@zhuxixi/pi-agent-board 0.6.0 → 0.6.2

package/src/runtime/service.mjs

@@ -25,7 +25,8 @@ import { launchAutoState as launchAutoStateProcess, launchHost as launchHostProc
 import { gitRepoRoot } from "../core/repo.mjs";
 import { isAlive, killProcess } from "../core/pid.mjs";
 import { acquireOwnedViewLock, tryAcquireOwnedViewLock } from "../core/locks.mjs";
-import { canReplaceHost } from "../core/host-coordination.mjs";
+import { canFinalizeLegacyHost, canReplaceHost } from "../core/host-coordination.mjs";
+import { modelRefAvailable } from "../core/launch-options.mjs";
 import { HOST_PROBE_RETRY_MS, probeHost } from "../core/host-probe.mjs";
 import * as P from "../core/paths.mjs";
 import {
@@ -34,11 +35,13 @@ import {
 	listRows,
 	loadRow,
 	readHost,
+	readHostPid,
 	readLaunchPrefs,
 	readPid,
 	readState,
 	readStatus,
 	updateOwnedHost,
+	writeHost,
 	writeLaunchPrefs,
 	writeMeta,
 	writeState,
@@ -85,6 +88,7 @@ const ATTACH_RESOLVE_TIMEOUT_MS = 120_000;
  *   signalOwnedProcess?: (identity: {pid: number, startToken: string|null}, signal: string) => void,
  *   probeHostFn?: typeof probeHost,
  *   sleepFn?: (ms: number) => Promise<void>,
+ *   availableModels?: () => Array<{ provider: string, id: string }> | undefined,
  * }} opts
  */
 export function createService(opts) {
@@ -109,6 +113,10 @@ export function createService(opts) {
 	// through sleepFn (never a blocking acquire / Atomics.wait).
 	const probeHostImpl = opts.probeHostFn ?? probeHost;
 	const sleepFnImpl = opts.sleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	// Live model list for the stale-defaultModel launch guard (issue #90). Called
+	// at validation time (never cached at startup) and wrapped defensively by the
+	// caller; undefined/absent skips validation entirely.
+	const availableModelsImpl = opts.availableModels ?? null;
 	// In-flight attach resolutions, keyed by viewId: concurrent resolver calls for
 	// the same view share one promise (issue #70 Task 12).
 	const inflightAttachResolvers = new Map();
@@ -193,6 +201,28 @@ export function createService(opts) {
 		return { ok: true, status: "pending", pid: null, socketPath: host?.socketPath ?? null, instanceId: host?.instanceId ?? null };
 	}
 
+	/**
+	 * Actionable error when the view's defaultModel is provably unavailable
+	 * (issue #90): launching a child with a dead model id makes it exit 1 on
+	 * every start, so attach would loop cold starts forever. Only fires when a
+	 * model is configured AND a live model list is injectable; anything
+	 * uncertain (no list, list call failure) conservatively allows the launch.
+	 * @param {import("../core/types.mjs").ViewMeta} meta
+	 * @returns {string|null}
+	 */
+	function validateViewModelMeta(meta) {
+		const model = meta.defaultModel ?? null;
+		if (!model || !availableModelsImpl) return null;
+		let available;
+		try {
+			available = availableModelsImpl();
+		} catch {
+			return null;
+		}
+		if (modelRefAvailable(model, available)) return null;
+		return `Model "${model}" configured for this session is no longer available — update the view's model (or clear defaultModel) and retry attach.`;
+	}
+
 	/**
 	 * Claim → spawn → merge flow. The CALLER must already hold the `host-start`
 	 * lease; this function never acquires or releases it.
@@ -214,6 +244,11 @@ export function createService(opts) {
 			return pendingLaunchResult(existing);
 		}
 
