@lawaty/lacode 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -6,7 +6,246 @@ All notable changes to LaCode are recorded here. The format follows
 
 Versions come from git release commits; the npm version is bumped in the same
 commit as the changelog entry it describes.
-## [Unreleased]
+## [0.11.0] — the old sessions and the old event rows are swept away on their own, and a pool edit takes effect without a restart
+
+### Added
+
+- **A pool edit is picked up live, and a model the provider has withdrawn no
+  longer takes its slot down with it.** The slot table used to be read once per
+  process, so editing `pool.txt`, `pool.json` or the bundled preset did nothing
+  until a restart — and a slot whose model id had been retired failed every
+  spawn routed to it. The plugin now watches the three file sources (`watchMs`,
+  default 1s; `watchDebounceMs`, default 250ms; both configurable, `watchMs: 0`
+  disables). When the resolved table actually changes it reassigns `s.slots`,
+  re-binds the variant agents and provider whitelists from the same config
+  object, and validates every slot with one real request — cooling or not. A
+  provider answering "Model not found" is now a first-class outcome:
+  `pool_recheck` benches that model for the quota cap (`model-missing`) so
+  routing stops choosing it, and names it in the report. Given `models`,
+  `pool_recheck` validates those even when they are not cooling; omitting
+  `models` keeps the old, cheap "probe what is cooling" contract. The watcher is
+  closed in `dispose`, so a torn-down plugin stops polling.
+
+### Fixed
+
+- **The bundled preset and the built-in fallback no longer name a withdrawn
+  model.** `opencode-go/minimax-m3.1-flash-free` is `deprecated` on models.dev
+  and is hidden from `opencode models`; it is replaced by
+  `opencode-go/beam-free`, which is active, free and in a different model family.
+  `tests/models-snapshot.json` was refreshed for the new slot.
+
+- **A build no longer unloads the pool from a process that starts during it.**
+  `npm run build` deleted `dist/` before rebuilding, so an opencode process that
+  imported `file://…/dist/index.js` in that window failed to load LaCode at all
+  and ran every `task` spawn on the caller's own model — `explore` appeared to
+  ignore the pool. Each entry is now staged and renamed into place, and stale
+  files are removed only after the live ones are in place.
+
+- **A task spawn with no `subagent_type` is reported instead of silently
+  bypassing the pool.** opencode runs the default subagent, which carries no
+  pool model, so it inherits the caller's model; the hook cannot route it after
+  the fact, but it now logs a warning naming the fix (`subagent_type: "explore"`
+  or `"implement"`). An `@explore` mention or a direct session prompt has the
+  same limitation: the plugin API exposes the model read-only, so it cannot be
+  re-routed there either.
+
+- **A provider limit the pool did not recognise left the task hanging until the
+  watchdog found it.** opencode reports a limit in two shapes: an `action` block
+  naming the provider and a reason, or — for every provider whose error body
+  opencode does not know — a retry status carrying nothing but the provider's
+  own words. The pool only read the first shape, and only when the reason
+  happened to be one of its own, so a limit that said "limit reached" was not a
+  limit to it: nothing was cooled, the session kept retrying the refused model,
+  and the task waited out the watchdog's minutes before anything killed it.
+  Worse, the retry went back to the same slot, because nothing had been put on
+  cooldown for the pool to route around.
+
+  The limit vocabulary now reads the provider's own phrasing — "limit reached",
+  "daily limit reached", "usage limit exceeded" — and a retry status is read for
+  its message as well as for its reason. The context family is deliberately
+  excluded: "context limit reached" is a prompt that is too long, not a
+  provider that has run out of allowance, and benching a model for it would take
+  a healthy provider out of rotation over the user's own prompt.
+
+  A limit that names its provider still benches the whole provider. A limit that
+  does not name a provider cools only the model the session was running on — the
+  one the refusal is evidence about — and either way the stalled session is
+  aborted at once, so the caller retries onto a slot that answers instead of
+  waiting for the watchdog.
+
+- **A transient outage no longer benches a model as if it had run out of
+  allowance.** "Endpoint is unavailable" is a provider that is briefly down, not
+  one that has spent its quota: it lifts on its own. Reported in a retry
+  status, it took the quota path — fifteen minutes off the rotation, filed
+  under "rate-limited" — and it counted as a strike, so the next real limit on
+  that model started at strike two and got a thirty-minute window. An outage now
+  takes the flat one-minute window the assistant-error path has always given
+  it, and it is never counted as a strike: the model is benched, the session is
