@ssheleg/agent-sync 1.19.0 → 1.19.2

package/CHANGELOG.md

@@ -1,3 +1,60 @@
+## [1.19.2] - 2026-09-04
+
+### Fixed
+
+- **An expired foreign lease printed at every SessionStart for ever, and the block it sat
+  in stopped being read.** Measured on the machine that filed the issue: sixteen expired
+  leases, none newer than two days, the oldest **thirteen days old** — six printed in full
+  plus *"… and 11 more"*, identically, every session for a fortnight. None of it was
+  actionable: a foreign lease is reported and deliberately never touched, so the operator
+  could not clear a single line of it. A block reprinted verbatim is a block an operator
+  learns to skim, **including the lines that would have mattered**.
+
+  Age splits the list now. A lease expired inside `STALE_DETAIL_SECONDS` (24h) may still
+  mean a run is in trouble and keeps its own line; anything older collapses into **one**
+  summary — which still **names the keys**, because a summary that hides which leases are
+  stuck replaces noise with a different uselessness. Sixteen lines became one.
+
+  Watched failing before it shipped: with the split removed the new check reports
+  *"6 ancient lease(s) still print a line each"* and *"nine ancient leases produced no
+  summary line at all, so they vanished"* — the second assertion exists because collapsing
+  and hiding are one edit apart.
+
+## v1.19.1 — re-acquiring your own lease now refreshes it
+
+**`renew` was fixed for exactly this and `acquire` was not, in the same file.**
+`_refresh_lease`'s docstring records the bug it exists to have fixed: *"`renew`
+appended `op=renew` to the RECORD plane — which has not decided a lease since 1.0.0 —
+and touched a throttle file. The lock's own `ts` was written once, by `acquire`. So a
+run holding a lease lost it at TTL while still working."* The repair landed in `renew`.
+The own-lock branch of `acquire` kept doing precisely what that paragraph describes.
+
+**Two harms, and the second is the one that bites.** The lock stayed expired, so
+`classify_lock` read it as spent and another run's `acquire` took it over while this one
+believed it held — measured 2026-09-01: a foreign expired lock IS taken over, timestamp
+and host rewritten. And `_touch_renew` resets the marker `renew()` throttles on, so a
+re-acquire **actively suppressed the next real refresh** while refreshing nothing
+itself. That is the mechanism behind a lease expiring three times in one run against a
+450-step CI job.
+
+Measured before and after, on a lock aged past its own TTL:
+
+```
+old: won mykey (…)   ts after re-acquire: 2026-08-29T20:59:04Z   still expired
+new: won mykey (…)   ts after re-acquire: 2026-09-01T12:38:48Z
+```
+
+`check_acquire_refreshes_its_own_lease` is beside `check_renew_extends_the_lease`,
+watched failing against the previous commit with both of its assertions.
+
+**One finding retracted in the same run, and it belongs here.** `reap` refuses to clear
+a lock three days past a forty-five-minute TTL when this run's identity is the shared
+fallback, and that reads like a deadlock. It is not: `acquire` takes over an expired
+lock regardless of who wrote it — measured, timestamp and host rewritten — so the
+expired lock blocks nothing, and `reap`'s stricter bar for a *tidying* operation is
+correct as designed. The claim that expiry alone should license a delete was wrong
+about which operation matters.
+
 ## v1.19.0 — the skill now promises the finish it has always performed
 
 Wave-4 close-out of the 2026-08-29 family audit (ASY-10), filed by this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/agent-sync",
-  "version": "1.19.0",
+  "version": "1.19.2",
   "description": "Let concurrent coding agents share one project without colliding — leases with TTL, race-free id reservation, a run journal and a generated board, over a pluggable knowledge cloud.",
   "bin": {
     "agent-sync": "bin/agent-sync.js"

package/plugins/agent-sync/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "agent-sync",
   "displayName": "Agent Sync",
-  "version": "1.19.0",
+  "version": "1.19.2",
   "description": "Coordination layer for multi-agent repositories — leases with TTL, race-free ID reservation, a run journal, a cross-repo signal feed and a generated board, over a pluggable knowledge cloud.",
   "author": {
     "name": "ssheleg",

package/plugins/agent-sync/skills/agent-sync/SKILL.md

@@ -4,7 +4,7 @@ description: "Use when several coding agents work one repository at the same tim
 compatibility: "Requires the task-pipeline skill for its stages (npx sshlg-skills install). Needs python3 3.9+ (stdlib only, HTTP included - nothing to pip install) and bash for the hooks. The knowledge backend is configured per project; with none configured it degrades to git-file leases. Enforcement hooks are Claude Code only - on other agents the same checks run as a self-check."
 license: MIT
 metadata:
-  version: "1.19.0"
+  version: "1.19.2"
   author: ssheleg
 ---
 

package/plugins/agent-sync/skills/agent-sync/scripts/agent_sync.py

@@ -33,11 +33,16 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
-VERSION = "1.19.0"
+VERSION = "1.19.2"
 
