@kabmo-labs/kabmo 0.5.2 → 0.6.0

package/src/server/lib/model-roles/store.server.ts

@@ -0,0 +1,188 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * CRUD for model-role presets (`model_role_presets`).
+ *
+ * A preset is Kabmo's record of a `modelRoles` map under a name, so the user can
+ * switch between whole role assignments instead of retyping every row. Applying
+ * one is NOT this module's job: the route writes the map through
+ * `writeModelRoles`, the same writer the individual role rows use, so a preset
+ * can never produce a config shape the row editor could not.
+ *
+ * Two invariants:
+ *   - `name` is the identity a user sees, and it is unique case-insensitively
+ *     (the column is `COLLATE NOCASE UNIQUE`), so a rename onto an existing
+ *     name is refused rather than silently creating a twin.
+ *   - A role id is NOT narrowed to omp's built-ins. `modelRoles` accepts custom
+ *     role ids (omp adds any configured role to its own role list), and dropping
+ *     them here would delete a custom role the user had assigned the moment a
+ *     preset was applied — the whole map is written back, so a filtered copy is
+ *     a silent edit of the live config.
+ */
+
+import { getDb } from '@/server/db.server';
+import { readSettingsJson, writeSettingsJson } from '@/server/lib/db/settings-store';
+import { isMockMode } from '@/server/mock.server';
+import { normalizeRoleMap } from '@/shared/lib/omp/config/model-roles';
+import type { ModelRolePreset } from '@/shared/types/model-roles';
+
+interface PresetRow {
+  id: string;
+  name: string;
+  roles: string;
+  created_at: number;
+  updated_at: number;
+}
+
+/** Names a preset may carry: no control characters, no leading/trailing space. */
+const NAME_MAX = 60;
+
+function parseRoles(raw: string): Record<string, string> {
+  try {
+    return normalizeRoleMap(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+
+function rowToPreset(row: PresetRow): ModelRolePreset {
+  return {
+    id: row.id,
+    name: row.name,
+    roles: parseRoles(row.roles),
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}
+
+/** Trim + validate a preset name; throws with a sentence the form can show. */
+export function normalizePresetName(raw: unknown): string {
+  if (typeof raw !== 'string') throw new Error('Preset name is required');
+  const name = raw.trim();
+  if (!name) throw new Error('Preset name is required');
+  if (name.length > NAME_MAX) throw new Error(`Preset name is limited to ${NAME_MAX} characters`);
+  if (/[\u0000-\u001f]/.test(name)) throw new Error('Preset name contains control characters');
+  return name;
+}
+
+export async function listModelRolePresets(): Promise<ModelRolePreset[]> {
+  const db = await getDb();
+  const rows = (await db.all('SELECT * FROM model_role_presets ORDER BY name COLLATE NOCASE ASC')) as PresetRow[];
+  return rows.map(rowToPreset);
+}
+
+export async function getModelRolePreset(id: string): Promise<ModelRolePreset | null> {
+  const db = await getDb();
+  const row = (await db.get('SELECT * FROM model_role_presets WHERE id = ?', [id])) as PresetRow | undefined;
+  return row ? rowToPreset(row) : null;
+}
+
+/**
+ * Create or update a preset. `id: null` creates; an id updates that row and
+ * keeps its `created_at`. Returns the stored preset.
+ *
+ * A duplicate name is caught by the unique index, and the raw SQLite sentence
+ * ("UNIQUE constraint failed: …") is replaced with the sentence a user can act
+ * on — the route surfaces this text verbatim.
+ */
+export async function saveModelRolePreset(input: {
+  id: string | null;
+  name: unknown;
+  roles: unknown;
+}): Promise<ModelRolePreset> {
+  const name = normalizePresetName(input.name);
+  const roles = normalizeRoleMap(input.roles);
