@sjawhar/opencode-legion-envoy 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/opencode-legion-envoy",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "type": "module",
   "main": "src/server.ts",
   "exports": {

package/src/__tests__/index.test.ts

@@ -302,96 +302,6 @@ describe("heartbeat refreshes all busy sessions (fix 1a)", () => {
   });
 });
 
-describe("re-adopts sibling sessions after serve restart (fix 1b)", () => {
-  it("registers idle same-dir+machine siblings on first activity, ignoring other machines/dirs", async () => {
-    const originalEnvoyUrl = process.env.ENVOY_URL;
-    process.env.ENVOY_URL = "http://127.0.0.1:59999";
-    const cwd = process.cwd();
-
-    const subscribed: string[] = [];
-    const originalFetch = globalThis.fetch;
-    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-      if (url.includes("/v1/interests/subscribe") && init?.body) {
-        const body = JSON.parse(init.body as string);
-        subscribed.push(body.session_id);
-        return new Response(JSON.stringify({ session_id: body.session_id, topics: [] }), {
-          status: 200,
-          headers: { "Content-Type": "application/json" },
-        });
-      }
-      if (url.includes("/v1/sessions")) {
-        return new Response(
-          JSON.stringify([
-            {
-              session_id: "ses_active",
-              machine_id: "M",
-              dir: cwd,
-              port: 13381,
-              title: "",
-              topics: [],
-              updated_at: Date.now(),
-            },
-            {
-              session_id: "ses_idle",
-              machine_id: "M",
-              dir: cwd,
-              port: 9,
-              title: "Idle",
-              topics: [],
-              updated_at: Date.now(),
-            },
-            {
-              session_id: "ses_foreign",
-              machine_id: "OTHER",
-              dir: cwd,
-              port: 7,
-              title: "",
-              topics: [],
-              updated_at: Date.now(),
-            },
-            {
-              session_id: "ses_otherdir",
-              machine_id: "M",
-              dir: "/somewhere/else",
-              port: 8,
-              title: "",
-              topics: [],
-              updated_at: Date.now(),
-            },
-          ]),
-          { status: 200, headers: { "Content-Type": "application/json" } }
-        );
-      }
-      if (url.includes("/session/")) return new Response("not found", { status: 404 });
-      throw new Error("connection refused");
-    }) as typeof fetch;
-
-    try {
-      const pluginModule = await import("../server");
-      const hooks = await pluginModule.default({
-        serverUrl: new URL("http://127.0.0.1:13381/"),
-      } as never);
-
-      await hooks.event({
-        event: {
-          type: "session.status",
-          properties: { sessionID: "ses_active", status: { type: "busy" } },
-        },
-      });
-      await new Promise((r) => setTimeout(r, 100));
-
-      expect(subscribed).toContain("ses_active");
-      expect(subscribed).toContain("ses_idle");
-      expect(subscribed).not.toContain("ses_foreign");
-      expect(subscribed).not.toContain("ses_otherdir");
-    } finally {
-      globalThis.fetch = originalFetch;
-      process.env.ENVOY_URL = originalEnvoyUrl;
-    }
-  });
-});
-
 describe("prunes deleted sessions from the heartbeat (fix 2)", () => {
   it("stops re-subscribing a session after session.deleted", async () => {
     const originalEnvoyUrl = process.env.ENVOY_URL;
@@ -462,88 +372,6 @@ describe("prunes deleted sessions from the heartbeat (fix 2)", () => {
   });
 });
 