 CONFIG_PATH = Path(".claude/agent-sync.json")
 ENV_FILE = Path(".env.agent-sync")
 STATE_DIR = Path(".agent-sync")
+# How recent an expired lease has to be to earn a line of its own. Anything older
+# collapses into one summary that still names the keys. Twenty-four hours is chosen
+# because it is the span in which an expired lease can still mean "a run is in
+# trouble"; beyond it, it means "somebody's machine was closed".
+STALE_DETAIL_SECONDS = 24 * 60 * 60
 GENERATED_MARKER = "<!-- agent-sync:generated"
 MERGE_LOG_MARKER = "<!-- agent-sync:merge-log -->"
 DEFAULT_MERGE_LOG = "docs/MERGES.md"
@@ -1646,6 +1651,21 @@ class Sync:
             except (json.JSONDecodeError, OSError):
                 held = {}
             if held.get("run") == self.rid:
+                # MOVE THE LOCK'S OWN `ts`, not just the throttle marker. This branch did
+                # exactly what `_refresh_lease`'s docstring describes as the bug it exists
+                # to have fixed — touch the throttle file and leave the timestamp the lease
+                # is arbitrated by — and the repair landed in `renew` and not here, in the
+                # same file, four minor versions ago.
+                #
+                # Two harms, and the second is the one that bites. The lock stayed expired,
+                # so `classify_lock` read it as spent and another run's `acquire` took it
+                # over while this one believed it held (measured 2026-09-01: a foreign
+                # expired lock IS taken over, timestamp and host rewritten). And
+                # `_touch_renew` resets the marker `renew()` throttles on — so a re-acquire
+                # actively SUPPRESSED the next real refresh, refreshing nothing itself.
+                # That is the mechanism behind a lease expiring three times in one run
+                # against a 450-step CI job on 2026-09-01.
+                self._refresh_lease(key)
                 self._touch_renew()
                 return True, self.rid
             if time.time() <= parse_iso(held.get("ts", "")) + int(held.get("ttl", self.ttl)):
@@ -3377,10 +3397,29 @@ def cmd_status(_args: argparse.Namespace) -> int:
               f"{len(left_alone)} left alone")
         print("\n  Expired leases still on disk. Nobody holds these: the TTL ended the "
               "lease\n  and left the file.")
-        for e in stale[:6]:
+        # Age splits the list, because age is what decides whether a line is news.
+        # A lease that expired an hour ago may still be a run in trouble; one that
+        # expired thirteen days ago is residue nobody will ever clear, and printing
+        # it in full at every SessionStart is how an operator learns to skim the
+        # whole block — including the recent lines that mattered. Measured on the
+        # machine that filed this: sixteen entries, none newer than two days, the
+        # oldest thirteen days old, printed identically every session for a fortnight.
+        fresh = [e for e in stale
+                 if e.get("expired_for") is not None and e["expired_for"] < STALE_DETAIL_SECONDS]
+        old_ones = [e for e in stale if e not in fresh]
+        for e in fresh[:6]:
             print(f"    · {e['key']}  [{e['state']}] {e['why']} ({spent(e)})")
-        if len(stale) > 6:
-            print(f"    · … and {len(stale) - 6} more — agent_sync.py residue")
+        if len(fresh) > 6:
+            print(f"    · … and {len(fresh) - 6} more expired in the last "
+                  f"{since(STALE_DETAIL_SECONDS)}")
+        if old_ones:
+            # One line, and it still names them: a summary that hides WHICH keys
+            # cannot be acted on, and the point of collapsing is to keep the block
+            # readable rather than to stop reporting.
+            keys = ", ".join(e["key"] for e in old_ones[:8])
+            more = f", +{len(old_ones) - 8} more" if len(old_ones) > 8 else ""
+            print(f"    · {len(old_ones)} expired over {since(STALE_DETAIL_SECONDS)} ago "
+                  f"— {keys}{more}")
         if reapable:
             print("    Clear what this run owns:  agent_sync.py reap")
         if left_alone: