId) return this.ownerIsMember;
-        return this.allowedMemberIds.includes(userId);
+        return this.ownerIsMember && (userId === this.deps.runnerUserId || this.allowedMemberIds.includes(userId));
       }
       /**
        * False once `ROSTER_FAIL_CLOSED_AFTER` refresh intervals have passed with no successful read,
@@ -6240,16 +6402,20 @@ var init_roster = __esm({
         if (channel) await this.deps.db.removeChannel(channel);
       }
       async load() {
-        const { db, runnerId, workspaceId, runnerUserId, log } = this.deps;
+        const { db, runnerId, workspaceId, runnerUserId } = this.deps;
         const runner = await this.withTimeout(
-          db.from("runners").select("allowed_member_ids").eq("id", runnerId).single(),
+          db.from("runners").select("allowed_member_ids, user_id, workspace_id").eq("id", runnerId).maybeSingle(),
           `could not read allowed_member_ids for runner ${runnerId}: timed out`
         );
-        if (runner.error || !runner.data) {
+        if (runner.error) {
           throw new Error(
-            `could not read allowed_member_ids for runner ${runnerId}: ${runner.error?.message ?? "no row"}`
+            `could not read allowed_member_ids for runner ${runnerId}: ${runner.error.message}`
           );
         }
+        if (!runner.data || runner.data.user_id !== runnerUserId || runner.data.workspace_id !== workspaceId) {
+          this.apply([], false, []);
+          return;
+        }
         const listed = runner.data.allowed_member_ids;
         const members = await this.withTimeout(
           db.from("workspace_members").select("user_id").eq("workspace_id", workspaceId).in("user_id", [runnerUserId, ...listed]),
@@ -6261,15 +6427,18 @@ var init_roster = __esm({
           );
         }
         const current = new Set(members.data.map((m) => m.user_id));
+        const ownerIsMember = current.has(runnerUserId);
+        const served = ownerIsMember ? listed.filter((id) => id !== runnerUserId && current.has(id)) : [];
+        this.apply(listed, ownerIsMember, served);
+      }
+      /** Record one successful read: the lists spliced in place, the time, and a line on a change. */
+      apply(listed, ownerIsMember, served) {
+        const { runnerId, log } = this.deps;
         const before = [...this.allowedMemberIds];
         const beforeOwnerIsMember = this.ownerIsMember;
         this.listed = [...listed];
-        this.ownerIsMember = current.has(runnerUserId);
-        this.allowedMemberIds.splice(
-          0,
-          this.allowedMemberIds.length,
-          ...listed.filter((id) => id !== runnerUserId && current.has(id))
-        );
+        this.ownerIsMember = ownerIsMember;
+        this.allowedMemberIds.splice(0, this.allowedMemberIds.length, ...served);
         this.lastSuccessAt = performance.now();
         if (!sameIds(before, this.allowedMemberIds) || beforeOwnerIsMember !== this.ownerIsMember) {
           log.info(
@@ -7411,6 +7580,18 @@ var init_service = __esm({
   }
 });
 
+// src/providers/env.ts
+function definedEnv(env) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) if (value !== void 0) out[key] = value;
+  return out;
+}
