agentus 0.4.5 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
  "name": "agentus",
- "version": "0.4.5",
+ "version": "0.5.0",
  "description": "Multi-session web cockpit for ACP-speaking coding agents (Qoder CLI / Hermes). UI has no intelligence — the agent lives in spawned CLI subprocesses.",
  "license": "Apache-2.0",
  "repository": {
@@ -65,6 +65,10 @@
   "notify-testbed": "tsx scripts/notify-testbed.mts",
   "notify-smoke": "tsx scripts/notify-smoke.mts",
   "web-notify-rules": "tsx scripts/qa/web-notify-rules.mts",
+  "notify-chime": "tsx scripts/qa/notify-chime.mts",
+  "ws-send-ack": "node scripts/qa/ws-send-ack.mjs",
+  "send-ack": "node scripts/qa/send-ack-page.mjs",
+  "composer-input": "node scripts/qa/composer-input-sweep.mjs",
   "web-notify-sweep": "node scripts/qa/web-notify-sweep.mjs",
   "apk": "bash scripts/build-apk.sh",
   "transcript-fold": "tsx scripts/qa/transcript-fold.mts",

package/packages/server/src/acp/session-manager.ts

@@ -972,6 +972,12 @@ export class SessionManager {
        * message, no attribution, indistinguishable from something they typed).
        */
       origin?: { sessionId: string; title?: string | null };
+      /**
+       * Client-generated id of the prompt that is being sent (issue #26). Echoed on the `turn-start`
+       * this call causes, so a page can prove its frame landed instead of assuming `ws.send()` did
+       * something. Opaque to the server: it comes back unchanged, it is never stored.
+       */
+      pid?: string;
     } = {},
   ): Promise<void> {
     const s = this.#need(sessionId);
@@ -1038,7 +1044,7 @@ export class SessionManager {
     // Timed from the announcement, not from the prompt call: the operator's wait INCLUDES the
     // moment the card lit up. Only the queue-wait above is excluded (that is other turns' time).
     const turnStartedAt = Date.now();
-    this.#emit({ t: "turn-start", sessionId, trace: this.#turnTrace(s) });
+    this.#emit({ t: "turn-start", sessionId, trace: this.#turnTrace(s), ...(opts.pid ? { pid: opts.pid } : {}) });
     const msg = this.#store.appendMessage({
       sessionId,
       kind: "user",

package/packages/server/src/index.ts

@@ -450,8 +450,9 @@ function runPrompt(
   text: string,
   attachments: PromptAttachment[] = [],
   interrupt = false,
+  pid?: string,
 ): void {
-  void mgr.prompt(sessionId, text, attachments, { interrupt }).catch((e: unknown) => {
+  void mgr.prompt(sessionId, text, attachments, { interrupt, pid }).catch((e: unknown) => {
     const msg = describeAcpError(e);
     const tail = mgr.stderrTail(sessionId);
     console.error(`[agentus] prompt failed for ${sessionId}: ${msg}${tail ? `\n  agent stderr tail:\n  ${tail}` : ""}`);
@@ -463,7 +464,10 @@ function runPrompt(
     const lost = msg === "turn already running" || msg === IMAGE_UNSUPPORTED;
     emit({ t: "message", message: {
       seq: -1, sessionId, kind: "meta",
-      payload: { text: `turn failed: ${msg}`, ...(lost ? { rejectedPrompt: text } : {}) },
+      // `pid` rides along (issue #26) so the page can pair this refusal with the prompt it is still
+      // waiting to acknowledge: without it the refusal and the ack timeout both put the same sentence
+      // back in line, and the operator sees his message twice.
+      payload: { text: `turn failed: ${msg}`, ...(lost ? { rejectedPrompt: text } : {}), ...(pid ? { pid } : {}) },
       createdAt: Date.now(),
     } });
     // `turn-end` is the frame that says A TURN IS OVER. For the two "nothing left the client" refusals
@@ -1510,7 +1514,7 @@ async function post(path){const r=await fetch(path,{method:'POST'});alert(r.ok?'
         const attachments = Array.isArray(body.attachments) ? (body.attachments as PromptAttachment[]) : [];
         if (!text && !attachments.length) return send(res, 400, { error: "empty prompt" });
         // fire & forget: stream arrives via WS; client watches turn-start/end
-        void runPrompt(id, text, attachments, body.interrupt === true);
+        void runPrompt(id, text, attachments, body.interrupt === true, typeof body.pid === "string" ? body.pid : undefined);
         return send(res, 202, { ok: true });
       }
       if (req.method === "POST" && sub === "/workspace") {
@@ -1795,6 +1799,9 @@ const handleUpgrade = (req: IncomingMessage, socket: Duplex, head: Buffer) => {
 httpServer.on("upgrade", handleUpgrade);
 wss.on("connection", (ws) => {
   const clientId = randomUUID().slice(0, 8);
+  // Any frame — including a pong — proves the peer is alive (see the heartbeat below).
+  (ws as WebSocket & { isAlive?: boolean }).isAlive = true;
+  ws.on("pong", () => { (ws as WebSocket & { isAlive?: boolean }).isAlive = true; });
   clients.set(clientId, { ws, lastSeen: new Map() });
   const sendEvt = (e: ServerEvent) => {
     if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(e));
@@ -1831,7 +1838,7 @@ wss.on("connection", (ws) => {
           break;
         }
         case "prompt":
-          void runPrompt(cmd.sessionId, cmd.text, cmd.attachments ?? [], cmd.interrupt === true);
+          void runPrompt(cmd.sessionId, cmd.text, cmd.attachments ?? [], cmd.interrupt === true, cmd.pid);
           break;
         case "cancel":
           await mgr.cancel(cmd.sessionId);
@@ -1865,6 +1872,35 @@ wss.on("connection", (ws) => {
   ws.on("close", () => clients.delete(clientId));
 });
 
