@ouro.bot/cli 0.1.0-alpha.729 → 0.1.0-alpha.730

package/dist/senses/cli.js

@@ -68,7 +68,7 @@ const cli_logging_1 = require("../nerves/cli-logging");
 const runtime_1 = require("../nerves/runtime");
 const trust_gate_1 = require("./trust-gate");
 const pipeline_1 = require("./pipeline");
-const session_lock_1 = require("./session-lock");
+const session_transaction_1 = require("../mind/session-transaction");
 const update_hooks_1 = require("../heart/versioning/update-hooks");
 const bundle_meta_1 = require("../heart/daemon/hooks/bundle-meta");
 const agent_config_v2_1 = require("../heart/daemon/hooks/agent-config-v2");
@@ -797,96 +797,102 @@ async function runCliSession(options) {
                     continue;
                 }
             }
-            // Check for slash commands (legacy path only — pipeline handles commands for runTurn path)
-            if (!options.runTurn) {
-                const parsed = (0, commands_1.parseSlashCommand)(input);
-                if (parsed) {
-                    const dispatchResult = registry.dispatch(parsed.command, { channel: "cli" });
-                    if (dispatchResult.handled && dispatchResult.result) {
-                        if (dispatchResult.result.action === "exit") {
-                            break;
+            await options.onTurnStart?.(messages);
+            try {
+                // Check for slash commands (legacy path only — pipeline handles commands for runTurn path)
+                if (!options.runTurn) {
+                    const parsed = (0, commands_1.parseSlashCommand)(input);
+                    if (parsed) {
+                        const dispatchResult = registry.dispatch(parsed.command, { channel: "cli" });
+                        if (dispatchResult.handled && dispatchResult.result) {
+                            if (dispatchResult.result.action === "exit") {
+                                break;
+                            }
+                            else if (dispatchResult.result.action === "response") {
+                                display.text(dispatchResult.result.message || "");
+                                continue;
+                            }
                         }
-                        else if (dispatchResult.result.action === "response") {
-                            display.text(dispatchResult.result.message || "");
+                    }
+                }
+                // Track user message in TUI for display
+                if (tuiStore)
+                    tuiStore.addUserMessage(input);
+                currentAbort = new AbortController();
+                if (tuiStore)
+                    tuiStore.suppressInput();
+                inputCtrl?.suppress(() => { currentAbort?.abort(); });
+                // Resolve pending image content before the turn executes
+                let contentParts = null;
+                const currentImages = pendingImages;
+                if (currentImages && currentImages.size > 0) {
+                    contentParts = await (0, image_paste_1.resolveImageContent)(input, currentImages);
+                    pendingImages = null;
+                }
+                let result;
+                try {
+                    if (options.runTurn) {
+                        // Pipeline-based turn: the runTurn callback handles user message assembly,
+                        // pending drain, trust gate, runAgent, postTurn, and token accumulation.
+                        result = await options.runTurn(messages, input, cliCallbacks, currentAbort.signal, effectiveToolContext, contentParts ?? undefined);
+                        // Handle pipeline-intercepted commands with loop-control side effects
+                        if (result?.turnOutcome === "command") {
+                            if (result.commandAction === "exit") {
+                                break;
+                            }
+                            // For "response" commands: the pipeline already emitted the response via onTextChunk
+                            cliCallbacks.flushMarkdown();
                             continue;
                         }
                     }
+                    else {
+                        // Legacy path: inline runAgent (used by serpent guide and tests)
+                        const prefix = options.getContentPrefix?.();
+                        const userContent = contentParts
+                            ? contentParts
+                            : (prefix ? `${prefix}\n\n${input}` : input);
+                        const userMsg = { role: "user", content: userContent };
+                        (0, session_events_1.stampIngressTime)(userMsg);
+                        messages.push(userMsg);
+                        const traceId = (0, nerves_1.createTraceId)();
+                        result = await (0, core_1.runAgent)(messages, cliCallbacks, options.skipSystemPromptRefresh ? undefined : "cli", currentAbort.signal, {
+                            toolChoiceRequired: getEffectiveToolChoiceRequired(),
+                            traceId,
+                            tools: options.tools,
+                            execTool: wrappedExecTool,
+                            toolContext: effectiveToolContext,
+                        });
+                    }
                 }
-            }
-            // Track user message in TUI for display
-            if (tuiStore)
-                tuiStore.addUserMessage(input);
-            currentAbort = new AbortController();
-            if (tuiStore)
-                tuiStore.suppressInput();
-            inputCtrl?.suppress(() => { currentAbort?.abort(); });
-            // Resolve pending image content before the turn executes
-            let contentParts = null;
-            const currentImages = pendingImages;
-            if (currentImages && currentImages.size > 0) {
-                contentParts = await (0, image_paste_1.resolveImageContent)(input, currentImages);
-                pendingImages = null;
-            }
-            let result;
-            try {
-                if (options.runTurn) {
-                    // Pipeline-based turn: the runTurn callback handles user message assembly,
-                    // pending drain, trust gate, runAgent, postTurn, and token accumulation.