+var init_env = __esm({
+  "src/providers/env.ts"() {
+    "use strict";
+  }
+});
+
 // src/claude/auth-mode.ts
 function authModeFrom(info) {
   if (info.apiProvider && info.apiProvider !== "firstParty") return "third_party";
@@ -7572,17 +7753,13 @@ async function askGuard(guard, toolName2, input) {
     return GUARD_FAILED;
   }
 }
-function definedEnv(env) {
-  const out = {};
-  for (const [key, value] of Object.entries(env)) if (value !== void 0) out[key] = value;
-  return out;
-}
 var SESSION_FLAG_SETTINGS, GUARD_FAILED, ASK_TOOL_REASON, ClaudeSession;
 var init_session2 = __esm({
   "src/claude/session.ts"() {
     "use strict";
     init_src();
     init_log();
+    init_env();
     init_auth_mode();
     init_normalize();
     init_pushable();
@@ -7970,6 +8147,7 @@ var init_session3 = __esm({
   "src/codex/session.ts"() {
     "use strict";
     init_src();
+    init_env();
     init_attachments2();
     init_normalize2();
     init_policy();
@@ -8027,8 +8205,12 @@ var init_session3 = __esm({
       questionCounts = /* @__PURE__ */ new Map();
       start() {
         if (this.child) throw new Error("VALIDATION: session already started");
-        const spawnFn = this.opts.spawnFn ?? ((p, a) => spawn2(p, a, { stdio: "pipe" }));
-        const child = spawnFn(this.opts.codexPath, ["app-server"]);
+        const spawnFn = this.opts.spawnFn ?? ((p, a, env) => spawn2(p, a, { stdio: "pipe", env }));
+        const child = spawnFn(
+          this.opts.codexPath,
+          ["app-server"],
+          definedEnv({ ...process.env, ...this.opts.env })
+        );
         this.child = child;
         child.stderr?.setEncoding("utf8");
         child.stderr?.on("data", (line) => {
@@ -9743,6 +9925,9 @@ function worthRespawning(current, next) {
   if (next.state !== "ok") return next.state === "none" && current.state !== "none";
   return current.state !== "ok" || current.token !== next.token;
 }
+function refusedByPostgres(code) {
+  return typeof code === "string" && /^[0-9A-Z]{5}$/.test(code) && code !== UNIQUE_VIOLATION && code !== "40003" && !code.startsWith("08") && !code.startsWith("57P");
+}
 function assertTaskMode(mode) {
   if (TASK_REFUSED_MODES.has(mode)) {
     throw new Error(`VALIDATION: a task session cannot run in ${mode}`);
@@ -9780,7 +9965,7 @@ function shrink(event) {
       return null;
   }
 }
-var READ_ONLY_TEXT, REFRESH_WITHIN_MS, betweenTurns, UNREADABLE_MARK_CREDS, roundUsd, ORPHANED_STATUSES, RESTARTABLE_STATUSES, isAtOrBelow3, DENY_MESSAGE_MAX, EXIT_ERROR_MAX, INITIAL_PROMPT_MAX, TASK_SKILL_LOOKUP_MS, TASK_REFUSED_MODES, OWNER_DRIVEN_KINDS, REPO_OWNER_ONLY, REPO_NO_DUPLICATE, PROVIDER_SESSION_ID, REPO_WORKTREE_GONE, TASK_ASK_TOOLS, MEMORY_PREAMBLE, MEMORY_SOURCE, wrapMemory, PATH_INPUT_TOOLS, PATH_INPUT_KEYS, isRecord, errorCode, SessionManager;
+var READ_ONLY_TEXT, REFRESH_WITHIN_MS, betweenTurns, UNREADABLE_MARK_CREDS, roundUsd, UNIQUE_VIOLATION, ROW_WRITE_TIMEOUT_MS, ORPHANED_STATUSES, RESTARTABLE_STATUSES, isAtOrBelow3, DENY_MESSAGE_MAX, EXIT_ERROR_MAX, INITIAL_PROMPT_MAX, TASK_SKILL_LOOKUP_MS, TASK_REFUSED_MODES, OWNER_DRIVEN_KINDS, REPO_OWNER_ONLY, REPO_NO_DUPLICATE, PROVIDER_SESSION_ID, REPO_WORKTREE_GONE, TASK_ASK_TOOLS, MEMORY_PREAMBLE, MEMORY_SOURCE, wrapMemory, PATH_INPUT_TOOLS, PATH_INPUT_KEYS, isRecord, errorCode, SessionManager;
