@saadnvd1/agent-os 0.3.588 → 0.3.592

package/lib/chat/client-send.ts

@@ -3,20 +3,27 @@ import type { CompactFirst } from "./stale";
 
 // What a browser's send may carry: its text and images, and whether the
 // reader chose to compact a stale chat first. Who a message is from (`from`,
-// `peer`, `origin`) is set by the server alone, never by a client.
+// `peer`, `origin`) is set by the server alone, never by a client. Its own
+// id for the message is kept only in a shape no server id takes.
 export function clientSend(msg: unknown): {
   text: string;
   images?: ChatImage[];
   compact?: CompactFirst;
+  id?: string;
 } {
   const m = (msg ?? {}) as {
     text?: unknown;
     images?: unknown;
     compact?: unknown;
+    clientId?: unknown;
   };
   return {
     text: typeof m.text === "string" ? m.text : "",
     images: Array.isArray(m.images) ? (m.images as ChatImage[]) : undefined,
     ...(m.compact === true && { compact: "yes" as const }),
+    ...(isClientId(m.clientId) && { id: m.clientId }),
   };
 }
+
+export const isClientId = (id: unknown): id is string =>
+  typeof id === "string" && /^user-c-[A-Za-z0-9-]{8,64}$/.test(id);

package/lib/chat/demo.ts

@@ -5,6 +5,7 @@
  */
 
 import { randomUUID } from "crypto";
+import { clientSend } from "./client-send";
 import type { ChatConversation } from "./driver";
 import type { ChatClientMessage, ChatServerMessage } from "./events";
 import { demoConversation } from "./drivers/demo";
@@ -37,7 +38,11 @@ function conversation(sessionId: string): ChatConversation {
   return c;
 }
 
-export function sendDemoChat(sessionId: string, text: string): void {
+export function sendDemoChat(
+  sessionId: string,
+  text: string,
+  id = `user-${Date.now()}-${randomUUID().slice(0, 5)}`
+): void {
   const trimmed = text.trim();
   if (!trimmed) return;
   getSession(sessionId);
@@ -45,7 +50,7 @@ export function sendDemoChat(sessionId: string, text: string): void {
   if (count >= MAX_SENDS) throw new Error(DEMO_REFUSAL);
   sends.set(sessionId, count + 1);
   const item = {
-    id: `user-${Date.now()}-${randomUUID().slice(0, 5)}`,
+    id,
     kind: "user" as const,
     text: DEMO_VISITOR_TEXT,
     tagged: true as const,
@@ -84,7 +89,21 @@ export function handleDemoChat(
   msg: ChatClientMessage,
   reply: (m: ChatServerMessage) => void
 ): void {
-  if (msg.type === "send") return sendDemoChat(sessionId, String(msg.text));
+  if (msg.type === "send") {
+    const { id } = clientSend(msg);
+    if (!id) return sendDemoChat(sessionId, String(msg.text));
+    reply({ type: "accepted", id });
+    try {
+      return sendDemoChat(sessionId, String(msg.text), id);
+    } catch (err) {
+      reply({
+        type: "send_failed",
+        id,
+        message: err instanceof Error ? err.message : String(err),
+      });
+      throw err;
+    }
+  }
   if (msg.type === "interrupt") {
     void conversations.get(sessionId)?.interrupt();
     return;

package/lib/chat/drivers/claude.ts

@@ -183,6 +183,19 @@ export const claudeDriver: ChatDriver = {
     );
     let access = options.access;
     let plan = !options.permissionMode && !!options.plan;
+    // The mode the CLI is in. Asking again for the same one waits on the
+    // CLI starting up (seconds, on a new worker) for nothing.
+    let applied = sdkMode(access, plan);
+    const applyMode = async () => {
+      const mode = sdkMode(access, plan);
+      if (mode === applied) return;
+      const before = applied;
+      applied = mode;
+      await q.setPermissionMode(mode).catch((error: unknown) => {
+        if (applied === mode) applied = before;
+        throw error;
+      });
+    };
     const q = query({
       prompt: input,
       options: {
@@ -344,12 +357,12 @@ export const claudeDriver: ChatDriver = {
       async setAccess(next) {
         access = next;
         if (options.permissionMode || plan) return;
-        await q.setPermissionMode(sdkMode(access, plan));
+        await applyMode();
       },
       async setPlan(next) {
         if (options.permissionMode) return;
         plan = next;
-        await q.setPermissionMode(sdkMode(access, plan));
+        await applyMode();
       },
       respond(id, answer) {
         approvals.respond(id, answer);

