@kabmo-labs/kabmo 0.3.1 → 0.5.0

package/src/client/hooks/workspace/left-dock.ts

@@ -0,0 +1,132 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The left dock's state, as the desktop layout and its bar read it.
+ *
+ * Backed by the GLOBAL `app_settings.omp_left_panels` (see
+ * `shared/lib/workspace/left-dock.ts`), not by `layout.*` session state: the
+ * dock lists the same views in every chat, so a placement stored per session
+ * would move the user's arrangement when they picked another session.
+ *
+ * The read is synchronous from the primed settings snapshot, so the first render
+ * already knows whether the bar is drawn. A write notifies every reader on
+ * screen, because they all resolve against this one module-level cache.
+ *
+ * The snapshot is compared by IDENTITY of the stored value: `writeSetting`
+ * replaces it with the exact object a write handed it, so a reference comparison
+ * is both correct and free — a rebuilt object would make
+ * `useSyncExternalStore` see a change on every render and loop.
+ */
+import { useCallback, useEffect, useState } from 'preact/hooks';
+import { useSyncExternalStore } from 'preact/compat';
+import { readKabmoSetting } from '@/shared/lib/settings/client';
+import {
+  LEFT_DOCK_SETTING_KEY,
+  readLeftDock,
+  setPanelSide as persistPanelSide,
+  writeLeftDock,
+  type LeftDockState,
+  type PanelSide,
+} from '@/shared/lib/workspace/left-dock';
+import { resolveLeftDockWidth, saveLeftDockWidth } from '@/shared/lib/workspace/left-dock-width';
+
+const listeners = new Set<() => void>();
+
+/** The stored value the cache was built from, and the state it produced. */
+let lastSource: unknown;
+let cached: LeftDockState = { enabled: false, panels: [] };
+
+function subscribe(listener: () => void): () => void {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+function snapshot(): LeftDockState {
+  const source = readKabmoSetting<unknown>(LEFT_DOCK_SETTING_KEY);
+  if (source === lastSource) return cached;
+  lastSource = source;
+  cached = readLeftDock();
+  return cached;
+}
+
+function publish(): void {
+  lastSource = undefined;
+  for (const listener of listeners) listener();
+}
+
+export interface LeftDockHandle extends LeftDockState {
+  /** Draw the dock's activity bar. Off by default. */
+  setEnabled: (enabled: boolean) => void;
+  /**
+   * Place a plugin panel on the left, or send it back to the right.
+   *
+   * Placing a panel TURNS THE RAIL ON. The rail exists to reach the panels on
+   * it, so leaving it off after a successful placement would be a move with no
+   * button, no view and no way to undo it from the bar — the settings row would
+   * be the only control, which is exactly the state a user reads as broken.
+   * Moving a panel back to the right does NOT turn the rail off: that is the
+   * user's switch, and the dock may still be worth showing.
+   */
+  setSide: (panelId: string, side: PanelSide) => void;
+  /** The width this view opens at, and the writer a drag commits through. */
+  widthOf: (viewId: string) => number;
+  commitWidth: (viewId: string, px: number) => void;
+}
+
+export function useLeftDock(): LeftDockHandle {
+  const state = useSyncExternalStore(subscribe, snapshot);
+
+  const setEnabled = useCallback((enabled: boolean) => {
+    writeLeftDock({ enabled });
+    publish();
+  }, []);
+
+  const setSide = useCallback((panelId: string, side: PanelSide) => {
+    // The coupling — placing a panel also shows the rail — lives in the store,
+    // so a second caller cannot produce a placement nobody can reach.
+    persistPanelSide(panelId, side);
+    publish();
+  }, []);
+
+  const commitWidth = useCallback((viewId: string, px: number) => {
+    saveLeftDockWidth(viewId, px);
+    publish();
+  }, []);
+
+  return {
+    ...state,
+    setEnabled,
+    setSide,
+    widthOf: resolveLeftDockWidth,
+    commitWidth,
+  };
+}
+
+/**
+ * The dock's width for ONE view.
+ *
+ * Per view because a session list reads at 280px and a plugin's table does not:
+ * a column that snapped to the list's width the moment the user switched views
+ * would be a column with one width that is wrong for every second view.
+ */
+export function useLeftDockWidth(viewId: string): [number, (px: number) => void] {
+  const dock = useLeftDock();
+  const [width, setWidth] = useState(() => dock.widthOf(viewId));
+
+  useEffect(() => {
+    setWidth(dock.widthOf(viewId));
+  }, [viewId, dock]);
+
+  const commitWidth = useCallback(
+    (px: number) => {
+      dock.commitWidth(viewId, px);
+      setWidth(dock.widthOf(viewId));
+    },
+    [dock, viewId],
+  );
+
+  return [width, commitWidth];
+}

