agent-relay-runner 0.129.11 → 0.129.12

package/src/adapters/codex.ts

@@ -1,4 +1,4 @@
-import type { ContextState, InteractivePrompt, LivenessSignal, Message, MessageTurnEndReason, ProviderState } from "agent-relay-sdk";
+import type { ContextState, InteractivePrompt, LivenessSignal, Message, MessageTurnEndReason, ProviderState, ToolCallCategory } from "agent-relay-sdk";
 import { isRecord, stringValue } from "agent-relay-sdk";
 import { isPidAlive, killPid, processTreePids, processTreePidsFromTable, waitForPidsExit } from "agent-relay-sdk/process-utils";
 import { profileAllowsRelayFeature, providerMessageText, relayContext, type ManagedProcess, type ProviderAdapter, type ProviderConfig, type ProviderPermissionDecisionInput, type ProviderSessionEvent, type ProviderStatusUpdate, type RunnerSpawnConfig, type SpawnArgs, type TerminalAttachSpec } from "../adapter";
@@ -79,6 +79,10 @@ export class CodexAdapter implements ProviderAdapter {
   // cap below keeps a runaway session from growing memory unbounded.
   private sessionEvents: SessionEvent[] = [];
   private static readonly SESSION_EVENTS_CAP = 50_000;
+  // #1570 SUB-A: how many relay deliveries this thread has received, so providerMessageText can
+  // gate the reply-reminder block to first-delivery + periodic instead of every message. Reset
+  // alongside the rest of the thread state (fresh process, or an explicit /clear-style thread reset).
+  private deliveryCount = 0;
 
   onStatusChange(cb: (status: ProviderStatusUpdate) => void): void {
     this.statusCb = cb;
@@ -108,6 +112,7 @@ export class CodexAdapter implements ProviderAdapter {
     this.subagentThreads.clear();
     this.pendingApprovals.clear();
     this.activeTurnId = undefined;
+    this.deliveryCount = 0;
     this.agentMessageCapture.reset();
     this.itemTextBuffers.clear();
     this.itemTextBufferTypes.clear();
@@ -217,8 +222,8 @@ export class CodexAdapter implements ProviderAdapter {
       exitReported = true;
       this.statusCb(status);
     };
-    void appServer.exited.then((code) => reportExit(code === 0 ? "offline" : "error"));
-    if (tui) void tui.exited.then((code) => reportExit(code === 0 ? "idle" : "error"));
+    void appServer.exited.then((code) => reportExit(code === 0 ? "offline" : "error")).catch(() => reportExit("error")).catch(() => {});
+    if (tui) void tui.exited.then((code) => reportExit(code === 0 ? "idle" : "error")).catch(() => reportExit("error")).catch(() => {});
     const process: ManagedProcess = {
       pid: tui?.pid ?? appServer.pid,
       process: appServer,
@@ -373,14 +378,24 @@ export class CodexAdapter implements ProviderAdapter {
       }
       throw new Error(CODEX_TURN_IN_PROGRESS_MESSAGE);
     }
-    let text = [codexLaunchContext(process), providerMessageText(messages)].filter(Boolean).join("\n\n");
+    this.deliveryCount += 1;
+    let text = [codexLaunchContext(process), providerMessageText(messages, { deliveryCount: this.deliveryCount })].filter(Boolean).join("\n\n");
     if (codexRelayContextEnabled(process) && !process.meta?.relayContextSent) {
       text = codexRelayContextBlock() + "\n\n" + text;
       process.meta = { ...(process.meta ?? {}), relayContextSent: true };
     }
     logger.info("codex", codexDeliveryNotice(messages, threadId));
     const client = process.meta?.client as CodexAppClient;
-    await client.turnStart(threadId, text);
+    const started = await client.turnStart(threadId, text);
+    // #1565 F1 — claim the turn from the RESPONSE, not from the later `turn/started` notification.
+    // The guard above is only as good as the state it reads: with the turn id arriving a few ms
+    // later over the event stream, a second delivery in that window passed the guard and issued a
+    // concurrent turn/start on the same thread, which the app-server silently drops — while its
+    // command still reported success, so nothing retried it. Claiming it here closes the window:
+    // the second payload is DEFERRED (the runner re-offers it when this turn ends) instead of
+    // being lost. A later `turn/started` overwrites this id; `turn/completed`, `turn/failed`,
+    // `turn/interrupted` and the 4s probeActivity sweep all clear it, so it cannot wedge.
+    this.ensureMainTurnActive(stringValue(isRecord(started?.turn) ? started.turn.id : undefined));
   }
 