+  if (Object.keys(roles).length === 0) throw new Error('A preset needs at least one role assigned');
+
+  const db = await getDb();
+  const now = Date.now();
+  if (input.id) {
+    const existing = await getModelRolePreset(input.id);
+    if (!existing) throw new Error('Preset not found');
+    try {
+      await db.run(
+        'UPDATE model_role_presets SET name = ?, roles = ?, updated_at = ? WHERE id = ?',
+        [name, JSON.stringify(roles), now, input.id],
+      );
+    } catch (error) {
+      throw new Error(duplicateNameMessage(error, name));
+    }
+    const stored = await getModelRolePreset(input.id);
+    if (!stored) throw new Error('Preset not found');
+    return stored;
+  }
+
+  const id = crypto.randomUUID();
+  try {
+    await db.run(
+      'INSERT INTO model_role_presets (id, name, roles, created_at, updated_at) VALUES (?, ?, ?, ?, ?)',
+      [id, name, JSON.stringify(roles), now, now],
+    );
+  } catch (error) {
+    throw new Error(duplicateNameMessage(error, name));
+  }
+  const stored = await getModelRolePreset(id);
+  if (!stored) throw new Error('Preset not found after insert');
+  return stored;
+}
+
+function duplicateNameMessage(error: unknown, name: string): string {
+  const text = error instanceof Error ? error.message : String(error);
+  return /UNIQUE constraint failed/i.test(text) ? `A preset named “${name}” already exists` : text;
+}
+
+/**
+ * Name of the preset seeded from the roles an install already had.
+ *
+ * Named for what it is — the assignment the user was running before presets
+ * existed — rather than after a strategy ("cheap", "thinking"), which would be a
+ * claim the seeder cannot make.
+ */
+export const SEEDED_PRESET_NAME = 'Default';
+
+/** `app_settings` marker: the one-shot seed has already made its decision. */
+const SEED_MARKER_KEY = 'model_role_presets_seeded';
+
+/**
+ * Seed ONE preset from the `modelRoles` map an install already carries, so the
+ * picker is never empty on a machine that has been running omp for months.
+ *
+ * One-shot, and the marker is written on EVERY path that decides — the same
+ * shape `workspace_sync_ran` uses, and for the same reason: "the table is empty"
+ * has two meanings a row count cannot separate (never seeded, and the user
+ * deleted the seeded preset). Without the marker a delete would resurrect it on
+ * the next panel open.
+ *
+ * Three cases step aside and still spend the run:
+ *   - a map with no roles (a fresh install has nothing to snapshot);
+ *   - a table that already holds a preset (including one written by hand);
+ *   - MOCK mode, which must not write demo data into the database.
+ *
+ * A failure to insert is swallowed: a seed is a convenience, and the panel's own
+ * `Save as…` is the manual path. The marker is still written, so a config that
+ * omp rejects cannot make every panel open retry it.
+ */
+export async function seedPresetFromCurrentRoles(roles: Record<string, string>): Promise<void> {
+  if (isMockMode()) return;
+  const db = await getDb();
+  if (await readSettingsJson<boolean>(db, SEED_MARKER_KEY, false)) return;
+  const existing = await db.get<{ id: string }>('SELECT id FROM model_role_presets LIMIT 1');
+  if (!existing && Object.keys(roles).length > 0) {
+    try {
+      await saveModelRolePreset({ id: null, name: SEEDED_PRESET_NAME, roles });
+    } catch {
+      // A name collision or a bad selector is not worth failing a read over.
+    }
+  }
+  await writeSettingsJson(db, SEED_MARKER_KEY, true);
+}
+
+/** Delete a preset; returns false when the id named nothing. */
+export async function deleteModelRolePreset(id: string): Promise<boolean> {
+  const db = await getDb();
+  const result = await db.run('DELETE FROM model_role_presets WHERE id = ?', [id]);
+  return result.changes > 0;
+}

