@yeaft/webchat-agent 0.1.734 → 0.1.738

package/unify/web-bridge.js

@@ -50,9 +50,8 @@ import {
   compactHistory,
   trimSnapshotForBudget,
 } from './history-compact.js';
-import { createFeatureArc } from './feature-arc.js';
-import { getFeatureStore } from './tools/feature-tools.js';
 import { persistUnifyAttachments, attachmentsForPersistence } from './attachments.js';
+import { parseSeqFromId } from './conversation/persist.js';
 
 /** @type {import('./session.js').Session | null} */
 let session = null;
@@ -193,6 +192,42 @@ export function broadcastLanguageChange(language) {
 /** Query timeout in ms — abort if LLM doesn't respond within this window */
 const QUERY_TIMEOUT_MS = 120_000;
 
+/**
+ * Secondary watchdog grace period (ms).
+ *
+ * After {@link QUERY_TIMEOUT_MS} of silence the per-VP `vpAbort` is fired.
+ * That's enough on its own when adapters / tools cooperate with the
+ * AbortSignal — the engine throws `AbortError`, runVpTurn's catch emits
+ * `result{stopped:true}`, the driver `finally` emits `vp_typing_end`, and
+ * the user is unstuck.
+ *
+ * If a tool ignores `signal` and never resolves, the engine generator's
+ * `await tool.execute(...)` is permanently blocked: the abort fires on a
+ * controller it never observes, and runVpTurn never returns. The same
+ * applies to an adapter `stream()` that ignores `signal` (e.g. a stuck
+ * SSE connection) or to tools that legitimately opt out of the per-tool
+ * timeout via `timeoutMs <= 0`. The per-tool timeout in
+ * {@link import('./tools/registry.js').DEFAULT_TOOL_TIMEOUT_MS}
+ * is the primary cure for the tool-ignore-signal case; this bridge-level
+ * escalation strictly extends it to cover the adapter and opt-out cases.
+ * Without a second-stage escalation the typing dots hang forever —
+ * exactly the "halts mid-execution with no turn_end" symptom.
+ *
+ * The driver loop wraps `await runVpTurn(...)` in a Promise.race against
+ * this grace-window timer. If runVpTurn doesn't return within
+ * QUERY_TIMEOUT_MS + ESCALATE_AFTER_ABORT_MS, the driver forces its
+ * `finally` block (vp_typing_end + group_message), emits a synthetic
+ * `result{stopped:true}` so the frontend leaves its in-flight state,
+ * and moves on. The hung tool promise leaks (JS lacks cooperative
+ * promise cancellation) but the user-facing turn is closed.
+ *
+ * 15s is wide enough that legitimate "abort took a moment to propagate"
+ * paths (network teardown, finally cleanup) finish first; tight enough
+ * that a truly stuck tool doesn't stretch the user-visible stall to
+ * minutes.
+ */
+const ESCALATE_AFTER_ABORT_MS = 15_000;
+
 /** Virtual conversationId for the Unify session */
 let unifyConversationId = null;
 
@@ -423,7 +458,7 @@ function ensureDriverRunning(groupId, vpId) {
       } catch { /* never crash WS pipeline */ }
 
       try {
-        await runVpTurn({
+        await runVpTurnWithEscalation({
           prompt,
           promptParts,
           groupId,
@@ -909,15 +944,18 @@ export function installUnifyRuntimeBridge(s) {
  */
 function handleEngineEvent(event, hctx) {
   hctx.resetQueryTimer();
-  // featureId may have just been published mid-turn by the FeatureArc
-  // (the arc's observeEvent runs before this dispatch); pull it fresh
-  // so the wire envelope tags every subsequent emit with the right id.
-  const featureId = typeof hctx.getFeatureId === 'function' ? hctx.getFeatureId() : null;
+  // Sub-agent events may carry their own `featureId` (stamped by the
+  // sub-agent runner from the parent's inbound feature scope). Plain
+  // VP-turn events have no featureId — auto-feature creation was
+  // removed when Track-A / FeatureArc was deleted (2026-05-08).
+  const eventFeatureId = typeof event === 'object' && event && typeof event.featureId === 'string'
+    ? event.featureId
+    : null;
   const envelope = {
     groupId: hctx.groupId,
     vpId: hctx.vpId,
     turnId: hctx.turnId,
-    ...(featureId ? { featureId } : {}),
+    ...(eventFeatureId ? { featureId: eventFeatureId } : {}),
   };
 
   switch (event.type) {
@@ -1671,6 +1709,94 @@ async function ensureSessionLoaded() {
   sendGroupSnapshotBroadcast();
 }
 
