@zgeoff/atc 2.14.0 → 2.15.1

package/src/daemon/sessions.ts

@@ -1,21 +1,25 @@
 import { writeFileSync } from 'node:fs';
 import type {
-  AdapterEvent,
   AgentAdapter,
-  AgentID,
   SpawnOptions,
   SpawnOverrides,
   SpawnPlan,
 } from '../agents/agent-adapter';
-import { truncateDetail } from '../agents/truncate-detail';
+import type { AdapterEvent } from '../protocol/adapter-event';
+import { countSessionStates } from '../protocol/count-session-states';
 import { DaemonError } from '../protocol/daemon-error';
+import type { HookEvent } from '../protocol/hook-event';
 import type { ErrorCode } from '../protocol/protocol';
+import type { SessionState } from '../protocol/session-state';
+import { sortSessionViews } from '../protocol/sort-session-views';
+import type { AgentID } from '../shared/agent-id';
 import type { AgentSessionID } from '../shared/agent-session-id';
 import type { TargetConfigError } from '../shared/collect-targets';
 import { socketPath, statusFile } from '../shared/config';
 import type { DaemonID } from '../shared/daemon-id';
 import { resolveRepoRoot } from '../shared/resolve-repo-root';
 import type { SessionID } from '../shared/session-id';
+import { truncateDetail } from '../shared/truncate-detail';
 import { truncateToBytes } from '../shared/truncate-to-bytes';
 import type { FleetEntry, FleetEntryUpdate, FleetStore } from '../store/fleet-entry';
 import type { SessionWorkspace } from '../store/workspace-materialization';
@@ -31,14 +35,11 @@ import type {
   HarnessRelay,
 } from './execution-provider';
 import { findExecutionRefusal } from './find-execution-refusal';
-import type { HookEvent } from './hooks';
 import type { BridgeBinding } from './is-binding-current';
 import { LocalPTYProvider } from './local-pty-provider';
 import { mintSessionID } from './mint-session-id';
 import { pickSessionState } from './pick-session-state';
 
-export type SessionState = 'running' | 'needs_you' | 'done' | 'exited';
-
 export type SessionEventKind = 'added' | 'state' | 'renamed' | 'removed';
 
 // The over-the-wire view of a session: everything but the harness handle,
@@ -181,6 +182,10 @@ interface MaterializedSpawn {
 // stored identity ran on.
 const LOCAL_TARGET_IDENTITY = buildTargetIdentity('local-pty', {});
 
+// How long a failed spawn's rollback waits for the killed process to exit,
+// once after its kill and once more after a forced kill.
+const FAILED_SPAWN_EXIT_WAIT_MS = 2000;
+
 // The target a session runs on and the identity it is bound to there; null
 // binds a new session to the target as it stands now.
 interface TargetBinding {
@@ -232,6 +237,17 @@ export class SessionManager {
   // of the same session does not start a second harness.
   private readonly adopting = new Set<SessionID>();
 
+  // Sessions dropped from the list on purpose whose rows the next fleet
+  // write deletes; each stays here until a write carrying it lands.
+  private readonly removedIDs = new Set<SessionID>();
+
+  // Failed spawns whose rollback is running, and those whose killed process
+  // it could not confirm gone, each with the harness it ran in, so no revive
+  // starts a second harness while the first may still run.
+  private readonly rollingBack = new Set<SessionID>();
+
+  private readonly unconfirmedKills = new Map<SessionID, HarnessHandle>();
+
   // The epoch the next harness start or attach takes, unique across every
   // session this manager holds.
   private nextBridgeEpoch = 1;
@@ -471,6 +487,12 @@ export class SessionManager {
       return null;
     }
 
+    const settled = await this.isRollbackSettled(id);
+
+    if (!settled) {
+      return null;
+    }
+
     const adapter = this.findAdapter(s.agent);
 
     if (adapter === null) {
@@ -494,8 +516,14 @@ export class SessionManager {
       this.adopting.delete(id);
     }
 
-    // A kill or a second adopt can land while the host wakes.
-    if (s.pty !== null || !this.sessions.includes(s)) {
+    // A kill, a second adopt, or a failed spawn's rollback can land while
+    // the host wakes.
+    if (
+      s.pty !== null ||
+      !this.sessions.includes(s) ||
+      this.rollingBack.has(id) ||
+      this.unconfirmedKills.has(id)
+    ) {
       return null;
     }
 
