@pi-in-go/pigpen-ahp 0.1.0

package/extensions/ahp/internal/host/reconnect_test.go

@@ -0,0 +1,197 @@
+package host_test
+
+import (
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/microsoft/agent-host-protocol/clients/go/ahptypes"
+
+	"github.com/MichaelKinsy/pigpen/ahp/internal/channels"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/host"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/testkit"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/twin"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/wire"
+)
+
+const reconnectClientID = "reconnecting-client"
+
+func bumpActiveSessions(h *host.Host, n int64) {
+	h.DispatchServerAction(wire.RootChannel, rootActiveSessions(n))
+}
+
+type replayResult struct {
+	Type    string                    `json:"type"`
+	Actions []ahptypes.ActionEnvelope `json:"actions"`
+	Missing []string                  `json:"missing"`
+	Snaps   []ahptypes.Snapshot       `json:"snapshots"`
+}
+
+func reconnect(t *testing.T, c *testkit.Client, clientID string, lastSeen int64, subs []string) replayResult {
+	t.Helper()
+	var r replayResult
+	c.Decode(c.Must("reconnect", rootParams(map[string]any{"clientId": clientID, "lastSeenServerSeq": lastSeen, "subscriptions": subs})), &r)
+	return r
+}
+
+// Twins of upstream test/reconnect.test.ts, describe "reconnect".
+func TestReconnect(t *testing.T) {
+	// A tiny buffer makes the eviction path cheap to exercise.
+	h := testkit.NewHost(host.Options{ReplayBufferCapacity: 4})
+
+	twin.Run(t, "reconnect", "keeps non-VS Code and explicitly misrouted reconnects strict", func(t *testing.T) {
+		c := testkit.Connect(t, h)
+		for _, tc := range []struct {
+			context string
+			params  map[string]any
+		}{
+			{"non-VS Code reconnect without a channel", map[string]any{"clientId": reconnectClientID + "-missing-channel", "lastSeenServerSeq": 0, "subscriptions": []string{wire.RootChannel}}},
+			{"VS Code reconnect with the wrong channel", map[string]any{
+				"channel": wire.SessionURI("wrong-channel"), "clientId": reconnectClientID + "-wrong-channel", "lastSeenServerSeq": 0,
+				"subscriptions": []string{wire.RootChannel}, "_meta": map[string]any{"vscode.telemetryLevel": "off"},
+			}},
+		} {
+			e := c.ExpectError("reconnect", tc.params, wire.CodeInvalidParams)
+			if !strings.HasSuffix(e.Message, "reconnect requires channel ahp-root://") {
+				t.Errorf("%s: message %q", tc.context, e.Message)
+			}
+		}
+	})
+
+	twin.Run(t, "reconnect", "replays only the actions the client missed", func(t *testing.T) {
+		first := testkit.Connect(t, h)
+		init := first.Initialize(reconnectClientID, map[string]any{"initialSubscriptions": []string{wire.RootChannel}})
+		bumpActiveSessions(h, 1)
+		bumpActiveSessions(h, 2)
+		first.Close()
+
+		r := reconnect(t, testkit.Connect(t, h), reconnectClientID, init.ServerSeq, []string{wire.RootChannel})
+		if r.Type != "replay" || len(r.Actions) != 2 {
+			t.Fatalf("result = %+v", r)
+		}
+		if r.Actions[0].ServerSeq != init.ServerSeq+1 || r.Actions[1].ServerSeq != init.ServerSeq+2 {
+			t.Fatalf("serverSeqs = %d, %d (from %d)", r.Actions[0].ServerSeq, r.Actions[1].ServerSeq, init.ServerSeq)
+		}
+		if len(r.Missing) != 0 {
+			t.Fatalf("missing = %v", r.Missing)
+		}
+	})
+
+	twin.Run(t, "reconnect", "falls back to snapshots when the gap predates the replay buffer", func(t *testing.T) {
+		c := testkit.Connect(t, h)
+		c.Initialize(reconnectClientID+"-gap", map[string]any{"initialSubscriptions": []string{wire.RootChannel}})
+		stale := h.ServerSeq()
+		// Overflow the 4-entry buffer so stale+1 is evicted.