+  still killed, and the quota window that follows starts where it should.
+
+- **Two processes could raise the same notification.** A notification is claimed
+  with an exclusive create, so only the process that wins the claim raises it,
+  and a claim older than its window may be taken over so a holder that died
+  mid-popup cannot silence every later one. The takeover deleted the stale claim
+  and then created its own — but the delete was unconditional and never
+  re-checked that the file it removed was still the stale claim it had judged a
+  moment earlier. Two processes that both saw the same stale claim both reached
+  the takeover: the first replaced it with a fresh claim, the second deleted
+  that fresh claim and made its own, and both returned "won", so both notified.
+  The takeover is now a compare-and-swap: an exclusive takeover lock, an
+  immediate refusal for whoever did not get it, and a re-read of the claim
+  inside the lock, so the loser leaves a live holder's fresh claim untouched.
+  The staleness rule itself is unchanged — a fresh claim is never stolen and a
+  stale one is still reclaimed.
+
+- **A `busy` session counted as you answering a prompt.** The five-second floor
+  before a notification is raised exists so it does not land while you are
+  already at the keyboard, and it is meant to be reset by real interaction.
+  `session.status: busy` was counted as that interaction — but `busy` is raised
+  whenever the session starts working, including when opencode resumes on its
+  own, so the floor was refreshed without you touching anything and the popup
+  you were owed could be suppressed. The signal is now a `message.updated` with
+  the user's own role on it, plus the reply events for permissions and
+  questions; `busy` no longer counts.
+
+- **A tunnel unit could be installed with a preflight it cannot run.** The unit
+  writer put `ExecStartPre=<preflight>` in unconditionally, so on a host where
+  the preflight was never installed systemd failed the unit and the tunnel never
+  came up — and the up-to-date check kept the broken unit because it demanded
+  the line. The line is now written only when the preflight is installed, which
+  degrades to "no preflight" rather than "no tunnel", and an already-broken unit
+  is repaired on the next run. The up-to-date check no longer requires the line.
+
+- **A strike for an unavailable provider is filed where it belongs.** An outage
+  reported through the strike path could still be counted as a quota strike and
+  handed the long window, because only one of the two call sites delegated to
+  the outage handler. Both now do, and a strike never counts an outage. A limit
+  that names a provider is also no longer overridden by the model the session
+  happened to be running on.
+
+- **Two acceptance criteria were corrected to match the shipped behaviour.**
+  US-6 criterion 4 stated the "a full slot is not the next one" rule without its
+  exception, so it contradicted the overflow path; it now says a full slot is
+  next only when no other slot is available and under its ceiling. US-19
+  criterion 3 stated a standing rule as if the product injected it, when it now
+  lives in the repo-level `AGENTS.md`.
+
+### Added
+
+- **The limit vocabulary is read from one place.** `pool.limitReason()` names
+  the limit a text reports, and the pool, the prober and the fail-over path all
+  take the reason from it, so a log line and a cooldown file never spell the
+  same fault two ways.
+
+- **US-31 — a limit that hangs is killed, and the retry lands on a slot that
+  answers.** The contract is written down as a user story with acceptance
+  criteria in `docs/USER-STORIES.md`, and every criterion has a test in
+  `tests/stories/`.
+
+- **Two retention sweeps take the old rows away before they become the whole
+  database.** `scripts/retire-old-sessions.mjs` archives then removes sessions
+  past a window (30 days, 24 hours of grace) and
+  `scripts/prune-old-events.mjs` deletes old transcript rows from `event`
+  (7 days, 1 hour of grace), in chunks, ordering by id — the id carries the
+  timestamp, so the primary-key index turns "older than" into a range scan
+  instead of a full table walk. Both refuse to touch a row that something still
+  depends on: a session an `event_sequence` cursor owns, a session bound to a
+  workspace, and anything inside the grace window. Neither ever removes or
+  resets a cursor. A session is written to a JSON archive before it is deleted,
+  and the archive is the recovery path if the window was wrong.
+
+  Both run by hand with `--dry-run`, support `--limit`, and the event prune also
+  takes `--vacuum`; a window larger than the id's own era is clamped, so a
+  mistyped number cannot be read as "delete everything". Each ships a systemd
+  service and timer (daily; `Persistent=true`, with a randomized delay on the
+  event prune so it does not run inside the session sweep's write window) and
+  appends one JSONL line per real run to a log under the state directory.
+
