@saadnvd1/agent-os 0.3.489 → 0.3.493

package/lib/chat/store.ts

@@ -4,22 +4,102 @@ import type { ChatItem } from "./events";
 // Items keep the position they were first written at, so replacing one
 // (a finished tool call, a streamed message's final text) never reorders.
 export function saveItem(sessionId: string, item: ChatItem): void {
+  flushItems();
   db.prepare(
     `INSERT INTO chat_items (session_id, item_id, seq, data)
      VALUES (?, ?, (SELECT COALESCE(MAX(seq), 0) + 1 FROM chat_items WHERE session_id = ?), ?)
      ON CONFLICT(session_id, item_id) DO UPDATE SET data = excluded.data`
   ).run(sessionId, item.id, sessionId, JSON.stringify(item));
+  seqs.delete(sessionId);
+}
+
+// The streaming path. Every update of an item is a write, so they're held
+// in memory (the latest state of each item) and written together, in one
+// transaction, every FLUSH_MS. Callers flush at anything that mustn't be
+// lost: an item finishing, a turn ending, an error, an interrupt, a close.
+// Every reader here flushes first; one that queries the table itself may be
+// up to FLUSH_MS behind.
+export const FLUSH_MS = 250;
+
+type Pending = { seq: number; data: string };
+type Seqs = { next: number; of: Map<string, number> };
+
+const pending = new Map<string, Map<string, Pending>>();
+const seqs = new Map<string, Seqs>();
+let timer: NodeJS.Timeout | undefined;
+
+// Seeded once from the table, then kept: an item gets its seq the first
+// time it's seen, the same one it would have got from MAX(seq) + 1.
+function seqsOf(sessionId: string): Seqs {
+  let s = seqs.get(sessionId);
+  if (!s) {
+    const row = db
+      .prepare(
+        `SELECT COALESCE(MAX(seq), 0) AS m FROM chat_items WHERE session_id = ?`
+      )
+      .get(sessionId) as { m: number };
+    s = { next: row.m + 1, of: new Map() };
+    seqs.set(sessionId, s);
+  }
+  return s;
+}
+
+export function queueItem(
+  sessionId: string,
+  item: ChatItem,
+  { flush = false }: { flush?: boolean } = {}
+): void {
+  const s = seqsOf(sessionId);
+  let seq = s.of.get(item.id);
+  if (seq === undefined) {
+    seq = s.next++;
+    s.of.set(item.id, seq);
+  }
+  let items = pending.get(sessionId);
+  if (!items) pending.set(sessionId, (items = new Map()));
+  items.set(item.id, { seq, data: JSON.stringify(item) });
+  if (flush) flushItems();
+  else if (!timer) {
+    timer = setTimeout(flushItems, FLUSH_MS);
+    timer.unref();
+  }
+}
+
+export function flushItems(): void {
+  clearTimeout(timer);
+  timer = undefined;
+  if (!pending.size) return;
+  try {
+    const insert = db.prepare(
+      `INSERT INTO chat_items (session_id, item_id, seq, data) VALUES (?, ?, ?, ?)
+       ON CONFLICT(session_id, item_id) DO UPDATE SET data = excluded.data`
+    );
+    db.transaction(() => {
+      for (const [sessionId, items] of pending)
+        for (const [itemId, p] of items)
+          insert.run(sessionId, itemId, p.seq, p.data);
+    })();
+    pending.clear();
+  } catch (error) {
+    // Kept for the next try rather than lost.
+    console.error("Chat items not written:", error);
+    timer = setTimeout(flushItems, FLUSH_MS);
+    timer.unref();
+  }
 }
 