+		for i := int64(0); i < 6; i++ {
+			bumpActiveSessions(h, i)
+		}
+		c.Close()
+		r := reconnect(t, testkit.Connect(t, h), reconnectClientID+"-gap", stale, []string{wire.RootChannel})
+		if r.Type != "snapshot" || len(r.Snaps) != 1 || r.Snaps[0].Resource != wire.RootChannel || r.Snaps[0].FromSeq != h.ServerSeq() {
+			t.Fatalf("result = %+v (serverSeq %d)", r, h.ServerSeq())
+		}
+	})
+
+	twin.Run(t, "reconnect", "reports subscriptions it cannot resume as missing", func(t *testing.T) {
+		c := testkit.Connect(t, h)
+		init := c.Initialize(reconnectClientID+"-missing", map[string]any{"initialSubscriptions": []string{wire.RootChannel}})
+		disposed := wire.SessionURI("already-gone")
+		c.Close()
+		r := reconnect(t, testkit.Connect(t, h), reconnectClientID+"-missing", init.ServerSeq, []string{wire.RootChannel, disposed})
+		if r.Type != "replay" || !reflect.DeepEqual(r.Missing, []string{disposed}) {
+			t.Fatalf("result = %+v", r)
+		}
+	})
+
+	twin.Run(t, "reconnect", "returns an empty replay for a client that is already current", func(t *testing.T) {
+		c := testkit.Connect(t, h)
+		c.Initialize(reconnectClientID+"-current", map[string]any{"initialSubscriptions": []string{wire.RootChannel}})
+		c.Close()
+		r := reconnect(t, testkit.Connect(t, h), reconnectClientID+"-current", h.ServerSeq(), []string{wire.RootChannel})
+		if r.Type != "replay" || r.Actions == nil || len(r.Actions) != 0 {
+			t.Fatalf("result = %+v (actions must be an empty array)", r)
+		}
+	})
+
+	twin.Run(t, "reconnect", "replaces a half-open connection that reuses a clientId", func(t *testing.T) {
+		clientID := reconnectClientID + "-duplicate"
+		before := h.SubscriberCount(wire.RootChannel)
+		first := testkit.Connect(t, h)
+		first.Initialize(clientID, nil)
+		first.Subscribe(wire.RootChannel)
+		if got := h.SubscriberCount(wire.RootChannel); got != before+1 {
+			t.Fatalf("subscribers = %d, want %d", got, before+1)
+		}
+		replacement := testkit.Connect(t, h)
+		replacement.Initialize(clientID, nil)
+		replacement.Subscribe(wire.RootChannel)
+		if got := h.SubscriberCount(wire.RootChannel); got != before+1 {
+			t.Fatalf("subscribers = %d, want %d", got, before+1)
+		}
+		// The host closes the replaced transport on its own goroutine (a Close that blocks must not stall the handshake).
+		testkit.Eventually(t, "the half-open connection to be closed", first.ServerClosed)
+	})
+
+	twin.Run(t, "reconnect", "retains clientInfo when a replacement initialize omits it", func(t *testing.T) {
+		clientID := reconnectClientID + "-reinitialize"
+		id := "vscode-reinitialize"
+		mustCreate(t, h, wire.SessionURI(id), channels.InitialSessionState("pi", "Reinitialize", "/tmp"), wire.KindSession)
+		first := testkit.Connect(t, h)
+		first.Must("initialize", rootParams(map[string]any{"clientId": clientID, "protocolVersions": testkit.SupportedVersions(), "clientInfo": map[string]any{"name": "vscode-editor-window"}}))
+		first.Close()
+		replacement := testkit.Connect(t, h)
+		replacement.Initialize(clientID, nil)
+		clientURI := "pi:/" + id
+		if got := replacement.Subscribe(clientURI); got.Snapshot == nil || got.Snapshot.Resource != clientURI {
+			t.Fatalf("subscribe(%s) = %+v", clientURI, got)
+		}
+	})
+
+	twin.Run(t, "reconnect", "infers the provider URI dialect without clientInfo", func(t *testing.T) {
+		clientID := reconnectClientID + "-provider-alias"
+		id := "provider-alias-reconnect"
+		canonical, alias := wire.SessionURI(id), "pi:/"+id
+		mustCreate(t, h, canonical, channels.InitialSessionState("pi", "Reconnect", "/tmp"), wire.KindSession)
+		first := testkit.Connect(t, h)