package/lib/chat/drivers/opencode.ts

@@ -209,6 +209,7 @@ export const openCodeDriver: ChatDriver = {
         model = openCodeModel(next);
       },
       async setAccess(next) {
+        if (next === access) return;
         access = next;
         await ready;
         await setRules();

package/lib/chat/events.ts

@@ -381,11 +381,16 @@ export type ChatServerMessage =
       ok: boolean;
       error?: string;
     }
-  | { type: "undone"; from: string; text: string };
+  | { type: "undone"; from: string; text: string }
+  // A send with a `clientId` was taken in (before any worker is up), or
+  // failed. The message itself still comes as an item or in the queue.
+  | { type: "accepted"; id: string }
+  | { type: "send_failed"; id: string; message: string };
 
 // What a browser sends.
 export type ChatClientMessage =
-  | { type: "send"; text: string; images?: ChatImage[] }
+  // `clientId` (`user-c-…`) becomes the message's id: a resend is a no-op.
+  | { type: "send"; text: string; images?: ChatImage[]; clientId?: string }
   | { type: "queue_edit"; id: string; text: string }
   | { type: "queue_move"; id: string; by: -1 | 1 }
   | { type: "queue_delete"; id: string }

package/lib/chat/pending.ts

@@ -0,0 +1,169 @@
+import type { ChatImage } from "./events";
+
+// A message the composer sent that isn't in the chat or its queue yet. It
+// shows as a bubble at once, and stays (as failed, with Retry) if it never
+// arrives, so a long paste is never lost to a dead socket.
+export interface PendingSend {
+  id: string;
+  text: string;
+  images?: ChatImage[];
+  compact?: boolean;
+  // "sending": not taken in yet. "accepted": the server has it and is
+  // starting the agent.
+  status: "sending" | "accepted" | "failed";
+  error?: string;
+  // When it was last sent or accepted, for the timeouts below.
+  at: number;
+  // Sends so far; each reconnect resends once, up to MAX_SENDS.
+  sends: number;
+}
+
+export type PendingAction =
+  | {
+      type: "add";
+      send: Omit<PendingSend, "status" | "at" | "sends">;
+      now: number;
+    }
+  // Sent again on a new socket, or by Retry.
+  | { type: "resent"; id: string; now: number }
+  | { type: "accepted"; id: string; now: number }
+  | { type: "failed"; id: string; error: string }
+  // Ids now in the chat or its queue: those sends are done.
+  | { type: "resolved"; ids: Iterable<string> }
+  | { type: "drop"; id: string }
+  | { type: "tick"; now: number };
+
+// No answer at all: the socket is likely dead though not yet closed.
+export const SEND_TIMEOUT_MS = 10_000;
+// Taken in but never shown: a new agent takes seconds, not a minute.
+export const ACCEPTED_TIMEOUT_MS = 60_000;
+export const MAX_SENDS = 3;
+
+export const NOT_SENT = "connection lost";
+const NO_ANSWER = "no answer from AgentOS";
+const NEVER_ARRIVED = "the agent didn't take it";
+
+export function pendingReducer(
+  state: PendingSend[],
+  action: PendingAction
+): PendingSend[] {
+  const update = (id: string, fn: (p: PendingSend) => PendingSend | null) => {
+    const i = state.findIndex((p) => p.id === id);
+    if (i === -1) return state;
+    const next = fn(state[i]);
+    if (next === state[i]) return state;
+    const out = state.slice();
+    if (next) out[i] = next;
+    else out.splice(i, 1);
+    return out;
+  };
+  switch (action.type) {
+    case "add":
+      if (state.some((p) => p.id === action.send.id)) return state;
+      return [
+        ...state,
+        { ...action.send, status: "sending", at: action.now, sends: 1 },
+      ];
+    case "resent":
+      return update(action.id, (p) => ({
+        ...p,
+        status: "sending",
+        error: undefined,
+        at: action.now,
+        sends: p.sends + 1,
+      }));
+    case "accepted":
+      return update(action.id, (p) =>
+        p.status === "sending"
+          ? { ...p, status: "accepted", at: action.now }
+          : p
+      );
+    case "failed":
+      return update(action.id, (p) => ({
+        ...p,
+        status: "failed",
+        error: action.error,
+      }));
+    case "resolved": {
+      const ids = new Set(action.ids);
+      const kept = state.filter((p) => !ids.has(p.id));
+      return kept.length === state.length ? state : kept;
+    }
+    case "drop":
+      return update(action.id, () => null);
+    case "tick": {
+      let changed = false;
+      const next = state.map((p) => {
+        const limit =
+          p.status === "sending"
+            ? SEND_TIMEOUT_MS
+            : p.status === "accepted"
+              ? ACCEPTED_TIMEOUT_MS
+              : Infinity;
+        if (action.now - p.at < limit) return p;
+        changed = true;
+        return {
+          ...p,
+          status: "failed" as const,
+          error: p.status === "sending" ? NO_ANSWER : NEVER_ARRIVED,
+        };
+      });
+      return changed ? next : state;
+    }
+  }
+}
+
+// What a new socket sends again: anything not failed and not over its sends.
+// Safe to repeat: the server drops an id already in the chat or its queue.
+export const toResend = (state: PendingSend[]) =>
+  state.filter((p) => p.status !== "failed" && p.sends < MAX_SENDS);
+
+// A new socket that can't send again what's still pending marks it failed.
+export const overSends = (state: PendingSend[]) =>
+  state.filter((p) => p.status !== "failed" && p.sends >= MAX_SENDS);
+
+// getRandomValues, not randomUUID: a phone on plain http over the tailnet
+// isn't a secure context.
+export const clientId = () =>
+  `user-c-${Array.from(crypto.getRandomValues(new Uint8Array(12)), (b) =>
+    b.toString(16).padStart(2, "0")
+  ).join("")}`;
+
+const keyFor = (sessionId: string) => `agentos:pending:${sessionId}`;
+
+// Kept in this browser so a reload doesn't lose a failed article. Over
+// quota, images go first and the words stay.
+export function savePending(sessionId: string, state: PendingSend[]): void {
+  try {
+    const key = keyFor(sessionId);
+    if (!state.length) return localStorage.removeItem(key);
+    for (const kept of [
+      state,
+      state.map((p) => ({ ...p, images: undefined })),
+    ]) {
+      try {
+        localStorage.setItem(key, JSON.stringify(kept));
+        return;
+      } catch {
+        // Too big; try without images.
+      }
+    }
+  } catch {
+    // Storage unavailable.
+  }
+}
+
+export function loadPending(sessionId: string): PendingSend[] {
+  try {
+    const raw = localStorage.getItem(keyFor(sessionId));
+    const list = raw ? (JSON.parse(raw) as PendingSend[]) : [];
+    // From an earlier page: each is sent once more on connecting.
+    return Array.isArray(list)
+      ? list.filter(
+          (p) => typeof p?.id === "string" && typeof p.text === "string"
+        )
+      : [];
+  } catch {
+    return [];
+  }
+}

