agent-tempo 1.5.0 → 1.5.1

package/dashboard/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-tempo-dashboard",
   "private": true,
-  "version": "1.5.0",
+  "version": "1.5.1",
   "type": "module",
   "description": "Web dashboard for agent-tempo. Bundled into the npm package; served by the daemon at /dashboard/*.",
   "scripts": {

package/dist/cli/commands.js

@@ -345,6 +345,10 @@ async function applyLineupPlayersAndSchedules(args) {
                     temporalTlsKeyPath: config.temporalTlsKeyPath,
                     isConductor: false,
                     workDir: playerWorkDir,
+                    // #672 — a `up --lineup` copilot PLAYER is also spawned directly (no
+                    // terminal) by the transient CLI → same self-kill bug as the conductor.
+                    // Skip the ppid-poll; daemon-recruit copilot (outbox.ts) keeps it.
+                    transientSpawner: true,
                 });
             }
             else {
@@ -589,6 +593,9 @@ async function start(opts) {
             temporalTlsKeyPath: config.temporalTlsKeyPath,
             isConductor: opts.conductor,
             workDir,
+            // #672 — CLI-direct copilot spawn (start path): transient `up`/`conduct`
+            // spawner → skip the ppid-poll. Daemon-recruit copilot (outbox.ts) omits it.
+            transientSpawner: true,
         });
         out.success(`Launched copilot bridge "${sessionName}" (pid ${pid ?? 'unknown'})`);
     }
@@ -1304,6 +1311,10 @@ async function up(opts) {
             temporalTlsKeyPath: config.temporalTlsKeyPath,
             isConductor: true,
             workDir: process.cwd(),
+            // #672 — the `up` CLI is a TRANSIENT spawner; the detached bridge must NOT
+            // ppid-poll it (would self-kill seconds after launch → lease never renews →
+            // all players detach). The daemon-recruit path (outbox.ts) omits this.
+            transientSpawner: true,
         }));
     }
     else if (conductorAgent === 'pi') {

package/dist/cli/config-command.d.ts

@@ -1,3 +1,18 @@
+import type { AgentType } from '../types';
+/**
+ * Agents valid as a persistent `defaultAgent` — the conductor-capable PRODUCTION
+ * agents. `defaultAgent` drives the conductor that `up` / `start` / `conduct`
+ * spawn when no `--agent` is given (`cli.ts` `resolvedAgent`), and the
+ * conductor-spawn branch only realises `copilot` / `pi` / else→`claude`. So:
+ *   - `mock` is DEV-ONLY (recruit pre-flight rejects it outside dev mode) — never
+ *     a persistent default.
+ *   - the headless adapters (`claude-api` / `opencode` / `claude-code-headless`)
+ *     can't be a conductor — they'd silently fall through to `claude` — so they
+ *     are not offered here.
+ * Single source of truth for the interactive selector + `config set` validation
+ * (#666 — adds `pi` so the new interactive Pi conductor can be the default).
+ */
+export declare const VALID_DEFAULT_AGENTS: readonly AgentType[];
 /** Interactive config setup: `agent-tempo config` */
 export declare function configInteractive(): Promise<void>;
 /** Non-interactive: `agent-tempo config set <key> <value>` */

