@selesai/code 0.8.3 → 0.8.5

package/dist/extensions/pi-intercom/broker/broker.ts

@@ -3,6 +3,7 @@ import { writeFileSync, unlinkSync } from "fs";
 import { join } from "path";
 import { randomUUID } from "crypto";
 import { writeMessage, createMessageReader } from "./framing.ts";
+import { isMessage, isMessageReceipt, isSessionId, isSessionRegistration } from "./protocol.ts";
 import {
   ensureIntercomRuntimeDir,
   getBrokerListenTarget,
@@ -17,7 +18,7 @@ import {
 import { getAskTimeoutMs } from "../config.ts";
 import { sameCwd } from "../cwd.ts";
 import { EXTENSION_BUS_FEATURE } from "../types.ts";
-import type { SessionInfo, Message, Attachment, BrokerMessage, SessionRegistration, ExtensionCapability, MessageControl, MessageReceipt, MessageReceiptStatus } from "../types.ts";
+import type { SessionInfo, Message, BrokerMessage, ExtensionCapability, MessageControl } from "../types.ts";
 import { ExtensionStateManager } from "./extension-state.ts";
 import { assertNoLiveBroker } from "./runtime-claim.ts";
 
@@ -93,124 +94,6 @@ interface MailboxMessage {
   queuedAt: number;
 }
 
-function isMessageReceiptStatus(value: unknown): value is MessageReceiptStatus {
-  return value === "receiver_received"
-    || value === "queued"
-    || value === "injected"
-    || value === "acknowledged"
-    || value === "expired"
-    || value === "cancelled"
-    || value === "superseded"
-    || value === "cancellation_requested";
-}
-
-function isMessageReceipt(value: unknown): value is MessageReceipt {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-  const receipt = value as Record<string, unknown>;
-  if (typeof receipt.messageId !== "string" || !isMessageReceiptStatus(receipt.status) || typeof receipt.timestamp !== "number") {
-    return false;
-  }
-  return receipt.detail === undefined || typeof receipt.detail === "string";
-}
-
-function isAttachment(value: unknown): value is Attachment {
-  if (typeof value !== "object" || value === null) {
-    return false;
-  }
-
-  const attachment = value as Record<string, unknown>;
-
-  if (
-    attachment.type !== "file"
-    && attachment.type !== "snippet"
-    && attachment.type !== "context"
-  ) {
-    return false;
-  }
-
-  if (typeof attachment.name !== "string" || typeof attachment.content !== "string") {
-    return false;
-  }
-
-  return attachment.language === undefined || typeof attachment.language === "string";
-}
-
-function isMessage(value: unknown): value is Message {
-  if (typeof value !== "object" || value === null) {
-    return false;
-  }
-
-  const message = value as Record<string, unknown>;
-
-  if (typeof message.id !== "string" || typeof message.timestamp !== "number") {
-    return false;
-  }
-
-  for (const key of ["senderSequence", "brokerReceivedAt", "brokerDeliveredAt", "receiverReceivedAt", "injectedAt"] as const) {
-    if (message[key] !== undefined && typeof message[key] !== "number") {
-      return false;
-    }
-  }
-
-  if (message.supersedes !== undefined && typeof message.supersedes !== "string") {
-    return false;
-  }
-
-  if (message.retryOf !== undefined && typeof message.retryOf !== "string") {
-    return false;
-  }
-
-  if (message.replyTo !== undefined && typeof message.replyTo !== "string") {
-    return false;
-  }
-
-  if (message.expectsReply !== undefined && typeof message.expectsReply !== "boolean") {
-    return false;
-  }
-
-  if (typeof message.content !== "object" || message.content === null) {
-    return false;
-  }
-
-  const content = message.content as Record<string, unknown>;
-  if (typeof content.text !== "string") {
-    return false;
-  }
-
-  return content.attachments === undefined
-    || (Array.isArray(content.attachments) && content.attachments.every(isAttachment));
-}
-
-function isSessionId(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0;
-}
-
-function isSessionRegistration(value: unknown): value is SessionRegistration {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-
-  const session = value as Record<string, unknown>;
-
-  if (
-    typeof session.cwd !== "string"
-    || typeof session.model !== "string"
-    || typeof session.pid !== "number"
-    || typeof session.startedAt !== "number"