package/lib/chat/runner.ts

@@ -384,6 +384,10 @@ const sentBy = ({ from, peer, origin }: SentBy): SentBy => ({
   origin,
 });
 
+// Already a message in the chat or its queue.
+const taken = (sessionId: string, id: string) =>
+  hasItem(sessionId, id) || listQueue(sessionId).some((q) => q.id === id);
+
 export async function sendChat(
   sessionId: string,
   input: {
@@ -393,16 +397,20 @@ export async function sendChat(
     queue?: boolean;
     // Compact a stale chat first (lib/chat/stale).
     compact?: CompactFirst;
+    // The client's own id for it, so a resend after a reconnect is a no-op.
+    id?: string;
   } & SentBy
 ): Promise<void> {
   const text = input.text.trim();
   if (!text && !input.images?.length) return;
+  if (input.id && taken(sessionId, input.id)) return;
   refuseAway(sessionId);
+  const id = input.id ?? `user-${Date.now()}-${randomUUID().slice(0, 5)}`;
   // Its worktree is still being set up, its task hasn't launched (held by
   // Pause, say), or it's moving or landing: the message waits its turn.
   if (settingUp(sessionId) || launchPending(sessionId) || chatHold(sessionId)) {
     enqueue(sessionId, {
-      id: `user-${Date.now()}-${randomUUID().slice(0, 5)}`,
+      id,
       text,
       images: input.images,
       ...sentBy(input),
@@ -411,7 +419,8 @@ export async function sendChat(
     return;
   }
   const live = await ensureLive(sessionId);
-  const id = `user-${Date.now()}-${randomUUID().slice(0, 5)}`;
+  // Sent again while the worker was starting.
+  if (input.id && taken(sessionId, id)) return;
   if (queuedIfHeld(sessionId, { ...input, id, text })) return;
   live.worker.command({
     type: "send",