package/src/client/hooks/workspace/panel-registry.ts

@@ -123,6 +123,19 @@ export function seedPanelRegistry(payload: PanelRegistryPayload): void {
   adoptPanelRegistry(payload);
 }
 
+/**
+ * Forget the adopted payload — a test seam, and nothing else.
+ *
+ * The store is anchored on `globalThis` (a `bun --hot` reload must not lose it),
+ * which is also why it survives between test files in one `bun test` process: a
+ * suite that adopts a payload with a plugin in it leaves every later suite
+ * drawing that plugin's button. A file that adopts one has to put the store
+ * back.
+ */
+export function resetPanelRegistry(): void {
+  globalThis.__kabmoPanelRegistry = undefined;
+}
+
 /**
  * Re-read the marketplace from disk, bypassing the server's scan cache.
  *

package/src/client/tailwind.css

@@ -182,6 +182,28 @@
   overflow-y: auto;
 }
 
+/* The composer reads at the transcript's own size — 13px — EXCEPT on iOS.
+ *
+ * Every message row in the timeline is `text-[13px] leading-relaxed`, and a
+ * draft written at 16px looked like a different document pasted under the
+ * conversation. The size itself is a utility on the textarea; this rule exists
+ * for the one platform where 13px is not allowed to apply.
+ *
+ * iOS Safari ZOOMS the viewport when a text control below 16px takes focus,
+ * and it does not zoom back out — the page is left wider than the screen with
+ * the composer half off it. So iOS keeps 16px and every other platform reads
+ * at the transcript's size. `-webkit-touch-callout` is the standard
+ * iOS-only probe (it is a Safari-only property), and it cannot be expressed as
+ * a Tailwind variant, which is why this is a class rather than a utility.
+ *
+ * The PLACEHOLDER needs no rule of its own: `::placeholder` inherits
+ * `font-size` from its textarea, so both move together. */
+@supports (-webkit-touch-callout: none) {
+  textarea.composer-type {
+    font-size: 16px;
+  }
+}
+
 /* Reveal-on-hover controls are written `opacity-0 group-hover:opacity-100`
  * (or `hidden group-hover:flex`), and Tailwind v4 emits every one of those
  * variants inside `@media (hover: hover)` — verified in the emitted

package/src/server/db.server.test.ts

@@ -33,7 +33,7 @@ import { existsSync, mkdtempSync, rmSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import * as path from 'node:path';
 
-import { getDatabasePath, getDb } from '@/server/db.server';
+import { closeDb, getDatabasePath, getDb } from '@/server/db.server';
 import { removeDir } from '@/test-support/remove-dir';
 