-describe("re-adoption retries until the registry shows our own session (fix 3)", () => {
-  it("adopts an idle sibling once /v1/sessions includes self on a later poll", async () => {
-    const originalEnvoyUrl = process.env.ENVOY_URL;
-    const originalHb = process.env.ENVOY_HEARTBEAT_MS;
-    process.env.ENVOY_URL = "http://127.0.0.1:59999";
-    process.env.ENVOY_HEARTBEAT_MS = "40";
-    const cwd = process.cwd();
-
-    let sessionsCalls = 0;
-    const subscribed: string[] = [];
-    const originalFetch = globalThis.fetch;
-    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-      if (url.includes("/v1/interests/subscribe") && init?.body) {
-        const body = JSON.parse(init.body as string);
-        subscribed.push(body.session_id);
-        return new Response(JSON.stringify({ session_id: body.session_id, topics: [] }), {
-          status: 200,
-          headers: { "Content-Type": "application/json" },
-        });
-      }
-      if (url.includes("/v1/sessions")) {
-        sessionsCalls += 1;
-        // First poll: self not persisted yet. Later polls: self + idle sibling present.
-        const body =
-          sessionsCalls <= 1
-            ? []
-            : [
-                {
-                  session_id: "ses_active",
-                  machine_id: "M",
-                  dir: cwd,
-                  port: 13381,
-                  title: "",
-                  topics: [],
-                  updated_at: Date.now(),
-                },
-                {
-                  session_id: "ses_idle",
-                  machine_id: "M",
-                  dir: cwd,
-                  port: 9,
-                  title: "Idle",
-                  topics: [],
-                  updated_at: Date.now(),
-                },
-              ];
-        return new Response(JSON.stringify(body), {
-          status: 200,
-          headers: { "Content-Type": "application/json" },
-        });
-      }
-      if (url.includes("/session/")) return new Response("not found", { status: 404 });
-      throw new Error("connection refused");
-    }) as typeof fetch;
-
-    let dispose: (() => void) | undefined;
-    try {
-      const pluginModule = await import("../server");
-      const hooks = await pluginModule.default({
-        serverUrl: new URL("http://127.0.0.1:13381/"),
-      } as never);
-      dispose = (hooks as { dispose?: () => void }).dispose;
-      await hooks.event({
-        event: {
-          type: "session.status",
-          properties: { sessionID: "ses_active", status: { type: "busy" } },
-        },
-      });
-      await new Promise((r) => setTimeout(r, 200));
-
-      expect(subscribed).toContain("ses_idle");
-    } finally {
-      dispose?.();
-      globalThis.fetch = originalFetch;
-      process.env.ENVOY_URL = originalEnvoyUrl;
-      if (originalHb === undefined) delete process.env.ENVOY_HEARTBEAT_MS;
-      else process.env.ENVOY_HEARTBEAT_MS = originalHb;
-    }
-  });
-});
-
 describe("invalid ENVOY_HEARTBEAT_MS falls back to the default (fix 6)", () => {
   it("does not hammer subscribe when the env value is negative", async () => {
     const originalEnvoyUrl = process.env.ENVOY_URL;
@@ -655,3 +483,152 @@ describe("tool.execute.after auto-subscribes the caller to dispatch threads (AC#
     expect(subscribed.length).toBe(0);
   });
 });
+
+// Several live processes can hold the same session (opencode session state is on
+// shared disk). Envoy arbitrates competing route claims by whether the claiming
+// process is DRIVING the session, so the plugin must report that honestly:
+// sessions that have run in this process are driven; siblings re-adopted after a
+// serve restart are recovery claims that must not displace a live driver.
+describe("claims report whether this process drives the session", () => {
+  it("marks sessions that have been busy in this process as driving", async () => {
+    const originalEnvoyUrl = process.env.ENVOY_URL;
+    process.env.ENVOY_URL = "http://127.0.0.1:59999";
+
+    const claims: { id: string; driving: unknown }[] = [];
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      if (url.includes("/v1/interests/subscribe") && init?.body) {
+        const body = JSON.parse(init.body as string);
+        claims.push({ id: body.session_id, driving: body.driving });
+        return new Response(JSON.stringify({ session_id: body.session_id, topics: [] }), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        });
+      }
+      if (url.includes("/v1/sessions")) {
+        return new Response(JSON.stringify([]), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        });
+      }
+      if (url.includes("/session/")) return new Response("not found", { status: 404 });
+      throw new Error("connection refused");
+    }) as typeof fetch;
+
+    let dispose: (() => void) | undefined;
+    try {
+      const pluginModule = await import("../server");
+      const hooks = await pluginModule.default({
+        serverUrl: new URL("http://127.0.0.1:13381/"),
+      } as never);
+      dispose = (hooks as { dispose?: () => void }).dispose;
+
+      await hooks.event({
+        event: {
+          type: "session.status",
+          properties: { sessionID: "ses_driven", status: { type: "busy" } },
+        },
+      });
+      await new Promise((r) => setTimeout(r, 30));
+
+      const own = claims.filter((c) => c.id === "ses_driven");
+      expect(own.length).toBeGreaterThan(0);
+      expect(own.every((c) => c.driving === true)).toBe(true);
+    } finally {
+      dispose?.();
+      globalThis.fetch = originalFetch;
+      process.env.ENVOY_URL = originalEnvoyUrl;
+    }
+  });
+});
+
+// Serve-restart recovery must not hijack sessions that a LIVE process still
+// serves. Because opencode session state is on shared disk and every `oc -s`
+// launch is its own process, a new process in a shared directory re-pointed
+// every sibling session's route at itself (observed: 231 sessions claimed by one
+// process in a single burst, then refreshed every 2 minutes). Envoy then
+// delivers there, and that process starts its own model loop on a session
+// another process owns — two loops, one transcript.
+//
+// A process may therefore claim ONLY sessions it has actually run. Keeping
+// idle-but-owned sessions reachable is the daemon's job (it knows the serve port
+// and the session IDs it dispatched), not something a stranger process may
+// arrange by adopting routes.
+describe("a process claims only sessions it has run", () => {
+  const runReadopt = async (siblingPortAlive: boolean) => {
+    const originalEnvoyUrl = process.env.ENVOY_URL;
+    process.env.ENVOY_URL = "http://127.0.0.1:59999";
+    const siblingPort = 34751;
+
+    const subscribed: string[] = [];
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      if (url.includes("/v1/interests/subscribe") && init?.body) {
+        const body = JSON.parse(init.body as string);
+        subscribed.push(body.session_id);
+        return new Response(JSON.stringify({ session_id: body.session_id, topics: [] }), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        });
+      }
+      if (url.includes("/v1/sessions")) {
+        return new Response(
+          JSON.stringify([
+            { session_id: "ses_self", machine_id: "m", dir: process.cwd(), port: 42145 },
+            {
+              session_id: "ses_sibling",
+              machine_id: "m",
+              dir: process.cwd(),
+              port: siblingPort,
+            },
+          ]),
+          { status: 200, headers: { "Content-Type": "application/json" } }
+        );
+      }
+      // Any liveness probe at all means readopt is still trying to adopt.
+      if (url.includes(`:${siblingPort}/`)) {
+        if (siblingPortAlive) {
+          return new Response(JSON.stringify({ healthy: true }), {
+            status: 200,
+            headers: { "Content-Type": "application/json" },
+          });
+        }
+        throw new Error("connection refused");
+      }
+      if (url.includes("/session/")) return new Response("not found", { status: 404 });
+      throw new Error("connection refused");
+    }) as typeof fetch;
+
+    let dispose: (() => void) | undefined;
+    try {
+      const pluginModule = await import("../server");
+      const hooks = await pluginModule.default({
+        serverUrl: new URL("http://127.0.0.1:13381/"),
+      } as never);
+      dispose = (hooks as { dispose?: () => void }).dispose;
+      await hooks.event({
+        event: {
+          type: "session.status",
+          properties: { sessionID: "ses_self", status: { type: "busy" } },
+        },
+      });
+      await new Promise((r) => setTimeout(r, 80));
+      return subscribed;
+    } finally {
+      dispose?.();
+      globalThis.fetch = originalFetch;
+      process.env.ENVOY_URL = originalEnvoyUrl;
+    }
+  };
+
+  it("never claims a sibling session, whether or not its serve is alive", async () => {
+    for (const siblingServeAlive of [true, false]) {
+      const subscribed = await runReadopt(siblingServeAlive);
+
+      expect(subscribed).toContain("ses_self");
+      expect(subscribed).not.toContain("ses_sibling");
+    }
+  });
+});