 // Moves an item after every other, as if first written now.
 export function moveToEnd(sessionId: string, itemId: string): void {
+  flushItems();
   db.prepare(
     `UPDATE chat_items SET seq = (SELECT MAX(seq) + 1 FROM chat_items WHERE session_id = ?)
      WHERE session_id = ? AND item_id = ?`
   ).run(sessionId, sessionId, itemId);
+  seqs.delete(sessionId);
 }
 
 export function listItems(sessionId: string): ChatItem[] {
+  flushItems();
   return (
     db
       .prepare(`SELECT data FROM chat_items WHERE session_id = ? ORDER BY seq`)
@@ -31,6 +111,7 @@ export function getItem(
   sessionId: string,
   itemId: string
 ): ChatItem | undefined {
+  flushItems();
   const row = db
     .prepare(`SELECT data FROM chat_items WHERE session_id = ? AND item_id = ?`)
     .get(sessionId, itemId) as { data: string } | undefined;
@@ -38,6 +119,7 @@ export function getItem(
 }
 
 export function hasItem(sessionId: string, itemId: string): boolean {
+  flushItems();
   return !!db
     .prepare(`SELECT 1 FROM chat_items WHERE session_id = ? AND item_id = ?`)
     .get(sessionId, itemId);
@@ -49,6 +131,7 @@ export function lastItems(
   n: number,
   kind?: ChatItem["kind"]
 ): ChatItem[] {
+  flushItems();
   const rows = (
     kind
       ? db
@@ -69,6 +152,7 @@ export function lastItems(
 // What the agent has said since the last message to it, as text: where a
 // chat task's BLOCKED: line stays until someone answers it.
 export function saidSinceLastMessage(sessionId: string, n = 20): string {
+  flushItems();
   const items = lastItems(sessionId, n);
   return items
     .slice(items.findLastIndex((i) => i.kind === "user") + 1)
@@ -81,6 +165,7 @@ export function itemsOfKind<K extends ChatItem["kind"]>(
   sessionId: string,
   kind: K
 ): Extract<ChatItem, { kind: K }>[] {
+  flushItems();
   return (
     db
       .prepare(
@@ -95,6 +180,7 @@ export function itemsOfKind<K extends ChatItem["kind"]>(
 export function runningTools(
   sessionId: string
 ): Extract<ChatItem, { kind: "tool" }>[] {
+  flushItems();
   return (
     db
       .prepare(
@@ -107,6 +193,8 @@ export function runningTools(
 }
 
 export function deleteItems(sessionId: string): void {
+  pending.delete(sessionId);
+  seqs.delete(sessionId);
   db.prepare(`DELETE FROM chat_items WHERE session_id = ?`).run(sessionId);
 }
 
@@ -135,6 +223,7 @@ export function settle(items: ChatItem[]): ChatItem[] {
 
 // What a chat session is working on: the first line of its latest message.
 export function lastUserTask(sessionId: string): string | null {
+  flushItems();
   const row = db
     .prepare(
       `SELECT data FROM chat_items WHERE session_id = ? AND item_id LIKE 'user-%'

package/lib/chat/worker/host.ts

@@ -22,9 +22,10 @@ import type {
 } from "../events";
 import {
   itemsOfKind,
+  flushItems,
   moveToEnd,
+  queueItem,
   runningTools,
-  saveItem,
   settle,
 } from "../store";
 import { claimNext, enqueue, listQueue, moveToFront } from "../queued";
@@ -261,7 +262,10 @@ export class ChatHost {
   }
 
   private record(item: ChatItem): void {
-    saveItem(this.session.id, item);
+    // Streaming updates are written in batches; anything else right away.
+    queueItem(this.session.id, item, {
+      flush: !("streaming" in item && item.streaming),
+    });
     this.emit({ type: "item", item });
   }
 
