@schoolai/shipyard 3.34.0 → 3.34.1-rc.20260924.0

package/dist/{chunk-ZGLXU6XJ.js → chunk-CRS3BMH4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getDaemonVersion
-} from "./chunk-O7PCPQ5T.js";
+} from "./chunk-ZZHFRLKK.js";
 import {
   WorkerCommandCodec,
   WorkerReplyCodec
@@ -1116,4 +1116,4 @@ export {
   shutdownFileWatcherGuard,
   guardedSubscribe
 };
-//# sourceMappingURL=chunk-ZGLXU6XJ.js.map
+//# sourceMappingURL=chunk-CRS3BMH4.js.map

package/dist/{chunk-O7PCPQ5T.js → chunk-ZZHFRLKK.js}

@@ -18,8 +18,8 @@ function getDaemonVersion() {
   return cached;
 }
 function readDaemonVersion() {
-  if ("3.34.0".length > 0) {
-    return "3.34.0";
+  if ("3.34.1".length > 0) {
+    return "3.34.1";
   }
   try {
     const here = dirname(fileURLToPath(import.meta.url));
@@ -48,4 +48,4 @@ function readDaemonVersion() {
 export {
   getDaemonVersion
 };
-//# sourceMappingURL=chunk-O7PCPQ5T.js.map
+//# sourceMappingURL=chunk-ZZHFRLKK.js.map

package/dist/electron-utility.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   getDaemonVersion
-} from "./chunk-O7PCPQ5T.js";
+} from "./chunk-ZZHFRLKK.js";
 import {
   enableNativeCrashReports
 } from "./chunk-CTVKFKRG.js";
@@ -71,7 +71,7 @@ async function main() {
   await loadAuthFromConfig(env);
   crumb("post-auth-load");
   crumb("pre-serve-import");
-  const { serve } = await import("./serve-NWLZH6MD.js");
+  const { serve } = await import("./serve-ZUI52LNF.js");
   crumb("post-serve-import");
   const portQueue = [];
   let acceptor = null;

package/dist/index.js

@@ -137,7 +137,7 @@ async function handleSubcommand() {
     return true;
   }
   if (subcommand === "start") {
-    const { startCommand } = await import("./start-DCG37IQJ.js");
+    const { startCommand } = await import("./start-2FKA6COR.js");
     await startCommand();
     return true;
   }
@@ -159,7 +159,7 @@ async function main() {
   const args = parseCliArgs();
   if (args.serve) {
     await loadAuthFromConfig(env);
-    const { serve } = await import("./serve-NWLZH6MD.js");
+    const { serve } = await import("./serve-ZUI52LNF.js");
     return serve({ isDev: env.SHIPYARD_DEV });
   }
   logger.error("Use `shipyard start` to run the daemon. Use --help for usage.");

package/dist/{serve-NWLZH6MD.js → serve-ZUI52LNF.js}

@@ -12,7 +12,7 @@ import {
   guardedSubscribe,
   makeInitialAttemptState,
   shutdownFileWatcherGuard
-} from "./chunk-ZGLXU6XJ.js";
+} from "./chunk-CRS3BMH4.js";
 import {
   TRAILER_SCHEMA_VERSION,
   appendTrailerToMessage,
@@ -46,7 +46,7 @@ import {
 } from "./chunk-T5J6HZOQ.js";
 import {
   getDaemonVersion
-} from "./chunk-O7PCPQ5T.js";
+} from "./chunk-ZZHFRLKK.js";
 import {
   collectPriorCrashDetail,
   getRecentWasmPanicMessages
@@ -6333,7 +6333,7 @@ function nanoid(size = 21) {
 }
 
 // src/services/bootstrap/signaling.ts
-var DAEMON_NPM_VERSION = true ? "3.34.0" : "unknown";
+var DAEMON_NPM_VERSION = true ? "3.34.1" : "unknown";
 function createDaemonSignaling(config) {
   const agentId = config.agentId ?? nanoid();
   function send(msg) {
@@ -80980,14 +80980,41 @@ function buildDevinTaskSubprocess(options) {
 }
 