-    || typeof session.lastActivity !== "number"
-  ) {
-    return false;
-  }
-
-  if (session.name !== undefined && typeof session.name !== "string") {
-    return false;
-  }
-
-  return session.status === undefined || typeof session.status === "string";
-}
-
 class IntercomBroker {
   private sessions = new Map<string, ConnectedSession>();
   private askEdges = new Map<string, AskEdge>();
@@ -472,6 +355,7 @@ class IntercomBroker {
         const info: SessionInfo = {
           id,
           ...(session.name !== undefined ? { name: session.name } : {}),
+          ...(session.runtimeFallbackAlias !== undefined ? { runtimeFallbackAlias: session.runtimeFallbackAlias } : {}),
           cwd: session.cwd,
           model: session.model,
           pid: session.pid,
@@ -745,20 +629,15 @@ class IntercomBroker {
             });
             break;
           }
-          const liveMailboxTarget = this.findUniqueLiveSessionForDisconnectedSession(target);
-          const effectiveTargetId = liveMailboxTarget?.info.id ?? target.id;
           if (message.expectsReply) {
-            const reverseEdge = Array.from(this.askEdges.entries()).find(([edgeMessageId, edge]) => edgeMessageId !== message.replyTo && edge.from === effectiveTargetId && edge.to === currentId);
-            if (reverseEdge) {
-              writeMessage(socket, {
-                type: "delivery_failed",
-                messageId: message.id,
-                reason: "Mutual ask refused: target session is already waiting for a reply from this session.",
-              });
-              break;
-            }
-            this.askEdges.set(message.id, { from: currentId, to: effectiveTargetId, createdAt: Date.now() });
+            writeMessage(socket, {
+              type: "delivery_failed",
+              messageId: message.id,
+              reason: "Target session is not currently connected; blocking asks are not queued",
+            });
+            break;
           }
+          const liveMailboxTarget = this.findUniqueLiveSessionForDisconnectedSession(target, currentId);
           if (liveMailboxTarget) {
             const deliveredMessage: Message = {
               ...message,
@@ -897,6 +776,15 @@ class IntercomBroker {
               changed = true;
             }
           }
+          if (clientMessage.runtimeFallbackAlias !== undefined) {
+            if (typeof clientMessage.runtimeFallbackAlias !== "boolean") {
+              throw new Error("Invalid presence runtimeFallbackAlias");
+            }
+            if (session.info.runtimeFallbackAlias !== clientMessage.runtimeFallbackAlias) {
+              session.info.runtimeFallbackAlias = clientMessage.runtimeFallbackAlias;
+              changed = true;
+            }
+          }
           if (clientMessage.status !== undefined) {
             if (typeof clientMessage.status !== "string") {
               throw new Error("Invalid presence status");
@@ -1025,9 +913,15 @@ class IntercomBroker {
     for (let index = 0; index < this.mailboxMessages.length;) {
       const entry = this.mailboxMessages[index]!;
       const matchesId = entry.target.id === session.info.id;
+      const matchesSenderIdentity = Boolean(
+        sessionName
+        && entry.from.name?.toLowerCase() === sessionName
+        && sameCwd(entry.from.cwd, session.info.cwd),
+      );
       const matchesUniqueName = Boolean(
         uniqueMailboxIdentity
         && sessionName
+        && !matchesSenderIdentity
         && entry.target.name?.toLowerCase() === sessionName
         && sameCwd(entry.target.cwd, session.info.cwd),
       );
@@ -1125,26 +1019,32 @@ class IntercomBroker {
       .map(([, session]) => session);
   }
 
-  private findUniqueLiveSessionForDisconnectedSession(info: SessionInfo): ConnectedSession | null {
-    const matches = this.findLiveSessionsSharingMailboxIdentity(info);
+  private findUniqueLiveSessionForDisconnectedSession(info: SessionInfo, senderId?: string): ConnectedSession | null {
+    const matches = this.findLiveSessionsSharingMailboxIdentity(info)
+      .filter((session) => session.info.id !== senderId);
     return matches.length === 1 ? matches[0]! : null;
   }
 