package/lib/chat/socket.ts

@@ -145,7 +145,18 @@ function onChatMessage(
     void Promise.resolve(p).catch(fail);
   if (msg.type === "send") {
     const send = clientSend(msg);
-    run(sendChat(sessionId, { ...send, queue: true }));
+    const id = send.id;
+    // Taken in now: a new worker can take seconds to start.
+    if (id) reply({ type: "accepted", id });
+    void sendChat(sessionId, { ...send, queue: true }).catch((err) => {
+      if (id)
+        reply({
+          type: "send_failed",
+          id,
+          message: err instanceof Error ? err.message : String(err),
+        });
+      fail(err);
+    });
     // "Session 4" is named after its first message.
     run(titleChatFromMessage(sessionId, send.text));
   } else if (msg.type === "queue_edit" && typeof msg.text === "string")

package/lib/db/migrations.ts

@@ -2325,6 +2325,22 @@ export const migrations: Migration[] = [
       installChangeTriggers(db, TABLES_WATCHED_CHAT_BOOKMARKS);
     },
   },
+  {
+    key: "20261014T2100_gate_failure_ask_held",
+    up: (db) => {
+      // When a failed-twice escalation started holding its ask until the
+      // agent is idle and CI has settled; null is not held. Additive.
+      const has = (
+        db.prepare(`PRAGMA table_info(orchestrator_gate_failures)`).all() as {
+          name: string;
+        }[]
+      ).some((c) => c.name === "ask_held_at");
+      if (!has)
+        db.exec(
+          `ALTER TABLE orchestrator_gate_failures ADD COLUMN ask_held_at TEXT`
+        );
+    },
+  },
 ];
 
 // `upTo`: stop after this legacy id or timestamp key, inclusive (tests that

package/lib/orchestrator/ask-heads.ts

@@ -3,9 +3,13 @@
 // gone; the ask is moved to the head it would merge, with a line on whether
 // the PR's patch changed. The approve button is bound to the commit shown,
 // so an answer from a screen that predates the move is refused (asks.ts).
+// The head is read from GitHub, never taken from the facts (which can be
+// older than the ask), and an ask never moves back to a commit it contains.
 
 import { db, type Session } from "../db";
+import { isAncestor } from "../git-exec";
 import { hostLink } from "../hosts/remote-api";
+import { prFor } from "../tasks/session";
 import { moveAskHead, openAsks, taskSubject } from "./asks";
 import type { SessionFacts } from "./facts";
 import { addNote } from "./notes";
@@ -21,16 +25,24 @@ export async function followAskHeads(
 ): Promise<void> {
   for (const ask of openAsks(workspaceId)) {
     const f = facts.find((x) => taskSubject(x.id) === ask.subject);
-    const pr = f?.task?.pr;
-    if (!ask.sha || pr?.state !== "OPEN" || !pr.head || pr.head === ask.sha)
+    const seen = f?.task?.pr;
+    if (
+      !ask.sha ||
+      seen?.state !== "OPEN" ||
+      !seen.head ||
+      seen.head === ask.sha
+    )
       continue;
     const task = db
       .prepare(`SELECT * FROM sessions WHERE id = ?`)
       .get(f!.id) as Session | undefined;
     if (!task || hostLink(task.host_id)) continue;
     try {
+      const pr = await prFor(task, true);
+      if (pr?.state !== "OPEN" || !pr.head || pr.head === ask.sha) continue;
       const repo = repoOf(task);
       const base = await fetchRefs(repo, task);
+      if (await isAncestor(repo, pr.head, ask.sha)) continue;
       const { same, note } = await comparePatches(repo, base, ask.sha, pr.head);
       const what = same ? `same patch (rebased onto ${base})` : note;
       const line = `Head moved from ${short(ask.sha)} to ${short(pr.head)}: ${what}. Approving merges ${short(pr.head)}.`;

package/lib/orchestrator/escalate.ts

@@ -2,26 +2,25 @@
 // it escalates), one escalation note in the orchestrator's chat, and the
 // task held so the orchestrator doesn't merge it.
 