-                    result = await options.runTurn(messages, input, cliCallbacks, currentAbort.signal, effectiveToolContext, contentParts ?? undefined);
-                    // Handle pipeline-intercepted commands with loop-control side effects
-                    if (result?.turnOutcome === "command") {
-                        if (result.commandAction === "exit") {
-                            break;
-                        }
-                        // For "response" commands: the pipeline already emitted the response via onTextChunk
-                        cliCallbacks.flushMarkdown();
-                        continue;
+                catch (err) {
+                    if (!(err instanceof DOMException && err.name === "AbortError")) {
+                        display.error(err instanceof Error ? err.message : String(err));
                     }
                 }
-                else {
-                    // Legacy path: inline runAgent (used by serpent guide and tests)
-                    const prefix = options.getContentPrefix?.();
-                    const userContent = contentParts
-                        ? contentParts
-                        : (prefix ? `${prefix}\n\n${input}` : input);
-                    const userMsg = { role: "user", content: userContent };
-                    (0, session_events_1.stampIngressTime)(userMsg);
-                    messages.push(userMsg);
-                    const traceId = (0, nerves_1.createTraceId)();
-                    result = await (0, core_1.runAgent)(messages, cliCallbacks, options.skipSystemPromptRefresh ? undefined : "cli", currentAbort.signal, {
-                        toolChoiceRequired: getEffectiveToolChoiceRequired(),
-                        traceId,
-                        tools: options.tools,
-                        execTool: wrappedExecTool,
-                        toolContext: effectiveToolContext,
-                    });
+                cliCallbacks.flushMarkdown();
+                if (!tuiStore)
+                    process.stdout.write("\n"); // ensure response ends with newline before prompt (imperative only)
+                if (tuiStore)
+                    tuiStore.restoreInput();
+                inputCtrl?.restore();
+                currentAbort = null;
+                // Check if exit tool was fired during this turn
+                if (exitToolFired) {
+                    exitReason = "tool_exit";
+                    break;
                 }
-            }
-            catch (err) {
-                if (!(err instanceof DOMException && err.name === "AbortError")) {
-                    display.error(err instanceof Error ? err.message : String(err));
+                // Safety net: never silently swallow an empty response
+                const lastMsg = messages[messages.length - 1];
+                if (lastMsg?.role === "assistant" && !(typeof lastMsg.content === "string" ? lastMsg.content : "").trim()) {
+                    display.warn("(empty response)");
+                }
+                // Post-turn hook (session persistence, pending drain, prompt refresh, etc.)
+                if (options.onTurnEnd) {
+                    await options.onTurnEnd(messages, result ?? { usage: undefined });
                 }
             }
-            cliCallbacks.flushMarkdown();
-            if (!tuiStore)
-                process.stdout.write("\n"); // ensure response ends with newline before prompt (imperative only)
-            if (tuiStore)
-                tuiStore.restoreInput();
-            inputCtrl?.restore();
-            currentAbort = null;
-            // Check if exit tool was fired during this turn
-            if (exitToolFired) {
-                exitReason = "tool_exit";
-                break;
-            }
-            // Safety net: never silently swallow an empty response
-            const lastMsg = messages[messages.length - 1];
-            if (lastMsg?.role === "assistant" && !(typeof lastMsg.content === "string" ? lastMsg.content : "").trim()) {
-                display.warn("(empty response)");
-            }
-            // Post-turn hook (session persistence, pending drain, prompt refresh, etc.)
