@schoolai/shipyard 3.24.0-rc.20260813.0 → 3.24.0

package/dist/electron-utility.js

@@ -71,7 +71,7 @@ async function main() {
   await loadAuthFromConfig(env);
   crumb("post-auth-load");
   crumb("pre-serve-import");
-  const { serve } = await import("./serve-QHLWAVVY.js");
+  const { serve } = await import("./serve-RWFBSQIE.js");
   crumb("post-serve-import");
   const portQueue = [];
   let acceptor = null;

package/dist/index.js

@@ -137,7 +137,7 @@ async function handleSubcommand() {
     return true;
   }
   if (subcommand === "start") {
-    const { startCommand } = await import("./start-JJCGZ63I.js");
+    const { startCommand } = await import("./start-ZV22UPMC.js");
     await startCommand();
     return true;
   }
@@ -159,7 +159,7 @@ async function main() {
   const args = parseCliArgs();
   if (args.serve) {
     await loadAuthFromConfig(env);
-    const { serve } = await import("./serve-QHLWAVVY.js");
+    const { serve } = await import("./serve-RWFBSQIE.js");
     return serve({ isDev: env.SHIPYARD_DEV });
   }
   logger.error("Use `shipyard start` to run the daemon. Use --help for usage.");

package/dist/{serve-QHLWAVVY.js → serve-RWFBSQIE.js}

@@ -78822,6 +78822,13 @@ function handleSpawning(snapshot, event) {
   }
   return noop(snapshot);
 }
+function buildStallGiveUpMessage(recoveryAttempts) {
+  if (recoveryAttempts <= 0) {
+    return "The agent stopped responding mid-run. Send a message to try again.";
+  }
+  const plural = recoveryAttempts === 1 ? "time" : "times";
+  return `The agent stopped responding mid-run. Automatic recovery already retried ${recoveryAttempts} ${plural} without success \u2014 send a message to resume.`;
+}
 function runningStallTimeout(sessionId, event) {
   const b2 = createEffectBuilder();
   b2.log("running", "resumable_idle", event.type);
@@ -78829,11 +78836,7 @@ function runningStallTimeout(sessionId, event) {
   b2.effects.push({ type: "clear_queue" });
   if (!event.recoveryArmed) {
     b2.taskStatus("input_required");
-    b2.emitError(
-      "The agent stopped responding mid-run. Send a message to try again.",
-      "sdk_error",
-      "run_stall_timeout"
-    );
+    b2.emitError(buildStallGiveUpMessage(event.recoveryAttempts), "sdk_error", "run_stall_timeout");
   }
   b2.effects.push({ type: "kill_runner" });
   return {
@@ -79654,10 +79657,13 @@ var AgentSessionManager = class {
         return;
       }
       let recoveryArmed = false;
+      let recoveryAttempts = 0;
       try {
-        recoveryArmed = this.#config.onStallTimeout?.() ?? false;
+        const outcome = this.#config.onStallTimeout?.() ?? { armed: false, recoveryAttempts: 0 };
+        recoveryArmed = outcome.armed;
+        recoveryAttempts = outcome.recoveryAttempts;
       } finally {
-        this.#dispatch({ type: "run_stall_timeout", recoveryArmed });
+        this.#dispatch({ type: "run_stall_timeout", recoveryArmed, recoveryAttempts });
       }
     }, timeoutMs);
   }
@@ -79685,48 +79691,98 @@ var AgentSessionManager = class {
 