 const saved = {
@@ -151,3 +151,54 @@ describe('a failed open is not cached', () => {
     }
   });
 });
+
+describe('closeDb', () => {
+  test('retires an open that is still in flight, and closes its handle', async () => {
+    // The bug this pins, measured on the Release gate: `releaseDb` cleared the
+    // slot while `getDb()` was still opening, so the continuation assigned
+    // `resolved` on the DROPPED slot object. Nothing could reach that handle
+    // again, and on Windows its temp directory stayed locked — `EBUSY … a
+    // handle outlived its test`, reported against the two PRECEDING cases.
+    const savedSlot = globalThis.__kabmoDb;
+    try {
+      Bun.env.KABMO_DB_PATH = path.join(tempRoot(), 'in-flight', 'db.sqlite');
+      globalThis.__kabmoDb = undefined;
+
+      // Start the open and retire the slot in the SAME tick, so the async
+      // continuation is still pending when `closeDb` runs.
+      const pending = getDb();
+      const retired = globalThis.__kabmoDb as { disposed?: boolean } | undefined;
+      closeDb();
+      expect(retired?.disposed).toBe(true);
+
+      // The open settles as a refusal rather than handing back a handle whose
+      // owner is gone, and the slot stays clear for the next caller.
+      await expect(pending).rejects.toThrow(/retired/);
+      expect(globalThis.__kabmoDb ?? null).toBeNull();
+
+      // A later open under a NEW path works, which is what a test isolating
+      // itself between cases needs.
+      Bun.env.KABMO_DB_PATH = path.join(tempRoot(), 'after', 'db.sqlite');
+      const db = await getDb();
+      expect(db).toBeDefined();
+      closeDb();
+    } finally {
+      globalThis.__kabmoDb = savedSlot;
+    }
+  });
+
+  test('closes a resolved handle and clears the slot', async () => {
+    const savedSlot = globalThis.__kabmoDb;
+    try {
+      Bun.env.KABMO_DB_PATH = path.join(tempRoot(), 'resolved', 'db.sqlite');
+      globalThis.__kabmoDb = undefined;
+      const db = await getDb();
+      closeDb();
+      expect(globalThis.__kabmoDb ?? null).toBeNull();
+      // A closed handle refuses further work rather than silently succeeding.
+      expect(() => db.raw.exec('SELECT 1')).toThrow();
+    } finally {
+      globalThis.__kabmoDb = savedSlot;
+    }
+  });
+});

package/src/server/db.server.ts

@@ -41,6 +41,19 @@ interface DbSlot {
   promise: Promise<DbClient> | null;
   /** Resolved handle for `getDbSync`; hot paths must not await. */
   resolved: DbClient | null;
+  /**
+   * Set when a caller retired this slot while an open was still in flight.
+   *
+   * An open is asynchronous (`getDatabasePath` → `createDb` → `initSchema`), so
+   * a teardown that clears the slot mid-open does not stop it: the continuation
+   * used to keep running and assign `state.resolved` on the DROPPED slot object,
+   * leaving an open `bun:sqlite` handle nothing could ever close. On Windows
+   * that is a locked temp directory — measured on the Release gate, where
+   * `releaseDb` failed with `EBUSY … a handle outlived its test` and reported
+   * the two preceding cases as failed. The continuation now closes the handle
+   * it opened and rejects instead of caching it.
+   */
+  disposed: boolean;
 }
 
 declare global {
@@ -49,7 +62,30 @@ declare global {
 }
 
 function slot(): DbSlot {
-  return (globalThis.__kabmoDb ??= { promise: null, resolved: null });
+  return (globalThis.__kabmoDb ??= { promise: null, resolved: null, disposed: false });
+}
+
+/**
+ * Retire the current handle so the next `getDb()` opens the path configured
+ * NOW, closing whatever is open.
+ *
+ * The one caller is `test-support/isolated-db.ts`, but the rule it enforces is
+ * a lifecycle one: a handle must never outlive the configuration it was opened
+ * under. An in-flight open is marked `disposed` rather than awaited, and the
+ * continuation closes its own handle — see {@link DbSlot.disposed}.
+ */
+export function closeDb(): void {
+  const state = globalThis.__kabmoDb;
+  globalThis.__kabmoDb = undefined;
+  if (!state) return;
+  state.disposed = true;
+  try {
+    state.resolved?.raw.close();
+  } catch {
+    // Already closed by a failed open; the slot is gone either way.
+  }
+  state.resolved = null;
+  state.promise = null;
 }
 
 export async function getDatabasePath(): Promise<string> {
@@ -111,6 +147,18 @@ export async function getDb(): Promise<DbClient> {
 
     await migrateLegacyProjectSettings(db);
 
+    // The slot may have been retired while this open was in flight. Assigning
+    // `state.resolved` then would cache a handle on an object nothing reaches
+    // any more — an open connection whose temp directory can never be deleted.
+    if (state.disposed) {
+      try {
+        db.raw.close();
+      } catch {
+        // Nothing to do: the caller already moved on.
+      }
+      throw new Error('database open was retired before it finished');
+    }
+
     state.resolved = db;
     return db;
   })();