-            if (options.onTurnEnd) {
-                await options.onTurnEnd(messages, result ?? { usage: undefined });
+            finally {
+                await options.onTurnFinish?.();
             }
             if (closed)
                 break;
@@ -963,149 +969,163 @@ async function main(agentName, options) {
         sinks: agentConfig.logging?.sinks,
     });
     const sessPath = (0, config_1.sessionPath)(friendId, "cli", "session");
-    let sessionLock = null;
-    try {
-        sessionLock = (0, session_lock_1.acquireSessionLock)(`${sessPath}.lock`, (0, identity_1.getAgentName)());
-    }
-    catch (error) {
-        /* v8 ignore start -- integration: main() is interactive, lock tested in session-lock.test.ts @preserve */
-        if (error instanceof session_lock_1.SessionLockError) {
-            process.stderr.write(`${error.message}\n`);
-            return;
-        }
-        throw error;
-        /* v8 ignore stop */
-    }
-    // Load existing session or start fresh
-    const existing = (0, context_1.loadSession)(sessPath);
-    let sessionState = existing?.state;
-    let sessionEvents = existing?.events ?? [];
+    const acquireTurnLease = options?._acquireSessionTurnLease ?? session_transaction_1.acquireSessionTurnLease;
+    let sessionTurnLease = null;
+    let pendingPersists = [];
+    let existing = null;
+    let sessionState;
+    let sessionEvents = [];
     const mcpManager = await (0, mcp_manager_1.getSharedMcpManager)() ?? undefined;
-    const sessionMessages = existing?.messages && existing.messages.length > 0
-        ? existing.messages
-        : [{ role: "system", content: (0, prompt_1.flattenSystemPrompt)(await (0, prompt_1.buildSystem)("cli", {}, resolvedContext)) }];
-    // Repair any orphaned tool calls from a crash mid-turn
-    (0, core_1.repairOrphanedToolCalls)(sessionMessages);
+    const sessionMessages = [
+        { role: "system", content: (0, prompt_1.flattenSystemPrompt)(await (0, prompt_1.buildSystem)("cli", {}, resolvedContext)) },
+    ];
     // Per-turn pipeline input: CLI capabilities and pending dir
     const cliCapabilities = (0, friends_1.getChannelCapabilities)("cli");
     const currentAgentName = (0, identity_1.getAgentName)();
     const pendingDir = (0, pending_1.getPendingDir)(currentAgentName, friendId, "cli", "session");
     const summarize = (0, core_1.createSummarize)("human");
     const cliFailoverState = { pending: null };
-    try {
-        await runCliSession({
-            agentName: currentAgentName,
-            pasteDebounceMs,
-            messages: sessionMessages,
-            lastActivityAt: sessionState?.lastFriendActivityAt,
-            _testInputSource: options?._testInputSource,
-            onAsyncAssistantMessage: async (messages, _assistantMessage) => {
-                const prepared = (0, context_1.postTurnTrim)(messages);
-                const events = (0, context_1.postTurnPersist)(sessPath, prepared, undefined, sessionState);
-                /* v8 ignore next -- defensive: postTurnPersist always returns events in practice @preserve */
-                sessionEvents = events.length > 0 ? events : sessionEvents;
-            },
-            runTurn: async (messages, userInput, callbacks, signal, toolContext, userContent) => {
-                // Run the full per-turn pipeline: resolve -> gate -> session -> drain -> runAgent -> postTurn -> tokens
-                // User message passed via input.messages so the pipeline can prepend pending messages to it.
-                const failoverState = cliFailoverState;
-                // Capture terminal errors instead of displaying immediately — the failover
-                // message replaces the raw error if failover triggers successfully.