@@ -354,6 +358,7 @@ export class ChatHost {
           }
         } else if (e.type === "state") {
           if (e.state === "idle") {
+            flushItems();
             // A turn cut off mid-sentence (Esc, Stop) keeps what it streamed.
             this.settleStreaming();
             this.closeTools();
@@ -406,6 +411,7 @@ export class ChatHost {
       this.settleStreaming();
       this.closeTools();
       this.showHandedOver();
+      flushItems();
       this.setState("idle");
     }
   }
@@ -485,7 +491,7 @@ export class ChatHost {
       checkpoint,
     };
     if (handOver) {
-      saveItem(this.session.id, user);
+      queueItem(this.session.id, user, { flush: true });
       this.handedOver.push(user);
     } else this.record(user);
     this.setState("running");
@@ -631,6 +637,7 @@ export class ChatHost {
         }
         return;
       case "interrupt":
+        flushItems();
         await this.modeChange.catch(() => {});
         if (cmd.hard) {
           this.hardStopAt = Date.now();
@@ -877,6 +884,7 @@ export class ChatHost {
     clearTimeout(this.retireTimer);
     clearTimeout(this.restTimer);
     this.closed = true;
+    flushItems();
     this.onClose();
     this.conversation.close();
   }

package/lib/orchestrator/brief.ts

@@ -124,7 +124,7 @@ Acting:
 - \`${TOOL_NAMES.disarm}\` (task): stop an armed task merging by itself.
 - \`${TOOL_NAMES.ask_saad}\` (title, detail, link?, kind, task?, sha?): park an item on Saad's asks list and carry on; it never waits.
 
-Act through these tools, not the shell: they're scoped to this workspace and braked. The shell runs only \`aos\` commands that read (peers, inbox, history, stacks, schedules, docs), \`aos notify "<text>"\`, which pushes a message to Saad's phone, and git in your own quick changes' worktrees (\`git -C <path> ...\`), each as one plain command: no \`;\`, \`&&\`, pipes, redirects or \`$\` outside quotes. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.
+Act through these tools, not the shell: they're scoped to this workspace and braked. The shell runs anything without asking (Saad chose this on 2026-10-11), so use it to read and investigate yourself: \`gh pr list\`, \`gh run view --log-failed\`, \`gh api\` GETs, \`curl\`, \`sqlite3 -readonly\`, git in any repository, a skill's scripts, pipes and chains. Never use it to get around the tools. A deny list refuses, naming the tool to use instead: merging, closing or retargeting a PR (\`${TOOL_NAMES.sign_off}\`, \`${TOOL_NAMES.arm}\`, \`${TOOL_NAMES.land}\`, \`${TOOL_NAMES.drop}\`), \`git push\` (\`${TOOL_NAMES.quick_pr}\`), writing in a project repository or task worktree other than your own quick changes (\`${TOOL_NAMES.start_task}\`, \`${TOOL_NAMES.quick_change}\`), writing AgentOS's state (sqlite3 without \`-readonly\`, or files in ~/.agent-os outside your folder), stopping or restarting AgentOS or its tmux, and reading secret files or tokenvault. The list catches honest mistakes, not a determined bypass: a script or \`python -c\` could do any of these unseen, and doing so would break Saad's trust in every gate. \`aos notify "<text>"\` pushes a message to Saad's phone. Use it for what he'd want to see now and asked for: the morning report, a real milestone (a stack landed, a blocker only he can clear). Never for routine status: one a minute at most, and he reads the rest here. You can read files anywhere (Read, Grep, Glob), and write them (Write, Edit, NotebookEdit) anywhere except: a project repository or task worktree other than your own open quick changes' worktrees (start a task, or a quick change for a small edit, so the change goes through CI, review and scope), AgentOS's own state in ~/.agent-os outside your folder, secret files (.env, keys, ~/.ssh, ~/.aws, tokenvault and the like), and files that make something run: dotfiles and dot-folders at the top of your home (shell, git, Claude and tool config), ~/Library and /Library's launch agents, git's core.hooksPath folders, the folders on PATH, and any .git, .claude, .mcp.json, CLAUDE.md or AGENTS.md, which would hand you a shell or run code around the gates. Each write is checked before it runs, on the path with symlinks and \`..\` resolved; a refused one says why.
 
 ## Untrusted text