package/src/server/index.ts

@@ -25,6 +25,7 @@ import { isMockMode } from '@/server/mock.server';
 import { migrateLegacyDataDir } from '@/server/lib/lifecycle/paths';
 import { stopDiscoveryRootsWatch, syncDiscoveryRootsWatch } from '@/server/lib/omp/config/roots-watch.server';
 import { startScheduleRuntime, stopScheduleRuntime } from '@/server/lib/schedule/runtime.server';
+import { startWaitingRuntime, stopWaitingRuntime } from '@/server/lib/waiting/runtime.server';
 import { seedDefaultMarketplace } from '@/server/lib/panels/seed.server';
 import { syncBundledPlugins } from '@/server/lib/panels/sync.server';
 import { startPanelAutoUpdate } from '@/server/lib/panels/auto-update.server';
@@ -255,6 +256,13 @@ try {
  */
 startScheduleRuntime();
 
+/**
+ * The waiting-prompt clock: a prompt held until another session finishes. Same
+ * shape and the same placement — after the listener and the watchers, because
+ * the first sweep may spawn an omp child.
+ */
+startWaitingRuntime();
+
 /**
  * Bring installed BUNDLED plugins up to the copy this package ships.
  *
@@ -320,6 +328,7 @@ for (const signal of ['SIGTERM', 'SIGINT'] as const) {
   process.once(signal, () => {
     stopDiscoveryRootsWatch();
     stopScheduleRuntime();
+    stopWaitingRuntime();
     void app.stop();
     // Plugins own children and listeners nothing else releases, and a detached
     // child outlives its parent — so this is awaited BEFORE the exit. It is

package/src/server/lib/assets/compressed-cache.server.test.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, expect, test } from 'bun:test';
+
+import { clearCompressedCache, compressedAsset, compressedCacheStats } from '@/server/lib/assets/compressed-cache.server';
+
+describe('compressedAsset', () => {
+  test('computes once for a key and serves the same bytes afterwards', async () => {
+    clearCompressedCache();
+    let produced = 0;
+    const produce = async () => {
+      produced += 1;
+      return new Uint8Array([1, 2, 3]);
+    };
+
+    const first = await compressedAsset('k', produce);
+    const second = await compressedAsset('k', produce);
+
+    expect(produced).toBe(1);
+    expect(second).toEqual(first);
+  });
+
+  // Two tabs opening a cold instance at the same moment would otherwise both
+  // compress a 10 MB bundle. The gate is a deferred promise, not a delay: the
+  // second caller must join the first while it is still unresolved.
+  test('shares one computation between concurrent callers', async () => {
+    clearCompressedCache();
+    const gate = Promise.withResolvers<void>();
+    let produced = 0;
+    const produce = async () => {
+      produced += 1;
+      await gate.promise;
+      return new Uint8Array([9]);
+    };
+
+    const first = compressedAsset('shared', produce);
+    const second = compressedAsset('shared', produce);
+    gate.resolve();
+    const [a, b] = await Promise.all([first, second]);
+
+    expect(produced).toBe(1);
+    expect(a).toEqual(b);
+  });
+
+  test('a different key is a different entry', async () => {
+    clearCompressedCache();
+    await compressedAsset('one', async () => new Uint8Array([1]));
+    await compressedAsset('two', async () => new Uint8Array([2]));
+
+    expect(compressedCacheStats().entries).toBe(2);
+  });
+
+  // An entry is keyed by the asset's ETag, so a rebuild is a new key and the
+  // old bytes are never asked for again. Retention is bounded by count.
+  test('retains a bounded number of entries', async () => {
+    clearCompressedCache();
+    for (let i = 0; i < 20; i += 1) {
+      await compressedAsset(`key-${i}`, async () => new Uint8Array(1024));
+    }
+
+    const stats = compressedCacheStats();
+    expect(stats.entries).toBeLessThanOrEqual(8);
+    expect(stats.bytes).toBeLessThanOrEqual(48 * 1024 * 1024);
+  });
+
+  // The caller needs the bytes it asked for even when they cannot be kept, or a
+  // single asset larger than the budget would fail to serve at all.
+  test('returns an asset larger than the whole budget', async () => {
+    clearCompressedCache();
+    const huge = new Uint8Array(50 * 1024 * 1024);
+    const bytes = await compressedAsset('huge', async () => huge);
+
+    expect(bytes.byteLength).toBe(huge.byteLength);
+  });
+});