+		first.Initialize(clientID, nil)
+		if got := first.Subscribe(alias); got.Snapshot == nil || got.Snapshot.Resource != alias {
+			t.Fatalf("subscribe = %+v", got)
+		}
+		stale := h.ServerSeq()
+		first.Close()
+		for i := int64(0); i < 6; i++ {
+			bumpActiveSessions(h, i)
+		}
+		r := reconnect(t, testkit.Connect(t, h), clientID, stale, []string{alias})
+		if r.Type != "snapshot" || len(r.Snaps) != 1 || r.Snaps[0].Resource != alias {
+			t.Fatalf("result = %+v", r)
+		}
+		if !h.Store().Has(canonical) || h.Store().Has(alias) {
+			t.Fatal("core state stays canonical")
+		}
+	})
+
+	twin.Run(t, "reconnect", "retains VS Code's URI dialect across connections", func(t *testing.T) {
+		clientID := reconnectClientID + "-vscode"
+		id := "vscode-reconnect"
+		clientURI := "pi:/" + id
+		mustCreate(t, h, wire.SessionURI(id), channels.InitialSessionState("pi", "Reconnect", "/tmp"), wire.KindSession)
+		first := testkit.Connect(t, h)
+		first.Must("initialize", rootParams(map[string]any{"clientId": clientID, "protocolVersions": testkit.SupportedVersions(), "clientInfo": map[string]any{"name": "vscode-editor-window"}}))
+		if got := first.Subscribe(clientURI); got.Snapshot == nil || got.Snapshot.Resource != clientURI {
+			t.Fatalf("subscribe = %+v", got)
+		}
+		stale := h.ServerSeq()
+		first.Close()
+		for i := int64(0); i < 6; i++ {
+			bumpActiveSessions(h, i)
+		}
+		r := reconnect(t, testkit.Connect(t, h), clientID, stale, []string{clientURI})
+		if r.Type != "snapshot" || len(r.Snaps) != 1 || r.Snaps[0].Resource != clientURI {
+			t.Fatalf("result = %+v", r)
+		}
+	})
+}
+
+var _ = json.Marshal

package/extensions/ahp/internal/host/replaywindow_test.go

@@ -0,0 +1,31 @@
+package host_test
+
+import (
+	"testing"
+
+	"github.com/MichaelKinsy/pigpen/ahp/internal/host"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/testkit"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/wire"
+)
+
+// The replay buffer serves a client only when it still holds every action after lastSeenServerSeq:
+// one action past the edge must fall back to fresh snapshots, never a replay with a hole in it.
+func TestReplayWindowEdge(t *testing.T) {
+	h := testkit.NewHost(host.Options{ReplayBufferCapacity: 4})
+	c := testkit.Connect(t, h)
+	c.Initialize("edge-client", map[string]any{"initialSubscriptions": []string{wire.RootChannel}})
+	c.Close()
+	seen := h.ServerSeq()
+	for i := 0; i < 4; i++ {
+		bumpActiveSessions(h, int64(i))
+	}
+	inside := reconnect(t, testkit.Connect(t, h), "edge-client", seen, []string{wire.RootChannel})
+	if inside.Type != "replay" || len(inside.Actions) != 4 {
+		t.Fatalf("the buffer still holds every action after lastSeen: type=%s actions=%d", inside.Type, len(inside.Actions))
+	}
+	bumpActiveSessions(h, 9) // evicts the oldest action the client has not seen
+	outside := reconnect(t, testkit.Connect(t, h), "edge-client", seen, []string{wire.RootChannel})
+	if outside.Type != "snapshot" || len(outside.Snaps) != 1 {
+		t.Fatalf("one action beyond the buffer must fall back to snapshots: type=%s snapshots=%d", outside.Type, len(outside.Snaps))
+	}
+}

package/extensions/ahp/internal/host/schema_test.go

@@ -0,0 +1,79 @@
+package host_test
+
+import (
+	"testing"
+
+	"github.com/microsoft/agent-host-protocol/clients/go/ahptypes"
+
+	"github.com/MichaelKinsy/pigpen/ahp/internal/host"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/testkit"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/twin"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/wire"
+)
+
+// Twins of upstream test/schema.test.ts, describe "wire schema".