+- **US-32 and US-33 document the sweeps, and the coverage guard reads the root
+  suites.** Both have acceptance criteria in `docs/USER-STORIES.md` and story
+  markers on their tests. The guard now scans the root-level `tests/*-test.mjs`
+  suites as well as `tests/stories/`, so a story whose tests legitimately live
+  outside the story directory is counted instead of reported uncovered.
+
+- **Every acceptance criterion that could not be falsified now has a test that
+  fails when the behaviour regresses.** The audit found criteria whose tests
+  would have passed for the opposite behaviour: the least-loaded slot under a
+  full cooldown, a ceiling turn being skipped rather than consumed, a full slot
+  left unmarked, a macOS prompt carrying no buttons, a question carrying none,
+  a missing sound player costing only the sound, the bus path coming from the
+  local user rather than the remote, the sound playing where the notice is
+  rendered and never on the headless host, the self-update CLI, its argv and its
+  state file, cost control with no price information, the cartographer carrying
+  no model of its own, the map being reported rather than edited, an OmniRoute
+  gateway leaving a user's pool alone, and the notification doc leading with the
+  shipped path. Each new test was shown to fail by breaking the behaviour it
+  covers.
+
+## [0.10.0] — a notification waits for you instead of timing out, and a permission can be answered from the popup
+
+### Added
+
+- **A permission prompt can be answered from the notification itself.** The
+  plugin reads the permission request id off opencode's `permission.asked`
+  event and puts it in the helper's environment (`LACODE_REQUEST_ID`), so the
+  notification carries three buttons: **Allow once**, **Always allow** and
+  **Deny**. Their names are opencode's own reply values — `once`, `always` and
+  `reject` ("reject" is the server's word for deny) — so a click is already a
+  valid answer and nothing has to be translated on the way.
+
+  The answer travels back over the same path the notification came. The desktop
+  end is an ssh forced command, so its stdout comes back down the ssh
+  connection and the plugin reads the chosen button's name off the helper's
+  stdout — no new key, no listener, no HTTP server. The hop was one-way until
+  now, and what made it two-way was a channel that was already there: the
+  forced command's stdout is carried to whoever opened the connection, so the
+  answer rides home on the connection that is already open. The plugin then
+  answers the permission through opencode's own API, and a permission that was
+  already answered in the terminal is recognised rather than reported as a
+  failure.
+
+  The wire payload is six newline-delimited fields on both wires —
+  `title\nmessage\nurgency\nicon\nsound\nrequestID`, the request id last — and a
+  payload with fewer than six fields carries no request id, so an older sender
+  still works.
+
+  Two limits, stated plainly. The scope is **permissions only**: a question is
+  not answerable this way, because opencode's v1 SDK client — the one this
+  plugin has — has no question API at all, and the v2 routes need a bound TCP
+  socket that the default opencode TUI does not have. And the buttons are
+  **Linux only**: `osascript` and `terminal-notifier` have no action support,
+  so a macOS desktop still gets a plain notice, and the answer there still has
+  to be given in the terminal.
+
+### Changed
+
+- **A desktop notification now waits for you instead of timing out on its own.**
+  `notify-send` is called with `--expire-time=0` — the freedesktop "never
+  expire" timeout — at all three call sites: `sendLocal` in
+  `src/tunnel/index.ts`, the tunnel's forced command
+  (`bin/oc-notify-receiver`), and `send_notify` in `bin/oc`. Without it the
+  desktop daemon's own timer dismissed the popup by itself: measured on KDE
+  Plasma 6.7.4, a normal-urgency notification is closed with reason 1
+  ("expired") after about five seconds, so a notice the user had not acted on
+  within that window was simply gone — the difference between a notice you can
+  still act on and one you missed. A notification now stays on the desktop
+  until you close it.
+
+  Nothing else about it changed: the `--urgency` values are untouched (a
+  question or a permission prompt is deliberately not `critical`, so it does
+  not escalate to a modal on most desktops), and the whitelists and the
+  cooldown behaviour are exactly as they were.
+
+### Documented
+
+- **The npm publish notice does not say which dist-tag a release lands on.** npm
+  12 prints "Publishing to https://registry.npmjs.org/ with tag latest" for every
+  publish, including one whose `publishConfig.tag` sends it to `beta`: the
+  message reports the CLI's default, not the resolved tag. 0.9.0 was published
+  that way and landed on `beta`, with `latest` still at 0.4.2. The registry is
+  the authority, not the notice — after publishing, read
+  `npm view @lawaty/lacode dist-tags` before assuming anything about where the
+  release went.
 
