@quantiya/codevibe-antigravity-plugin 2.0.50 → 2.0.51

package/dist/server.js

@@ -290,7 +290,64 @@ var fs2 = __toESM(require("fs"));
 var os2 = __toESM(require("os"));
 var path2 = __toESM(require("path"));
 var import_chokidar = require("chokidar");
+
+// src/shutdown-bounds.ts
+var TEARDOWN_STEP_TIMEOUT_MS = 3e3;
+var WATCHER_CLOSE_TIMEOUT_MS = 2e3;
+var SHUTDOWN_WATCHDOG_MS = 15e3;
+async function boundedStep(work, ms, onTimeout) {
+  let timer;
+  try {
+    const started = (() => {
+      try {
+        return Promise.resolve(work());
+      } catch (err) {
+        return Promise.reject(err);
+      }
+    })();
+    const timeout = new Promise((resolve3) => {
+      timer = setTimeout(() => resolve3("timeout"), ms);
+      if (timer.unref) timer.unref();
+    });
+    const outcome = await Promise.race([
+      started.then(
+        () => "settled",
+        () => "settled"
+      ),
+      timeout
+    ]);
+    if (outcome === "timeout") {
+      void started.catch(() => void 0);
+      try {
+        onTimeout?.();
+      } catch {
+      }
+    }
+    return outcome;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+function armShutdownWatchdog(exit, onFire, ms = SHUTDOWN_WATCHDOG_MS, durableObligationSettled = () => true) {
+  const timer = setTimeout(() => {
+    try {
+      onFire();
+    } catch {
+    }
+    let settled = false;
+    try {
+      settled = durableObligationSettled();
+    } catch {
+      settled = false;
+    }
+    exit(settled ? 0 : 1);
+  }, ms);
+  return () => clearTimeout(timer);
+}
+
+// src/transcript-tailer.ts
 var OFFSET_FLUSH_INTERVAL_MS = 3e4;
+var ERROR_LOG_MIN_INTERVAL_MS = 1e4;
 var LRU_CAP = 50;
 var TRANSCRIPT_FILE_REGEX = /\/brain\/([0-9a-fA-F-]{36})\/\.system_generated\/logs\/transcript\.jsonl$/;
 function defaultPaths() {
@@ -306,6 +363,11 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     this.watcher = null;
     this.isWatching = false;
     this.isShuttingDown = false;
+    /** Error-log rate limiting (incident 2026-09-22 — a wedged watcher wrote
+     *  356,298 identical EMFILE errors / 96 MB before the daemon was killed). */
+    this.lastErrorSignature = null;
+    this.lastErrorLoggedAtMs = 0;
+    this.suppressedErrorCount = 0;
     /** Per-file offset state (in-memory mirror of the persisted store). */
     this.offsets = /* @__PURE__ */ new Map();
     /** Conversation UUIDs we're actively tailing. v1.0 pins to single-active
@@ -383,8 +445,7 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     this.watcher.on("change", (filePath) => this.onFileChanged(filePath));
     this.watcher.on("unlink", (filePath) => this.onFileUnlinked(filePath));
     this.watcher.on("error", (error) => {
-      logger.error("Chokidar error", { error });
-      this.emitError(error);
+      this.emitError(error, "Chokidar error");
     });
     this.watcher.on("ready", () => {
       logger.info("Transcript tailer ready (chokidar initial scan complete)");
@@ -404,15 +465,25 @@ var TranscriptTailer = class extends import_events.EventEmitter {
    * covers the residual windows — the doStop teardown detaches listeners
    * BEFORE the tailer stops, and any embedder that never attached one.
    */
-  emitError(error) {
+  emitError(error, chokidarLabel) {
     const err = error instanceof Error ? error : new Error(String(error));
-    if (this.listenerCount("error") > 0) {
-      this.emit("error", err);
+    const signature = String(err);
+    const now = Date.now();
+    const suppressed = signature === this.lastErrorSignature && now - this.lastErrorLoggedAtMs < ERROR_LOG_MIN_INTERVAL_MS;
+    const hasListener = this.listenerCount("error") > 0;
+    if (suppressed) {
+      this.suppressedErrorCount++;
     } else {
-      logger.error("Transcript tailer error (no listener attached \u2014 logged, non-fatal)", {
-        error: String(err)
+      logger.error(chokidarLabel ?? "Transcript tailer error (non-fatal)", {
+        error: signature,
+        ...hasListener ? {} : { noListenerAttached: true },
+        ...this.suppressedErrorCount > 0 ? { suppressedRepeats: this.suppressedErrorCount } : {}
       });
+      this.lastErrorSignature = signature;
+      this.lastErrorLoggedAtMs = now;
+      this.suppressedErrorCount = 0;
     }
+    if (hasListener) this.emit("error", err);
   }
   /**
    * Stop watching. Flushes offsets one last time before closing chokidar.