+func TestWireSchema(t *testing.T) {
+	h := testkit.NewHost(host.Options{})
+
+	twin.Run(t, "schema", "emits a conforming InitializeResult", func(t *testing.T) {
+		c := testkit.Connect(t, h)
+		res := c.Initialize(nextClientID(), map[string]any{"initialSubscriptions": []string{wire.RootChannel}})
+		testkit.AssertValid(t, "commands", "InitializeResult", res)
+	})
+
+	twin.Run(t, "schema", "emits a conforming RootState snapshot", func(t *testing.T) {
+		c := initialized(t, h)
+		res := c.Subscribe(wire.RootChannel)
+		if res.Snapshot == nil {
+			t.Fatal("no snapshot")
+		}
+		testkit.AssertValid(t, "commands", "Snapshot", res.Snapshot)
+		testkit.AssertValid(t, "state", "RootState", res.Snapshot.State.Root)
+	})
+
+	twin.Run(t, "schema", "emits conforming ActionEnvelopes", func(t *testing.T) {
+		c := initialized(t, h, wire.RootChannel)
+		h.DispatchServerAction(wire.RootChannel, ahptypes.StateAction{Value: &ahptypes.RootActiveSessionsChangedAction{
+			Type: ahptypes.ActionTypeRootActiveSessionsChanged, ActiveSessions: 3,
+		}})
+		env := c.NextEnvelope(wire.RootChannel, 0)
+		testkit.AssertValid(t, "actions", "ActionEnvelope", env)
+		testkit.AssertValid(t, "actions", "StateAction", env.Action)
+	})
+
+	twin.Run(t, "schema", "fails validation for a structurally wrong action", func(t *testing.T) {
+		// A reducer would accept this silently (unknown shape becomes a no-op); only the schema catches it.
+		bogus := map[string]any{
+			"channel":   wire.RootChannel,
+			"action":    map[string]any{"type": "root/activeSessionsChanged"},
+			"serverSeq": 1,
+		}
+		if testkit.CheckSchema("actions", "ActionEnvelope", bogus) == nil {
+			t.Fatal("the schema accepted an action without its required field")
+		}
+	})
+}
+
+// Twins of upstream test/upstream-workarounds.test.ts: they fail once a spec re-sync no longer
+// needs the workarounds the schema validator applies.
+func TestUpstreamWorkarounds(t *testing.T) {
+	if err := testkit.LoadSchemas(); err != nil {
+		t.Fatal(err)
+	}
+	twin.Run(t, "upstream-workarounds", "still needs the dangling-$ref strip", func(t *testing.T) {
+		if testkit.StrippedDanglingRefs == 0 {
+			t.Fatal("the schemas no longer contain a dangling `$ref` to an empty `$defs` name: delete the strip from internal/testkit/schema.go and this test")
+		}
+	})
+	twin.Run(t, "upstream-workarounds", "still needs every KNOWN_BITSET_ENUMS entry", func(t *testing.T) {
+		found := false
+		for _, e := range testkit.RelaxedBitsetEnums {
+			if len(e) >= len("SessionStatus") && e[len(e)-len("SessionStatus"):] == "SessionStatus" {
+				found = true
+			}
+		}
+		if !found {
+			t.Fatal("SessionStatus is no longer emitted as a closed enum: remove the relaxation from internal/testkit/schema.go")
+		}
+	})
+}

package/extensions/ahp/internal/host/store.go

@@ -0,0 +1,291 @@
+package host
+
+import (
+	"encoding/json"
+	"fmt"
+	"sync"
+
+	"github.com/microsoft/agent-host-protocol/clients/go/ahp"
+	"github.com/microsoft/agent-host-protocol/clients/go/ahptypes"
+
+	"github.com/MichaelKinsy/pigpen/ahp/internal/wire"
+)
+
+// maxRetainedTerminalChars bounds the output kept for snapshots; live clients still receive every action.
+const maxRetainedTerminalChars = 1_000_000
+
+// Store holds the state tree of every state-bearing channel. Every state is mutated only by
+// actions run through the protocol's reducers (the vendored Microsoft Go reducers), and reads
+// return deep copies, so a caller never observes a later mutation. Port of src/core/state-store.ts.
+type Store struct {
+	mu       sync.RWMutex
+	channels map[string]*entry
+}
+
+type entry struct {
+	kind  wire.ChannelKind
+	state any // *RootState, *SessionState, *ChatState, *TerminalState or *ResourceWatchState
+}
+
+func newStore() *Store { return &Store{channels: map[string]*entry{}} }
+
+// Create registers a channel with its initial state (a pointer to the typed state). The kind is
+// inferred from the scheme unless given, which callers do when a command establishes the kind of
+// a client-chosen URI. It replaces any existing entry.