package/src/server/lib/omp/rpc/destroy-stream-row.test.ts

@@ -56,12 +56,12 @@ function makeProc(): RpcProcess {
  * path at a temp file (the order is the point), and `releaseDb` closes it again
  * before deleting — the only shape that works on Windows.
  */
-beforeEach(() => {
-  isolateDb();
+beforeEach(async () => {
+  await isolateDb();
 });
 
-afterEach(() => {
-  releaseDb();
+afterEach(async () => {
+  await releaseDb();
 });
 
 /** A wrapper with a live run and a matching `stream` row behind it. */

package/src/server/lib/omp/rpc/frame-fold.test.ts

@@ -27,8 +27,9 @@ import { ModeMirror } from '@/server/lib/omp/rpc/mode-mirror';
 function makeHost(overrides: Partial<SessionFrameHost> = {}): SessionFrameHost {
   return {
     sessionId: '',
-    autoTitleInFlight: false,
     autoTitleWindowUntil: 0,
+    autoTitleClaims: 0,
+    autoTitleDispatch: null,
     autoTitlePending: true,
     autoTitleRequested: false,
     promptRunning: false,
@@ -298,3 +299,31 @@ describe('releasesStreamRowOnPromptResult', () => {
     expect(releasesStreamRowOnPromptResult({ agentInvoked: false }, { streaming: false, sessionId: '' })).toBe(false);
   });
 });
+
+/**
+ * A rename writes the title SLOT in place, which no mtime-keyed scan can see.
+ *
+ * The sidebar therefore has to be republished from this frame, not only from
+ * the turn-boundary signals: measured, a session named by its own run kept
+ * `New Session - <timestamp>` in the list while the header already showed the
+ * title, until an unrelated tool call happened to republish.
+ */
+describe('session_info_update', () => {
+  test('drops the sidebar scan cache, which the in-place title write cannot invalidate itself', () => {
+    // The title is rewritten in a fixed-width slot INSIDE the session file, so
+    // the mtime the scan cache keys on does not move. Without this the list
+    // kept `New Session - <timestamp>` while the header already showed the
+    // title, until an unrelated tool call happened to republish.
+    globalThis.__kabmoSidebarDataCache = {
+      data: {} as never,
+      expiresAt: Date.now() + 60_000,
+      inFlight: null,
+    };
+
+    const host = makeHost({ sessionId: 's1' });
+    const result = foldSessionFrame(host, { type: 'session_info_update', title: 'A new name' });
+
+    expect(result.suppressForward).toBe(false);
+    expect(globalThis.__kabmoSidebarDataCache?.expiresAt).toBe(0);
+  });
+});

package/src/server/lib/omp/rpc/frame-fold.ts

@@ -269,8 +269,13 @@ export function foldSessionFrame(host: SessionFrameHost, event: AgentEvent): Fra
     case 'session_info_update':
       // A rename rewrote the fixed-width title slot in place; the scan cache is
       // keyed on file mtime, which that write cannot move, so the list must be
-      // rebuilt explicitly.
+      // rebuilt explicitly. Published HERE, not only from the `message_end`
+      // fallback: the title frame is the last thing a rename produces, and
+      // without this the sidebar kept the placeholder until the next turn's
+      // tool call republished it — measured as a session that had a name in the
+      // header and `New Session - <timestamp>` in the list.
       clearSessionFileCaches();
+      publishSidebarStructure();
       break;
     // omp's own goal transitions. The wrapper keeps the record so a snapshot
     // (`get_state` plus the live frame) can report the mode without a round

package/src/server/lib/omp/rpc/manager.ts

@@ -81,24 +81,29 @@ export class AgentSessionWrapper {
   // Public so `RunSettle` can retire a stranded entry on omp's own quiescence
   // verdict (see `run-settle.server.ts`).
   readonly subagents = new SubagentLiveness();
-  // One background `/rename` at a time. The first run makes up to two attempts
-  // (the early one at the first user message, the fallback at run end), and two
-  // overlapping generations would race to write the same title slot.
-  autoTitleInFlight = false;
+  // The `/rename` dispatch chain (see `session/title-request.server.ts`): a
+  // prompt after the run end waits here so the rename goes first.
+  autoTitleDispatch: Promise<void> | null = null;
   /** omp's own plan/goal mode, mirrored from the frames. */
   readonly modeMirror = new ModeMirror();
-  // One-shot: the FIRST run of this conversation is the only one Kabmo
-  // may ask omp to name it from. Seeded in applyIdentity from omp's own message
-  // count, so a session reclaimed and respawned with `--resume` (which reports
-  // the messages it restored) never re-titles from its newest turn.
+  // One-shot: the FIRST run is the only one Kabmo may ask omp to name from.
+  // Seeded in applyIdentity from omp's own message count, so a child resumed
+  // with `--resume` (which reports the messages it restored) never re-titles.
   autoTitlePending = true;
-  // True once this run's early attempt (the first settled user message) has
-  // been made. Reset at each `agent_start`, so a queued steer message inside the
-  // same run cannot re-ask and cancel the generation already in flight.
+  // True once this run's early attempt was made, so a queued steer cannot
+  // re-ask inside the run. Reset at each `agent_start`.
   autoTitleRequested = false;
-  // Epoch ms until which `command_output` frames belong to our own background
-  // rename and must not reach the timeline. 0 when nothing is outstanding.
+  // Epoch ms until which `command_output` frames belong to our own rename.
   autoTitleWindowUntil = 0;
+  // Outstanding requests, one claim each: both attempts can be unanswered at
+  // once, and one slot let the first one's output reach the timeline.
+  autoTitleClaims = 0;
+  /** The pin a title request runs under (see `auto-title.server.ts`). A GETTER
+   *  over `runModel`: `get_state`, the `set_model` ack and the fallback probe all
+   *  write that one field, and a second copy would pin a model the session left. */
+  get autoTitleModel(): SessionRunModel | null {
+    return this.runModel;
+  }
   /** Idle reclaim. Its own object because the rules are self-contained: a busy
    *  session is never reclaimed, and every frame defers the deadline. */
   readonly idle: IdleReaper;