+/**
+ * Wrap {@link runVpTurn} with a hard escalation deadline.
+ *
+ * The first-line defense is the in-turn watchdog inside runVpTurn: at
+ * {@link QUERY_TIMEOUT_MS} of silence it calls `vpAbort.abort()`. When
+ * adapters and tools cooperate with AbortSignal that's enough — the
+ * engine throws AbortError, the catch handler emits `result{stopped:true}`,
+ * and the driver's `finally` emits `vp_typing_end`.
+ *
+ * This wrapper is the second-line defense for the "tool ignores signal"
+ * failure mode. If runVpTurn doesn't return within
+ * QUERY_TIMEOUT_MS + ESCALATE_AFTER_ABORT_MS we synthesize a clean exit:
+ * emit a synthetic `result{stopped:true}` so the frontend leaves its
+ * in-flight state, log loudly so operators know a tool is stuck, and
+ * resolve. The hung promise leaks (the engine generator is permanently
+ * blocked on a tool that ignores cancellation) but the user-facing turn
+ * is closed and the next message can flow. Resolving the wrapper is
+ * preferred over rejecting because the driver's catch already logs a
+ * warning — we want a single, unambiguous "watchdog escalated" line in
+ * the log instead of layered noise.
+ *
+ * Tool-level timeouts (see registry.js DEFAULT_TOOL_TIMEOUT_MS) are the
+ * real cure: this wrapper should rarely fire because no tool should be
+ * able to block longer than its budget. It exists as belt-and-suspenders
+ * for tools that legitimately disable timeouts (long-running internal
+ * helpers) or for adapter implementations that ignore signal.
+ */
+async function runVpTurnWithEscalation(args) {
+  const { groupId, vpId, turnId } = args;
+  const deadlineMs = QUERY_TIMEOUT_MS + ESCALATE_AFTER_ABORT_MS;
+  await raceWithEscalation(runVpTurn(args), {
+    deadlineMs,
+    onEscalate: () => {
+      console.error(
+        `[Unify] runVpTurn watchdog escalation: VP ${vpId} did not return ${deadlineMs}ms after enqueue — emitting synthetic stop and unblocking driver`,
+      );
+      try {
+        sendUnifyOutput(
+          { type: 'result', result_text: '', stopped: true },
+          { groupId, vpId, turnId },
+        );
+      } catch { /* never crash WS pipeline */ }
+    },
+  });
+}
+
+/**
+ * Race `inner` against a deadline timer. If `inner` resolves/rejects first,
+ * the timer is cleared and the result of `inner` is returned. If the timer
+ * wins, `onEscalate` is called and the wrapper resolves cleanly — the inner
+ * promise is left dangling (JS has no promise cancellation) but the caller
+ * is unblocked.
+ *
+ * `onEscalate` MUST be synchronous. We swallow synchronous throws so a
+ * torn-down WS pipeline can't crash the watchdog, but a Promise rejection
+ * from an async `onEscalate` would leak past this `catch`.
+ *
+ * Pure helper, no module-level state, exported as `__testRaceWithEscalation`
+ * so the contract can be unit-tested in isolation. Inner errors propagate
+ * (a tool that throws still surfaces through `runVpTurn`'s normal catch).
+ *
+ * @template T
+ * @param {Promise<T>} inner
+ * @param {{ deadlineMs: number, onEscalate: () => void }} opts
+ * @returns {Promise<T|void>}
+ */
+async function raceWithEscalation(inner, { deadlineMs, onEscalate }) {
+  let escalateTimer = null;
+  const escalation = new Promise((resolve) => {
+    escalateTimer = setTimeout(() => {
+      try { onEscalate(); } catch { /* never throw out of the watchdog */ }
+      resolve();
+    }, deadlineMs);
+    // `unref()` lets a pending escalation timer not hold the Node event
+    // loop open (e.g. during graceful shutdown). Browsers / non-Node
+    // runtimes don't expose it, hence the typeof guard. Node's own
+    // `Timeout.unref()` does not throw, so no try/catch is needed.
+    if (escalateTimer && typeof escalateTimer.unref === 'function') {
+      escalateTimer.unref();
+    }
+  });
+  try {
+    return await Promise.race([inner, escalation]);
+  } finally {
+    clearTimeout(escalateTimer);
+  }
+}
+
 /**
  * Run a single VP's turn: call engine.query() with the supplied prompt and
  * coordinator-bound router, stream events to the frontend, and append the
@@ -1696,11 +1822,6 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, turnId, en
   if (!prompt?.trim()) return;
 