 var init_manager = __esm({
   "src/sessions/manager.ts"() {
     "use strict";
@@ -9812,7 +9997,8 @@ var init_manager = __esm({
     READ_ONLY_TEXT = {
       not_connected: READ_ONLY_NOT_CONNECTED,
       no_expiry: READ_ONLY_NO_EXPIRY,
-      scope_refused: READ_ONLY_SCOPE_REFUSED
+      scope_refused: READ_ONLY_SCOPE_REFUSED,
+      github_not_installed: READ_ONLY_GITHUB_NOT_INSTALLED
     };
     REFRESH_WITHIN_MS = 10 * 6e4;
     betweenTurns = (live) => (live.status === "idle" || live.status === "error") && !live.stopping;
@@ -9821,6 +10007,8 @@ var init_manager = __esm({
       readOnlyText: READ_ONLY_UNAVAILABLE
     };
     roundUsd = (usd) => Math.round(usd * 1e6) / 1e6;
+    UNIQUE_VIOLATION = "23505";
+    ROW_WRITE_TIMEOUT_MS = 3e4;
     ORPHANED_STATUSES = ["running", "awaiting_permission"];
     RESTARTABLE_STATUSES = /* @__PURE__ */ new Set(["idle", ...ORPHANED_STATUSES]);
     isAtOrBelow3 = (p, dir) => p === dir || p.startsWith(dir.endsWith(sep16) ? dir : `${dir}${sep16}`);
@@ -10486,8 +10674,9 @@ var init_manager = __esm({
       /**
        * The runner's own re-check of who queued a `session.*` command, after the RPC's.
        *
-       * `created_by` must be a member this runner serves: the runner owner, or one of
-       * `runners.allowed_member_ids` as loaded at registration. The session owner gets no separate
+       * `created_by` must be a member this runner serves, as the live roster decides (`serves`): the
+       * runner owner or one of `runners.allowed_member_ids` still in the workspace, and nobody while
+       * the owner is not a member of the runner's workspace (0039). The session owner gets no separate
        * branch: `sessions_insert` already required `can_command_runner`, so every owner was on the
        * list when the session was created, and an owner off it now has been de-listed since. A
        * command with no creator is a flow's (data model §2), which phase 1A does not run.
@@ -10522,11 +10711,12 @@ var init_manager = __esm({
       /**
        * Whether this creator may command this machine at all.
        *
-       * The same membership test `assertMayCommand` runs (the runner owner, or one of
-       * `runners.allowed_member_ids`), given its own name because not every command is
-       * session-scoped: `github.request` addresses a repository, and `requireSession` would
-       * reject it outright. One roster, one decision (`serves`); this and `assertMayCommand`
-       * only differ in the noun they name in the refusal, never in who they let through.
+       * The same membership test `assertMayCommand` runs (the roster's `serves`: the runner owner or
+       * a listed member, and nobody while the owner is out of the runner's workspace, 0039), given
+       * its own name because not every command is session-scoped: `github.request` addresses a
+       * repository, and `requireSession` would reject it outright. One roster, one decision
+       * (`serves`); this and `assertMayCommand` only differ in the noun they name in the refusal,
+       * never in who they let through.