+		// Fail fast BEFORE claiming (issue #90): no claim record, no config file,
+		// no spawn — the resolver surfaces the error via its pending reason.
+		const modelError = validateViewModelMeta(meta);
+		if (modelError) return { ok: false, error: modelError };
+
 		const instanceId = randomIdImpl();
 		const configPath = P.hostConfigPathFor(root, meta.id, instanceId);
 		const socketPath = P.hostEndpointPathFor(process.platform, root, meta.id, instanceId);
@@ -789,6 +824,14 @@ export function createService(opts) {
 				// The record moved on (adopted elsewhere, revoked, or replaced) — surface it.
 				return { ok: true, pending: true, socketPath: current?.socketPath ?? host.socketPath ?? null, instanceId: current?.instanceId ?? instanceId };
 			}
+			// Stale-model guard (issue #90): the claim is an abandoned record, so mark
+			// it failed fenced (same shape as the spawn-failure path below — the next
+			// ensure can claim anew) instead of spawning a child doomed to exit 1.
+			const modelError = validateViewModelMeta(meta);
+			if (modelError) {
+				updateOwnedHost(root, viewId, instanceId, (h) => ({ ...h, state: "failed", endedAt: nowImpl(), exitCode: 1, error: modelError, claimPid: null, claimIdentity: null }));
+				return { ok: true, pending: true, socketPath: null, instanceId };
+			}
 			const configPath = current.configPath ?? P.hostConfigPathFor(root, viewId, instanceId);
 			const socketPath = current.socketPath ?? P.hostEndpointPathFor(process.platform, root, viewId, instanceId);
 			/** @type {import("../core/types.mjs").HostConfig} */
@@ -821,8 +864,9 @@ export function createService(opts) {
 			}
 			if (pid == null) {
 				const message = spawnError ?? "PTY host runner failed to spawn (adopted claim)";
-				// Clear the dead claimer's fields so canReplaceHost sees the claim as
-				// ended — a retry (fresh ensure) must not pend on a gone claimer pid.
+				// Clear the dead claimer's fields (failed fenced — keeps the record
+				// replaceable without depending on claimer liveness; canReplaceHost no
+				// longer consults claim fields, see issue #99).
 				updateOwnedHost(root, viewId, instanceId, (h) => ({ ...h, state: "failed", endedAt: nowImpl(), exitCode: 1, error: message, claimPid: null, claimIdentity: null }));
 				removeFile(configPath);
 				return { ok: true, pending: true, socketPath: null, instanceId };
@@ -951,6 +995,13 @@ export function createService(opts) {
 					continue;
 				}
 				if (withinGrace || legacy) {
+					// A legacy starting host whose runner is provably dead would wait out
+					// the grace window forever (withinGrace is always true for legacy) —
+					// finalize it now instead (issue #87).
+					if (legacy && finalizeDeadLegacyHost(root, viewId, host, probe.classification, nowImpl(), tryAcquireLockImpl)) {
+						await sleepFnImpl(HOST_PROBE_RETRY_MS);
+						continue;
+					}
 					// Normal cold start (or a legacy starting host — legacy is never recovered,
 				// spec §10.1): wait out the grace window.
 				await sleepFnImpl(HOST_PROBE_RETRY_MS);
@@ -961,6 +1012,13 @@ export function createService(opts) {
 				await sleepFnImpl(HOST_PROBE_RETRY_MS);
 				continue;
 			} else if (legacy) {
+				// Legacy host unreachable. spec §10.1 says never recover — unless the
+				// runner pid is provably dead, in which case finalize and self-heal
+				// (issue #87).
+				if (finalizeDeadLegacyHost(root, viewId, host, probe.classification, nowImpl(), tryAcquireLockImpl)) {
+					await sleepFnImpl(HOST_PROBE_RETRY_MS);
+					continue;
+				}
 				return pending(sessionFile, "legacy host unreachable — manual restart needed");
 			}
 
@@ -1867,6 +1925,54 @@ function serviceIdentity() {
 	return { pid: process.pid, startToken: readProcStartToken(process.pid) };
 }
 