 // src/services/serve-factory/rate-limit-account-switch.ts
-function attributeRateLimitEvents(onEvent, spawnAccountKey) {
+function attributeRateLimitEvents(onEvent, spawnAccountKey, ctx) {
   if (spawnAccountKey === null) return onEvent;
+  const isStale = () => {
+    if (ctx === void 0) return false;
+    const current = ctx.getCurrentAccountKey();
+    if (spawnAccountKey !== null && current !== null && spawnAccountKey !== current) {
+      return true;
+    }
+    const lastSwitchAt = ctx.getLastAccountSwitchAtMs();
+    return lastSwitchAt !== null && ctx.spawnedAtMs < lastSwitchAt;
+  };
   return (event) => {
-    if (event.type !== "rate_limit" || event.accountKey !== void 0) {
-      onEvent(event);
+    if (event.type === "rate_limit") {
+      const stale = isStale();
+      if (event.accountKey !== void 0 && !stale) {
+        onEvent(event);
+        return;
+      }
+      onEvent({
+        ...event,
+        accountKey: event.accountKey ?? spawnAccountKey,
+        ...stale ? { spawnAccountStale: true } : {}
+      });
       return;
     }
-    onEvent({ ...event, accountKey: spawnAccountKey });
+    if (event.type === "rate_limit_error") {
+      const stale = isStale();
+      if (!stale) {
+        onEvent(event);
+        return;
+      }
+      onEvent({ ...event, spawnAccountStale: true });
+      return;
+    }
+    onEvent(event);
   };
 }
 function planClaudeAccountTransition(lastKey, next) {
@@ -81020,12 +81047,15 @@ function applyClaudeAccountSwitch(deps, switched) {
     });
   }
   deps.rewarmUnderNewAccount();
+  const retired = deps.retireStaleClaudeLanes();
   deps.log({
     event: "claude_account_switched",
     from: switched.from,
     to: switched.to,
     clearedTaskIds,
-    newAccountHasRateLimitRecord: record2 !== void 0
+    newAccountHasRateLimitRecord: record2 !== void 0,
+    retiredLanesStopped: retired.stopped,
+    retiredLanesDeferred: retired.deferred
   });
 }
 