@@ -889,8 +917,11 @@ export class SessionManager {
 
   // Takes back a spawn that failed after its process started: the process
   // dies and the session leaves the list and the fleet, so the spawn leaves
-  // nothing behind. It resolves only once the fleet without the session is
-  // durable, and throws when the kill or that write fails. A session that
+  // nothing behind. It resolves only once the process has exited and the
+  // fleet without the session is durable, and throws when the kill, the
+  // exit, or that write cannot be confirmed. A session whose exit is not
+  // confirmed stays listed, so the spawn's caller can still find it, and
+  // no revive starts it until its process is found gone. A session that
   // never registered is left alone.
   async removeFailedSpawn(id: SessionID): Promise<void> {
     const s = this.sessions.find((x) => x.id === id);
@@ -899,13 +930,87 @@ export class SessionManager {
       return;
     }
 
-    s.pty?.kill();
-    s.pty = null;
+    const pty = s.pty;
 
-    this.remove(s);
-    this.emitChange();
+    this.rollingBack.add(id);
 
-    await this.writeFleet();
+    try {
+      if (pty !== null) {
+        await this.killFailedSpawn(id, pty);
+      }
+
+      // A harness other than the killed one would outlive the rollback.
+      if (s.pty !== null && s.pty !== pty) {
+        throw new Error(`session ${id} started another harness while its spawn rolled back`);
+      }
+
+      s.pty = null;
+
+      this.remove(s);
+      this.emitChange();
+
+      await this.writeFleet();
+    } finally {
+      this.rollingBack.delete(id);
+    }
+  }
+
+  // Kills a failed spawn's harness and waits for its exit. A kill that
+  // throws or an exit it cannot confirm leaves the harness recorded as
+  // possibly running, which blocks revives of the session.
+  private async killFailedSpawn(id: SessionID, pty: HarnessHandle): Promise<void> {
+    this.unconfirmedKills.set(id, pty);
+    pty.kill();
+
+    const exited = await this.waitForKilledExit(pty);
+
+    if (!exited) {
+      throw new Error(`session ${id} did not exit after its kill`);
+    }
+
+    this.unconfirmedKills.delete(id);
+  }
+
+  // Waits for a killed harness to exit, ending it with a signal it cannot
+  // ignore when the first wait runs out and its provider can send one.
+  private async waitForKilledExit(pty: HarnessHandle): Promise<boolean> {
+    const exited = await pty.waitForExit(FAILED_SPAWN_EXIT_WAIT_MS);
+
+    if (exited) {
+      return true;
+    }
+
+    if (pty.killForced === undefined) {
+      return false;
+    }
+
+    pty.killForced();
+
+    return pty.waitForExit(FAILED_SPAWN_EXIT_WAIT_MS);
+  }
+
+  // Whether a failed spawn's rollback leaves the session free to revive:
+  // none is running, and any process it killed is gone now. A session whose
+  // killed process may still run stays blocked until a later check finds it
+  // gone.
+  private async isRollbackSettled(id: SessionID): Promise<boolean> {
+    if (this.rollingBack.has(id)) {
+      return false;
+    }
+
+    const killed = this.unconfirmedKills.get(id);
+
+    if (killed !== undefined) {
+      const gone = await killed.waitForExit(0);
+
+      if (!gone) {
+        return false;
+      }
+
+      this.unconfirmedKills.delete(id);
+    }
+
+    return true;
   }
 
   collectDescriptors(): SessionDescriptor[] {
@@ -1350,6 +1455,8 @@ export class SessionManager {
   private remove(s: Session) {
     this.sessions = this.sessions.filter((x) => x.id !== s.id);
 
+    this.removedIDs.add(s.id);
+
     if (this.focusedId === s.id) {
       this.focusedId = null;
     }
@@ -1383,8 +1490,11 @@ export class SessionManager {
   }
 
