@saluzi/saluzi-edu 0.4.5 → 0.4.7

package/packages/remote-control-server/src/transport/ws-handler.ts

@@ -10,6 +10,7 @@ import {
 import { log, error as logError } from '../logger'
 import { toClientPayload } from './client-payload'
 import { wipeSessionConversation } from '../services/session-clear'
+import { redispatchWorkForSession } from '../services/work-dispatch'
 import { config } from '../config'
 
 // Per-connection cleanup, keyed by sessionId (only one WS per session)
@@ -25,6 +26,25 @@ const cleanupBySession = new Map<string, CleanupEntry>()
 // Track all active WS connections for graceful shutdown
 const activeConnections = new Set<WSContext>()
 
+/**
+ * Event types excluded from the WS-reconnect history replay. These are
+ * point-in-time RPC traffic, not conversation state: replaying them to the
+ * bridge would re-execute them as fresh requests — a replayed `interrupt`
+ * aborts whatever turn is running AFTER the reconnect, replayed
+ * `get_context_usage` fires spurious responses, and replayed
+ * permission asks/responses resurrect stale dialogs. The replay exists so
+ * the bridge can reconstruct the conversation transcript (user/assistant/
+ * system messages) — control traffic has no reconstruction value.
+ */
+const NON_REPLAYABLE_EVENT_TYPES = new Set([
+  'control_request',
+  'control_response',
+  'control_cancel_request',
+  'permission_request',
+  'permission_response',
+  'interrupt',
+])
+
 // Server-side keepalive interval (configurable via RCS_WS_KEEPALIVE_INTERVAL).
 // Sends data frames to keep reverse proxies from closing idle connections.
 const SERVER_KEEPALIVE_INTERVAL_MS = (config.wsKeepaliveInterval || 20) * 1000
@@ -64,14 +84,20 @@ export function handleWebSocketOpen(ws: WSContext, sessionId: string) {
 
   const bus = getEventBus(sessionId)
 
-  // Replay ALL events (inbound + outbound) so the bridge can reconstruct
-  // the full conversation history — assistant replies are inbound events.
-  // Transient streaming deltas are skipped: they are display-only and would
-  // flood the child's stdin parser with unknown message types on reconnect.
+  // Replay conversation events so the bridge can reconstruct the full
+  // history — assistant replies are inbound events. Transient streaming
+  // deltas are skipped (display-only, would flood the child's stdin parser),
+  // and so is point-in-time control traffic (see NON_REPLAYABLE_EVENT_TYPES —
+  // a replayed interrupt would abort the post-reconnect turn).
   const missed = bus.getEventsSince(0)
   if (missed.length > 0) {
-    log(`[WS] Replaying ${missed.length} missed event(s)`)
-    for (const event of missed) {
+    const replayable = missed.filter(
+      event => !NON_REPLAYABLE_EVENT_TYPES.has(event.type),
+    )
+    log(
+      `[WS] Replaying ${replayable.length} of ${missed.length} retained event(s)`,
+    )
+    for (const event of replayable) {
       if (ws.readyState !== 1) break
       if (event.type === 'stream_event' || event.type === 'partial_assistant')
         continue
@@ -102,17 +128,10 @@ export function handleWebSocketOpen(ws: WSContext, sessionId: string) {
       clearInterval(keepalive)
       return
     }
-    // Check if client is still alive — close if no data received for too long
-    const silenceMs = Date.now() - lastClientActivity
-    if (silenceMs > CLIENT_ACTIVITY_TIMEOUT_MS) {
-      log(
-        `[WS] Client inactive for ${Math.round(silenceMs / 1000)}s on session=${sessionId}, closing dead connection`,
-      )
-      try {
-        ws.close(1000, 'client inactive')
-      } catch {
-        clearInterval(keepalive)
-      }
+    // Check if client is still alive — close if no data received for too
+    // long (see closeInactiveClient: the close doubles as the write-path
+    // recovery trigger via work re-dispatch).
+    if (closeInactiveClient(sessionId)) {
       return
     }
     try {
@@ -133,18 +152,29 @@ export function handleWebSocketOpen(ws: WSContext, sessionId: string) {
 
 /**
  * Called from onMessage — bridge sends newline-delimited JSON.
+ *
+ * Activity tracking skips pure keep_alive frames: with HybridTransport the
+ * worker's WS-layer keepalives (WebSocketTransport.startKeepaliveInterval,
+ * direct socket writes) keep flowing even when the POST write path is dead —
+ * counting them would make the inactivity close (and its write-path
+ * recovery re-dispatch) unreachable for exactly the zombie state it exists
+ * to detect. Real WS messages and ALL POST ingress still refresh the clock.
  */
 export function handleWebSocketMessage(
   ws: WSContext,
   sessionId: string,
   data: string,
 ) {
-  // Track client activity for dead-connection detection
-  touchClientActivity(sessionId)
   const lines = data.split('\n').filter(l => l.trim())
   for (const line of lines) {
     try {
-      ingestBridgeMessage(sessionId, JSON.parse(line))
+      const parsed = JSON.parse(line) as Record<string, unknown>
+      // Track client activity for dead-connection detection — non-keepalive
+      // frames only (see function comment).
+      if (parsed.type !== 'keep_alive') {
+        touchClientActivity(sessionId)
+      }
+      ingestBridgeMessage(sessionId, parsed)
     } catch (err) {
       logError('[WS] parse error:', err)
     }
@@ -164,6 +194,41 @@ export function touchClientActivity(sessionId: string): void {
   }
 }
 
+/**
+ * Inactivity sweep for one session's WS connection. Returns true when the
+ * connection was closed as dead.
+ *
+ * With HybridTransport the inactivity clock ONLY advances via HTTP POST
+ * ingress (writes go through POST; the WS carries no app-level
+ * client→server frames). 300s of silence with a live WS therefore means the
+ * worker's event uploader is wedged, not that the WS is dead — the WS will
+ * auto-reconnect within seconds. Closing it alone changes nothing (the
+ * zombie uploader is per-transport and survives WS reconnects), so this
+ * also queues a recovery work item: the worker's next at-capacity poll
+ * (≤10 min) fires onWorkReceived → fresh transport (fresh uploader) → the
+ * write path recovers. See redispatchWorkForSession.
+ */
+export function closeInactiveClient(
+  sessionId: string,
+  now: number = Date.now(),
+): boolean {
+  const entry = cleanupBySession.get(sessionId)
+  if (!entry) return false
+  if (entry.ws.readyState !== 1) return false
+  const silenceMs = now - entry.lastClientActivity
+  if (silenceMs <= CLIENT_ACTIVITY_TIMEOUT_MS) return false
+  log(
+    `[WS] Client inactive for ${Math.round(silenceMs / 1000)}s on session=${sessionId}, closing dead connection`,
+  )
+  try {
+    entry.ws.close(1000, 'client inactive')
+  } catch {
+    // already closed
+  }
+  void redispatchWorkForSession(sessionId)
+  return true
+}
+
 /** Called from onClose — unsubscribes from event bus */
 export function handleWebSocketClose(
   ws: WSContext,