+func (s *Store) Create(uri string, state any, kind ...wire.ChannelKind) error {
+	var k wire.ChannelKind
+	if len(kind) > 0 && kind[0] != "" {
+		k = kind[0]
+	} else if inferred, ok := wire.KindOf(uri); ok {
+		k = inferred
+	} else {
+		return fmt.Errorf("cannot create channel with unknown scheme: %s", uri)
+	}
+	if !stateMatchesKind(state, k) {
+		return fmt.Errorf("state %T does not belong to a %s channel", state, k)
+	}
+	s.mu.Lock()
+	s.channels[uri] = &entry{kind: k, state: cloneState(state)}
+	s.mu.Unlock()
+	return nil
+}
+
+// UpdateChat edits a chat's state in place under the store lock, so an edit cannot overwrite an
+// action reduced between reading the state and writing it back. fn reports whether it changed
+// anything; UpdateChat returns false when the chat does not exist or fn made no change.
+func (s *Store) UpdateChat(uri string, fn func(*ahptypes.ChatState) bool) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	e, ok := s.channels[uri]
+	if !ok {
+		return false
+	}
+	chat, ok := e.state.(*ahptypes.ChatState)
+	if !ok {
+		return false
+	}
+	return fn(chat)
+}
+
+func stateMatchesKind(state any, kind wire.ChannelKind) bool {
+	switch state.(type) {
+	case *ahptypes.RootState:
+		return kind == wire.KindRoot
+	case *ahptypes.SessionState:
+		return kind == wire.KindSession
+	case *ahptypes.ChatState:
+		return kind == wire.KindChat
+	case *ahptypes.TerminalState:
+		return kind == wire.KindTerminal
+	case *ahptypes.ChangesetState:
+		return kind == wire.KindChangeset
+	case *ahptypes.ResourceWatchState:
+		return kind == wire.KindResourceWatch
+	}
+	return false
+}
+
+// cloneState deep-copies a typed state through its JSON form (the wire form is the contract).
+func cloneState(state any) any {
+	switch v := state.(type) {
+	case *ahptypes.RootState:
+		return cloneVia(v)
+	case *ahptypes.SessionState:
+		return cloneVia(v)
+	case *ahptypes.ChatState:
+		return cloneVia(v)
+	case *ahptypes.TerminalState:
+		return cloneVia(v)
+	case *ahptypes.ChangesetState:
+		return cloneVia(v)
+	case *ahptypes.ResourceWatchState:
+		return cloneVia(v)
+	}
+	return state
+}
+
+func cloneVia[T any](v *T) *T {
+	if v == nil {
+		return nil
+	}
+	b, err := json.Marshal(v)
+	if err != nil {
+		panic(fmt.Sprintf("host: state is not marshalable: %v", err))
+	}
+	out := new(T)
+	if err := json.Unmarshal(b, out); err != nil {
+		panic(fmt.Sprintf("host: state does not round-trip: %v", err))
+	}
+	return out
+}
+
+// Delete removes a channel.
+func (s *Store) Delete(uri string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	_, ok := s.channels[uri]
+	delete(s.channels, uri)
+	return ok
+}
+
+// Has reports whether a channel exists.
+func (s *Store) Has(uri string) bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	_, ok := s.channels[uri]
+	return ok
+}
+
+// KindOf returns the kind of an existing channel.
+func (s *Store) KindOf(uri string) (wire.ChannelKind, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	e, ok := s.channels[uri]
+	if !ok {
+		return "", false
+	}
+	return e.kind, true
+}
+
+func get[T any](s *Store, uri string) *T {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	e, ok := s.channels[uri]
+	if !ok {
+		return nil
+	}
+	typed, ok := e.state.(*T)
+	if !ok {
+		return nil
+	}
+	return cloneVia(typed)
+}
+
+// Root, Session, Chat, Terminal, ResourceWatch return a deep copy of the typed state, nil when
+// the channel is absent or of another kind.