        */
       assertMayUseRunner(createdBy) {
         if (createdBy === null || !this.serves(createdBy)) {
@@ -10789,7 +10979,9 @@ var init_manager = __esm({
       }
       /**
        * Put rows on this runner that claim a turn in progress back to `idle`, for the chats that have
-       * no live session here — at boot every one of them, since nothing is live yet. Only
+       * no live session here — at boot every one of them, since nothing is live yet, and again when
+       * the runner owner is back in the runner's workspace (S-42, `cayenne start`), minus the sessions
+       * live by then. Only
        * `running` and `awaiting_permission`: those are the states a dead provider cannot leave, while
        * `starting` is still owed a `session.start` and `error` is the member's to read. Their pending
        * permission prompts are retired first (`expireOrphanedPermissions`). A failed write is logged,
@@ -10800,7 +10992,11 @@ var init_manager = __esm({
         if (ids?.length === 0) return;
         await this.expireOrphanedPermissions(ids);
         let write = this.deps.db.from("chat_sessions").update({ status: "idle" }).eq("runner_id", this.deps.runnerId).in("status", ORPHANED_STATUSES);
-        if (ids) write = write.in("id", ids);
+        if (ids) {
+          write = write.in("id", ids);
+        } else if (this.live.size > 0) {
+          write = write.not("id", "in", `(${[...this.live.keys()].join(",")})`);
+        }
         const { data, error } = await write.select("id");
         if (error) {
           this.deps.log.warn({ err: error.message }, "settling orphaned session rows failed");
@@ -10900,12 +11096,17 @@ var init_manager = __esm({
         this.assertCodexOwner(sessionId, createdBy);
         return { slashCommands: await this.provider(() => live.session.supportedCommands()) };
       }
+      /**
+       * `stop` every live session, as `session.stop` would. Used at daemon shutdown and when the runner
+       * owner leaves the runner's workspace (S-42): it sets no flag, so the manager serves again after.
+       */
       async shutdown() {
         await Promise.allSettled([...this.live.keys()].map((id) => this.stop(id)));
       }
       // --- internals ---
+      /** The roster decides, the runner owner included: under 0039 an owner out of the workspace is refused. */
       serves(userId) {
-        return userId === this.deps.runnerUserId || this.deps.allowedMemberIds.includes(userId);
+        return this.deps.serves(userId);
       }
       /**
        * Write this session's skills and name the tree the SDK should load (D38, lane 6 §4).
@@ -11583,7 +11784,7 @@ var init_manager = __esm({
         const create = this.deps.createSession ?? createProviderSession;
         let session;
         try {
-          session = create(provider, this.withProviderEnv(provider, opts, place.repo));
+          session = create(provider, this.withProviderEnv(opts, place.repo));
         } catch (err) {
           if (this.live.get(sessionId)?.channel !== channel) {
             await this.deps.db.removeChannel(channel);
@@ -11610,6 +11811,7 @@ var init_manager = __esm({
           stopping: false,
           dropping: null,
           inflight: /* @__PURE__ */ new Set(),
+          writes: Promise.resolve(),
           changesVersion: this.nextChangesSeed(),
           watcher: null,
           docs: null,
@@ -11751,13 +11953,15 @@ var init_manager = __esm({
         return this.changesHigh;
       }
       /**
-       * The account pairing rides on the session's own env, never on `process.env` (D33). Merged over
-       * the env the settings policy already set (D39's `CLAUDE.md` switch), never instead of it. A
-       * repository chat's credential environment (D50, `repositoryChatEnv`) goes last, so nothing
-       * before it can put a credential helper, a token or a `gh` login back.
+       * The account pairing rides on the session's own env, never on `process.env` (D33). Both
+       * providers get it: a Codex session is owner-only, and a `claude` it runs uses the runner's
+       * account, as in the owner's terminal (D55, amending D33). Merged over the env the
+       * settings policy already set (D39's `CLAUDE.md` switch), never instead of it. A repository
+       * chat's credential environment (D50, `repositoryChatEnv`) goes last, so nothing before it can
+       * put a credential helper, a token or a `gh` login back.