-                let capturedTerminalError = null;
-                /* v8 ignore start -- failover-aware callback wrapper: tested via pipeline integration @preserve */
-                const failoverAwareCallbacks = {
-                    ...callbacks,
-                    // Save session after each tool result for crash recovery (deferred to avoid blocking)
-                    onToolResult: (turnMessages) => {
-                        const prepared = (0, context_1.postTurnTrim)(turnMessages);
-                        (0, context_1.deferPostTurnPersist)(sessPath, prepared, undefined, sessionState);
-                    },
-                    onError: (error, severity) => {
-                        if (severity === "terminal" && failoverState) {
-                            capturedTerminalError = error;
-                            callbacks.onError(new Error(""), "transient");
-                            return;
-                        }
-                        callbacks.onError(error, severity);
-                    },
-                };
-                /* v8 ignore stop */
-                const result = await (0, pipeline_1.handleInboundTurn)({
-                    channel: "cli",
-                    sessionKey: "session",
-                    capabilities: cliCapabilities,
-                    messages: [{ role: "user", content: userContent ?? userInput }],
-                    continuityIngressTexts: getCliContinuityIngressTexts(userInput),
-                    callbacks: failoverAwareCallbacks,
-                    friendResolver: { resolve: () => Promise.resolve(resolvedContext) },
-                    sessionLoader: {
-                        loadOrCreate: () => Promise.resolve({
-                            messages,
-                            sessionPath: sessPath,
-                            state: sessionState,
-                            events: sessionEvents,
-                            structuredOutputs: existing?.structuredOutputs,
-                        }),
-                    },
-                    pendingDir,
-                    friendStore,
-                    provider: "local",
-                    externalId: localExternalId,
-                    enforceTrustGate: trust_gate_1.enforceTrustGate,
-                    drainPending: pending_1.drainPending,
-                    drainDeferredReturns: (deferredFriendId) => (0, pending_1.drainDeferredReturns)(currentAgentName, deferredFriendId),
-                    runAgent: (msgs, cb, channel, sig, opts) => (0, core_1.runAgent)(msgs, cb, channel, sig, {
-                        ...opts,
-                        toolContext: {
-                            /* v8 ignore next -- default no-op signin; pipeline provides the real one @preserve */
-                            signin: async () => undefined,
-                            ...opts?.toolContext,
-                            summarize,
-                        },
+    await runCliSession({
+        agentName: currentAgentName,
+        pasteDebounceMs,
+        messages: sessionMessages,
+        lastActivityAt: sessionState?.lastFriendActivityAt,
+        _testInputSource: options?._testInputSource,
+        onTurnStart: async (messages) => {
+            sessionTurnLease = await acquireTurnLease(sessPath);
+            try {
+                pendingPersists = [];
+                existing = (0, context_1.loadSession)(sessPath);
+                sessionState = existing?.state;
+                sessionEvents = existing?.events ?? [];
+                const loadedMessages = existing?.messages && existing.messages.length > 0
+                    ? existing.messages
+                    : [{ role: "system", content: (0, prompt_1.flattenSystemPrompt)(await (0, prompt_1.buildSystem)("cli", {}, resolvedContext)) }];
+                (0, core_1.repairOrphanedToolCalls)(loadedMessages);
+                messages.splice(0, messages.length, ...loadedMessages);
+            }
+            catch (error) {
+                const lease = sessionTurnLease;
+                sessionTurnLease = null;
+                await lease.release();
+                throw error;
+            }
+        },
+        onTurnFinish: async () => {
+            try {
+                await Promise.all(pendingPersists);
+            }
+            finally {
+                const lease = sessionTurnLease;
+                sessionTurnLease = null;
+                await lease.release();
+            }
+        },
+        onAsyncAssistantMessage: async (messages, _assistantMessage) => {
+            const prepared = (0, context_1.postTurnTrim)(messages);
+            const events = (0, context_1.postTurnPersist)(sessPath, prepared, undefined, sessionState, sessionTurnLease ?? undefined);
+            /* v8 ignore next -- defensive: postTurnPersist always returns events in practice @preserve */
+            sessionEvents = events.length > 0 ? events : sessionEvents;
+        },
+        runTurn: async (messages, userInput, callbacks, signal, toolContext, userContent) => {
+            // Run the full per-turn pipeline: resolve -> gate -> session -> drain -> runAgent -> postTurn -> tokens
+            // User message passed via input.messages so the pipeline can prepend pending messages to it.
+            const failoverState = cliFailoverState;
+            // Capture terminal errors instead of displaying immediately — the failover
+            // message replaces the raw error if failover triggers successfully.