@@ -91955,6 +91985,18 @@ var AgentSessionManager = class {
    */
   #expectedShutdown = false;
   #configReloadPending = false;
+  /**
+   * One-shot intent: retire this lane's subprocess for a Claude account
+   * switch as soon as it reaches quiescent warm_idle. Set only by
+   * `prepareAccountReload()` when the lane is mid-turn — aborting a running
+   * turn would lose work, so the retirement is deferred until the turn
+   * completes (the stale-account respawn in RateLimitFlapController is the
+   * backstop if the old account saturates first). Cleared wherever the
+   * pending retirement becomes moot: `stop()`, `dispose()`, subprocess
+   * death, and any fresh `spawn` effect (a new generation already
+   * authenticates under the new account).
+   */
+  #accountReloadPending = false;
   /**
    * True while a Cursor tool call is in flight (between `tool_execution_started`
    * and `tool_execution_settled` FSM events). When true, `#chooseStallTimeoutMs`
@@ -92095,6 +92137,7 @@ var AgentSessionManager = class {
   stop() {
     if (this.#configReloadPending) this.#queue.length = 0;
     this.#configReloadPending = false;
+    this.#accountReloadPending = false;
     this.#dispatch({ type: "stop_commanded" });
   }
   /** Preserve queued follow-up input across a configuration-only shutdown. */
@@ -92104,6 +92147,38 @@ var AgentSessionManager = class {
     this.#dispatch({ type: "stop_commanded" });
     return true;
   }
+  /**
+   * Retire the live subprocess because the canonical Claude account
+   * changed underneath it. A `warm_idle` process is parked holding the OLD
+   * account's token — stopping it now costs only a resume spawn on the
+   * next user message, so it goes down immediately via the existing
+   * config-reload teardown (queue preserved). A `running`/`spawning`/
+   * `stopping` lane keeps its turn — aborting would lose work — and is
+   * stopped on reaching quiescent warm_idle via `#accountReloadPending`.
+   * No live process (`cold_idle`/`resumable_idle`) means nothing to do.
+   */
+  prepareAccountReload() {
+    if (this.#state === "warm_idle" && this.#pendingInputs.size === 0) {
+      const from = this.#state;
+      this.prepareConfigReload();
+      this.#config.log({
+        event: "session_account_reload_stopped",
+        taskId: this.#config.taskId,
+        state: from
+      });
+      return "stopped";
+    }
+    if (this.#state === "running" || this.#state === "spawning" || this.#state === "stopping" || this.#state === "warm_idle") {
+      this.#accountReloadPending = true;
+      this.#config.log({
+        event: "session_account_reload_deferred",
+        taskId: this.#config.taskId,
+        state: this.#state
+      });
+      return "deferred";
+    }
+    return "noop";
+  }
   rewind(resumeAtMessageId) {
     this.#dispatch({ type: "rewind_requested", resumeAtMessageId });
   }
@@ -92184,6 +92259,7 @@ var AgentSessionManager = class {
     this.#queue = [];
     this.#pendingInputs.clear();
     this.#eventQueue = [];
+    this.#accountReloadPending = false;
   }
   /**
    * Trace the rewind fork target's whole lifetime: SET when a rewind records
@@ -92269,6 +92345,17 @@ var AgentSessionManager = class {
       this.#configReloadPending = false;
       if (this.#queue.length > 0) this.#dispatch({ type: "user_message" });
     }
+    if (this.#accountReloadPending && this.#state === "warm_idle" && this.#pendingInputs.size === 0) {
+      this.#accountReloadPending = false;
+      this.prepareConfigReload();
+      this.#config.log({
+        event: "session_account_reload_stopped",
+        taskId: this.#config.taskId,
+        state: "warm_idle",
+        deferred: true
+      });
+    }
+    if (event.type === "subprocess_died") this.#accountReloadPending = false;
   }
   #applyEffects(effects) {
     for (const effect of effects) {
@@ -92279,6 +92366,7 @@ var AgentSessionManager = class {
           this.#firstStepReceived = false;
           this.#lastStreamActivityAt = null;
           this.#toolExecutionInFlight = false;
+          this.#accountReloadPending = false;
           this.#config.onSpawn(effect.reason, initial?.content ?? []);
           break;
         }
@@ -92833,6 +92921,8 @@ var CursorRecoveryController = class {
 // src/services/conversation/rate-limit-flap-controller.ts
 var MAX_RATE_LIMIT_FLAP_RETRIES = 1;