+/**
+ * Finalize a provably-dead legacy host as `exited` so the resolver loop's next
+ * iteration sees hostActive=false and claims a fresh new-protocol host
+ * (issue #87). The gate is `canFinalizeLegacyHost` — anything unverifiable
+ * stays pending (spec §10.1 conservatism). The write itself is serialized
+ * under the host-start lease (same gate as recoverHost/claim) with a
+ * live-record re-check: a concurrent resolver may have already finalized and
+ * claimed a new-protocol host, and a stale `alive` snapshot must never clobber
+ * that replacement's record (issue #87 CR r1).
+ * @param {string} root
+ * @param {string} viewId
+ * @param {import("../core/types.mjs").HostStatus} host
+ * @param {string} probeClassification
+ * @param {number} now
+ * @param {(r: string, v: string, name: string, o?: object) => ({ acquired: true, lease: { release: () => void } } | { acquired: false, reason: string })} acquireHostStartLock
+ * @returns {boolean} true when finalized (caller should `continue` the loop).
+ */
+function finalizeDeadLegacyHost(root, viewId, host, probeClassification, now, acquireHostStartLock) {
+	// Same pid fallback as loadRow: legacy records carry no runnerPid property —
+	// the pid lives only in the host-pid.json mirror.
+	const hostPid = Object.hasOwn(host, "runnerPid") ? host.runnerPid : readHostPid(root, viewId);
+	if (!canFinalizeLegacyHost({ host, hostPid, hostPidAlive: isAlive(hostPid), probeClassification })) return false;
+	// Serialize with claims: only write while the live record still matches our
+	// (possibly stale) snapshot.
+	const gate = acquireHostStartLock(root, viewId, "host-start", { identity: serviceIdentity() });
+	if (!gate.acquired) return false; // busy — record left untouched; caller pends/waits this attempt, a later one finalizes
+	try {
+		const cur = readHost(root, viewId);
+		if (!cur || cur.instanceId != null) return false; // already claimed by a new-protocol host
+		if (cur.state !== "starting" && cur.state !== "alive") return false; // already finalized
+		if (cur.socketPath !== host.socketPath || cur.state !== host.state) return false; // snapshot drifted
+		const finalizedAt = now;
+		writeHost(root, { ...cur, state: "exited", endedAt: finalizedAt, lastSeenAt: finalizedAt, error: "legacy host finalized: runner pid dead" });
+	} finally {
+		try { gate.lease.release(); } catch { /* best effort */ }
+	}
+	try {
+		appendDiagnostic(root, viewId, {
+			source: "service",
+			level: "info",
+			code: "legacy_host_finalized",
+			message: `Finalized stale legacy host (pid ${hostPid} dead, probe ${probeClassification}) — next attach claims a fresh host`,
+			details: { hostPid, probeClassification, previousState: host.state },
+		});
+	} catch { /* best effort */ }
+	return true;
+}
+
 /** Conservative pre-identity observation (issue #70 Task 10): a recorded pid that
  *  is still alive is always `unknown` — never safe to release; not recorded or
  *  provably gone is `dead`. Task 11 replaces this with identity-aware observation. */
@@ -1903,7 +2009,6 @@ function observeHostForReplace(host) {
 		host,
 		runnerObservation: conservativeObservation(host?.runnerPid ?? null),
 		childObservation: conservativeObservation(host?.childPid ?? null),
-		claimObservation: conservativeObservation(host?.claimPid ?? null),
 		launchLeaseActive: false,
 	};
 }

package/src/ui/dashboard.ts

@@ -18,6 +18,7 @@ import {
 	clampThinkingLevel,
 	listDirectorySuggestions,
 	existingCwdCandidates,
+	modelRefAvailable,
 	nextCwdPickerState,
 	resolveDirectoryValue,
 	resolveLaunchContext,
@@ -143,6 +144,15 @@ export class DashboardComponent implements Component {
 	private inputNotice: InputNotice | null = null;
 	private launch: LaunchState | null = null;
 	private lastLaunchPrefs: { cwd: string | null; model: string | null; thinkingLevel: ThinkingLevel | null } | null = null;
+	/** First frame after mount must clear the screen: pi-tui's first render
+	 *  "assumes clean screen" (fullRender(false)) and overlays never get
+	 *  clearOnShrink — crash output / dirty bottoms would persist (issue #88). */
+	private needsFullClear = true;
+	/** Content line count of the previous frame BEFORE spacer/padding fill
+	 *  (padding always fills the terminal height, so padded counts never
+	 *  shrink — shrink detection must run on pre-fill counts). */
+	private lastContentLineCount: number | null = null;
+	private frameContentLineCount = 0;
 	private readonly editor: CustomEditor;
 
 	constructor(
@@ -1155,6 +1165,28 @@ export class DashboardComponent implements Component {
 	}
 
 	render(width: number): string[] {
+		const lines = this.renderLines(width);
+		// Self-heal frames (issue #88): pi-tui disables clearOnShrink while an
+		// overlay is active ("overlays need the padding"), so a content shrink
+		// under the dashboard overlay would leave stale rows forever. Force a
+		// full clear on the first frame and on any content-line shrink.
+		// The force MUST be deferred past the active doRender pass: calling
+		// requestRender(true) synchronously here resets pi-tui's diff state
+		// mid-frame (previousLines=[], previousWidth=-1), making the CURRENT frame
+		// take the first-render no-clear branch, after which the deferred re-render
+		// diffs identical content — nothing is ever cleared (issue #88 CR r1).
+		// Deferred to nextTick, the reset lands between frames: the next doRender
+		// sees previousWidth=-1 ≠ width → widthChanged → fullRender(true), a real
+		// clear wrapped in DECSET 2026 synchronized output by pi-tui itself.
+		if (this.needsFullClear || (this.lastContentLineCount != null && this.frameContentLineCount < this.lastContentLineCount)) {
+			this.needsFullClear = false;
+			process.nextTick(() => this.tui.requestRender(true));
+		}
+		this.lastContentLineCount = this.frameContentLineCount;
+		return lines;
+	}
+
+	private renderLines(width: number): string[] {
 		const allRows = this.deps.service.rows();
 		const needs = allRows.filter((r) => r.state?.semanticState === "needs_input").length;
 		const working = allRows.filter((r) => r.state?.semanticState === "working").length;
@@ -1184,6 +1216,12 @@ export class DashboardComponent implements Component {
 		const body = this.renderRows(width);
 		const windowed = this.windowBody(body, capacity);
 		lines.push(...windowed.lines);
+		// Shrink-detection count: recorded BEFORE the spacer fill — the spacer
+		// pads the frame back out to the terminal height, so the padded (or
+		// pre-fitToHeight-padding) total never shrinks and would mask row
+		// removals, the exact ghosting trigger (issue #88). Non-list modes
+		// return earlier and intentionally don't record.
+		this.frameContentLineCount = lines.length;
 		// Keep the compose box visually docked to the bottom instead of glued to the
 		// final session row. This matches the Claude-style layout: list at top,
 		// large calm workspace, input/footer at bottom.
@@ -1738,7 +1776,9 @@ function filterLaunchChoices(choices: LaunchChoice[], query: string): LaunchChoi
 function findLaunchModelByRef(models: LaunchModel[], ref: string): LaunchModel | null {
 	const target = String(ref || "").trim().toLowerCase();
 	if (!target) return null;
-	return models.find((model) => `${model.provider}/${model.id}`.toLowerCase() === target) ?? null;
+	// Single source of truth with the service-side stale-model guard (issue #90):
+	// same case-insensitive exact "provider/id" rule.
+	return models.find((model) => modelRefAvailable(target, [model])) ?? null;
 }
 