 // src/services/conversation/cursor-recovery-controller.ts
 var MAX_SIGNAL_DEATH_RETRIES = 1;
-var MAX_STALL_RESUME_RETRIES = 1;
+var MAX_STALL_RESUME_RETRIES = 3;
+var STALL_RESUME_BASE_DELAY_MS = 3e3;
+var STALL_RESUME_BACKOFF_MULTIPLIER = 3;
+function stallResumeDelayMs(attempt) {
+  return STALL_RESUME_BASE_DELAY_MS * STALL_RESUME_BACKOFF_MULTIPLIER ** (attempt - 1);
+}
 var MAX_CRASH_DEATH_RETRIES = 1;
 var CursorRecoveryController = class {
   #signalDeathRetries = 0;
   #stallResumeRetries = 0;
   #stallResumeArmed = false;
   #crashDeathRetries = 0;
+  /**
+   * Pending timer for the settle-delay before an armed stall resume fires.
+   * Cleared at every call site that supersedes the in-flight resume (new
+   * user turn, stop, rewind, dispose) plus its own callback on fire — the
+   * same shape as `RateLimitFlapController#timer`. A single handle suffices;
+   * `consumeStallResumeOnDeath` cannot run twice without an intervening
+   * `onStallTimeout` re-arming it.
+   */
+  #stallResumeTimer = null;
   #deps;
   constructor(deps) {
     this.#deps = deps;
   }
+  /**
+   * Cancel a pending delayed stall resume. Idempotent. Call from any path
+   * that supersedes the armed resume (new user turn, stop, rewind, dispose)
+   * — without this, a fresh intent would race the deferred
+   * `respawnForResume()` fired by the settle-delay timer.
+   */
+  cancelPendingResume() {
+    if (this.#stallResumeTimer !== null) {
+      clearTimeout(this.#stallResumeTimer);
+      this.#stallResumeTimer = null;
+    }
+  }
   /** Reset every budget. Call on each new user turn and on turn_complete. */
   reset() {
+    this.cancelPendingResume();
     this.#signalDeathRetries = 0;
     this.#stallResumeRetries = 0;
     this.#stallResumeArmed = false;
     this.#crashDeathRetries = 0;
   }
+  /**
+   * Call on `turn_complete` instead of `reset()`. A successful auto-recovery
+   * otherwise leaves no trace that the daemon self-healed rather than the
+   * run simply never stalling — log the recovery before clearing the budget.
+   */
+  noteTurnCompleteRecovery() {
+    if (this.#stallResumeRetries > 0) {
+      this.#deps.log({
+        event: "thread_cursor_stall_auto_resume_recovered",
+        threadId: this.#deps.threadId,
+        attempts: this.#stallResumeRetries
+      });
+    }
+    this.reset();
+  }
   /**
    * Fired by the manager when the stall watchdog expires, BEFORE the
    * `run_stall_timeout` event transitions the FSM. A mid-run Cursor stall
    * otherwise lands in `resumable_idle` with a "send a message to try again"
-   * banner and strands the orphaned turn until the user returns. Arm a one-shot
-   * resume so the imminent `kill_runner` death is resumed instead of surfaced.
-   * On repeat (cap exceeded) stay armed-off and let the existing banner run.
+   * banner and strands the orphaned turn until the user returns. Arm a
+   * resume so the imminent `kill_runner` death is resumed instead of
+   * surfaced. On repeat, up to `MAX_STALL_RESUME_RETRIES` times, stay
+   * armed-off and let the existing banner run.
    *
-   * Returns true when a recovery was armed — the manager passes this as
-   * `recoveryArmed` on the `run_stall_timeout` FSM event so the FSM suppresses
-   * the user-facing error banner during the 5-second self-heal (Fix B2).
+   * Returns `armed: true` when a recovery was armed — the manager passes
+   * this as `recoveryArmed` on the `run_stall_timeout` FSM event so the FSM
+   * suppresses the user-facing error banner during the self-heal.
+   * `recoveryAttempts` is only ever positive on the cap-exceeded give-up
+   * (see `StallTimeoutOutcome`), letting the FSM distinguish "never
+   * attempted" from "tried N times".
    */
   onStallTimeout() {
-    if (this.#deps.getState() !== "running") return false;
-    if (this.#deps.getAgentSystem() !== AGENT_SYSTEM_CURSOR) return false;
+    if (this.#deps.getState() !== "running") return { armed: false, recoveryAttempts: 0 };
+    if (this.#deps.getAgentSystem() !== AGENT_SYSTEM_CURSOR) {
+      return { armed: false, recoveryAttempts: 0 };
+    }
     this.#stallResumeRetries++;
     if (this.#stallResumeRetries > MAX_STALL_RESUME_RETRIES) {
+      const recoveryAttempts = this.#stallResumeRetries - 1;
       this.#deps.log({
         event: "thread_cursor_stall_resume_cap_exceeded",
         threadId: this.#deps.threadId,
-        retries: this.#stallResumeRetries
+        retries: this.#stallResumeRetries,
+        maxRetries: MAX_STALL_RESUME_RETRIES
       });
       this.#stallResumeRetries = 0;
-      return false;
+      return { armed: false, recoveryAttempts };