package/dist/cli/config-command.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.VALID_DEFAULT_AGENTS = void 0;
 exports.configInteractive = configInteractive;
 exports.configSet = configSet;
 exports.configShow = configShow;
@@ -41,6 +42,20 @@ const readline = __importStar(require("readline"));
 const config_1 = require("../config");
 const config_2 = require("../config");
 const out = __importStar(require("./output"));
+/**
+ * Agents valid as a persistent `defaultAgent` — the conductor-capable PRODUCTION
+ * agents. `defaultAgent` drives the conductor that `up` / `start` / `conduct`
+ * spawn when no `--agent` is given (`cli.ts` `resolvedAgent`), and the
+ * conductor-spawn branch only realises `copilot` / `pi` / else→`claude`. So:
+ *   - `mock` is DEV-ONLY (recruit pre-flight rejects it outside dev mode) — never
+ *     a persistent default.
+ *   - the headless adapters (`claude-api` / `opencode` / `claude-code-headless`)
+ *     can't be a conductor — they'd silently fall through to `claude` — so they
+ *     are not offered here.
+ * Single source of truth for the interactive selector + `config set` validation
+ * (#666 — adds `pi` so the new interactive Pi conductor can be the default).
+ */
+exports.VALID_DEFAULT_AGENTS = ['claude', 'copilot', 'pi'];
 // NOTE: `createTemporalConnection` is dynamic-imported inside `configInteractive`'s
 // connection-test step (issue #157 PR C). Top-level static import would pull in
 // `@temporalio/client`, defeating the crash-proof property of `config show` /
@@ -131,11 +146,11 @@ async function configInteractive() {
         config.temporalTlsKeyPath = await ask('TLS key path', existing.temporalTlsKeyPath);
     }
     // Default agent type
-    const agentChoice = await choose('Default agent', ['claude', 'copilot']);
-    if (agentChoice === 'copilot') {
-        config.defaultAgent = 'copilot';
+    const agentChoice = await choose('Default agent', [...exports.VALID_DEFAULT_AGENTS]);
+    if (agentChoice !== 'claude') {
+        config.defaultAgent = agentChoice;
     }
-    // Don't set defaultAgent if claude — it's the default, keeps config clean
+    // Don't set defaultAgent if claude — it's the implicit default, keeps config clean
     (0, config_1.saveConfigFile)(config);
     out.success(`Saved to ${config_1.CONFIG_FILE_PATH}`);
     // Test connection
@@ -190,9 +205,9 @@ function configSet(key, value) {
         out.log(`  Valid keys: ${Object.keys(keyMap).join(', ')}`);
         process.exit(1);
     }
-    // Validate agent type
-    if (configKey === 'defaultAgent' && value !== 'claude' && value !== 'copilot') {
-        out.error(`Invalid agent type: "${value}". Must be "claude" or "copilot".`);
+    // Validate agent type — restrict to the conductor-capable production agents.
+    if (configKey === 'defaultAgent' && !exports.VALID_DEFAULT_AGENTS.includes(value)) {
+        out.error(`Invalid agent type: "${value}". Must be one of: ${exports.VALID_DEFAULT_AGENTS.join(', ')}.`);
         process.exit(1);
     }
     config[configKey] = value;

package/dist/client/core.js

@@ -1167,6 +1167,21 @@ function createTempoClientCore(client, opts = {}) {
                 return false;
             }
         },
+        async ensembleExists(ensemble) {
+            // #673 — STRONGLY-CONSISTENT existence check. `describe()` the per-ensemble
+            // maestro HUB (started at `up`/creation via `ensureMaestroWorkflow`) — it
+            // reflects a just-started workflow IMMEDIATELY, unlike `listEnsembles`
+            // (Temporal visibility, eventually consistent on Cloud). Only RUNNING
+            // counts as "exists": a TERMINATED/COMPLETED hub (destroyed ensemble) → false,
+            // and a never-created hub throws WorkflowNotFoundError → false.
+            try {
+                const desc = await handle((0, config_1.maestroWorkflowId)(ensemble)).describe();
+                return desc.status.name === 'RUNNING';
+            }
+            catch {
+                return false;
+            }
+        },
         // ── Maestro session (TUI-owned workflow for two-way messaging) ──
         async ensureMaestroSession(ensemble) {
             const workflowId = (0, config_1.sessionWorkflowId)(ensemble, 'maestro');

package/dist/client/interface.d.ts

@@ -428,6 +428,15 @@ export interface TempoClientCore {
     isConnected(): Promise<boolean>;
     /** Check if the Global Maestro workflow is running. */
     hasGlobalMaestro(): Promise<boolean>;
+    /**
+     * #673 — STRONGLY-CONSISTENT existence check for an ensemble: `describe()` the
+     * per-ensemble maestro hub workflow (started at `up`/creation) and report
+     * whether it's RUNNING. Unlike {@link listEnsembles} (Temporal VISIBILITY,
+     * eventually consistent on Cloud), `describe` reflects a just-started workflow
+     * immediately — the SSE existence gate uses it as a fallback so a fresh
+     * ensemble isn't 404'd before visibility catches up.
+     */
+    ensembleExists(ensemble: string): Promise<boolean>;
     /**
      * Subscribe to the per-ensemble SSE event stream exposed by the daemon
      * at `/v1/events/:ensemble`. Returns an `AsyncIterable<TempoEvent>` —

package/dist/config.d.ts

@@ -121,6 +121,15 @@ export declare const ENV: {
      * module loads (see `src/cli/dev-mode-bootstrap.ts`).
      */
     readonly DEV_MODE: "AGENT_TEMPO_DEV_MODE";
+    /**
+     * #672 — set to `'1'` by a TRANSIENT-CLI spawner (e.g. the short-lived `up`
+     * conductor) on a process it intentionally DETACHES to outlive that spawner.
+     * Tells the parent-death watchdog to skip ONLY the ppid-poll signal (which
+     * would otherwise self-kill the detached process when the transient spawner
+     * exits); the universally-correct stdin-EOF signal stays. Daemon-recruit
+     * spawns do NOT set it, so recruited adapters keep the #604 anti-leak ppid-poll.
+     */
+    readonly NO_PPID_WATCHDOG: "AGENT_TEMPO_NO_PPID_WATCHDOG";
     /**
      * Escape hatch for triple-isolated environments (ADR 0014 §5.3). When
      * set, `resolveTempoHome()` returns this path verbatim — bypassing both