 var RATE_LIMIT_FLAP_RETRY_DELAY_MS = 8e3;
+var MAX_STALE_ACCOUNT_RESPAWNS = 1;
+var STALE_ACCOUNT_RESPAWN_DELAY_MS = 1e3;
 function isLikelyAnthropicFlap(info, nowMs = Date.now()) {
   if (info === void 0) return false;
   if (info.provider !== void 0 && info.provider !== "anthropic") return false;
@@ -92885,6 +92975,13 @@ var RateLimitFlapController = class {
    * sent something fresh, that turn deserves its own retry budget).
    */
   #flapRetries = 0;
+  /**
+   * Consecutive stale-account respawns this turn. Independent budget from
+   * `#flapRetries`: the stale path answers "the emitting process predates
+   * the current account", not "Anthropic returned an implausible
+   * rejection". Reset alongside it.
+   */
+  #staleAccountRespawns = 0;
   /**
    * Cached most recent `rate_limit` info-event payload. The flap
    * discriminator runs at `rate_limit_error` time but the discriminating
@@ -92912,6 +93009,7 @@ var RateLimitFlapController = class {
   resetForNewTurn() {
     this.cancelPendingRetry();
     this.#flapRetries = 0;
+    this.#staleAccountRespawns = 0;
     this.#lastInfo = void 0;
   }
   /**
@@ -92935,15 +93033,17 @@ var RateLimitFlapController = class {
    * exhausts into the surfaced banner, not a silent loop. #3932.
    */
   noteRecoveredOnTurnComplete(producedOutput) {
-    if (this.#flapRetries === 0) return;
+    if (this.#flapRetries === 0 && this.#staleAccountRespawns === 0) return;
     if (!producedOutput) return;
     this.cancelPendingRetry();
     this.#deps.log({
       event: "thread_usage_limit_flap_recovered",
       threadId: this.#deps.threadId,
-      retries: this.#flapRetries
+      retries: this.#flapRetries,
+      staleAccountRespawns: this.#staleAccountRespawns
     });
     this.#flapRetries = 0;
+    this.#staleAccountRespawns = 0;
   }
   handleEvent(event) {
     if (event.type === "rate_limit" && event.info.status === "rejected") {
@@ -92952,6 +93052,22 @@ var RateLimitFlapController = class {
     if (this.#timer !== null) return;
     const isBlocking = event.type === "rate_limit_error" || event.info.status === "rejected" && event.info.isUsingOverage !== true;
     if (!isBlocking) return;
+    if (event.spawnAccountStale === true && this.#deps.getState() === "running" && this.#staleAccountRespawns < MAX_STALE_ACCOUNT_RESPAWNS) {
+      this.#staleAccountRespawns++;
+      this.#deps.log({
+        event: "thread_usage_limit_stale_account_respawn",
+        threadId: this.#deps.threadId,
+        eventType: event.type,
+        retries: this.#staleAccountRespawns
+      });
+      this.#deps.notifyAbortRetry();
+      this.#timer = setTimeout(() => {
+        this.#timer = null;
+        if (this.#deps.isDisposed()) return;
+        this.#deps.respawnForResume();
+      }, STALE_ACCOUNT_RESPAWN_DELAY_MS);
+      return;
+    }
     const flapInfo = event.type === "rate_limit" ? event.info : this.#lastInfo;
     if (this.#deps.getState() === "running" && this.#flapRetries < MAX_RATE_LIMIT_FLAP_RETRIES && isLikelyAnthropicFlap(flapInfo)) {
       this.#flapRetries++;
@@ -96342,6 +96458,17 @@ var Thread = class {
     if (this.#agentSystem !== "devin") return false;
     return this.#manager.prepareConfigReload();
   }
+  /**
+   * Retire this lane's subprocess after a Claude account switch: a parked
+   * warm_idle process holds the old account's token, so it is stopped now
+   * (the next message respawns under the new credential); a running lane
+   * keeps its turn and is retired on reaching warm_idle. Non-Claude lanes
+   * are unaffected by a Claude credential swap.
+   */
+  retireSubprocessForAccountSwitch() {
+    if (this.#agentSystem !== "claude-code") return "noop";
+    return this.#manager.prepareAccountReload();
+  }
   async reconnectMcpServer(serverName) {
     if (!this.#subprocess) return;
     await this.#subprocess.reconnectMcpServer(serverName);
@@ -102972,6 +103099,15 @@ function handleMainThreadEvent(ctx, event) {
       ctx.onAuthNotLoggedIn(ctx.getRuntimeId());
       break;
     case "rate_limit":
+      if (event.spawnAccountStale === true) {
+        ctx.log({
+          event: "rate_limit_event_dropped_stale_account",
+          taskId: ctx.taskId,
+          spawnAccountKey: event.accountKey ?? null,
+          status: event.info.status
+        });
+        break;
+      }