   /**
-   * Mailbox identity is name plus directory, never name alone. A name on its own
-   * is display metadata that unrelated projects reuse, so matching on it would
-   * hand one project's queued mail to a same-named session in another project.
+   * Mailbox identity is an explicit name plus directory, never name alone. A
+   * runtime fallback alias is derived from the session id rather than chosen as
+   * a durable identity, so it must not transfer mail to another process. This
+   * also prevents two unnamed UUIDv7 sessions started close together from
+   * inheriting each other's mailbox through a shared short alias.
+   *
    * Directories compare through sameCwd so a relaunch that reports the same
    * directory differently (trailing slash, "."/"..", or a symlink such as macOS
    * /tmp vs /private/tmp) still matches.
    */
   private findLiveSessionsSharingMailboxIdentity(info: SessionInfo): ConnectedSession[] {
     const lowerName = info.name?.toLowerCase();
-    if (!lowerName) {
+    if (!lowerName || info.runtimeFallbackAlias) {
       return [];
     }
     return Array.from(this.sessions.values()).filter(session =>
-      session.info.name?.toLowerCase() === lowerName && sameCwd(session.info.cwd, info.cwd)
+      !session.info.runtimeFallbackAlias
+      && session.info.name?.toLowerCase() === lowerName
+      && sameCwd(session.info.cwd, info.cwd)
     );
   }
 
@@ -1228,12 +1128,10 @@ class IntercomBroker {
       const winner = candidates[0];
       const existing = this.namespaceOwners.get(namespace);
 
-      // Check if owner changed or socket changed
       const ownerChanged = !existing || existing.sessionId !== winner.sessionId;
       const socketChanged = existing && existing.socket !== winner.session.socket;
 
       if (ownerChanged || socketChanged) {
-        // Generate new epoch
         const epoch = randomUUID();
         this.namespaceOwners.set(namespace, {
           sessionId: winner.sessionId,
@@ -1241,7 +1139,6 @@ class IntercomBroker {
           epoch,
         });
 
-        // Broadcast owner change to all capable sessions
         for (const session of this.sessions.values()) {
           if (session.extensions?.length) {
             const isCapable = session.extensions.some((ext) => ext.namespace === namespace);