+func (s *Store) Root(uri string) *ahptypes.RootState       { return get[ahptypes.RootState](s, uri) }
+func (s *Store) Session(uri string) *ahptypes.SessionState { return get[ahptypes.SessionState](s, uri) }
+func (s *Store) Chat(uri string) *ahptypes.ChatState       { return get[ahptypes.ChatState](s, uri) }
+func (s *Store) Terminal(uri string) *ahptypes.TerminalState {
+	return get[ahptypes.TerminalState](s, uri)
+}
+func (s *Store) ResourceWatch(uri string) *ahptypes.ResourceWatchState {
+	return get[ahptypes.ResourceWatchState](s, uri)
+}
+
+// Apply reduces an action into a channel using the reducer for its kind. Reducers are total: an
+// action they do not recognise is a no-op, which is how forward compatibility works. It returns
+// false when the channel does not exist — the spec requires the host to silently ignore actions
+// targeting an unknown channel rather than echoing a rejection.
+func (s *Store) Apply(uri string, action ahptypes.StateAction) (applied bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	e, ok := s.channels[uri]
+	if !ok {
+		return false
+	}
+	// The vendored reducers panic on a malformed timestamp; a hostile or buggy client must not take the host down.
+	defer func() {
+		if r := recover(); r != nil {
+			applied = true
+		}
+	}()
+	switch st := e.state.(type) {
+	case *ahptypes.RootState:
+		ahp.ApplyActionToRoot(st, action)
+	case *ahptypes.SessionState:
+		ahp.ApplyActionToSession(st, action)
+	case *ahptypes.ChatState:
+		ahp.ApplyActionToChat(st, action)
+	case *ahptypes.TerminalState:
+		ahp.ApplyActionToTerminal(st, action)
+		if _, isData := action.Value.(*ahptypes.TerminalDataAction); isData {
+			trimTerminal(st)
+		}
+	case *ahptypes.ChangesetState:
+		ahp.ApplyActionToChangeset(st, action)
+	case *ahptypes.ResourceWatchState:
+		ahp.ApplyActionToResourceWatch(st, action)
+	}
+	return true
+}
+
+// Snapshot builds a subscribe/initialize snapshot for a channel at the given seq.
+func (s *Store) Snapshot(uri string, fromSeq int64) (ahptypes.Snapshot, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	e, ok := s.channels[uri]
+	if !ok {
+		return ahptypes.Snapshot{}, false
+	}
+	var state ahptypes.SnapshotState
+	switch st := e.state.(type) {
+	case *ahptypes.RootState:
+		state.Root = cloneVia(st)
+	case *ahptypes.SessionState:
+		state.Session = cloneVia(st)
+	case *ahptypes.ChatState:
+		state.Chat = cloneVia(st)
+	case *ahptypes.TerminalState:
+		state.Terminal = cloneVia(st)
+	case *ahptypes.ChangesetState:
+		state.Changeset = cloneVia(st)
+	case *ahptypes.ResourceWatchState:
+		state.ResourceWatch = cloneVia(st)
+	}
+	return ahptypes.Snapshot{Resource: uri, State: state, FromSeq: fromSeq}, true
+}
+
+// trimTerminal drops only the oldest retained output beyond the cap.
+func trimTerminal(st *ahptypes.TerminalState) {
+	remaining := maxRetainedTerminalChars
+	trimmed := false
+	var newestFirst []ahptypes.TerminalContentPart
+	for i := len(st.Content) - 1; i >= 0; i-- {
+		part := st.Content[i]
+		out := terminalOutput(part)
+		runes := []rune(out)
+		if len(runes) <= remaining {
+			newestFirst = append(newestFirst, part)
+			remaining -= len(runes)
+			continue
+		}
+		if remaining > 0 {
+			newestFirst = append(newestFirst, withTerminalOutput(part, string(runes[len(runes)-remaining:])))
+		}
+		trimmed = true
+		break
+	}
+	if !trimmed {
+		return
+	}
+	content := make([]ahptypes.TerminalContentPart, 0, len(newestFirst))
+	for i := len(newestFirst) - 1; i >= 0; i-- {
+		content = append(content, newestFirst[i])
+	}
+	st.Content = content
+}
+
+func terminalOutput(p ahptypes.TerminalContentPart) string {
+	switch v := p.Value.(type) {
+	case *ahptypes.TerminalUnclassifiedPart:
+		return v.Value
+	case *ahptypes.TerminalCommandPart:
+		return v.Output
+	}
+	return ""
+}
+
+func withTerminalOutput(p ahptypes.TerminalContentPart, out string) ahptypes.TerminalContentPart {
+	switch v := p.Value.(type) {
+	case *ahptypes.TerminalUnclassifiedPart:
+		c := *v
+		c.Value = out
+		return ahptypes.TerminalContentPart{Value: &c}
+	case *ahptypes.TerminalCommandPart:
+		c := *v
+		c.Output = out
+		return ahptypes.TerminalContentPart{Value: &c}
+	}
+	return p
+}

package/extensions/ahp/internal/host/store_update_test.go

@@ -0,0 +1,85 @@
+package host_test
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/MichaelKinsy/pigpen/ahp/internal/host"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/testkit"
+	"github.com/MichaelKinsy/pigpen/ahp/internal/wire"
+	ahptypes "github.com/microsoft/agent-host-protocol/clients/go/ahptypes"
+)
+
+// UpdateChat is a read-modify-write under the store lock: edits racing with reduced actions must
+// never drop either side (a title rewrite that replaced the whole state once erased a running turn).