   const envelope = { groupId, vpId, turnId };
-  // Arc is declared at outer-try scope so the catch / finally branches
-  // below can call `arc.finalize({status:'aborted'|'error'})` after a
-  // throw escaping the inner try. It's null until the inner try
-  // populates it; all catch-side calls guard with `arc?.finalize?.`.
-  let arc = null;
 
   try {
     if (session?.dreamScheduler) {
@@ -1726,12 +1847,6 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, turnId, en
       const assistantTextParts = [];
       const toolCallsAccum = [];
       const toolResultsAccum = [];
-      // PR-4 (review fix): hoist `vpEngine` so the `finally` can clear
-      // the per-turn featureId accessor on the SAME engine instance
-      // we installed it on — even if the VP was kicked or its group
-      // deleted mid-turn (both code paths call `vpEngines.delete(...)`).
-      // Calling `getOrCreateVpEngine` again from `finally` would
-      // resurrect a zombie engine for a VP that no longer exists.
       let vpEngine = null;
 
       // task-707: per-VP engine + persistent group coord. The coord is
@@ -1748,74 +1863,7 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, turnId, en
         envelope: inboundEnvelope,
       });
 
-      // ── Dual-track feature arc ──
-      // Track A (quick-response) runs concurrently against the same
-      // primary model with a non-looping single call; its preview is
-      // surfaced to the user immediately via `quick_preview` so they
-      // see *something* within ~1s. Three signals (Track A intent,
-      // ≥3 engine loops, key tool call) auto-create a Feature record
-      // and the wire envelope starts tagging emits with `featureId`,
-      // letting the frontend fold subsequent messages into a pill.
-      arc = createFeatureArc({
-        adapter: session?.adapter || null,
-        model: session?.config?.model || null,
-        featureStore: getFeatureStore(),
-        prompt,
-        vpId,
-        groupId: groupId || null,
-        turnId,
-        vpDisplayName: queryOpts?.vpPersona?.displayName || vpId,
-        language: session?.config?.language || 'en',
-        signal: vpAbort.signal,
-        emit: {
-          quickPreview: ({ intent, preview }) => {
-            sendUnifyEvent({
-              type: 'quick_preview',
-              intent,
-              preview,
-              vpId,
-              turnId,
-            }, envelope);
-          },
-          featureStarted: ({ featureId, title, trigger, toolName }) => {
-            sendUnifyEvent({
-              type: 'feature_started',
-              featureId,
-              title,
-              trigger,         // 'quick' | 'turns' | 'tool'
-              toolName: toolName || null,
-              vpId,
-              turnId,
-            }, { ...envelope, featureId });
-          },
-          featureCompleted: ({ featureId, summary, status }) => {
-            sendUnifyEvent({
-              type: 'feature_completed',
-              featureId,
-              summary,
-              status,            // 'completed' | 'aborted' | 'error'
-              vpId,
-              turnId,
-            }, { ...envelope, featureId });
-          },
-        },
-      });
-      // Fire-and-forget — Track A produces its preview / decision when
-      // ready; the main engine loop must not be held back waiting for it.
-      arc.startTrackA();
-
-      // PR-4: let sub-agents spawned during this turn inherit the
-      // parent's active featureId. Read lazily inside the engine's
-      // parentEngineDeps so a feature that opens AFTER a sub-agent
-      // spawns still tags the sub-agent's later events. Cleared in the
-      // `finally` below so a stale `arc` reference doesn't leak into
-      // the next turn.
       vpEngine = getOrCreateVpEngine(groupId, vpId);
-      if (typeof vpEngine.setCurrentFeatureIdAccessor === 'function') {
-        vpEngine.setCurrentFeatureIdAccessor(() => {
-          try { return arc?.getFeatureId?.() || null; } catch { return null; }
-        });
-      }
 