package/dist/config.js

@@ -152,6 +152,15 @@ exports.ENV = {
      * module loads (see `src/cli/dev-mode-bootstrap.ts`).
      */
     DEV_MODE: 'AGENT_TEMPO_DEV_MODE',
+    /**
+     * #672 — set to `'1'` by a TRANSIENT-CLI spawner (e.g. the short-lived `up`
+     * conductor) on a process it intentionally DETACHES to outlive that spawner.
+     * Tells the parent-death watchdog to skip ONLY the ppid-poll signal (which
+     * would otherwise self-kill the detached process when the transient spawner
+     * exits); the universally-correct stdin-EOF signal stays. Daemon-recruit
+     * spawns do NOT set it, so recruited adapters keep the #604 anti-leak ppid-poll.
+     */
+    NO_PPID_WATCHDOG: 'AGENT_TEMPO_NO_PPID_WATCHDOG',
     /**
      * Escape hatch for triple-isolated environments (ADR 0014 §5.3). When
      * set, `resolveTempoHome()` returns this path verbatim — bypassing both

package/dist/http/server.js

@@ -546,9 +546,20 @@ async function handle(req, res, ctx) {
         }
         // Validate existence before opening the SSE stream — clean 404 when
         // the ensemble was never live, instead of an empty stream.
+        //
+        // #673 — `listEnsembles` is a Temporal VISIBILITY query (eventually
+        // consistent; ~seconds behind on Temporal Cloud), so immediately after
+        // `up`/creation the just-started maestro hub isn't indexed yet and this
+        // gate would 404 — which the subscribe client classes as PERMANENT, leaving
+        // the TUI stuck on "Loading messages…". Before 404'ing, fall back to a
+        // STRONGLY-CONSISTENT describe of the maestro hub (`ensembleExists`): a
+        // RUNNING hub means the ensemble is live even if visibility hasn't caught up.
         const list = await ctx.client.listEnsembles().catch(() => []);
         if (!list.find((e) => e.name === ensemble)) {
-            return (0, responses_1.errorResponse)(res, 404, { error: 'ensemble-not-found', ensemble });
+            const existsStrong = await ctx.client.ensembleExists(ensemble).catch(() => false);
+            if (!existsStrong) {
+                return (0, responses_1.errorResponse)(res, 404, { error: 'ensemble-not-found', ensemble });
+            }
         }
         const bus = ctx.aggregate.getOrCreateEnsembleBus(ensemble);
         return (0, sse_handler_1.handleSseRequest)(req, res, {

package/dist/spawn.d.ts

@@ -150,6 +150,16 @@ export interface CopilotBridgeOpts {
     attachmentId?: string;
     attachmentRunId?: string;
     adapterId?: string;
+    /**
+     * #672 — set true by a TRANSIENT-CLI spawner that launches this bridge DETACHED
+     * to outlive it: BOTH the `up` conductor (commands.ts) AND the `up --lineup`
+     * copilot PLAYER loop (commands.ts applyLineupPlayersAndSchedules) — both spawn
+     * the bridge directly (no terminal), so its ppid is the short-lived CLI. When
+     * set, the bridge skips the ppid-poll that would self-kill it on the CLI's exit
+     * (stdin-EOF stays). The DAEMON-recruit path (outbox.ts) OMITS it → the bridge
+     * keeps the ppid-poll (#604 anti-leak on daemon death; ppid = persistent daemon).
+     */
+    transientSpawner?: boolean;
 }
 export interface CopilotBridgeResult {
     pid: number | undefined;

package/dist/spawn.js

@@ -518,6 +518,10 @@ function buildPiConductorSpawn(opts) {
         [config_1.ENV.TASK_QUEUE]: opts.taskQueue,
         [config_1.ENV.ENSEMBLE]: opts.ensemble,
         [config_1.ENV.CONDUCTOR]: 'true', // codebase-consistent; the Pi extension accepts '1'|'true'
+        // #672 — the Pi conductor is launched detached by the transient `up` CLI:
+        // skip the ppid-poll (no current pi process installs the watchdog, but this is
+        // propagation-safe + principled if a pi subprocess ever does; stdin-EOF stays).
+        [config_1.ENV.NO_PPID_WATCHDOG]: '1',
         [config_1.ENV.PLAYER_NAME]: opts.sessionName,
         ...(opts.devMode ? { [config_1.ENV.DEV_MODE]: '1' } : {}),
         ...(opts.anthropicApiKey ? { ANTHROPIC_API_KEY: opts.anthropicApiKey } : {}),
@@ -565,6 +569,9 @@ function spawnCopilotBridge(opts) {
                 [config_1.ENV.BRIDGE_MODE]: '', // Clear parent's bridge mode
                 [config_1.ENV.TEMPORAL_ADDRESS]: opts.temporalAddress,
                 [config_1.ENV.CONDUCTOR]: opts.isConductor ? 'true' : '',
+                // #672 — transient-CLI spawner: the detached bridge skips the ppid-poll
+                // (would self-kill on the short-lived `up` exit). Daemon recruit omits it.
+                ...(opts.transientSpawner ? { [config_1.ENV.NO_PPID_WATCHDOG]: '1' } : {}),
                 // Forward Temporal connection settings so child processes can connect
                 ...(opts.temporalNamespace ? { [config_1.ENV.TEMPORAL_NAMESPACE]: opts.temporalNamespace } : {}),
                 ...(opts.temporalApiKey ? { [config_1.ENV.TEMPORAL_API_KEY]: opts.temporalApiKey } : {}),