        */
-      withProviderEnv(provider, opts, repo) {
-        const extra = provider === "claude" ? this.deps.claudeEnv : void 0;
+      withProviderEnv(opts, repo) {
+        const extra = this.deps.claudeEnv;
         const repoEnv = repo ? this.repositoryEnv(repo.creds) : void 0;
         if ((!extra || Object.keys(extra).length === 0) && !repoEnv) return opts;
         return { ...opts, env: { ...opts.env, ...extra, ...repoEnv } };
@@ -11901,13 +12105,15 @@ var init_manager = __esm({
         );
         session.on("result", (r) => {
           this.deps.timings?.finished(sessionId);
+          const lastSeq = live.writes.then(() => live.seq);
           guard(async () => {
             if (live.provider === "claude") await this.recordCost(sessionId, live, r);
+            const seq = await lastSeq;
             const status = r.isError ? "error" : "idle";
             live.status = status;
             await this.updateSession(sessionId, { status, last_message_at: (/* @__PURE__ */ new Date()).toISOString() });
             const { authMode: _authMode, ...event } = r;
-            await this.broadcast(sessionId, { type: "result", seq: live.seq, ...event });
+            await this.broadcast(sessionId, { type: "result", seq, ...event });
             await this.broadcast(sessionId, {
               type: "session.status",
               status,
@@ -12015,35 +12221,55 @@ var init_manager = __esm({
           );
         });
       }
+      /**
+       * Write one `chat_messages` row and broadcast its `message` twin, in this session's write order.
+       *
+       * The step is queued on `live.writes` before this method first awaits, so two calls made back to
+       * back (the SDK hands a short turn's reply and result row over on one tick) insert and broadcast
+       * in call order: insert N and its broadcast both happen before insert N+1 starts. A caller on
+       * the prompt path may therefore wait for earlier rows' inserts — a database wait. It never
+       * waits on a relay send: `broadcast` returns once the relay has the event queued.
+       *
+       * Rejects with `PROVIDER_ERROR: persist failed: …` for this row only; the chain goes on.
+       */
       async persist(sessionId, live, role, content, providerUuid, parentToolUseId, raw) {
         const safeContent = this.secrets.redact(content);
         const safeRaw = this.secrets.redact(raw);
-        live.seq += 1;
-        const { data, error } = await this.deps.db.from("chat_messages").insert({
-          session_id: sessionId,
-          // Overwritten from the session by stamp_message_workspace; the insert policy still needs
-          // is_member(workspace_id) to see a non-null value.
-          workspace_id: this.deps.workspaceId,
-          seq: live.seq,
-          role,
-          content: safeContent,
-          provider_uuid: providerUuid,
-          parent_tool_use_id: parentToolUseId,
-          raw: safeRaw
-        }).select(
-          "id, session_id, workspace_id, seq, role, content, provider_uuid, parent_tool_use_id, created_at"
-        ).single();
-        if (error || !data) {
-          throw new Error(`PROVIDER_ERROR: persist failed: ${error?.message ?? "no row"}`);
-        }
-        const row = {
-          ...data,
-          seq: live.seq,
-          role,
-          content: safeContent
-        };
-        await this.broadcast(sessionId, { type: "message", message: row });
-        return row;
+        const step = live.writes.then(async () => {
+          const seq = live.seq + 1;
+          live.seq = seq;
+          const { data, error } = await this.deps.db.from("chat_messages").insert({
+            session_id: sessionId,
+            // Overwritten from the session by stamp_message_workspace; the insert policy still needs
+            // is_member(workspace_id) to see a non-null value.
+            workspace_id: this.deps.workspaceId,
+            seq,
+            role,
+            content: safeContent,
+            provider_uuid: providerUuid,
+            parent_tool_use_id: parentToolUseId,
+            raw: safeRaw
+          }).select(
+            "id, session_id, workspace_id, seq, role, content, provider_uuid, parent_tool_use_id, created_at"
+          ).abortSignal(AbortSignal.timeout(ROW_WRITE_TIMEOUT_MS)).single();
+          if (error || !data) {
+            if (refusedByPostgres(error?.code)) live.seq = seq - 1;
+            throw new Error(`PROVIDER_ERROR: persist failed: ${error?.message ?? "no row"}`);
+          }
+          const row = {
+            ...data,
+            seq,
+            role,
+            content: safeContent
+          };
+          await this.broadcast(sessionId, { type: "message", message: row });
+          return row;
+        });
+        live.writes = step.then(
+          () => void 0,
+          () => void 0
+        );
+        return step;
       }
       /**
        * The highest `chat_messages.seq` this session has, or 0. A failed read is fatal rather than
@@ -12703,7 +12929,7 @@ function inside3(candidate, root) {
   return rel === "" || !rel.startsWith("..") && !isAbsolute21(rel);
 }
 var SECRET_ENV, MEMBER_ENV_ALLOW, MEMBER_ENV_KEYS, LOCALE_ENV, nodeShellFs;
-var init_env = __esm({
+var init_env2 = __esm({
   "src/terminal/env.ts"() {
     "use strict";
     init_src();
@@ -12888,7 +13114,7 @@ var init_manager2 = __esm({
     "use strict";
     init_src();
     init_paths();
-    init_env();
+    init_env2();
     init_process_group();
     init_refusals();
     init_ring();
@@ -14080,8 +14306,8 @@ async function compose(cfg, lock, host, preflight) {
       runnerId: identity.runnerId,
       workspaceId: identity.workspaceId,
       runnerUserId: identity.userId,
-      // The roster's own array, mutated in place: `serves` reads the live list with no restart.