@@ -432,10 +503,16 @@ var TranscriptTailer = class extends import_events.EventEmitter {
       logger.warn("Final offset flush failed", { error });
     }
     if (this.watcher) {
-      try {
-        await this.watcher.close();
-      } catch (error) {
-        logger.warn("Error closing chokidar watcher", { error });
+      const watcher = this.watcher;
+      const outcome = await boundedStep(
+        () => watcher.close(),
+        WATCHER_CLOSE_TIMEOUT_MS,
+        () => logger.warn("chokidar watcher.close() timed out \u2014 abandoning it", {
+          timeoutMs: WATCHER_CLOSE_TIMEOUT_MS
+        })
+      );
+      if (outcome === "timeout") {
+        logger.warn("Transcript tailer watcher abandoned; relying on shutdown watchdog");
       }
       this.watcher = null;
     }
@@ -443,7 +520,12 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     this.pendingReads.clear();
     this.isWatching = false;
     this.isShuttingDown = false;
-    logger.info("Transcript tailer stopped");
+    logger.info(
+      "Transcript tailer stopped",
+      this.suppressedErrorCount > 0 ? { suppressedErrorRepeats: this.suppressedErrorCount } : void 0
+    );
+    this.lastErrorSignature = null;
+    this.suppressedErrorCount = 0;
   }
   /**
    * Best-effort sync flush. Safe to call from a process EXIT trap.
@@ -3703,6 +3785,17 @@ var McpServer = class _McpServer {
      *  stop() — preserving the monotonic invariant lets stale callbacks
      *  reliably detect they're stale. (Codex Stage 2 R1 v5 MED 2026-05-20.) */
     this.lifecycleGen = 0;
+    /** Tracks the durable settlement obligation for a launch row. Set when a
+     *  create is ATTEMPTED (before the await — the marker is pre-set), cleared on
+     *  a confirmed retirement AND when the create threw. Read by the shutdown
+     *  watchdog to choose its exit code. (R2-F1 / R3-F1 / R3-F2 — see
+     *  isDurableObligationSettled() for the full predicate and its accepted
+     *  residual.) */
+    this.durableObligationOpen = false;
+    /** Teardown steps that exceeded their bound during the current stop().
+     *  Surfaced in the shutdown summary so a wedge is visible in the log even
+     *  though it no longer blocks exit. (Incident 2026-09-22.) */
+    this.teardownStepsTimedOut = [];
     /** In-flight stop() promise so a re-entrant call (e.g. double SIGINT)
      *  awaits the same shutdown instead of bypassing it and calling
      *  process.exit before the original stop's cleanup completes.
@@ -3852,8 +3945,7 @@ var McpServer = class _McpServer {
     if (!this.started) {
       return { httpPort: 0 };
     }
-    this.addListener(this.transcriptTailer, "error", (err) => {
-      logger.error("transcript tailer error (non-fatal)", { error: String(err) });
+    this.addListener(this.transcriptTailer, "error", () => {
     });
     this.addListener(this.transcriptTailer, "event", (emit) => {
       const task = this.handleTranscriptEmit(emit).catch((err) => {
@@ -3915,6 +4007,7 @@ var McpServer = class _McpServer {
   }
   async doStop() {
     this.started = false;
+    this.teardownStepsTimedOut = [];
     this.stopTmuxLifecycleMonitor();
     const launchSettlement = this.launchSessionPromise?.catch(() => void 0) ?? null;
     let mustAwaitLaunchSettlement = false;
@@ -3935,6 +4028,7 @@ var McpServer = class _McpServer {
       const pendingId = this.pendingLaunchSessionId;
       this.stopRequestedDuringCreate = true;
       const deactivated = await this.deactivateLaunchRow(pendingId);
+      if (deactivated) this.durableObligationOpen = false;
       if (deactivated) {
         if (this.pendingLaunchSessionId === pendingId) this.pendingLaunchSessionId = null;
       } else {
@@ -3971,6 +4065,7 @@ var McpServer = class _McpServer {
         logger.warn("[tool-activity] Agy shutdown drain failed", { error: String(err) });
       }
       const retired = await this.deactivateLaunchRow(this.session.sessionId);
+      if (retired) this.durableObligationOpen = false;
       if (!retired) {
         hostedRetirementError = new Error(
           `Failed to retire hosted Antigravity session ${this.session.sessionId}`
@@ -3984,26 +4079,10 @@ var McpServer = class _McpServer {
       }
     }
     this.unregisterSignalHandlers();
-    try {
-      await this.transcriptTailer.stop();
-    } catch (err) {
-      logger.warn("transcriptTailer.stop failed", { error: String(err) });
-    }
-    try {
-      await this.paneObserver.stop();
-    } catch (err) {
-      logger.warn("paneObserver.stop failed", { error: String(err) });
-    }
-    try {
-      await this.approvalDetector.stop();
-    } catch (err) {
-      logger.warn("approvalDetector.stop failed", { error: String(err) });
-    }
-    try {
-      await this.httpApi.stop();
-    } catch (err) {
-      logger.warn("httpApi.stop failed", { error: String(err) });