   // Persisted continuously so a crash (or quit) leaves a restorable fleet.
-  // Deliberate kills rewrite the file; unexpected session/atc deaths do not,
-  // so the last known fleet survives for `R` restore. Sessions whose
+  // A write covers the listed sessions and the ones dropped on purpose
+  // since the last write; a stored row the daemon has not restored yet
+  // stays as it is, so a write before `R` keeps it restorable. Deliberate
+  // kills rewrite the fleet; unexpected session/atc deaths do not, so the
+  // last known fleet survives for `R` restore. Sessions whose
   // terminal is gone persist as exited entries, so the killed archive
   // survives a daemon restart too. A session the agent has not yet given
   // its own session id persists as well, under its atc session id alone.
@@ -1416,7 +1526,13 @@ export class SessionManager {
       });
     }
 
-    await this.store.writeFleet(fleet);
+    const removed = [...this.removedIDs];
+
+    await this.store.writeFleet(fleet, removed);
+
+    for (const id of removed) {
+      this.removedIDs.delete(id);
+    }
   }
 
   // A write nobody awaits that fails leaves the stored rows as they were,
@@ -1467,95 +1583,6 @@ export class SessionManager {
   }
 }
 
-export function countSessionStates(
-  list: readonly { readonly state: SessionState }[],
-): Record<SessionState, number> {
-  const c = { needs_you: 0, running: 0, done: 0, exited: 0 };
-
-  for (const s of list) {
-    c[s.state]++;
-  }
-
-  return c;
-}
-
-interface SortableSessionView {
-  readonly id: string;
-  readonly parent: string | null;
-  readonly state: SessionState;
-  readonly pinned: boolean;
-  readonly lastAttachedAt: number;
-  readonly createdAt: number;
-}
-
-// Overlay order: pinned sessions first in most-recently-attached order, then
-// everyone else by urgency — who needs you, finished turns, busy, dead —
-// with most-recently-attached breaking ties inside each state. A
-// sub-session sits directly under its parent, ranked among its siblings
-// alone, so its attention never moves the parent's row; a sub-session whose
-// parent is not listed ranks as a top-level row.
-export function sortSessionViews<T extends SortableSessionView>(list: readonly T[]): T[] {
-  const rank: Record<SessionState, number> = {
-    needs_you: 0,
-    done: 1,
-    running: 2,
-    exited: 3,
-  };
-
-  const ranked = [...list].toSorted((a, b) => {
-    if (a.pinned !== b.pinned) {
-      return a.pinned ? -1 : 1;
-    }
-
-    const recency = b.lastAttachedAt - a.lastAttachedAt || b.createdAt - a.createdAt;
-
-    return a.pinned ? recency : rank[a.state] - rank[b.state] || recency;
-  });
-
-  const listed = new Set(ranked.map((s) => s.id));
-
-  const sorted: T[] = [];
-
-  for (const s of ranked) {
-    if (s.parent !== null && listed.has(s.parent)) {
-      continue;
-    }
-
-    sorted.push(s, ...ranked.filter((child) => child.parent === s.id));
-  }
-
-  return sorted;
-}
-
-// Never a filesystem path, so a repository can't collide with it.
-export const PINNED_GROUP_KEY = ' pinned';
-
-// Overlay display order for the grouped view: the flat sort with each
-// repository's sessions pulled together at the position of its best-ranked
-// member, so the renderer's adjacency-based headers appear once per group.
-// Pinned sessions form their own leading group. A sub-session keys by its
-// parent, so a set never splits across groups.
-export function sortGroupedSessionViews<
-  T extends SortableSessionView & { readonly repoRoot: string },
->(list: readonly T[]): T[] {
-  const byID = new Map(list.map((s) => [s.id, s]));
-  const buckets = new Map<string, T[]>();
-
-  for (const s of sortSessionViews(list)) {
-    const owner = (s.parent === null ? undefined : byID.get(s.parent)) ?? s;
-    const key = owner.pinned ? PINNED_GROUP_KEY : owner.repoRoot;
-    const bucket = buckets.get(key);
-
-    if (bucket === undefined) {
-      buckets.set(key, [s]);
-    } else {
-      bucket.push(s);
-    }
-  }
-
-  return [...buckets.values()].flat();
-}
-
 function buildLifecycle(s: Session): SessionLifecycle {
   return buildSessionLifecycle({
     desired: s.desired,

package/src/daemon/start-headless-turn.ts

@@ -1,9 +1,9 @@
-import type { AdapterEvent } from '../agents/agent-adapter';
-import { truncateDetail } from '../agents/truncate-detail';
+import type { AdapterEvent } from '../protocol/adapter-event';
 import type { SessionID } from '../shared/session-id';
+import { truncateDetail } from '../shared/truncate-detail';
+import { truncateSummary } from '../shared/truncate-summary';
 import type { SessionRuntime } from './session-runtime';
 import type { SessionManager } from './sessions';
-import { truncateSummary } from './truncate-summary';
 