   async respondToPermissionDecision(process: ManagedProcess, input: ProviderPermissionDecisionInput): Promise<Record<string, unknown>> {
@@ -609,7 +624,7 @@ export class CodexAdapter implements ProviderAdapter {
       if (codexItemFailed(item)) this.recordInsightEvent({ type: "tool_error" });
       // stepId = the app-server item id: the server upserts the running step emitted on
       // item/started into this completed state IN PLACE, so the tool persists as ONE row.
-      this.sessionEventCb({ type: "tool", origin: "provider", body: tool.body, label: tool.label, status: "completed", ...(turnId ? { turnId } : {}), ...(itemId ? { stepId: itemId } : {}) });
+      this.sessionEventCb({ type: "tool", origin: "provider", body: tool.body, label: tool.label, category: codexToolCategory(type, item), status: "completed", ...(turnId ? { turnId } : {}), ...(itemId ? { stepId: itemId } : {}) });
     }
     if (itemId) this.itemTextBuffers.delete(itemId);
     if (itemId) this.itemTextBufferTypes.delete(itemId);
@@ -685,7 +700,7 @@ export class CodexAdapter implements ProviderAdapter {
       this.flushBufferedReasoning();
       const tool = codexToolSummary(type, item ?? params ?? {});
       // stepId = item id so the server upserts this running step → completed IN PLACE (one row).
-      if (tool) this.sessionEventCb({ type: "tool", origin: "provider", body: tool.body, label: tool.label, status: "running", streaming: true, ...(turnId ? { turnId } : {}), ...(itemId ? { stepId: itemId } : {}) });
+      if (tool) this.sessionEventCb({ type: "tool", origin: "provider", body: tool.body, label: tool.label, category: codexToolCategory(type, item ?? params ?? {}), status: "running", streaming: true, ...(turnId ? { turnId } : {}), ...(itemId ? { stepId: itemId } : {}) });
       return;
     }
 
@@ -880,6 +895,24 @@ export function codexInsightToolName(type: string | undefined, item: Record<stri
   }
 }
 
+// #1498: Codex app-server item types → the provider-independent category taxonomy. Codex has
+// no MCP-tool-search or native read/ask-user-question item, so it simply never emits those
+// categories; webSearch and any other/future item type fall to "generic" rather than being
+// force-fit — the fallback exists precisely so nothing is hidden from the activity trace.
+// dynamicToolCall is a distinct client-provided dynamic tool (not MCP) so it falls to the
+// default generic case; collabAgentToolCall covers several collab ops (sendInput, resumeAgent,
+// wait, closeAgent, ...) and only the spawnAgent op is actually an agent spawn.
+export function codexToolCategory(type: string | undefined, item: Record<string, unknown>): ToolCallCategory {
+  switch (type) {
+    case "commandExecution": return "cli-bash";
+    case "fileChange": return "edit";
+    case "mcpToolCall": return "mcp-tool-call";
+    case "collabAgentToolCall": return stringValue(item.tool) === "spawnAgent" ? "agent-spawn" : "generic";
+    case "plan": return "plan";
+    default: return "generic";
+  }
+}
+
 // Did a completed tool item fail? Mirrors Claude's tool_result is_error outcome proxy.
 export function codexItemFailed(item: Record<string, unknown>): boolean {
   if (stringValue(item.status) === "failed") return true;
@@ -920,7 +953,12 @@ export function codexToolSummary(type: string | undefined, item: Record<string,
     const detail = prompt || (targets ? `${targets} agent${targets === 1 ? "" : "s"}` : tool);
     return { label: `Collab/${tool}`, body: clip(detail) };
   }
-  return null;
+  // reasoning/agentMessage/userMessage are handled earlier in the event stream and never reach
+  // here as a "tool" item — those genuinely aren't tool activity, so they stay null.
+  if (type === "reasoning" || type === "agentMessage" || type === "userMessage") return null;
+  // Any other/future Codex tool item type still gets a minimal summary rather than being
+  // dropped — the "nothing dropped, unknown→generic" guarantee must hold even here.
+  return { label: type ?? "Tool", body: clip(type ?? "tool") };
 }
 
 function codexApprovalMethod(method: string): boolean {

package/src/busy-reconciler.ts

@@ -1,3 +1,6 @@
+import { errMessage } from "agent-relay-sdk";
+import type { PaneBusyReading } from "./adapter";
+
 type ProviderActivity = "busy" | "idle" | "unknown";
 