+            let capturedTerminalError = null;
+            /* v8 ignore start -- failover-aware callback wrapper: tested via pipeline integration @preserve */
+            const failoverAwareCallbacks = {
+                ...callbacks,
+                // Save session after each tool result for crash recovery (deferred to avoid blocking)
+                onToolResult: (turnMessages) => {
+                    const prepared = (0, context_1.postTurnTrim)(turnMessages);
+                    pendingPersists.push((0, context_1.deferPostTurnPersist)(sessPath, prepared, undefined, sessionState, sessionTurnLease ?? undefined));
+                },
+                onError: (error, severity) => {
+                    if (severity === "terminal" && failoverState) {
+                        capturedTerminalError = error;
+                        callbacks.onError(new Error(""), "transient");
+                        return;
+                    }
+                    callbacks.onError(error, severity);
+                },
+            };
+            /* v8 ignore stop */
+            const result = await (0, pipeline_1.handleInboundTurn)({
+                channel: "cli",
+                sessionKey: "session",
+                capabilities: cliCapabilities,
+                messages: [{ role: "user", content: userContent ?? userInput }],
+                continuityIngressTexts: getCliContinuityIngressTexts(userInput),
+                callbacks: failoverAwareCallbacks,
+                sessionTurnLease: sessionTurnLease,
+                friendResolver: { resolve: () => Promise.resolve(resolvedContext) },
+                sessionLoader: {
+                    loadOrCreate: () => Promise.resolve({
+                        messages,
+                        sessionPath: sessPath,
+                        state: sessionState,
+                        events: sessionEvents,
+                        structuredOutputs: existing?.structuredOutputs,
                     }),
-                    postTurn: (turnMessages, sessionPathArg, usage, hooks, state) => {
-                        // Trim synchronously (mutates turnMessages for next turn),
-                        // then defer envelope build + disk I/O to avoid blocking the TUI.
-                        const prepared = (0, context_1.postTurnTrim)(turnMessages, usage, hooks);
-                        sessionState = state;
-                        (0, context_1.deferPostTurnPersist)(sessionPathArg, prepared, usage, state).then((events) => {
-                            /* v8 ignore next -- defensive: deferPostTurnPersist always resolves events in practice @preserve */
-                            sessionEvents = events.length > 0 ? events : sessionEvents;
-                        });
+                },
+                pendingDir,
+                friendStore,
+                provider: "local",
+                externalId: localExternalId,
+                enforceTrustGate: trust_gate_1.enforceTrustGate,
+                drainPending: pending_1.drainPending,
+                drainDeferredReturns: (deferredFriendId) => (0, pending_1.drainDeferredReturns)(currentAgentName, deferredFriendId),
+                runAgent: (msgs, cb, channel, sig, opts) => (0, core_1.runAgent)(msgs, cb, channel, sig, {
+                    ...opts,
+                    toolContext: {
+                        /* v8 ignore next -- default no-op signin; pipeline provides the real one @preserve */
+                        signin: async () => undefined,
+                        ...opts?.toolContext,
+                        summarize,
                     },
-                    accumulateFriendTokens: friends_1.accumulateFriendTokens,
-                    signal,
-                    runAgentOptions: {
-                        toolChoiceRequired: (0, commands_1.getToolChoiceRequired)(),
-                        traceId: (0, nerves_1.createTraceId)(),
-                        mcpManager,
-                        toolContext,
-                    },
-                    failoverState,
-                });
-                /* v8 ignore start -- failover display: tested via pipeline integration tests @preserve */
-                if (result.failoverMessage) {
-                    // Failover handled it — show the actionable message instead of the raw error
-                    process.stdout.write(`\x1b[33m${result.failoverMessage}\x1b[0m\n`);
-                }
-                else if (capturedTerminalError) {
-                    // Failover didn't trigger (no failoverState, or sequence failed) — show the raw error
-                    process.stderr.write(`\x1b[31m${(0, format_1.formatError)(capturedTerminalError)}\x1b[0m\n`);
-                }
-                /* v8 ignore stop */
-                // Handle gate rejection: display auto-reply if present
-                if (!result.gateResult.allowed) {
-                    if ("autoReply" in result.gateResult && result.gateResult.autoReply) {
-                        process.stdout.write(`${result.gateResult.autoReply}\n`);
-                    }
+                }),
+                postTurn: (turnMessages, sessionPathArg, usage, hooks, state) => {
+                    // Trim synchronously (mutates turnMessages for next turn),
+                    // then defer envelope build + disk I/O to avoid blocking the TUI.