package/dist/tui/index.js

@@ -134,6 +134,7 @@ function createDummyClient() {
         restore: fail,
         isConnected: async () => false,
         hasGlobalMaestro: async () => false,
+        ensembleExists: async () => false,
         getSchedules: async () => [],
         cancelSchedule: fail,
         getEnsembleChat: async () => ({ messages: [], total: 0, hasMore: false, hasConductor: false }),

package/dist/utils/parent-death-watchdog.d.ts

@@ -1 +1,13 @@
+/**
+ * Should the ppid-poll signal be installed? FALSE only when a TRANSIENT-CLI
+ * spawner set {@link ENV.NO_PPID_WATCHDOG} on a process it intentionally detached
+ * to OUTLIVE it (#672 — e.g. the short-lived `up` conductor: polling its dead pid
+ * would self-kill the conductor seconds after launch). Pure + injectable.
+ *
+ * Skipping ppid-poll is propagation-SAFE: the flag inherits down the spawn tree,
+ * but stdin-EOF (always installed) protects any child — its stdin IS this
+ * process's pipe, so it fires the instant THIS process dies. Only the ppid-poll
+ * (which keys on the SPAWNER, not the immediate parent) is the harmful signal.
+ */
+export declare function shouldInstallPpidPoll(env?: NodeJS.ProcessEnv): boolean;
 export declare function installParentDeathWatchdog(): void;

package/dist/utils/parent-death-watchdog.js

@@ -23,15 +23,40 @@
 // we falsely conclude the parent is alive. The stdin EOF path catches
 // that case immediately, so this is purely a fallback.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldInstallPpidPoll = shouldInstallPpidPoll;
 exports.installParentDeathWatchdog = installParentDeathWatchdog;
+const config_1 = require("../config");
 const log = (...args) => console.error('[agent-tempo:watchdog]', ...args);
+/**
+ * Should the ppid-poll signal be installed? FALSE only when a TRANSIENT-CLI
+ * spawner set {@link ENV.NO_PPID_WATCHDOG} on a process it intentionally detached
+ * to OUTLIVE it (#672 — e.g. the short-lived `up` conductor: polling its dead pid
+ * would self-kill the conductor seconds after launch). Pure + injectable.
+ *
+ * Skipping ppid-poll is propagation-SAFE: the flag inherits down the spawn tree,
+ * but stdin-EOF (always installed) protects any child — its stdin IS this
+ * process's pipe, so it fires the instant THIS process dies. Only the ppid-poll
+ * (which keys on the SPAWNER, not the immediate parent) is the harmful signal.
+ */
+function shouldInstallPpidPoll(env = process.env) {
+    return env[config_1.ENV.NO_PPID_WATCHDOG] !== '1';
+}
 function installParentDeathWatchdog() {
     const exit = (reason) => {
         log('parent gone (', reason, ') — exiting');
         process.exit(0);
     };
+    // stdin-EOF — UNIVERSALLY correct + ALWAYS installed: a closed stdin pipe means
+    // the IMMEDIATE parent is gone. This is what reaps a detached process's OWN
+    // children even when ppid-poll is skipped (the child's stdin is our pipe).
     process.stdin.on('end', () => exit('stdin end'));
     process.stdin.on('close', () => exit('stdin close'));
+    // ppid-poll — keys on the SPAWNER's death. Correct for a long-lived daemon
+    // spawner (#604 anti-leak), HARMFUL for a transient CLI that detached us to
+    // outlive it (#672). Skipped when the spawner marked itself transient; the
+    // Temporal lease TTL reaps a genuinely-orphaned detached process instead.
+    if (!shouldInstallPpidPoll())
+        return;
     const parentPid = process.ppid;
     if (parentPid && parentPid > 1) {
         const timer = setInterval(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-tempo",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Many agents, one tempo. Durable coordination for multi-agent work via Temporal.",
   "keywords": [
     "mcp",