-    }
+    await this.boundedTeardownStep("transcriptTailer.stop", () => this.transcriptTailer.stop());
+    await this.boundedTeardownStep("paneObserver.stop", () => this.paneObserver.stop());
+    await this.boundedTeardownStep("approvalDetector.stop", () => this.approvalDetector.stop());
+    await this.boundedTeardownStep("httpApi.stop", () => this.httpApi.stop());
     try {
       this.appSyncClient.cleanupSubscriptions();
     } catch (err) {
@@ -4021,6 +4100,7 @@ var McpServer = class _McpServer {
       if (this.pendingLaunchSessionId) {
         const pendingId = this.pendingLaunchSessionId;
         const retired = await this.deactivateLaunchRow(pendingId);
+        if (retired) this.durableObligationOpen = false;
         if (retired) {
           if (this.pendingLaunchSessionId === pendingId) this.pendingLaunchSessionId = null;
         } else {
@@ -4117,6 +4197,7 @@ var McpServer = class _McpServer {
     const userId = this.appSyncClient.getCurrentUserId();
     const projectPath = process.cwd();
     this.pendingLaunchSessionId = sessionId;
+    this.durableObligationOpen = true;
     let sessionKey = null;
     let sessionKeyGen = null;
     try {
@@ -4138,7 +4219,10 @@ var McpServer = class _McpServer {
       sessionKey = result.sessionKey ?? null;
       sessionKeyGen = result.sessionKeyGen ?? null;
     } catch (err) {
-      if (this.pendingLaunchSessionId === sessionId) this.pendingLaunchSessionId = null;
+      if (this.pendingLaunchSessionId === sessionId) {
+        this.pendingLaunchSessionId = null;
+        this.durableObligationOpen = false;
+      }
       const msg = String(err);
       if (msg.includes("session-limit-exceeded")) {
         logger.warn("Free-tier session limit reached \u2014 mobile sync disabled for this wrapper", { sessionId });
@@ -4158,7 +4242,10 @@ var McpServer = class _McpServer {
     if (gen !== this.lifecycleGen || !this.started || this.stopRequestedDuringCreate) {
       const deactivated = await this.deactivateLaunchRow(sessionId);
       if (deactivated) {
-        if (this.pendingLaunchSessionId === sessionId) this.pendingLaunchSessionId = null;
+        if (this.pendingLaunchSessionId === sessionId) {
+          this.pendingLaunchSessionId = null;
+          this.durableObligationOpen = false;
+        }
       } else {
         logger.error(
           "createLaunchSession bail: INACTIVE write for the just-created row FAILED \u2014 settlement obligation remains open (marker kept); the row may leak ACTIVE if nothing retries before exit (#638 H4)",
@@ -5503,9 +5590,23 @@ var McpServer = class _McpServer {
       logger.info("Native Antigravity tmux session ended; stopping companion daemon", {
         tmuxTarget
       });
+      const disarmLifecycleWatchdog = armShutdownWatchdog(
+        (code) => process.exit(code),
+        () => logger.error("Shutdown watchdog fired after native session end; exiting anyway", {
+          watchdogMs: SHUTDOWN_WATCHDOG_MS,
+          timedOutSteps: this.teardownStepsTimedOut,
+          durableObligationSettled: this.isDurableObligationSettled()
+        }),
+        SHUTDOWN_WATCHDOG_MS,
+        () => this.isDurableObligationSettled()
+      );
       void this.stop().then(
-        () => process.exit(0),
+        () => {
+          disarmLifecycleWatchdog();
+          process.exit(0);
+        },
         (error) => {
+          disarmLifecycleWatchdog();
           logger.error("Failed to stop companion daemon after native session end", {
             error: error instanceof Error ? error.message : String(error)
           });
@@ -5527,9 +5628,26 @@ var McpServer = class _McpServer {
     this.signalsRegistered = true;
     const onSignal = (sig) => {
       logger.info(`${sig} received \u2014 evaluating terminal shutdown`);
+      const disarm = armShutdownWatchdog(
+        (code) => process.exit(code),
+        () => logger.error("Shutdown watchdog fired \u2014 teardown did not complete in time; exiting anyway", {
+          signal: sig,
+          watchdogMs: SHUTDOWN_WATCHDOG_MS,
+          timedOutSteps: this.teardownStepsTimedOut,
+          durableObligationSettled: this.isDurableObligationSettled()
+        }),
+        SHUTDOWN_WATCHDOG_MS,
+        () => this.isDurableObligationSettled()
+      );
       void this.stopForTerminalSignal(sig).then((stopped) => {
-        if (stopped) process.exit(0);
+        if (stopped) {
+          disarm();
+          process.exit(0);
+        } else {
+          disarm();
+        }
       }).catch((err) => {
+        disarm();
         logger.error("shutdown error", { error: String(err) });
         process.exit(1);
       });
@@ -5566,6 +5684,71 @@ var McpServer = class _McpServer {
     await this.stop();
     return true;
   }
+  /**
+   * Has shutdown's DURABLE obligation landed? (Stage 1 r1 finding F3.)
+   *
+   * The only obligation that outliving this process can strand is the backend
+   * session row being marked INACTIVE.
+   *
+   * R2-F1: an earlier version read `pendingLaunchSessionId === null &&
+   * session === null`. That was lifecycle-WIRING state used as a proxy for the
+   * durable OUTCOME, and it was wrong in BOTH directions:
+   *   (a) `this.session = null` is cleared UNCONDITIONALLY at the end of
+   *       Phase 3, including after a retirement that FAILED and set
+   *       `hostedRetirementError` — so it reported success on a row known to
+   *       be stranded ACTIVE, which is the exact laundering F3 asked to close;
+   *   (b) `session` is only cleared AFTER Phase 3, so while the watchdog was
+   *       outlasting a wedged Phase-3 step it still read non-null even though
+   *       the INACTIVE write had already succeeded — reporting failure for the
+   *       wedged-local-handle case that F3 explicitly wanted to keep at exit 0.
+   *
+   * `durableObligationOpen` tracks the outcome directly instead:
+   *   - SET when a create is ATTEMPTED (the marker is pre-set before the
+   *     await), so it means "a create was attempted", not "a row exists";
+   *   - CLEARED when `deactivateLaunchRow` returns true. The stale-lifecycle
+   *     clear is additionally identity-guarded because that branch's
+   *     precondition is that a NEWER lifecycle exists. The other confirmed
+   *     clears are NOT guarded, deliberately: none of them has "a newer
+   *     lifecycle exists" as a precondition, and reaching the hazard would
+   *     need start() to overlap an in-flight doStop() (doStop sets
+   *     started=false first). The Phase-2 clear additionally retires
+   *     this.session.sessionId and has no marker to compare against at all,
+   *     so "unguarded" there is a category difference, not an omission;
+   *   - CLEARED when the create THREW (R3-F2).
+   *
+   * ACCEPTED RESIDUAL: the last rule also clears for a lost-response create
+   * (the server made the row, the response never arrived), so that case is
+   * reported SETTLED even though a row may exist. This is the irreducible
+   * SIGKILL-class residual the file already accepts for
+   * `pendingLaunchSessionId`; the alternative left the flag permanently true
+   * for every free-tier and unkeyed daemon. The row leaked before this change
+   * too and a non-zero exit would not have retired it, so only a diagnostic
+   * signal is traded away.
+   */
+  isDurableObligationSettled() {
+    return !this.durableObligationOpen;
+  }
+  /**
+   * Run one teardown step with a hard bound. Never throws and never hangs, so
+   * a wedged step cannot prevent the steps after it from running.
+   * (Incident 2026-09-22 — see src/shutdown-bounds.ts.)
+   */
+  async boundedTeardownStep(label, work) {
+    const outcome = await boundedStep(
+      async () => {
+        try {
+          await work();
+        } catch (err) {
+          logger.warn(`${label} failed`, { error: String(err) });
+        }
+      },
+      TEARDOWN_STEP_TIMEOUT_MS,
+      () => logger.warn(`${label} timed out \u2014 continuing teardown without it`, {
+        timeoutMs: TEARDOWN_STEP_TIMEOUT_MS
+      })
+    );
+    if (outcome === "timeout") this.teardownStepsTimedOut.push(label);
+  }
   unregisterSignalHandlers() {
     if (!this.signalsRegistered) return;
     if (this.boundSigintHandler) process.off("SIGINT", this.boundSigintHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-antigravity-plugin",
-  "version": "2.0.50",
+  "version": "2.0.51",
   "description": "Control Antigravity CLI from your iPhone and Android — real-time sync, approve file edits, send prompts by voice. Part of CodeVibe.",
   "main": "dist/server.js",
   "codevibe": {
@@ -46,7 +46,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@quantiya/codevibe-core": "^2.0.46",
+    "@quantiya/codevibe-core": "^2.0.48",
     "chokidar": "^5.0.0",
     "dotenv": "^16.6.1",
     "express": "^5.1.0",