package/src/server.ts

@@ -29,9 +29,7 @@ export default async (input: { serverUrl: URL }) => {
   // refreshes the envoy_sessions TTL for ALL of them — a single serve hosts many
   // sessions, so tracking only the most-recently-active one lets idle siblings
   // expire out of the registry and become undeliverable.
-  const trackedSessions = new Map<string, { title: string | null }>();
-  // Guard so sibling re-adoption (after a serve restart) runs at most once.
-  let readoptDone = false;
+  const trackedSessions = new Map<string, { title: string | null; driving: boolean }>();
   /** Cached port — resolved asynchronously, null until first successful resolution. */
   let resolvedPort: number | null = null;
 
@@ -84,7 +82,16 @@ export default async (input: { serverUrl: URL }) => {
   // Fire an immediate async attempt (non-blocking)
   syncPort().catch(() => {});
 
-  const subscribeSession = (sessionID: string, title: string | null, port: number) =>
+  // driving = this process is the one running the session (it has gone busy
+  // here), as opposed to a sibling re-adopted from shared on-disk state after a
+  // serve restart. Envoy uses it to keep a live driver's route from being stolen
+  // by another process that merely holds the same session.
+  const subscribeSession = (
+    sessionID: string,
+    title: string | null,
+    port: number,
+    driving: boolean
+  ) =>
     call("/v1/interests/subscribe", {
       method: "POST",
       headers: { "Content-Type": "application/json" },
@@ -94,41 +101,20 @@ export default async (input: { serverUrl: URL }) => {
         topics: [`notifications.agent.${sessionID}`],
         port,
         title: title ?? "",
+        driving,
       }),
     }).catch(() => {});
 