 ## [0.9.0] — the cartographer keeps an active backlog, and the model stops naming slot variants
 
@@ -464,7 +703,8 @@ experimental; `latest` remains 0.4.2.
 
 - First published release: pooled subagents over a shared set of models.
 
-[Unreleased]: https://github.com/lawaty/lacode/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/lawaty/lacode/compare/v0.10.0...HEAD
+[0.10.0]: https://github.com/lawaty/lacode/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/lawaty/lacode/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/lawaty/lacode/compare/v0.7.1...v0.8.0
 [0.7.1]: https://github.com/lawaty/lacode/compare/v0.7.0...v0.7.1

package/README.md

@@ -58,9 +58,11 @@ opencode plugin @lawaty/lacode -g
 
 ### 2. Restart opencode
 
-**Nothing here hot-reloads.** The `plugin` array is read at startup, so without a
-restart the change does not take effect and the agent set will look stale for no
-visible reason.
+**Plugin code is not hot-reloaded.** The `plugin` array is read at startup, so
+without a restart the change does not take effect and the agent set will look
+stale for no visible reason. (The pool's slot files are the exception: editing
+`pool.txt`, `pool.json` or the bundled preset is picked up live — see
+[Configure](#configure).)
 
 ### 3. Check it loaded
 
@@ -91,6 +93,7 @@ To see what the pool is doing underneath:
 
 ```bash
 /lacode-doctor        # slots, model resolution, OmniRoute — report only, changes nothing
+/pool-recheck         # probe the benched models now; re-admit the ones that answer
 lacode version        # which LaCode is actually running, and whether opencode loads that one
 ```
 
@@ -192,15 +195,18 @@ it. Those windows are computed backoff rather than a promise from the provider,
 and a quota-shaped one can run for hours — long enough for a provider that has
 since recovered, or whose quota you reset in its own console, to stay excluded
 while every delegated spawn queues behind the survivors. So LaCode asks instead
-of guessing: every fifteen minutes, and on demand via the `pool_recheck` tool, it
-probes each benched model with one real request on that exact model. A model that
-answers is re-admitted immediately — nothing restarts, nothing reloads — and a
-model that is still limited keeps exactly the window it had, because a check must
-never be the thing that extends the wait. A change is reported as a toast and a
-log line; a pass that finds nothing changed says nothing at all.
-
-Six commands: `/context-init`, `/context-update`, `/context-review`,
-`/lacode-doctor`, `/agent-instructions` and `/pool`. Everything is added **only
+of guessing: every fifteen minutes, on demand via the `pool_recheck` tool, and
+the moment a pool file changes (where it validates every slot, cooling or not),
+it probes each benched model with one real request on that exact model. A model
+that answers is re-admitted immediately — nothing restarts, nothing reloads — and
+a model that is still limited keeps exactly the window it had, because a check
+must never be the thing that extends the wait. A model the provider no longer
+serves at all is benched for the quota cap and named in the report. A change is
+reported as a toast and a log line; a pass that finds nothing changed says
+nothing at all.
+
+Seven commands: `/context-init`, `/context-update`, `/context-review`,
+`/lacode-doctor`, `/agent-instructions`, `/pool` and `/pool-recheck`. Everything is added **only
 when your config does not already
 define it** — an agent or command you wrote yourself is left byte-identical,
 never patched or partially merged. `{"enabled": false}` turns the whole thing off
@@ -236,7 +242,8 @@ are reading:
 /context-review    # audit it for staleness, contradictions, duplication and bloat
 /lacode-doctor     # check the pool, model resolution and the OmniRoute gateway. Report only
 /agent-instructions # apply a client instruction to the project's AGENTS.md — client-only, see below
-/pool              # rewrite the pool slot table in ~/.config/lacode/pool.txt; restart to apply
+/pool              # rewrite the pool slot table in ~/.config/lacode/pool.txt; picked up automatically
+/pool-recheck      # probe the pool now; accepts an optional provider/model list
 ```
 
 The map is local and untracked — it describes your checkout on your machine, so
@@ -346,9 +353,11 @@ lacode doctor                                        # what the environment reso
 ```
 
 `lacode notify` is fire-and-forget and always exits 0 — an unreachable desktop
-must never be able to fail the process that tried to notify you. `lacode forward
-HOST -- COMMAND` runs a command on another host over ssh and exits with its
-status.
+must never be able to fail the process that tried to notify you. The one
+exception is an actionable notification — one carrying a permission request id
+— which waits for the click, because the answer is the whole point of it.
+`lacode forward HOST -- COMMAND` runs a command on another host over ssh and
+exits with its status.
 