 function stripBracketedPaste(data: string): string {

package/src/ui/pty-attach.ts

@@ -244,6 +244,16 @@ export class PtyAttachComponent implements Component {
 			this.send({ type: "input", data });
 			return;
 		}
+		if (matchesKey(data, Key.ctrl("left"))) {
+			// Explicit detach chord (issue #89): single ← is gated on editor state
+			// (it doubles as cursor-left inside a non-empty draft), so a user with
+			// a draft had no way out short of Ctrl+C/D, which kills the child Pi.
+			// Ctrl+← is unambiguous intent — detach unconditionally, regardless of
+			// editor state or socket liveness (same always-exitable guarantee as
+			// the disconnected-← escape, issue #48).
+			this.detach();
+			return;
+		}
 		if (matchesKey(data, Key.left)) {
 			// While the socket is down the key can never reach the child, so
 			// escape unconditionally — the view must always be exitable, even
@@ -279,7 +289,7 @@ export class PtyAttachComponent implements Component {
 		}
 		const header =
 			this.theme.fg("accent", this.theme.bold(` ${this.opts.title} `)) +
-			this.theme.fg("muted", `${this.status} · click opens links · dblclick/drag selects+copies · ← detach`);
+			this.theme.fg("muted", `${this.status} · click opens links · dblclick/drag selects+copies · ←/Ctrl+← detach`);
 		return [clip(header, width), ...body.map((l) => clipTerminalLine(l, width)), this.theme.fg("dim", "─".repeat(width))];
 	}
 
@@ -295,7 +305,7 @@ export class PtyAttachComponent implements Component {
 		out.push(center(this.theme.fg("accent", this.theme.bold(title)), width));
 		out.push(center(this.theme.fg("muted", detail), width));
 		out.push("");
-		out.push(center(this.theme.fg("dim", "← to detach"), width));
+		out.push(center(this.theme.fg("dim", "←/Ctrl+← to detach"), width));
 		while (out.length < height) out.push("");
 		return out.slice(0, height);
 	}
@@ -1150,16 +1160,24 @@ function asciiCellsForBufferLine(line: BufferLineLike, reusable: BufferCellLike)
 function openExternalTarget(target: string): boolean {
 	const sanitized = sanitizeOscPayload(target).trim();
 	if (!sanitized) return false;
+	// Opening the target is best-effort: an async spawn failure (e.g. xdg-open
+	// missing on a minimal server) must be swallowed, not crash the host (issue #86).
 	try {
 		if (process.platform === "darwin") {
-			spawn("open", [sanitized], { detached: true, stdio: "ignore" }).unref();
+			const child = spawn("open", [sanitized], { detached: true, stdio: "ignore" });
+			child.on("error", () => {});
+			child.unref();
 			return true;
 		}
 		if (process.platform === "win32") {
-			spawn("cmd", ["/c", "start", "", sanitized], { detached: true, stdio: "ignore" }).unref();
+			const child = spawn("cmd", ["/c", "start", "", sanitized], { detached: true, stdio: "ignore" });
+			child.on("error", () => {});
+			child.unref();
 			return true;
 		}
-		spawn("xdg-open", [sanitized], { detached: true, stdio: "ignore" }).unref();
+		const child = spawn("xdg-open", [sanitized], { detached: true, stdio: "ignore" });
+		child.on("error", () => {});
+		child.unref();
 		return true;
 	} catch {
 		return false;