 const BUSY_RECONCILE_POLL_MS = 4_000;
@@ -14,9 +17,10 @@ interface BusyReconcilerDeps {
   hasProviderTurn(): boolean;
   canProbeActivity(): boolean;
   probeActivity(): Promise<ProviderActivity> | undefined;
-  // #769 P1-A: optional independent pane-busy read consulted ONLY at the force-clear
-  // moment. When it resolves true, a probe-`idle` must not clear the live turn.
-  probePaneBusy?(): Promise<boolean> | undefined;
+  // #769 P1-A / #1656: optional independent pane-busy read. `busy` vetoes a clear; `not-busy`
+  // is the positive corroboration every counted idle tick requires; anything else is unknown
+  // and holds the turn. Omitted entirely by providers with no pane to read.
+  probePaneBusy?(): Promise<PaneBusyReading> | undefined;
   clearProviderTurn(reason: string): void;
   sessionDebug(message: string): void;
 }
@@ -33,7 +37,7 @@ export class BusyReconciler {
     if (this.timer || !this.deps.canProbeActivity()) return;
     this.idleStreak = 0;
     this.sawBusy = false;
-    this.timer = setInterval(() => { void this.run(); }, BUSY_RECONCILE_POLL_MS);
+    this.timer = setInterval(() => this.runInBackground(), BUSY_RECONCILE_POLL_MS);
   }
 
   disarm(): void {
@@ -46,17 +50,36 @@ export class BusyReconciler {
   scheduleInterruptReconcile(): void {
     setTimeout(() => {
       if (this.deps.isStopped() || !this.deps.hasProcess()) return;
-      void (async () => {
-        if (this.deps.currentStatus() !== "busy" || this.deps.isProviderBlocked()) return;
-        const probe = this.deps.probeActivity();
-        let activity: ProviderActivity = "unknown";
-        try { if (probe) activity = await probe; } catch { return; }
-        this.deps.sessionDebug(`post-interrupt reconcile probe=${activity}`);
-        if (activity === "idle") this.deps.clearProviderTurn("post-interrupt");
-      })();
+      this.reconcileInterruptInBackground();
     }, INTERRUPT_RECONCILE_DELAY_MS);
   }
 