 The full CLI is `notify`, `forward`, `doctor`, `version`, `update`, `receive`
 and `tunnel setup`. `version` reports which copy of LaCode is running — and

package/dist/commands.js

@@ -168,7 +168,7 @@ Print one PASS/FAIL line per check below, with the exact fix for any FAIL.
 Change nothing. Print a final one-line summary of failures.`
   },
   "pool": {
-    description: "Modify this machine's LaCode pool from a short instruction \u2014 the shared free-model slot table in ~/.config/lacode/pool.txt. Restarts opencode afterwards.",
+    description: "Modify this machine's LaCode pool from a short instruction \u2014 the shared free-model slot table in ~/.config/lacode/pool.txt. Picked up live; no restart.",
     template: `Apply this change to the LaCode pool on this machine:
 
 $ARGUMENTS
@@ -186,16 +186,27 @@ The pool is ONE global slot table shared by every pooled base (explore, implemen
 
 3. Write the WHOLE file, not a patch. This file is an override, not an edit target: any slot you drop disappears, and slot numbers are line positions, so a partial write silently renumbers the rotation. Keep the existing comment header. If the write fails on a missing directory, create \`~/.config/lacode\` first and retry.
 
-4. Report the before \u2192 after slot table, the resolved path, and this reminder in substance: nothing hot-reloads, so every running opencode process must be restarted before the new pool takes effect.
+4. Report the before \u2192 after slot table and the resolved path. The running process watches the pool files: it reloads the table, re-binds the variant agents and validates every slot, so no restart is needed. If a slot names a model the provider does not serve, it will be benched and named in the log and toast \u2014 report that instead of claiming the swap succeeded.
 
 Two traps that fail silently, so check and state them explicitly:
 - A slot's provider must already exist in the user's opencode config, or that slot cannot resolve at all. If the instruction adds a model on a provider that is not configured, say so.
 - If a slot model is \`omniroute/<id>\`, that id must also appear in the plugin's \`omniroute.models\` allowlist (or be the \`combo\` id, which needs no entry) \u2014 otherwise the pool resolves and every spawn fails with \`ProviderModelNotFoundError\`.
 - A provider \`whitelist\` is an allowlist, and the plugin appends your model to it at config time. Nothing for you to do there.
 
-If the instruction is to RESET or REVERT rather than to change models, delete \`${USER_MODELS_TXT}\` instead, and report that the pool falls back to the bundled preset \u2014 with the same restart reminder.
+If the instruction is to RESET or REVERT rather than to change models, delete \`${USER_MODELS_TXT}\` instead, and report that the pool falls back to the bundled preset \u2014 the running process picks that up automatically too.
 
 Change nothing else. In particular do not touch \`presets/free-tier.json\`, \`~/.config/lacode/pool.json\`, \`FALLBACK_SLOTS\` in \`src/lib/pool.ts\`, or \`tests/models-snapshot.json\`: this command owns the per-machine override and nothing else.`
+  },
+  "pool-recheck": {
+    description: "Probe the pool now \u2014 re-admit benched models that answer, keep the ones still limited, and bench a model the provider no longer serves.",
+    template: `Probe the LaCode pool now and report the result. Run inline; do not spawn a subagent and do not edit the pool.
+
+$ARGUMENTS
+
+- If the text above names one or more models, call the \`pool_recheck\` tool with those ids in \`models\` (provider/model-id).
+- Otherwise call \`pool_recheck\` with no arguments; it probes every model that is currently cooling.
+
+Report the tool's output as it came back, then add one short line naming what changed: re-admitted, still limited, or benched because the provider does not serve the model. If a model was benched as \`model-missing\`, say so and name the replacement in \`~/.config/lacode/pool.txt\` \u2014 but change nothing yourself.`
   }
 };
 function applyCommands(cfg, commands = COMMANDS) {