+                    const prepared = (0, context_1.postTurnTrim)(turnMessages, usage, hooks);
+                    sessionState = state;
+                    const persist = (0, context_1.deferPostTurnPersist)(sessionPathArg, prepared, usage, state, sessionTurnLease ?? undefined).then((events) => {
+                        /* v8 ignore next -- defensive: deferPostTurnPersist always resolves events in practice @preserve */
+                        sessionEvents = events.length > 0 ? events : sessionEvents;
+                    });
+                    pendingPersists.push(persist);
+                },
+                accumulateFriendTokens: friends_1.accumulateFriendTokens,
+                signal,
+                runAgentOptions: {
+                    toolChoiceRequired: (0, commands_1.getToolChoiceRequired)(),
+                    traceId: (0, nerves_1.createTraceId)(),
+                    mcpManager,
+                    toolContext,
+                },
+                failoverState,
+            });
+            /* v8 ignore start -- failover display: tested via pipeline integration tests @preserve */
+            if (result.failoverMessage) {
+                // Failover handled it — show the actionable message instead of the raw error
+                process.stdout.write(`\x1b[33m${result.failoverMessage}\x1b[0m\n`);
+            }
+            else if (capturedTerminalError) {
+                // Failover didn't trigger (no failoverState, or sequence failed) — show the raw error
+                process.stderr.write(`\x1b[31m${(0, format_1.formatError)(capturedTerminalError)}\x1b[0m\n`);
+            }
+            /* v8 ignore stop */
+            // Handle gate rejection: display auto-reply if present
+            if (!result.gateResult.allowed) {
+                if ("autoReply" in result.gateResult && result.gateResult.autoReply) {
+                    process.stdout.write(`${result.gateResult.autoReply}\n`);
                 }
-                return { usage: result.usage, turnOutcome: result.turnOutcome, commandAction: result.commandAction };
-            },
-        });
-    }
-    finally {
-        sessionLock?.release();
-    }
+            }
+            return { usage: result.usage, turnOutcome: result.turnOutcome, commandAction: result.commandAction };
+        },
+    });
     // Force exit: lingering handles (Ink cleanup timers, MCP connections) keep the
     // event loop alive after the interactive session ends. This is safe because all
     // session persistence has already completed in the finally block above.

package/dist/senses/pipeline.js

@@ -690,6 +690,9 @@ async function handleInboundTurn(input) {
     }
     // Step 3: Load/create session
     const session = await input.sessionLoader.loadOrCreate();
+    if (input.sessionTurnLease && path.resolve(session.sessionPath) !== input.sessionTurnLease.sessionPath) {
+        throw new Error(`leased session path mismatch: expected ${input.sessionTurnLease.sessionPath}, loaded ${path.resolve(session.sessionPath)}`);
+    }
     const sessionMessages = session.messages;
     const sessionEvents = session.events ?? [];
     let mustResolveBeforeHandoff = (0, continuity_1.resolveMustResolveBeforeHandoff)(session.state?.mustResolveBeforeHandoff === true, input.continuityIngressTexts);
@@ -1001,6 +1004,26 @@ async function handleInboundTurn(input) {
                 ...(result.error ? { errorName: result.error.name } : {}),
                 ...(result.errorClassification ? { errorCode: result.errorClassification } : {}),
             }));
+        if (result.outcome === "suspended") {
+            if (!result.suspension)
+                throw new Error("suspended agent turn omitted durable approval suspension");
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.pipeline_approval_suspended",
+                message: "pipeline returned a durably checkpointed approval suspension without duplicate post-turn persistence",
+                meta: { approvalId: result.suspension.approvalId, sessionPath: session.sessionPath },
+            });
+            return {
+                resolvedContext,
+                gateResult,
+                usage: result.usage,
+                turnOutcome: result.outcome,
+                suspension: result.suspension,
+                sessionPath: session.sessionPath,
+                messages: sessionMessages,
+                drainedPending: pending,
+            };
+        }
         // Step 5b: Failover on terminal error
         if (result.outcome === "errored" && input.failoverState) {
             try {