       const handlerCtx = {
         assistantTextParts,
@@ -1825,9 +1873,6 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, turnId, en
         groupId,
         vpId,
         turnId,
-        // Lets handleEngineEvent stamp the latest featureId on each
-        // outgoing envelope; the arc may publish it mid-turn.
-        getFeatureId: () => arc.getFeatureId(),
       };
       // Always trim the snapshot before passing to engine.query. This is
       // the second-line defense (history-compact only fires above 30K
@@ -1852,26 +1897,12 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, turnId, en
         ...queryOpts,
       })) {
         resetQueryTimer();
-        // Arc observes BEFORE dispatch so featureId (if just published)
-        // is available when handleEngineEvent stamps the envelope.
-        try { arc.observeEvent(event); } catch (err) {
-          console.warn('[FeatureArc] observe failed:', err?.message || err);
-        }
         handleEngineEvent(event, handlerCtx);
       }
 
       // Turn completed — atomically append this VP's output to shared history.
       appendTurnToHistory(prompt, assistantTextParts, toolCallsAccum, toolResultsAccum);
 
-      // Close the arc: if a feature was opened during the turn, run the
-      // summary call and write status='completed' back to FeatureStore.
-      // Awaited so the `feature_completed` event reaches the frontend
-      // before the final 'result' bubble (UI ordering matters: the pill
-      // should reach its done state before the turn is marked done).
-      try { await arc.finalize({ status: 'completed' }); } catch (err) {
-        console.warn('[FeatureArc] finalize failed:', err?.message || err);
-      }
-
       sendUnifyOutput({
         type: 'assistant',
         message: { content: [] },
@@ -1882,25 +1913,10 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, turnId, en
       }, envelope);
     } finally {
       if (queryTimer) clearTimeout(queryTimer);
-      // PR-4 (review fix): clear the accessor on the SAME engine
-      // instance we installed it on. Reusing the captured reference
-      // (instead of calling getOrCreateVpEngine again) avoids
-      // resurrecting a zombie engine if the VP/group was torn down
-      // mid-turn. `vpEngine` is null only when the install path threw
-      // before the engine lookup (very early failure) — in that case
-      // there's nothing to clear.
-      try {
-        if (vpEngine && typeof vpEngine.setCurrentFeatureIdAccessor === 'function') {
-          vpEngine.setCurrentFeatureIdAccessor(null);
-        }
-      } catch { /* best-effort */ }
     }
   } catch (err) {
     const isAbort = err && (err.name === 'AbortError' || err.name === 'LLMAbortError');
     if (isAbort) {
-      // Best-effort close: mark the feature aborted so the frontend pill
-      // settles into the right terminal state instead of staying active.
-      try { await arc?.finalize?.({ status: 'aborted' }); } catch { /* ignore */ }
       sendUnifyOutput({
         type: 'result',
         result_text: '',
@@ -1910,7 +1926,6 @@ async function runVpTurn({ prompt, promptParts = null, groupId, vpId, turnId, en
     }
 
     console.error('[Unify] query error:', err);
-    try { await arc?.finalize?.({ status: 'error' }); } catch { /* ignore */ }
 
     if (isPermissionErrorMsg(err.message)) {
       if (!_permissionDiagnosticSent) {
@@ -2321,6 +2336,13 @@ export function __testGetRegisteredThreadIds() {
   return currentAbortCtrl && !currentAbortCtrl.signal.aborted ? ['main'] : [];
 }
 
+/**
+ * Test-only: expose the bridge-level escalation helper. Lets tests verify
+ * the "tool ignored signal → wrapper escalates" contract without booting a
+ * full session. See `test/agent/unify/web-bridge-escalation.test.js`.
+ */
+export const __testRaceWithEscalation = raceWithEscalation;
+
 /**
  * Manual dream trigger from VP detail page.
  */
@@ -2594,6 +2616,32 @@ export async function handleUnifyLoadHistory(msg) {
     }
   }
 
