@runuai/host 0.8.39 → 0.8.41

package/db/migrations/0011_codex_thread_id.sql

@@ -0,0 +1,5 @@
+-- ADR-078: Codex restart-survival. Persist the app-server thread id so a
+-- respawned Codex (allowAttach:false → kill+respawn on host restart) can
+-- `thread/resume` the SAME durable thread from its on-disk rollout instead of
+-- starting a fresh one and losing the conversation. Null for non-codex kinds.
+ALTER TABLE `host_agent_sessions` ADD `codex_thread_id` text;

package/db/migrations/meta/_journal.json

@@ -78,6 +78,13 @@
       "when": 1779900011000,
       "tag": "0010_host_engine_accounts",
       "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1779900012000,
+      "tag": "0011_codex_thread_id",
+      "breakpoints": true
     }
   ]
 }

package/db/schema.ts

@@ -144,6 +144,10 @@ export const hostAgentSessions = sqliteTable(
       .notNull()
       .default(0),
     status: text("status").notNull().default("running"), // running|closed
+    // ADR-078: Codex thread id (from thread/start). Persisted so a respawned
+    // app-server after a host restart resumes the SAME thread (thread/resume)
+    // instead of losing the conversation. Null for non-codex kinds / pre-resume.
+    codexThreadId: text("codex_thread_id"),
     createdAt: integer("created_at", { mode: "number" }).notNull(),
     updatedAt: integer("updated_at", { mode: "number" }).notNull(),
   },

package/lib/agents/codex.ts

@@ -32,6 +32,9 @@ import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { and, eq } from "drizzle-orm";
+
+import { getDb, schema } from "../db";
 import { newId } from "../ulid";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { isRateLimitMessage } from "./rate-limit";
@@ -211,6 +214,64 @@ const APPROVAL_METHODS = new Set([
  *  can legitimately run for minutes. */
 const RPC_TIMEOUT_MS = 30_000;
 
+/**
+ * ADR-078 thread/resume lock retry. Right after a host restart the previous
+ * (durable, in-container) app-server may still hold the thread's rollout lock;
+ * `thread/resume` then fails with JSON-RPC -32600 until the stop we sent the old
+ * runner lands. Retry that specific error a bounded number of times.
+ */
+const RESUME_LOCK_ATTEMPTS = 10;
+const RESUME_LOCK_BACKOFF_MS = 1_000;
+
+const delay = (ms: number): Promise<void> =>
+  new Promise((resolve) => setTimeout(resolve, ms));
+
+// ---------------------------------------------------------------------------
+// Thread persistence (ADR-078) — resume the SAME thread across a host restart.
+// ---------------------------------------------------------------------------
+
+/** The Codex thread id persisted for (task, agent), or null if none yet. */
+function readCodexThreadId(taskId: string, agentId: string): string | null {
+  try {
+    const row = getDb()
+      .select({ id: schema.hostAgentSessions.codexThreadId })
+      .from(schema.hostAgentSessions)
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, taskId),
+          eq(schema.hostAgentSessions.agentId, agentId),
+        ),
+      )
+      .get();
+    return row?.id ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Persist the Codex thread id for (task, agent) so a later host process resumes
+ * it. Best-effort — a write failure just means the next restart starts a fresh
+ * thread (today's behavior). The transport's session-row upsert never clears
+ * this column, so it survives the kill+respawn of a host restart.
+ */
+function saveCodexThreadId(taskId: string, agentId: string, threadId: string): void {
+  try {
+    getDb()
+      .update(schema.hostAgentSessions)
+      .set({ codexThreadId: threadId, updatedAt: Date.now() })
+      .where(
+        and(
+          eq(schema.hostAgentSessions.taskId, taskId),
+          eq(schema.hostAgentSessions.agentId, agentId),
+        ),
+      )
+      .run();
+  } catch {
+    /* best effort — see doc comment */
+  }
+}
+
 // ---------------------------------------------------------------------------
 // The session.
 // ---------------------------------------------------------------------------
@@ -222,6 +283,9 @@ export class CodexSession implements AgentSession {
   private readonly proc: LineTransport;
   private readonly handlers = new Set<AgentEventHandler>();
   private readonly systemPreamble: string;
+  private readonly taskId: string;
+  /** ADR-078: a thread id persisted by a PRIOR host process, to resume. */
+  private readonly resumeThreadId: string | null;
   private closed = false;
   private handshakeOk = false;
 
@@ -245,6 +309,10 @@ export class CodexSession implements AgentSession {
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
+    this.taskId = args.taskId;
+    // ADR-078: read BEFORE createAgentTransport (whose session-row upsert
+    // preserves this column). Non-null → a host restart; resume the thread.
+    this.resumeThreadId = readCodexThreadId(args.taskId, args.agent.id);
 
     // The agent's model / effort (when set) are selected via config overrides
     // (`-c model=<model>`, `-c model_reasoning_effort=<effort>`) on the
@@ -328,7 +396,15 @@ export class CodexSession implements AgentSession {
       if (waiter) {
         this.pending.delete(id);
         if (isObj(msg.error)) {
-          waiter.reject(new Error(str(msg.error.message, "rpc error")));
+          // Preserve the JSON-RPC code so thread/resume can retry -32600
+          // (the thread's single-writer lock still held by a dying app-server).
+          const code =
+            typeof msg.error.code === "number" ? msg.error.code : undefined;
+          waiter.reject(
+            Object.assign(new Error(str(msg.error.message, "rpc error")), {
+              rpcCode: code,
+            }),
+          );
         } else {
           waiter.resolve(msg.result);
         }
@@ -355,6 +431,7 @@ export class CodexSession implements AgentSession {
         const thread = msg.params.thread;
         if (isObj(thread) && typeof thread.id === "string") {
           this.threadId = thread.id;
+          saveCodexThreadId(this.taskId, this.agentId, thread.id);
         }
       }
       for (const ev of mapCodexNotification(method, msg.params)) {
@@ -448,11 +525,30 @@ export class CodexSession implements AgentSession {
   private async handshake(): Promise<void> {
     await this.request("initialize", {
       clientInfo: { name: "uai", version: "0.2" },
+      // ADR-078: unlock experimental fields. thread/resume's `excludeTurns`
+      // (resume without replaying history — see tryResumeThread) is gated on
+      // this; without it the app-server rejects the field with
+      // "thread/resume.excludeTurns requires experimentalApi capability" and
+      // we fall back to a fresh thread, losing the whole conversation.
+      capabilities: { experimentalApi: true },
     });
     this.notify("initialized", {});
-    // The uai channel briefing (how to @-mention, the roster, the
-    // project's defaultPrompt) goes in as developer instructions so it
-    // applies to every turn on the thread.
+    // ADR-078: a thread id from a prior host process means this is a restart —
+    // resume the SAME durable thread so the conversation survives, instead of
+    // starting fresh. Fall back to a new thread if resume isn't possible
+    // (thread gone/corrupt, or the old writer never released the lock).
+    if (this.resumeThreadId && (await this.tryResumeThread(this.resumeThreadId))) {
+      this.handshakeOk = true;
+      return;
+    }
+    await this.startThread();
+    this.handshakeOk = true;
+  }
+
+  private async startThread(): Promise<void> {
+    // The uai channel briefing (how to @-mention, the roster, the project's
+    // defaultPrompt) goes in as developer instructions so it applies to every
+    // turn on the thread (persisted with the thread, so resume needn't resend).
     const threadParams: Record<string, unknown> = {
       approvalPolicy: "never",
       sandbox: "danger-full-access",
@@ -462,9 +558,51 @@ export class CodexSession implements AgentSession {
     }
     const result = await this.request("thread/start", threadParams);
     if (isObj(result) && isObj(result.thread)) {
-      this.threadId = str(result.thread.id) || this.threadId;
+      const id = str(result.thread.id) || this.threadId;
+      this.threadId = id;
+      if (id) saveCodexThreadId(this.taskId, this.agentId, id);
     }
-    this.handshakeOk = true;
+  }
+
+  /**
+   * Reopen the persisted thread by id (ADR-078). `excludeTurns:true` returns
+   * only metadata — no history replay, which would double-post the transcript
+   * the cloud already holds. The app-server allows one writer per thread, so a
+   * -32600 (lock still held by the dying predecessor app-server) is retried with
+   * backoff; any other failure returns false and the caller starts a fresh
+   * thread. Returns true iff the thread is now open for turns.
+   */
+  private async tryResumeThread(threadId: string): Promise<boolean> {
+    for (let attempt = 0; attempt < RESUME_LOCK_ATTEMPTS; attempt++) {
+      try {
+        const result = await this.request("thread/resume", {
+          threadId,
+          excludeTurns: true,
+          approvalPolicy: "never",
+          sandbox: "danger-full-access",
+        });
+        const id =
+          isObj(result) && isObj(result.thread) && str(result.thread.id)
+            ? str(result.thread.id)
+            : threadId;
+        this.threadId = id;
+        saveCodexThreadId(this.taskId, this.agentId, id);
+        return true;
+      } catch (err) {
+        const code = (err as { rpcCode?: number }).rpcCode;
+        if (code === -32600 && attempt < RESUME_LOCK_ATTEMPTS - 1) {
+          await delay(RESUME_LOCK_BACKOFF_MS);
+          continue;
+        }
+        console.warn(
+          `[codex] thread/resume ${threadId} failed (${
+            err instanceof Error ? err.message : String(err)
+          }) — starting a fresh thread`,
+        );
+        return false;
+      }
+    }
+    return false;
   }
 
   // -- AgentSession ---------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.8.39",
+  "version": "0.8.41",
   "description": "Uai host — runs ephemeral AI coding tasks in Docker on a machine you control.",
   "license": "MIT",
   "author": "Diogo Perillo <diogo.perillo@gmail.com>",