 /**
  * Starts one headless turn for a session: finds its adapter's headless

package/src/daemon/start-session-bridge.ts

@@ -1,12 +1,12 @@
 import { z } from 'zod';
+import type { HookEvent } from '../protocol/hook-event';
 import type { EventMsg } from '../protocol/protocol';
 import type { MessageID } from '../shared/message-id';
 import type { SessionID } from '../shared/session-id';
 import { toMessageID } from '../shared/to-message-id';
 import type { MessageRecord } from '../store/message-record';
-import type { TapClient } from './daemon-connection';
+import type { TapClient } from './daemon-context';
 import type { HarnessRelay } from './execution-provider';
-import type { HookEvent } from './hooks';
 import { isBindingCurrent } from './is-binding-current';
 import type { BridgeBinding } from './is-binding-current';
 import { parseHookLine } from './parse-hook-line';

package/src/mcp/collect-clients.ts

@@ -1,6 +1,6 @@
 import type { Kysely } from 'kysely';
 import { collectJSONStrings } from './collect-json-strings';
-import type { MCPAuthSchema } from './types';
+import type { MCPAuthSchema } from './mcp-auth-schema';
 
 /**
  * A client added with `atc clients add`.

package/src/mcp/collect-grants.ts

@@ -2,7 +2,7 @@ import type { Kysely } from 'kysely';
 import { GRANT_SCOPES } from '../shared/grant-scope';
 import type { GrantScope } from '../shared/grant-scope';
 import { collectJSONStrings } from './collect-json-strings';
-import type { MCPAuthSchema } from './types';
+import type { MCPAuthSchema } from './mcp-auth-schema';
 
 /**
  * One authorization a client holds: every refresh token rotated from one

package/src/mcp/find-client-name.ts

@@ -1,5 +1,5 @@
 import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './types';
+import type { MCPAuthSchema } from './mcp-auth-schema';
 
 /**
  * The name a client was added under, or null for an unknown client id or a

package/src/mcp/mcp-auth-schema.ts

@@ -0,0 +1,37 @@
+/**
+ * The columns of the authorization server's database that atc reads and
+ * writes itself. better-auth owns the tables and their migrations; dates are
+ * ISO 8601 strings and string lists are JSON arrays.
+ */
+export interface MCPAuthSchema {
+  readonly oauthClient: {
+    readonly id: string;
+    readonly clientId: string;
+    readonly name: string | null;
+    readonly redirectUris: string;
+    readonly createdAt: string | null;
+  };
+  readonly oauthAccessToken: {
+    readonly id: string;
+    readonly token: string;
+    readonly clientId: string;
+    readonly sessionId: string | null;
+    readonly authorizationCodeId: string | null;
+  };
+  readonly oauthRefreshToken: {
+    readonly id: string;
+    readonly clientId: string;
+    readonly sessionId: string | null;
+    readonly authorizationCodeId: string | null;
+    readonly scopes: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly revoked: string | null;
+  };
+  readonly oauthConsent: { readonly id: string; readonly clientId: string };
+  readonly oauthResource: { readonly identifier: string };
+  readonly session: { readonly id: string; readonly expiresAt: string };
+
+  // When each grant last reached /mcp, keyed by the grant's authorization code id.
+  readonly atc_grant_use: { readonly grant_id: string; readonly last_used_at: string };
+}