+  // Compute the pagination cursor for the bootstrap load so the frontend
+  // knows whether a "Load older messages" hint should be shown and where
+  // to start the next page. The cursor is the seq of the oldest replayed
+  // message; `hasMore` is true iff there's an earlier message in the
+  // group that we did NOT replay.
+  let hasMore = false;
+  let oldestSeq = null;
+  if (groupId && messages.length > 0) {
+    const firstId = messages[0].id;
+    const seq = parseSeqFromId(firstId);
+    // Defend against malformed ids: a NaN cursor would round-trip back as
+    // a poison `beforeSeq` and degrade subsequent paginations to "give me
+    // the newest page again". Surface as null instead.
+    oldestSeq = Number.isFinite(seq) ? seq : null;
+    if (oldestSeq != null) {
+      // Consult the store for whether anything older exists in the same
+      // group. Cheap: a single extra `loadOlderByGroup` with turns=1.
+      try {
+        const probe = session.conversationStore.loadOlderByGroup(groupId, oldestSeq, 1);
+        hasMore = probe.messages.length > 0;
+      } catch (err) {
+        console.error('[Unify] history-load probe failed:', err.message);
+      }
+    }
+  }
+
   sendUnifyEvent({
     type: 'history_loaded',
     count: messages.length,
@@ -2601,6 +2649,71 @@ export async function handleUnifyLoadHistory(msg) {
     totalHot: session.conversationStore.countHot(),
     totalCold: session.conversationStore.countCold(),
     groupId,
+    hasMore,
+    oldestSeq,
+  });
+}
+
+/**
+ * Handle a "load older messages" pagination request. Reads `turns` more
+ * turns of history strictly older than `beforeSeq` for `groupId`, and
+ * emits them in a single `unify_history_chunk` envelope (NOT a
+ * `unify_output` — that pipeline appends, but the frontend needs to
+ * PREPEND these older messages above what it already has).
+ *
+ * Tool replay is NOT included in this PR — same projection as
+ * `handleUnifyLoadHistory` (user / assistant text only). On any internal
+ * failure we still emit an empty chunk so the spinner clears.
+ *
+ * @param {object} msg — { groupId, beforeSeq, turns }
+ */
+export async function handleUnifyLoadMoreHistory(msg) {
+  const groupId = (msg && typeof msg.groupId === 'string' && msg.groupId) || null;
+  const emit = (payload) => sendToServer({
+    type: 'unify_history_chunk',
+    conversationId: unifyConversationId,
+    groupId,
+    ...payload,
+  });
+
+  if (!session || !groupId) {
+    emit({ messages: [], oldestSeq: null, hasMore: false });
+    return;
+  }
+
+  const beforeSeq = (typeof msg.beforeSeq === 'number') ? msg.beforeSeq : null;
+  const turns = (typeof msg.turns === 'number' && msg.turns > 0) ? msg.turns : 20;
+
+  let result;
+  try {
+    result = session.conversationStore.loadOlderByGroup(groupId, beforeSeq, turns);
+  } catch (err) {
+    console.error('[Unify] loadOlderByGroup failed:', err.message);
+    result = { messages: [], oldestSeq: null, hasMore: false };
+  }
+
+  // Wire shape mirrors handleUnifyLoadHistory's projection: only user /
+  // assistant text rows. Tool_use / tool_result replay is out of scope
+  // for this PR (today's bootstrap path drops them too).
+  //
+  // We intentionally do NOT ship `id` or `time` over the wire:
+  // `handleUnifyHistoryChunk` reads only role / content / groupId. The
+  // pagination cursor (`oldestSeq`) is sent once at the envelope level,
+  // so per-row ids are dead weight. `time` would be useful if we render
+  // "5 days ago" stamps on older history rows — when that ships, add it
+  // back here and consume it in conversationHandler.
+  const projected = (result.messages || [])
+    .filter(m => m && (m.role === 'user' || m.role === 'assistant'))
+    .map(m => ({
+      role: m.role,
+      content: m.content,
+      groupId: m.groupId || null,
+    }));
+
+  emit({
+    messages: projected,
+    oldestSeq: result.oldestSeq,
+    hasMore: !!result.hasMore,
   });
 }