-  // After a serve restart, sessions that were live in the previous serve instance
-  // do NOT re-register on their own (registration is gated on a session going
-  // busy), so an idle session waiting to RECEIVE a message silently falls out of
-  // the registry. Recover them once, on first activity: read the live registry and
-  // re-subscribe siblings that share this serve's machine + dir at the new port.
-  const readoptSiblings = async (selfSessionID: string) => {
-    if (readoptDone) return;
-    const port = currentPort();
-    if (!port) return;
-    try {
-      const res = await call("/v1/sessions");
-      const sessions = JSON.parse(res) as Array<{
-        session_id: string;
-        machine_id: string;
-        dir: string;
-        title?: string;
-      }>;
-      // Authoritative machine id for this serve = the listener-stamped machine of
-      // our own active session. Only adopt siblings that match it (and our dir) to
-      // avoid hijacking a same-path session that lives on another machine.
-      const self = sessions.find((s) => s.session_id === selfSessionID);
-      if (!self) return;
-      readoptDone = true;
-      for (const s of sessions) {
-        if (s.machine_id !== self.machine_id) continue;
-        if (s.dir !== cwd) continue;
-        if (trackedSessions.has(s.session_id)) continue;
-        trackedSessions.set(s.session_id, { title: s.title ?? null });
-        subscribeSession(s.session_id, s.title ?? null, port);
-      }
-    } catch {}
-  };
+  // A process registers ONLY the sessions it has actually run (see the busy
+  // handler below). It must never claim a route for a session it merely has
+  // loaded from shared on-disk state: doing so re-points that session's route
+  // here, envoy delivers here, and this process starts a second model loop on a
+  // session another process is driving.
+  //
+  // That means a session whose process is gone stays unreachable until it runs
+  // again. Keeping dispatched-but-idle workers reachable is the daemon's job — it
+  // knows the serve port and the session IDs it dispatched — not something a
+  // stranger process may arrange by adopting routes.
 
   // Heartbeat: re-subscribe every tracked session to refresh the envoy_sessions
   // TTL (5-min). Refreshes ALL sessions that have been busy in this serve, not
@@ -142,10 +128,8 @@ export default async (input: { serverUrl: URL }) => {
     const port = currentPort();
     if (!port) return;
     for (const [sessionID, info] of trackedSessions) {
-      subscribeSession(sessionID, info.title, port);
+      subscribeSession(sessionID, info.title, port, info.driving);
     }
-    // Retry sibling re-adoption until the registry shows our own session.
-    if (!readoptDone && activeSessionID) readoptSiblings(activeSessionID).catch(() => {});
   }, heartbeatMs);
   heartbeatInterval.unref?.();
 
@@ -187,7 +171,7 @@ export default async (input: { serverUrl: URL }) => {
           activeSessionID = sessionID;
           activeSessionTitle = null;
           if (!trackedSessions.has(sessionID)) {
-            trackedSessions.set(sessionID, { title: null });
+            trackedSessions.set(sessionID, { title: null, driving: true });
           }
           await syncPort();
           const port = currentPort();
@@ -198,24 +182,19 @@ export default async (input: { serverUrl: URL }) => {
             return t;
           });
           if (port) {
-            // Await so our own session is persisted in the registry before
-            // readoptSiblings reads it back (otherwise self may be absent and
-            // re-adoption would be skipped).
-            await subscribeSession(sessionID, activeSessionTitle, port);
+            await subscribeSession(sessionID, activeSessionTitle, port, true);
             // After the title arrives, send one follow-up subscribe with it.
             titlePromise.then((title) => {
               if (!title) return;
               // Update tracked metadata even if this session is no longer the
               // active one (another session may have become busy meanwhile).
               if (trackedSessions.has(sessionID)) {
-                trackedSessions.set(sessionID, { title });
-                subscribeSession(sessionID, title, currentPort() ?? 0);
+                const driving = trackedSessions.get(sessionID)?.driving ?? true;
+                trackedSessions.set(sessionID, { title, driving });
+                subscribeSession(sessionID, title, currentPort() ?? 0, driving);
               }
               if (activeSessionID === sessionID) activeSessionTitle = title;
             });
-            // Recover idle siblings orphaned by a serve restart (retries from the
-            // heartbeat until the registry shows our own session).
-            readoptSiblings(sessionID).catch(() => {});
           }
         }
       }
@@ -263,6 +242,8 @@ export default async (input: { serverUrl: URL }) => {
             topics: [topic],
             port: currentPort() ?? 0,
             title: activeSessionTitle ?? "",
+            // A tool call runs in this process, so it is the driving holder.
+            driving: true,
           }),
         });
       } catch (err) {
@@ -298,6 +279,7 @@ export default async (input: { serverUrl: URL }) => {
               topics: args.topics,
               port: currentPort() ?? 0,
               title: activeSessionTitle ?? "",
+              driving: true,
             }),
           });
         },