+  // These two calls run from timers, so their promises have no caller that can observe a
+  // rejection. In particular clearProviderTurn can synchronously throw while publishing its
+  // durable timeline event during teardown. Catch at this boundary so an expected race cannot
+  // become Bun's process-fatal unhandled rejection; retain the error in the session log.
+  private runInBackground(): void {
+    void this.run().catch((error) => this.reportBackgroundRejection("busy reconcile", error));
+  }
+
+  private reconcileInterruptInBackground(): void {
+    void this.reconcileInterrupt().catch((error) => this.reportBackgroundRejection("post-interrupt reconcile", error));
+  }
+
+  private reportBackgroundRejection(scope: string, error: unknown): void {
+    // Logging must not rethrow from the rejection handler and recreate the same unhandled path.
+    try { this.deps.sessionDebug(`${scope} failed: ${errMessage(error)}`); } catch {}
+  }
+
+  private async reconcileInterrupt(): Promise<void> {
+    if (this.deps.currentStatus() !== "busy" || this.deps.isProviderBlocked()) return;
+    const probe = this.deps.probeActivity();
+    let activity: ProviderActivity = "unknown";
+    try { if (probe) activity = await probe; } catch { return; }
+    this.deps.sessionDebug(`post-interrupt reconcile probe=${activity}`);
+    if (activity === "idle") this.deps.clearProviderTurn("post-interrupt");
+  }
+
   /** Await the same provider-turn-clear signal maintained by status events and the
    * interrupt backstop. Redirect uses this boundary before starting its next turn. */
   waitForProviderTurnClear(timeoutMs = PROVIDER_TURN_CLEAR_TIMEOUT_MS): Promise<void> {
@@ -93,34 +116,49 @@ export class BusyReconciler {
       this.disarm();
       return;
     }
+    // #1656: a probe we could not read is `unknown`, not `idle`. It breaks the streak
+    // exactly like any other non-idle reading — it must never be silently skipped past.
     let activity: ProviderActivity;
-    try { activity = await probe; } catch { return; }
+    try { activity = await probe; } catch { activity = "unknown"; }
     if (activity === "busy") this.sawBusy = true;
     if (activity !== "idle") {
       this.idleStreak = 0;
       this.deps.sessionDebug(`reconcile probe=${activity} sawBusy=${this.sawBusy} streak=${this.idleStreak}`);
       return;
     }
+    // #769 P1-A / #1656: the probe alone does not get to end a turn. An independent pane read
+    // runs on EVERY idle tick — not just once at the force-clear moment — and the streak counts
+    // only ticks where it positively reported `not-busy`. That is the substance of #1656: the
+    // old counter measured "how long since I last saw busy", which a pane that cannot be read at
+    // all satisfies perfectly. It now measures accumulated positive evidence that the turn ended,
+    // and any tick that fails to produce such evidence resets it to zero.
+    const pane = await this.readPaneBusy();
+    if (pane === "busy") {
+      this.idleStreak = 0;
+      this.sawBusy = true;
+      this.deps.sessionDebug("reconcile probe=idle vetoed: pane still reads busy");
+      return;
+    }
+    if (pane === "no-session" || pane === "unreadable") {
+      this.idleStreak = 0;
+      this.deps.sessionDebug(`reconcile probe=idle but pane=${pane} — unknown, holding the turn`);
+      return;
+    }
     this.idleStreak += 1;
     const confirm = this.sawBusy ? BUSY_RECONCILE_IDLE_CONFIRM : BUSY_RECONCILE_IDLE_CONFIRM_NO_BUSY;
-    this.deps.sessionDebug(`reconcile probe=idle sawBusy=${this.sawBusy} streak=${this.idleStreak}/${confirm}`);
+    this.deps.sessionDebug(`reconcile not-busy pane=${pane ?? "none"} sawBusy=${this.sawBusy} streak=${this.idleStreak}/${confirm}`);
     if (this.idleStreak < confirm) return;
-    // #769 P1-A: before force-clearing, give an independent pane-busy read a veto.
-    // If the pane spinner still says busy, the probe-`idle` is untrustworthy (e.g. a
-    // connection retry wrote status:idle mid-turn) — hold the turn instead of clearing.
-    // Symmetric defense-in-depth: only clear when BOTH sources agree the turn is done.
-    const paneBusy = this.deps.probePaneBusy?.();
-    if (paneBusy) {
-      let stillBusy = false;
-      try { stillBusy = (await paneBusy) === true; } catch { stillBusy = false; }
-      if (stillBusy) {
-        this.idleStreak = 0;
-        this.sawBusy = true;
-        this.deps.sessionDebug("reconcile clear vetoed: pane still reads busy");
-        return;
-      }
-    }
     this.disarm();
     this.deps.clearProviderTurn(this.sawBusy ? "backstop reconciler" : "backstop reconciler (no-busy-observed)");
   }
+
+  /** The pane half of one tick. `undefined` means the provider wired no pane read at all (no
+   * pane exists to consult) — distinct from a pane that exists and could not be read, which is
+   * `unreadable` and blocks. A dep that rejects is `unreadable` for the same reason: a failed
+   * read is a fact about the read, never about the provider. */
+  private async readPaneBusy(): Promise<PaneBusyReading | undefined> {
+    const pending = this.deps.probePaneBusy?.();
+    if (!pending) return undefined;
+    try { return await pending; } catch { return "unreadable"; }
+  }
 }

package/src/config.ts

@@ -133,6 +133,16 @@ export function nativeSelfResumeTimeoutMsFromEnv(): number {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 120_000;
 }
 
+/**
+ * #1621 — how long a Claude session-probe `busy`/`shell` assertion stays authoritative with no
+ * rewrite before the pane must corroborate it. See claudeProbeBusyIsStale for the full rationale:
+ * this is a TRUST window, not a busy timeout.
+ */
+export function claudeProbeBusyStaleMsFromEnv(): number {
+  const parsed = Number(process.env.AGENT_RELAY_CLAUDE_PROBE_BUSY_STALE_MS);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 300_000;
+}
+
 export function agentProfileNameFromEnv(): string | undefined {
   return process.env.AGENT_RELAY_AGENT_PROFILE;
 }
@@ -202,6 +212,12 @@ export function runnerInfoFileFromEnv(): string | undefined {
   return process.env.AGENT_RELAY_RUNNER_INFO_FILE;
 }
 
+// #1514 — the owning orchestrator's state-home id, stamped onto each tmux session
+// (@agent-relay-owner) so the wedged-session reaper only reaps sessions it owns.
+export function tmuxOwnerIdFromEnv(): string | undefined {
+  return process.env.AGENT_RELAY_TMUX_OWNER;
+}
+
 export function runnerOutboxDirFromEnv(): string | undefined {
   return process.env.AGENT_RELAY_RUNNER_OUTBOX_DIR;
 }