-import { AskRefused, raiseAsk, workSubject } from "./asks";
+import { AskRefused, EXTERNAL_PREFIX, raiseAsk, workSubject } from "./asks";
 import {
+  failedTwiceWhy,
   failureOf,
+  holdAsk,
   markEscalated,
   recordFailure,
   type GateOutcome,
 } from "./gates";
 import { addNote } from "./notes";
 
-export function escalate(
+// Puts the ask on Saad's list (or notes why it couldn't be).
+export function askSaadAbout(
   workspaceId: string,
   task: { id: string; name: string },
-  gate: string,
   why: string,
   url: string,
-  sha: string | null = null
-): string {
-  if (!failureOf(task.id, gate))
-    recordFailure(workspaceId, task.id, gate, why, sha);
-  markEscalated(task.id, gate);
+  sha: string | null
+): void {
   let created = false;
   try {
     created = raiseAsk({
@@ -47,26 +46,49 @@ export function escalate(
       `Saad must decide on ${task.name} (${url}): ${why}. The orchestrator won't merge it; it's on his asks list to approve, decline, or sign off or drop himself.`,
       "escalation"
     );
+}
+
+// `hold`: the task is held at once, but Saad's ask waits until its agent is
+// idle and CI has settled, so it names the commit he'd merge (held-asks.ts).
+export function escalate(
+  workspaceId: string,
+  task: { id: string; name: string },
+  gate: string,
+  why: string,
+  url: string,
+  sha: string | null = null,
+  opts: { hold?: boolean } = {}
+): string {
+  if (!failureOf(task.id, gate))
+    recordFailure(workspaceId, task.id, gate, why, sha);
+  markEscalated(task.id, gate);
+  if (opts.hold) {
+    holdAsk(task.id, gate);
+    return `Escalated to Saad: ${why}. His ask goes up once ${task.name}'s agent is idle and CI has settled on its latest head, so it names the commit he'd merge; his answer reaches you as an event. Don't retry; say so in your chat.`;
+  }
+  askSaadAbout(workspaceId, task, why, url, sha);
   return `Escalated to Saad: ${why}. It's on his asks list; his answer reaches you as an event. Don't retry; say so in your chat.`;
 }
 
 // Counts a gate's failure on this head against the task; the same gate
-// failing on a second, different head goes to Saad. The same head judged
+// failing on a second, different head goes to Saad (a task's ask held until
+// its agent is done; a PR no task owns has no agent to wait for). The same head judged
 // again, from any path, isn't another failure.
 export function countFailure(
   workspaceId: string,
   task: { id: string; name: string },
   o: GateOutcome,
   url: string,
-  sha: string
+  sha: string,
+  opts: { hold?: boolean } = {}
 ): { line: string; escalated: boolean } {
   const n = recordFailure(workspaceId, task.id, o.gate, o.reason ?? "", sha);
   const line = `- ${o.gate} failed (${n === 1 ? "first" : "again"}): ${o.reason}`;
   if (n < 2 || failureOf(task.id, o.gate)?.escalated_at)
     return { line, escalated: false };
-  const why = `the ${o.gate} gate failed on two different commits: ${o.reason}`;
+  const why = failedTwiceWhy(o.gate, o.reason ?? "");
   return {
-    line: `${line}\n  ${escalate(workspaceId, task, o.gate, why, url, sha)}`,
+    line: `${line}\n  ${escalate(workspaceId, task, o.gate, why, url, sha, { hold: opts.hold ?? !task.id.startsWith(EXTERNAL_PREFIX) })}`,
     escalated: true,
   };
 }

package/lib/orchestrator/gates.ts

@@ -215,6 +215,8 @@ export interface FailureRow {
   last_reason: string | null;
   escalated_at: string | null;
   last_sha: string | null;
+  // Set while the escalation's ask waits for the agent to finish (held-asks.ts).
+  ask_held_at: string | null;
 }
 
 // Counts one failure; returns the count now. With `sha`, a failure is
@@ -277,6 +279,30 @@ export function markEscalated(sessionId: string, gate: string): void {
   markStatusDirty(sessionId);
 }
 
+export function holdAsk(sessionId: string, gate: string): void {
+  db.prepare(
+    `UPDATE orchestrator_gate_failures SET ask_held_at = COALESCE(ask_held_at, datetime('now')) WHERE session_id = ? AND gate = ?`
+  ).run(sessionId, gate);
+}
+
+export function releaseHeldAsks(sessionId: string): void {
+  db.prepare(
+    `UPDATE orchestrator_gate_failures SET ask_held_at = NULL WHERE session_id = ?`
+  ).run(sessionId);
+}
+
+export function heldAskFailures(workspaceId: string): FailureRow[] {
+  return db
+    .prepare(
+      `SELECT * FROM orchestrator_gate_failures
+       WHERE workspace_id = ? AND escalated_at IS NOT NULL AND ask_held_at IS NOT NULL`
+    )
+    .all(workspaceId) as FailureRow[];
+}
+
+export const failedTwiceWhy = (gate: string, reason: string) =>
+  `the ${gate} gate failed on two different commits: ${reason}`;
+
 export function escalations(sessionId: string): FailureRow[] {
   return db
     .prepare(