+func TestUpdateChatDoesNotLoseConcurrentActions(t *testing.T) {
+	const turns = 200
+	s := testkit.NewHost(host.Options{}).Store()
+	uri := "ahp-chat:/00000000-0000-7000-8000-000000000001"
+	if err := s.Create(uri, &ahptypes.ChatState{Resource: uri, Title: "t"}, wire.KindChat); err != nil {
+		t.Fatal(err)
+	}
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < turns; i++ {
+			s.Apply(uri, ahptypes.StateAction{Value: &ahptypes.ChatTurnStartedAction{Type: ahptypes.ActionTypeChatTurnStarted, TurnId: "x", StartedAt: "2025-01-01T00:00:00.000Z"}})
+			s.Apply(uri, ahptypes.StateAction{Value: &ahptypes.ChatTurnCompleteAction{Type: ahptypes.ActionTypeChatTurnComplete, TurnId: "x", Duration: 1}})
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		for i := 0; i < turns; i++ {
+			s.UpdateChat(uri, func(c *ahptypes.ChatState) bool { c.Title = "renamed"; return true })
+		}
+	}()
+	wg.Wait()
+	got := s.Chat(uri)
+	if len(got.Turns) != turns || got.ActiveTurn != nil {
+		t.Fatalf("turns = %d active = %v, want %d complete turns", len(got.Turns), got.ActiveTurn != nil, turns)
+	}
+	if got.Title != "renamed" {
+		t.Fatalf("title = %q", got.Title)
+	}
+	if s.UpdateChat("ahp-chat:/missing", func(*ahptypes.ChatState) bool { return true }) {
+		t.Fatal("updating a missing chat reported a change")
+	}
+}
+
+// An action reduced while an edit is in flight waits for it: the edit sees, and keeps, whatever
+// came before, and the action lands after (deterministic form of the race above; needs no -race).
+func TestUpdateChatExcludesReducers(t *testing.T) {
+	s := testkit.NewHost(host.Options{}).Store()
+	uri := "ahp-chat:/00000000-0000-7000-8000-000000000002"
+	if err := s.Create(uri, &ahptypes.ChatState{Resource: uri}, wire.KindChat); err != nil {
+		t.Fatal(err)
+	}
+	inside, applied := make(chan struct{}), make(chan struct{})
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		s.UpdateChat(uri, func(c *ahptypes.ChatState) bool {
+			close(inside)
+			go func() {
+				s.Apply(uri, ahptypes.StateAction{Value: &ahptypes.ChatTurnStartedAction{Type: ahptypes.ActionTypeChatTurnStarted, TurnId: "x", StartedAt: "2025-01-01T00:00:00.000Z"}})
+				close(applied)
+			}()
+			select {
+			case <-applied:
+				t.Error("an action was reduced while the edit held the chat")
+			case <-time.After(50 * time.Millisecond):
+			}
+			c.Title = "edited"
+			return true
+		})
+	}()
+	<-inside
+	<-done
+	<-applied
+	got := s.Chat(uri)
+	if got.Title != "edited" || got.ActiveTurn == nil {
+		t.Fatalf("title=%q active=%v: the edit and the action must both survive", got.Title, got.ActiveTurn != nil)
+	}
+}