package/src/server/lib/assets/compressed-cache.server.ts

@@ -0,0 +1,88 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Compressed bytes for a static asset, kept across requests.
+ *
+ * `plugins/compress.ts` compresses per response, which is right for a 4 KB JSON
+ * body and wrong for the client bundle: the production bundle is 10.4 MB, and
+ * re-compressing it on every cold request costs ~20 ms of blocked event loop
+ * for a result that cannot have changed. Measured on this repo's own bundle:
+ * zstd 10.4 MB -> 2.15 MB in 20 ms, gzip -> 2.32 MB in 66 ms.
+ *
+ * The key is the asset's own ETag plus the encoding, so an entry is valid
+ * exactly as long as the bytes it was made from — a rebuild changes the ETag
+ * (size and mtime both move) and the old entry simply stops being asked for.
+ * That also means no invalidation logic: the map is bounded, and a stale entry
+ * is evicted by age, never served.
+ *
+ * Two bounds, because a bundle-sized entry is not a small one: an entry count
+ * and a total byte budget. A single entry larger than the budget is still
+ * RETURNED — it just is not retained — since the caller needs the bytes it
+ * asked for either way.
+ */
+
+/** Encodings' worth of the biggest asset, plus room for the next build. */
+const MAX_ENTRIES = 8;
+const MAX_TOTAL_BYTES = 48 * 1024 * 1024;
+
+const entries = new Map<string, Uint8Array>();
+const inFlight = new Map<string, Promise<Uint8Array>>();
+let totalBytes = 0;
+
+/**
+ * The compressed bytes for `key`, computing them once.
+ *
+ * Concurrent requests for the same key share one computation: two tabs opening
+ * a cold instance at the same moment would otherwise both compress 10 MB.
+ */
+export async function compressedAsset(key: string, produce: () => Promise<Uint8Array>): Promise<Uint8Array> {
+  const hit = entries.get(key);
+  if (hit) {
+    // Re-insert so the map's own order stays least-recently-used first.
+    entries.delete(key);
+    entries.set(key, hit);
+    return hit;
+  }
+
+  const pending = inFlight.get(key);
+  if (pending) return pending;
+
+  const work = produce().then((bytes) => {
+    retain(key, bytes);
+    return bytes;
+  }).finally(() => {
+    inFlight.delete(key);
+  });
+  inFlight.set(key, work);
+  return work;
+}
+
+function retain(key: string, bytes: Uint8Array): void {
+  // Too big to keep. The caller already holds the reference, so the response is
+  // built from it; retaining it would evict everything else and then itself.
+  if (bytes.byteLength > MAX_TOTAL_BYTES) return;
+  entries.set(key, bytes);
+  totalBytes += bytes.byteLength;
+  // Evict oldest first, and never the entry just stored.
+  for (const [candidate, value] of entries) {
+    if (entries.size <= MAX_ENTRIES && totalBytes <= MAX_TOTAL_BYTES) break;
+    if (candidate === key) continue;
+    entries.delete(candidate);
+    totalBytes -= value.byteLength;
+  }
+}
+
+/** The retained byte count and entry count — the observable half of the cache. */
+export function compressedCacheStats(): { entries: number; bytes: number } {
+  return { entries: entries.size, bytes: totalBytes };
+}
+
+/** Drop everything. Tests only; nothing at runtime has a reason to call this. */
+export function clearCompressedCache(): void {
+  entries.clear();
+  inFlight.clear();
+  totalBytes = 0;
+}

package/src/server/lib/db/schema.test.ts

@@ -194,6 +194,7 @@ describe('schema bootstrap', () => {
       'workspace_folders', 'sessions', 'app_settings', 'chat_sessions', 'deleted_workspaces',
       'archived_sessions', 'session_ui_state', 'queued_messages', 'session_stream_state',
       'files', 'btw_topics', 'btw_turns', 'scheduled_tasks', 'scheduled_task_runs',
+      'waiting_prompts',
     ]) {
       expect(first).toContain(expected);
     }