package/src/mcp/open-mcp-auth.ts

@@ -8,11 +8,11 @@ import { betterAuth } from 'better-auth';
 import type { BetterAuthPlugin } from 'better-auth';
 import { getMigrations } from 'better-auth/db/migration';
 import { Kysely, SqliteAdapter, SqliteIntrospector, SqliteQueryCompiler, sql } from 'kysely';
+import { BunSqliteDriver } from '../shared/bun-sqlite-driver';
 import { GRANT_SCOPES } from '../shared/grant-scope';
-import { BunSqliteDriver } from '../store/bun-sqlite-driver';
 import { buildOwnerPlugin } from './build-owner-plugin';
 import { deriveTokenHash } from './derive-token-hash';
-import type { MCPAuthSchema } from './types';
+import type { MCPAuthSchema } from './mcp-auth-schema';
 
 interface MCPAuthOptions {
   readonly dbPath: string;

package/src/mcp/reconnecting-caller.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { DaemonClient } from '../client/daemon-client';
+import type { DaemonChannel } from '../protocol/daemon-channel';
 import type { DaemonFeature } from '../protocol/daemon-features';
 import { parseDaemonFeatures } from '../protocol/parse-daemon-features';
 import { requireDaemonFeatures } from './require-daemon-features';
@@ -30,7 +30,7 @@ const KEYED_METHODS: ReadonlyMap<string, DaemonFeature> = new Map<string, Daemon
 
 // One handshaken connection and the features its daemon announced.
 interface DaemonConnection {
-  readonly client: DaemonClient;
+  readonly client: DaemonChannel;
   readonly features: ReadonlySet<DaemonFeature>;
 }
 
@@ -48,13 +48,22 @@ export class ReconnectingCaller implements FleetCaller {
 
   private readonly build: string;
 
+  private readonly openChannel: (socketPath: string) => Promise<DaemonChannel>;
+
   private client: Promise<DaemonConnection> | null = null;
 
-  private readonly closed = new WeakSet<DaemonClient>();
+  private readonly closed = new WeakSet<DaemonChannel>();
 
-  constructor(socketPath: string, build: string) {
+  // The last argument connects to the daemon at a socket path; each channel
+  // it returns is handshaken here before a request rides it.
+  constructor(
+    socketPath: string,
+    build: string,
+    openChannel: (socketPath: string) => Promise<DaemonChannel>,
+  ) {
     this.socketPath = socketPath;
     this.build = build;
+    this.openChannel = openChannel;
   }
 
   // The required features are checked against each connection right before
@@ -141,10 +150,10 @@ export class ReconnectingCaller implements FleetCaller {
       }
     };
 
-    let client: DaemonClient;
+    let client: DaemonChannel;
 
     try {
-      client = await DaemonClient.open(this.socketPath);
+      client = await this.openChannel(this.socketPath);
     } catch (error) {
       resetClient();
       throw error;

package/src/mcp/remove-client.ts

@@ -1,5 +1,5 @@
 import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './types';
+import type { MCPAuthSchema } from './mcp-auth-schema';
 
 /**
  * Removes a client and everything it holds: its access and refresh tokens,

package/src/mcp/revoke-grant.ts

@@ -1,5 +1,5 @@
 import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './types';
+import type { MCPAuthSchema } from './mcp-auth-schema';
 
 /**
  * Revokes a grant: its access and refresh tokens go, along with the

package/src/mcp/types.ts

@@ -25,44 +25,6 @@ export interface ToolContext {
   readonly sender: { readonly kind: 'fixed' | 'default'; readonly name: string };
 }
 
-/**
- * The columns of the authorization server's database that atc reads and
- * writes itself. better-auth owns the tables and their migrations; dates are
- * ISO 8601 strings and string lists are JSON arrays.
- */
-export interface MCPAuthSchema {
-  readonly oauthClient: {
-    readonly id: string;
-    readonly clientId: string;
-    readonly name: string | null;
-    readonly redirectUris: string;
-    readonly createdAt: string | null;
-  };
-  readonly oauthAccessToken: {
-    readonly id: string;
-    readonly token: string;
-    readonly clientId: string;
-    readonly sessionId: string | null;
-    readonly authorizationCodeId: string | null;
-  };
-  readonly oauthRefreshToken: {
-    readonly id: string;
-    readonly clientId: string;
-    readonly sessionId: string | null;
-    readonly authorizationCodeId: string | null;
-    readonly scopes: string;
-    readonly createdAt: string;
-    readonly expiresAt: string;
-    readonly revoked: string | null;
-  };
-  readonly oauthConsent: { readonly id: string; readonly clientId: string };
-  readonly oauthResource: { readonly identifier: string };
-  readonly session: { readonly id: string; readonly expiresAt: string };
-
-  // When each grant last reached /mcp, keyed by the grant's authorization code id.
-  readonly atc_grant_use: { readonly grant_id: string; readonly last_used_at: string };
-}
-
 /**
  * The authorization server's store: the better-auth instance and the
  * database under it.