-      allowedMemberIds: liveRoster.allowedMemberIds,
+      // The roster decides who may command, the owner included (0039): live, with no restart.
+      serves: (userId) => liveRoster.serves(userId),
       worktreeOwners,
       sessionWorktrees,
       // And which sessions were started from a task, so their secret-file guard outlives a restart.
@@ -14114,6 +14340,30 @@ async function compose(cfg, lock, host, preflight) {
       tap: (sessionId, event) => local.emit(sessionId, event),
       timings
     });
+    let ownerServed = liveRoster.serves(identity.userId);
+    let ownerTransition = Promise.resolve();
+    liveRoster.onRefresh(() => {
+      const served = liveRoster.serves(identity.userId);
+      if (served === ownerServed) return;
+      ownerServed = served;
+      const line = { runnerId: identity.runnerId };
+      ownerTransition = ownerTransition.then(async () => {
+        try {
+          if (served) {
+            logger.info(line, "runner owner served again; settling chats left mid-turn");
+            await manager.settleOrphans();
+          } else {
+            logger.warn(line, "runner owner no longer served; stopping every live session");
+            await manager.shutdown();
+          }
+        } catch (err) {
+          logger.warn(
+            { ...line, served, err: err instanceof Error ? err.message : String(err) },
+            "runner owner transition failed"
+          );
+        }
+      });
+    });
     let terminals;
     let terminalManager = null;
     if (pty) {
@@ -14168,7 +14418,15 @@ async function compose(cfg, lock, host, preflight) {
         terminals
       })
     );
-    const source = new CommandSource(db, identity.runnerId, dispatch, logger, { timings });
+    const source = new CommandSource(db, identity.runnerId, dispatch, logger, {
+      timings,
+      // S-42 review C: a row under this id counts as this runner's only while it names this owner
+      // in this workspace.
+      owner: { userId: identity.userId, workspaceId: identity.workspaceId },
+      // S-42 review A: the source hears of a removal or a re-add within a probe; the roster, left
+      // alone, would at its next 60 s timer (a removal changes no runner row). Refresh it now.
+      onOwnRowVisibility: () => void liveRoster.refresh()
+    });
     const heartbeat = startHeartbeat(
       db,
       identity.runnerId,
@@ -14223,7 +14481,8 @@ async function compose(cfg, lock, host, preflight) {
           log: logger
         }),
         // The roster's own predicate, read live: the owner while a member, listed members while
-        // still members (PR16); every refresh re-checks every socket (SEC-P2).
+        // still members (PR16), nobody while the owner is out (0039); every refresh re-checks
+        // every socket (SEC-P2).
         serves: (userId) => liveRoster.serves(userId),
         onRosterRefresh: (cb) => liveRoster.onRefresh(cb),
         // Exactly the manager's rule (ruling 14, R2-H1), built from the same deps it was given.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jpcasabiancai/cayenne",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "files": [
     "dist/cli.js"
   ],