package/src/server/lib/db/schema.ts

@@ -15,6 +15,7 @@ import type { DbClient } from '@/server/lib/db/client';
 import { migrateQueueTableFk } from '@/server/lib/queue/schema-migration.server';
 import { ensureBtwSchema } from '@/server/lib/btw/schema.server';
 import { ensureScheduleSchema } from '@/server/lib/schedule/schema.server';
+import { ensureWaitingSchema } from '@/server/lib/waiting/schema.server';
 import { ensurePluginSchema } from '@/server/lib/plugins/schema.server';
 import { migrateWorkspaceFolderColumns } from '@/shared/lib/workspace/schema-migrations';
 import { migrateSessionStreamStateColumns } from '@/shared/lib/omp/session/schema-migrations';
@@ -104,6 +105,8 @@ export async function initSchema(db: DbClient): Promise<void> {
   await ensureBtwSchema(db);
   // Scheduled-task tables, same reasoning: their own module.
   await ensureScheduleSchema(db);
+  // Prompts held until another session finishes, same reasoning.
+  await ensureWaitingSchema(db);
   // The plugin platform's own tables (kv, records, settings).
   await ensurePluginSchema(db);
 

package/src/server/lib/fs/fs-path.test.ts

@@ -121,7 +121,7 @@ describe('resolveRoot / resolveReferencedPath / getDefaultFsRoot', () => {
     Bun.env.SYNC_WORKSPACE = 'false';
     Bun.env.KABMO_DB_PATH = dbPath;
     delete Bun.env.DB_PATH;
-    globalThis.__kabmoDb = { promise: null, resolved: null };
+    globalThis.__kabmoDb = { promise: null, resolved: null, disposed: false };
     const db = await getDb();
     await db.run('INSERT INTO workspace_folders (name, project_path) VALUES (?, ?)', ['proj', registeredDir]);
   });

package/src/server/lib/omp/rpc/terminal-settle.ts

@@ -32,6 +32,7 @@ import {
   type AutoTitleHost,
 } from '@/server/lib/omp/session/auto-title.server';
 import { scheduleQueueDelivery, type QueueDeliveryHost } from '@/server/lib/queue/delivery.server';
+import { requestWaitingSweep } from '@/server/lib/waiting/sweep-trigger';
 import { markStreamStatus, loadStreamStatuses } from '@/shared/lib/omp/session/stream-state.server';
 import { driveGoalAfterTurn } from '@/server/lib/omp/session/goal-driver.server';
 import { emitRealtimeSignal } from '@/server/lib/realtime/signals.server';
@@ -81,6 +82,12 @@ export function settleTerminalRun(host: TerminalSettleHost, messages: unknown):
     void driveGoalAfterTurn({ host, messages });
     scheduleQueueDelivery(host);
   }
+  // A prompt held until this session finished is released HERE, and not only by
+  // the sweep tick: the run end is the event the wait was about. The delay is
+  // the settle grace — the stream row this frame just wrote needs to age past it
+  // before the dependency reads as finished, and a queued follow-up armed by the
+  // line above needs its window to go out first.
+  requestWaitingSweep();
   // A run's work may have touched files and certainly advanced usage; the
   // realtime layer republishes whichever workspace topics are actually watched
   // (see `republishWatchedWorkspaceTopics`).

package/src/server/lib/omp/session/delete.server.ts

@@ -34,6 +34,7 @@ import { findSessionFileById } from '@/server/lib/omp/session/locator';
 import { clearSessionFileCaches } from '@/server/lib/omp/session/files';
 import { invalidateOmpSidebarData } from '@/server/lib/omp/session/reader';
 import { emitRealtimeSignal } from '@/server/lib/realtime/signals.server';
+import { failWaitingOn } from '@/server/lib/waiting/store.server';
 import { siblingDirForSession } from '@/server/lib/omp/subagent/history/paths';
 import { isSinglePathSegment } from '@/server/lib/fs/path-segment';
 
@@ -122,6 +123,13 @@ export async function purgeSessionData(sessionId: string): Promise<SessionPurgeR
   const db = await getDb();
   const rowChanges = await purgeKabmoRows(db, sessionId);
 