package/src/server/lib/omp/rpc/session-command-guards.ts

@@ -49,6 +49,10 @@ export interface SessionCommandHost extends WebStateHost {
   /** Arm the deadline watchdog for a dispatch whose turn never opened. Optional
    *  so a test host can omit it; the real wrapper always implements it. */
   armAgentStartWatchdog?(): void;
+  /** The background `/rename` dispatch a following prompt must be ordered
+   *  behind (see `session/title-request.server.ts`). Absent on a host that
+   *  never titles, which is why the barrier treats it as idle. */
+  autoTitleDispatch?: Promise<void> | null;
   destroyAndWait(): Promise<void>;
 }
 

package/src/server/lib/omp/rpc/session-commands.test.ts

@@ -82,6 +82,30 @@ describe('guards before dispatch', () => {
 });
 
 describe('prompt', () => {
+  test('a prompt waits for the rename a finished run asked for', async () => {
+    // Both are separate frames on one stdin. Without the barrier the prompt can
+    // be admitted first, and the rename then names a conversation that has
+    // already moved on — measured on a real session as a title derived from the
+    // second prompt instead of the first run.
+    const { promise: dispatchAck, resolve: ack } = Promise.withResolvers<void>();
+    const h = makeHarness({ autoTitleDispatch: dispatchAck });
+    h.respond(() => ({ agentInvoked: true }));
+
+    let admitted = false;
+    const prompt = dispatchSessionCommand(h.host, { type: 'prompt', message: 'second' }).then(() => {
+      admitted = true;
+    });
+    for (let i = 0; i < 8; i += 1) await Promise.resolve();
+    // The rename is still on its way to the child, so the prompt must not have
+    // reached it.
+    expect(admitted).toBe(false);
+    expect(h.calls).toEqual([]);
+
+    ack();
+    await prompt;
+    expect(h.calls).toEqual([{ type: 'prompt', message: 'second' }]);
+  });
+
   test('the accepted ack arms the agent-start watchdog instead of clearing the turn', async () => {
     const h = makeHarness();
     h.respond(() => ({ agentInvoked: true }));

package/src/server/lib/omp/rpc/session-commands.ts

@@ -12,6 +12,7 @@
 import { RpcCommandError, RpcCommandTimeoutError } from '@/server/lib/omp/rpc/process';
 import { AGENT_BUSY_MESSAGE, AGENT_BUSY_REFUSAL_RE, AWAITING_AGENT_START_TIMEOUT_MS, GET_STATE_TIMEOUT_MS, IMAGE_BEARING_COMMANDS, PASSTHROUGH_COMMANDS, PROMPT_ACK_TIMEOUT_MS, RESTARTING_MESSAGE, STEER_ACK_TIMEOUT_MS, WebRpcError, toImageContents, type RpcSessionState, validateAgentImages } from '@/server/lib/omp/rpc/constants';
 import { clearSessionFileCaches } from '@/server/lib/omp/session/files';
+import { awaitTitleDispatch } from '@/server/lib/omp/session/title-request.server';
 import { scheduleQueueDelivery } from '@/server/lib/queue/delivery.server';
 import { clearStreamStatus, markStreamStatus } from '@/shared/lib/omp/session/stream-state.server';
 import { buildWebState } from '@/server/lib/omp/rpc/web-state';
@@ -45,6 +46,12 @@ export async function dispatchSessionCommand(host: SessionCommandHost, command:
       // refusal from clearing a running turn's flags when the prompt was a
       // steer aimed at that turn.
       if (refuseTuiOnlyPrompt(host, command.message, Boolean(command.streamingBehavior))) return null;
+      // A rename the finished run asked for must be ON THE WIRE before this
+      // prompt is: both are separate frames on one stdin, and a prompt admitted
+      // first lets the rename name a conversation that has already moved on.
+      // The wait is the dispatch ack (~3 ms), never the generation, and it is
+      // bounded so a wedged child cannot hold the operator's prompt.
+      await awaitTitleDispatch(host);
       const streamingBehavior = command.streamingBehavior as 'steer' | 'followUp' | undefined;
       // The live `stream` row starts with the DISPATCH, not with agent_start:
       // the spawn/ack round trip that precedes agent_start must not read as