+// ---- liveness: the half-open socket ---------------------------------------------------------
+// A TCP connection that dies without a FIN (Wi-Fi switch, laptop sleep, NAT timeout) stays OPEN in
+// BOTH ends: the page's `send()` succeeds into the void, and this server keeps a client that will
+// never read again. There is no traffic to fail on, so nothing above this line can notice — and the
+// operator's message is written into a socket nobody owns, with no bubble and no error (issue #26,
+// measured live 2026-10-11 with the network cut). Ping/pong is the only detector the protocol gives
+// us: browsers answer `ping` automatically, so a missing pong means the peer is gone.
+//
+// 20s, not 60s: the window between "socket died" and "page knows" is exactly how long a prompt can
+// vanish, and the ack timeout on the client (8s) covers what happens inside one beat. An idle
+// cockpit costs 3 tiny frames a minute.
+const HEARTBEAT_MS = Number(process.env.AGENTUS_WS_HEARTBEAT_MS ?? "") || 20_000;
+const heartbeat = setInterval(() => {
+  for (const [id, client] of clients) {
+    const ws = client.ws as WebSocket & { isAlive?: boolean };
+    if (ws.isAlive === false) {
+      // No pong since the last beat: the peer is not there. `terminate()` (not `close()`) because a
+      // half-open peer never answers the closing handshake either — this is the only way out.
+      ws.terminate();
+      clients.delete(id);
+      continue;
+    }
+    ws.isAlive = false;
+    try { ws.ping(); } catch { /* already gone; the next beat reaps it */ }
+  }
+}, HEARTBEAT_MS);
+heartbeat.unref();
+
+
 // ---- the workspace panel's terminal -----------------------------------------
 // A shell is a stream, so it gets its own socket instead of riding the event bus:
 // one socket = one shell, and closing the socket (or the tab) kills the shell.

package/packages/shared/src/index.ts

@@ -206,7 +206,10 @@ export type ServerEvent =
       durationMs?: number }
   /** per-turn trace: what model/effort/mode this turn is actually running with
    *  (AionUi F-DISPLAY-11 lineage — "why did it behave differently?" ) */
-  | { t: "turn-start"; sessionId: string; trace?: TurnTrace }
+  /** `pid` is the id of the prompt that started this turn, copied from the client's command (issue
+   *  #26): it is the only thing that can prove a particular frame landed. Absent for turns the page
+   *  did not start (a call utterance, the cockpit's cross-session `send`, a resumed transcript). */
+  | { t: "turn-start"; sessionId: string; trace?: TurnTrace; pid?: string }
   /** A one-line status from the AGENT itself (issue #18): `👁️ Hindsight — recalled 8 memories`,
    *  a compaction countdown, a provider wait. Deliberately NOT a transcript row and not persisted —
    *  it describes what the process is doing NOW, so the page shows the latest one beside the running
@@ -407,7 +410,12 @@ export type ClientCommand =
    *  wait for it to actually stop before sending this prompt. Call mode sends every utterance
    *  this way (the operator speaking over the agent IS the interrupt), which is also what
    *  removes the race between an async cancel and the next prompt. */
-  | { t: "prompt"; sessionId: string; text: string; attachments?: PromptAttachment[]; interrupt?: boolean }
+  | { t: "prompt"; sessionId: string; text: string; attachments?: PromptAttachment[]; interrupt?: boolean;
+      /** Client-generated id for THIS prompt, echoed back on the `turn-start` it causes (issue #26).
+       *  Without it a page can only guess whether its frame landed: a socket that dies without a FIN
+       *  stays `OPEN` in JS, so `send()` returns true for a frame nobody received and the operator's
+       *  words vanish with no error. With it, "the server started a turn for prompt X" is a fact. */
+      pid?: string }
   | { t: "cancel"; sessionId: string }
   | { t: "set-mode"; sessionId: string; modeId: string }
   | { t: "set-config"; sessionId: string; configId: string; value: string | number | boolean }