package/dist/extensions/pi-intercom/broker/client-liveness.test.ts

@@ -0,0 +1,173 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import net from "node:net";
+import { once } from "node:events";
+import { mkdtempSync, rmSync } from "node:fs";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { IntercomClient } from "./client.ts";
+import { writeMessage } from "./framing.ts";
+
+/**
+ * Unit tests for the half-open socket fix.
+ *
+ * Bug: when the broker dies without sending a FIN (SIGKILL, crash, host loss),
+ * the client's socket stays "writable" indefinitely. isConnected() keeps
+ * returning true, no "disconnected" event fires, and the extension's
+ * scheduleReconnect() is never called — so the agent silently drops out of the
+ * intercom roster forever (this is why long-lived headless/RPC pi agents
+ * vanish from `intercom list` after a broker restart).
+ *
+ * The fix: (1) a socket "error" after registration destroys the socket so the
+ * existing onClose -> "disconnected" path runs, and (2) a liveness heartbeat
+ * that round-trips a lightweight request and tears down the socket on timeout
+ * or write error, so a half-open connection is detected within a bounded
+ * window even when the OS never delivers an error.
+ */
+
+const homeDir = mkdtempSync(path.join(tmpdir(), "pi-intercom-liveness-unit-"));
+const runtimeAgentDir = process.platform === "win32" ? undefined : mkdtempSync("/tmp/piic-");
+const previousHome = process.env.HOME;
+const previousUserProfile = process.env.USERPROFILE;
+const previousAgentDir = process.env.SELESAI_CODING_AGENT_DIR;
+process.env.HOME = homeDir;
+process.env.USERPROFILE = homeDir;
+if (runtimeAgentDir) process.env.SELESAI_CODING_AGENT_DIR = runtimeAgentDir;
+process.env.PI_INTERCOM_LIVENESS_INTERVAL_MS = "100";
+process.env.PI_INTERCOM_LIVENESS_TIMEOUT_MS = "200";
+
+test.after(() => {
+  process.env.HOME = previousHome;
+  process.env.USERPROFILE = previousUserProfile;
+  if (previousAgentDir === undefined) delete process.env.SELESAI_CODING_AGENT_DIR;
+  else process.env.SELESAI_CODING_AGENT_DIR = previousAgentDir;
+  rmSync(homeDir, { recursive: true, force: true });
+  if (runtimeAgentDir) rmSync(runtimeAgentDir, { recursive: true, force: true });
+});
+
+/**
+ * Build a registered IntercomClient wired to a fake server socket pair, so we
+ * can simulate a half-open connection without spawning a real broker.
+ */
+async function registeredClientAgainstFakeSocket(): Promise<{
+  client: IntercomClient;
+  serverSide: net.Socket;
+  closeServerSideAbruptly(): void;
+  stopResponding(): void;
+}> {
+  const { getBrokerSocketPath } = await import("./paths.ts");
+  const { mkdirSync, unlinkSync } = await import("node:fs");
+  const socketPath = getBrokerSocketPath();
+  const intercomDir = path.dirname(socketPath);
+  mkdirSync(intercomDir, { recursive: true });
+  try { unlinkSync(socketPath); } catch { /* no stale socket */ }
+
+  const client = new IntercomClient();
+  let resolveReady: (value: { serverSide: net.Socket; closeServerSideAbruptly(): void; stopResponding(): void }) => void;
+  let rejectReady: (reason: unknown) => void;
+  const ready = new Promise<{ serverSide: net.Socket; closeServerSideAbruptly(): void; stopResponding(): void }>((res, rej) => {
+    resolveReady = res;
+    rejectReady = rej;
+  });
+
+  let responding = true;
+  const server = net.createServer((serverSide) => {
+    serverSide.on("data", (data) => {
+      if (!responding) return; // simulate a dead/unresponsive broker: drop everything
+      try {
+        const len = data.readUInt32BE(0);
+        const json = JSON.parse(data.subarray(4, 4 + len).toString("utf-8"));
+        if (json.type === "register") {
+          writeMessage(serverSide, { type: "registered", sessionId: json.sessionId ?? "stable-test", features: [] });
+        }
+        if (json.type === "list") {
+          writeMessage(serverSide, { type: "sessions", requestId: json.requestId, sessions: [] });
+        }
+      } catch {
+        // ignore parse errors in the fake
+      }
+    });
+    server.close();
+    resolveReady({
+      serverSide,
+      closeServerSideAbruptly() {
+        // Destroy WITHOUT a clean FIN — simulates a SIGKILL'd broker peer.
+        serverSide.destroy();
+      },
+      stopResponding() {
+        // Simulate a half-open socket: the peer stops reading/replying but the
+        // connection is not closed, so no "close"/"error" event reaches the
+        // client. Only an active liveness probe can detect this.
+        responding = false;
+      },
+    });
+  });
+  server.on("error", (err) => rejectReady(err));
+  await new Promise<void>((resolve) => server.listen(socketPath, () => resolve()));
+
+  await client.connect(
+    {
+      name: "liveness-unit",
+      cwd: homeDir,
+      model: "test-model",
+      pid: process.pid,
+      startedAt: Date.now(),
+      lastActivity: Date.now(),
+    },
+    "stable-liveness-unit",
+  );
+  const { serverSide, closeServerSideAbruptly, stopResponding } = await ready;
+  return { client, serverSide, closeServerSideAbruptly, stopResponding };
+}
+
+test("client emits disconnected when the peer destroys the socket without a FIN", async () => {
+  const { client, closeServerSideAbruptly } = await registeredClientAgainstFakeSocket();
+  try {
+    assert.equal(client.isConnected(), true, "client should be connected after register");
+
+    const disconnected = once(client, "disconnected");
+    closeServerSideAbruptly();
+
+    const event = await Promise.race([
+      disconnected,
+      new Promise<never>((_, reject) =>
+        setTimeout(
+          () => reject(new Error("client never noticed the abruptly-closed peer (half-open socket)")),
+          3000,
+        ),
+      ),
+    ]);
+    assert.ok(event, "expected a disconnected event");
+    assert.equal(client.isConnected(), false);
+  } finally {
+    await client.disconnect().catch(() => undefined);
+  }
+});
+
+test("client liveness heartbeat detects a half-open socket within a bounded window", async () => {
+  const { client, stopResponding } = await registeredClientAgainstFakeSocket();
+  try {
+    assert.equal(client.isConnected(), true);
+
+    const disconnected = once(client, "disconnected");
+    // Simulate a half-open socket: the peer stops replying but does NOT close
+    // the connection. No "close"/"error" event reaches the client, so passive
+    // detection cannot fire — only the liveness heartbeat can notice.
+    stopResponding();
+
+    // The heartbeat (interval ~100ms, timeout ~200ms) must notice and tear down.
+    const event = await Promise.race([
+      disconnected,
+      new Promise<never>((_, reject) =>
+        setTimeout(
+          () => reject(new Error("liveness heartbeat did not detect the half-open socket within 3s")),
+          3000,
+        ),
+      ),
+    ]);
+    assert.ok(event, "expected the heartbeat to surface a disconnected event");
+    assert.equal(client.isConnected(), false);
+  } finally {
+    await client.disconnect().catch(() => undefined);
+  }
+});