     }
     this.#deps.log({
       event: "thread_cursor_stall_resume_armed",
@@ -79734,19 +79790,41 @@ var CursorRecoveryController = class {
       retries: this.#stallResumeRetries
     });
     this.#stallResumeArmed = true;
-    return true;
+    return { armed: true, recoveryAttempts: 0 };
   }
   /**
-   * Consume an armed stall resume on the `kill_runner` death. By now the FSM is
-   * in `resumable_idle` and the subprocess was already cleared by Thread's
-   * force-kill, so this only re-spawns. Race-free: we resume ON the death, so
-   * the hung runner is confirmed gone. Returns true when it handled the death.
+   * Consume an armed stall resume on the `kill_runner` death. By now the FSM
+   * is in `resumable_idle` and the subprocess was already cleared by
+   * Thread's force-kill. Schedule the actual resume after
+   * `stallResumeDelayMs(attempt)` rather than firing immediately — the
+   * settle window that prevents the busy collision (see
+   * `MAX_STALL_RESUME_RETRIES`'s doc comment). Returns true as soon as it
+   * commits to handling the death (the timer is in-flight); the caller must
+   * not also surface it.
    */
   consumeStallResumeOnDeath() {
     if (!this.#stallResumeArmed) return false;
     this.#stallResumeArmed = false;
-    this.#deps.log({ event: "thread_cursor_stall_auto_resume", threadId: this.#deps.threadId });
-    this.#deps.respawnForResume();
+    this.cancelPendingResume();
+    const attempt = this.#stallResumeRetries;
+    const delayMs = stallResumeDelayMs(attempt);
+    this.#deps.log({
+      event: "thread_cursor_stall_auto_resume_scheduled",
+      threadId: this.#deps.threadId,
+      attempt,
+      delayMs
+    });
+    this.#stallResumeTimer = setTimeout(() => {
+      this.#stallResumeTimer = null;
+      if (this.#deps.isDisposed()) return;
+      this.#deps.log({
+        event: "thread_cursor_stall_auto_resume",
+        threadId: this.#deps.threadId,
+        attempt,
+        delayMs
+      });
+      this.#deps.respawnForResume();
+    }, delayMs);
     return true;
   }
   /**
@@ -80857,6 +80935,7 @@ var Thread = class {
       threadId: config.threadId,
       getState: () => this.#manager.state,
       getAgentSystem: () => this.#agentSystem,
+      isDisposed: () => this.#disposed,
       log: config.log,
       clearSubprocess: () => {
         this.#subprocess?.setOnCwdChanged(null);
@@ -81017,8 +81096,16 @@ var Thread = class {
    * Unlike `handleUserMessage`, this does NOT call `#recovery.noteNewUserTurn()`
    * (which resets the request-aborted retry budget) because a synthetic wake is
    * not a real user message.
+   *
+   * DOES cancel a pending flap/stall-resume timer, same reasoning as `stop()`
+   * and `rewind()`: `sendMessage` from `resumable_idle` walks the FSM to
+   * `spawning` on its own, so a still-armed timer firing later would call
+   * `respawnForResume()` against whatever run this wake started — a resume
+   * with nothing to do with the death it was originally scheduled for.
    */
   pushSyntheticMessageAndWake(content) {
+    this.#rateLimitFlap.cancelPendingRetry();
+    this.#cursorRecovery.cancelPendingResume();
     this.#manager.sendMessage(content);
   }
   /**
@@ -81059,6 +81146,7 @@ var Thread = class {
   }
   stop() {
     this.#rateLimitFlap.cancelPendingRetry();
+    this.#cursorRecovery.cancelPendingResume();
     this.#manager.stop();
   }
   /**
@@ -81068,6 +81156,7 @@ var Thread = class {
    */
   rewind(resumeAtMessageId) {
     this.#rateLimitFlap.cancelPendingRetry();
+    this.#cursorRecovery.cancelPendingResume();
     this.#manager.rewind(resumeAtMessageId);
   }
   notifySetupReady() {
@@ -81221,6 +81310,7 @@ var Thread = class {
     await this.#asyncQueue;
     this.#disposed = true;
     this.#rateLimitFlap.cancelPendingRetry();
+    this.#cursorRecovery.cancelPendingResume();
     this.#permissionHandler.denyAllPending("Thread disposed");
     this.#permissionQueue.length = 0;
     this.#streamDelta.dispose();
@@ -81861,7 +81951,7 @@ var Thread = class {
         });
         this.#streamDelta.resetForTurn();
         this.#recovery.resetRetriesOnTurnComplete();
-        this.#cursorRecovery.reset();
+        this.#cursorRecovery.noteTurnCompleteRecovery();
         this.#rateLimitFlap.noteRecoveredOnTurnComplete((event.result.outputTokens ?? 0) > 0);
         this.#emitThreadTurnStats(event.result);
         this.#manager.notifyTurnComplete();
@@ -103390,4 +103480,4 @@ export {
   decideWorkspaceScope,
   serve
 };
-//# sourceMappingURL=serve-QHLWAVVY.js.map
+//# sourceMappingURL=serve-RWFBSQIE.js.map