+  // A prompt waiting on this session will never be released: the dependency is
+  // gone. Fail it BY NAME rather than letting it wait for a session that no
+  // longer exists — and keep the row, because its error text is the only thing
+  // that tells the user what happened to the prompt they wrote.
+  const strandedPrompts = await failWaitingOn(sessionId, 'The session being waited for was deleted.');
+  if (strandedPrompts > 0) emitRealtimeSignal('waiting-changed');
+
   // Both caches outlive the mutation by their own keys: the file list/scan pair
   // is mtime-keyed (a delete bumps the parent directory, but the memo can still
   // answer first) and the sidebar dataset is TTL'd, so without this the deleted

package/src/server/lib/omp/session/ownership.server.test.ts

@@ -22,7 +22,7 @@
  */
 
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { testPosix } from '@/test-support/platform';
@@ -39,6 +39,7 @@ import { getRpcSession, startRpcSession } from '@/server/lib/omp/rpc/session-reg
 import { removeDir } from '@/test-support/remove-dir';
 
 let root: string;
+let holderLog = '';
 let savedXdg: string | undefined;
 let savedDbPath: string | undefined;
 let savedAgentDir: string | undefined;
@@ -89,7 +90,12 @@ async function holdLeaseInChild(sessionId: string): Promise<number> {
   // The background process must NOT inherit the wrapper's stdout pipe, or
   // reading `$!` would block until that process exits.
   const inner = `exec ${JSON.stringify(process.execPath)} -e ${shellQuote(script)} ${shellQuote(lease)}`;
-  const child = Bun.spawn(['sh', '-c', `{ ${inner} >/dev/null 2>&1 & } ; echo $!`], {
+  // The holder's stderr goes to a FILE, not to `ignore`: when the child fails
+  // to take the lock (a missing libc, a broken FFI bind, a Bun that could not
+  // start), the reason is the only useful evidence, and discarding it is what
+  // made the Linux CI failure a bare "expected promise that rejects".
+  holderLog = join(root, 'holder.log');
+  const child = Bun.spawn(['sh', '-c', `{ ${inner} >>${shellQuote(holderLog)} 2>&1 & } ; echo $!`], {
     stdout: 'pipe',
     stderr: 'ignore',
     env: { ...Bun.env, XDG_STATE_HOME: root, PI_CODING_AGENT_DIR: join(root, 'agent') },
@@ -104,10 +110,45 @@ function shellQuote(value: string): string {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
-/** Wait until a process other than this one actually holds the lease. */
+/**
+ * How long a detached `sh -c` holder gets to take the lock.
+ *
+ * Polling real time is unavoidable here: the condition is an OS `flock` taken
+ * by ANOTHER process, which no fake timer can advance. The budget is generous
+ * on purpose — a cold CI runner spawns Bun and imports the FFI helper before it
+ * locks — and a miss is an ERROR, never a silent proceed.
+ */
+const FOREIGN_HOLDER_TIMEOUT_MS = 15_000;
+
+/**
+ * Wait until a process other than this one actually holds the lease.
+ *
+ * THROWS rather than returning on timeout. It used to give up silently after
+ * 3 s, which turned an infrastructure gap into a green-looking test that proved
+ * nothing: `startRpcSession` then found no foreign owner, spawned normally, and
+ * the assertion below failed with "Expected promise that rejects" — measured on
+ * the Linux CI leg, where the helper burned its whole budget (3075 ms) and the
+ * real reason (the detached holder never took the lock) was nowhere in the
+ * output. A slow cold runner is a reason to wait longer, never to proceed.
+ */
 async function waitForForeignHolder(leasePath: string): Promise<void> {
-  for (let attempt = 0; attempt < 300; attempt++) {
+  const deadline = Date.now() + FOREIGN_HOLDER_TIMEOUT_MS;
+  for (;;) {
     if (leaseHeldByAnother(leasePath) === true && fileHolderPid(leasePath) !== process.pid) return;
+    if (Date.now() >= deadline) {
+      const holder = fileHolderPid(leasePath);
+      let log = '';
+      try {
+        log = readFileSync(holderLog, 'utf8').trim();
+      } catch {
+        // The child never wrote anything: it did not start.
+      }
+      throw new Error(
+        `no foreign holder took ${leasePath} within ${FOREIGN_HOLDER_TIMEOUT_MS} ms ` +
+          `(held=${String(leaseHeldByAnother(leasePath))}, holderPid=${String(holder)}, ` +
+          `childPids=${JSON.stringify(children)})${log ? `\nholder log:\n${log}` : '\nholder log: (empty)'}`,
+      );
+    }
     await Bun.sleep(10);
   }
 }