package/src/mcp-http-server.ts

@@ -1,5 +1,6 @@
 import { mkdirSync } from 'node:fs';
 import { bootDaemonClient } from './client/boot-daemon';
+import { DaemonClient } from './client/daemon-client';
 import { collectClients } from './mcp/collect-clients';
 import { openMCPAuth } from './mcp/open-mcp-auth';
 import { ReconnectingCaller } from './mcp/reconnecting-caller';
@@ -27,7 +28,7 @@ export async function runMCPHTTPServer(build: string, flags: MCPHTTPFlags): Prom
 
   mkdirSync(stateDir, { recursive: true });
 
-  const caller = new ReconnectingCaller(boot.socketPath, build);
+  const caller = new ReconnectingCaller(boot.socketPath, build, (path) => DaemonClient.open(path));
 
   const server = await startMCPHTTPServer({
     caller,

package/src/mcp-server.ts

@@ -2,6 +2,7 @@ import { bootDaemonClient } from './client/boot-daemon';
 import { answerRPCRequest } from './mcp/answer-rpc-request';
 import { requireDaemonFeatures } from './mcp/require-daemon-features';
 import type { FleetCaller, ToolContext } from './mcp/types';
+import { LineDecoder } from './protocol/line-decoder';
 
 /**
  * An MCP server over stdio bridging to the atc daemon: any MCP client —
@@ -34,26 +35,14 @@ export async function runMCPServer(build: string): Promise<void> {
     sender: { kind: 'default', name: callerSessionID ?? 'mcp' },
   };
 
-  const decoder = new TextDecoder('utf-8');
-
-  let buffer = '';
+  const decoder = new LineDecoder();
 
   // Each request runs on its own, so a long poll never holds up the others;
   // responses carry their request's id.
   const inFlight = new Set<Promise<void>>();
 
   for await (const chunk of Bun.stdin.stream()) {
-    buffer += decoder.decode(chunk, { stream: true });
-
-    const lines = buffer.split('\n');
-
-    buffer = lines.pop() ?? '';
-
-    for (const line of lines) {
-      if (line.trim() === '') {
-        continue;
-      }
-
+    for (const line of decoder.splitChunk(chunk)) {
       const finished = Promise.withResolvers<void>();
 
       inFlight.add(finished.promise);

package/src/protocol/adapter-event.ts

@@ -0,0 +1,25 @@
+import type { AgentSessionID } from '../shared/agent-session-id';
+
+/**
+ * What an adapter makes of one hook event: the agent-neutral kind and the
+ * fields the daemon and the store act on.
+ */
+export interface AdapterEvent {
+  kind: 'started' | 'needs-input' | 'turn-done' | 'prompt-submitted' | 'ended' | 'heartbeat';
+  agentSessionID?: AgentSessionID;
+  message?: string;
+
+  // Fuller activity text than message: what the agent last said or was
+  // asked, for briefing. Bounded by the adapter.
+  detail?: string;
+
+  // Opaque handle the adapter can later pull a session name from.
+  nameSource?: string;
+
+  // Claude resume-existence path. Distinct from nameSource: a naming
+  // handle is not a resume gate.
+  transcriptSource?: string;
+
+  // The agent's whole final message for a finished turn; detail holds a bounded preview of it.
+  result?: string;
+}

package/src/protocol/count-session-states.ts

@@ -0,0 +1,16 @@
+import type { SessionState } from './session-state';
+
+/**
+ * How many of the sessions are in each state.
+ */
+export function countSessionStates(
+  list: readonly { readonly state: SessionState }[],
+): Record<SessionState, number> {
+  const c = { needs_you: 0, running: 0, done: 0, exited: 0 };
+
+  for (const s of list) {
+    c[s.state]++;
+  }
+
+  return c;
+}