       ctx.onRateLimitEvent(event.info, event.accountKey ?? null);
       break;
     case "billing_error":
@@ -108459,6 +108595,23 @@ var Task = class {
   get mainThread() {
     return this.#getPrimary();
   }
+  /**
+   * Retire every Claude lane in this task after a canonical-account switch:
+   * the primary thread plus every side thread. Warm-idle lanes stop now
+   * (`stopped`); mid-turn lanes defer until they reach warm_idle
+   * (`deferred`). Non-Claude and process-free lanes are `noop`.
+   */
+  retireClaudeSubprocessesForAccountSwitch() {
+    const tally = { stopped: 0, deferred: 0 };
+    const apply = (thread) => {
+      const result = thread.retireSubprocessForAccountSwitch();
+      if (result === "stopped") tally.stopped++;
+      else if (result === "deferred") tally.deferred++;
+    };
+    apply(this.#getPrimary());
+    this.#propagateToSideThreads(apply, "retire_for_account_switch_error");
+    return tally;
+  }
   /**
    * Cancel the sliding-window timer for `uri` and trigger an immediate flush.
    * User-initiated path from `flush_resource_batch` control-channel message.
@@ -111660,6 +111813,20 @@ var TaskManager = class {
     }
     return result;
   }
+  /**
+   * Retire every Claude lane across all managed tasks after a canonical
+   * account switch. Called from `applyClaudeAccountSwitch`; returns the
+   * aggregate counts for the `claude_account_switched` log line.
+   */
+  retireClaudeSubprocessesForAccountSwitch() {
+    const tally = { stopped: 0, deferred: 0 };
+    for (const task of this.#tasks.values()) {
+      const result = task.orchestrator.retireClaudeSubprocessesForAccountSwitch();
+      tally.stopped += result.stopped;
+      tally.deferred += result.deferred;
+    }
+    return tally;
+  }
   /**
    * Browser-initiated flush for a specific resource URI (PROTOCOL_VERSION 48).
    * Resolves the URI to its owning task by extracting the taskId from the
@@ -113944,9 +114111,13 @@ async function createDaemon(deps) {
   const claudeAccountSwitchRef = {
     current: (switched) => deps.log({ event: "claude_account_switch_before_wiring", ...switched })
   };
+  let lastClaudeAccountSwitchAtMs = null;
   const commitCapabilities = createCapabilityWriter(
     capabilitiesRef,
-    createClaudeAccountTracker((switched) => claudeAccountSwitchRef.current(switched))
+    createClaudeAccountTracker((switched) => {
+      lastClaudeAccountSwitchAtMs = Date.now();
+      claudeAccountSwitchRef.current(switched);
+    })
   );
   const rateLimitStoreRef = { current: null };
   const gitCheckpoint = createGitCheckpointService();
@@ -114680,9 +114851,24 @@ async function createDaemon(deps) {
     });
     const selectedModel = settings?.model ?? null;
     const profileForModel = selectedModel !== null ? profileRegistry.findByModelId(selectedModel) : null;
+    const spawnProfileId = profileForModel?.id ?? "claude-code";
     const onEvent = attributeRateLimitEvents(
       unattributedOnEvent,
-      resolveRateLimitAccountKey(capabilitiesRef.current, profileForModel?.id ?? "claude-code")
+      resolveRateLimitAccountKey(capabilitiesRef.current, spawnProfileId),
+      {
+        /**
+         * Same profile as the spawn key: a non-Claude lane compares against
+         * its own account so cross-profile key shapes never false-flag stale.
+         */
+        getCurrentAccountKey: () => resolveRateLimitAccountKey(capabilitiesRef.current, spawnProfileId),
+        /**
+         * `lastClaudeAccountSwitchAtMs` is Claude-only — gate it on the
+         * spawn profile so a Codex/Cursor lane spawned before a Claude
+         * switch isn't false-flagged stale by the timestamp rule.
+         */
+        getLastAccountSwitchAtMs: () => spawnProfileId === "claude-code" ? lastClaudeAccountSwitchAtMs : null,
+        spawnedAtMs: Date.now()
+      }
     );
     const decision = decideSpawnRoute({
       mode,
@@ -115394,6 +115580,7 @@ async function createDaemon(deps) {
         preWarmManager.kill();
         preWarmManager.resetAndRestart();
       },
+      retireStaleClaudeLanes: () => taskManager.retireClaudeSubprocessesForAccountSwitch(),
       log: deps.log
     },
     switched
@@ -119525,4 +119712,4 @@ export {
   decideWorkspaceScope,
   serve
 };
-//# sourceMappingURL=serve-NWLZH6MD.js.map
+//# sourceMappingURL=serve-ZUI52LNF.js.map