aibroker 0.62.3 → 0.62.4

package/dist/daemon/manage.js

@@ -1822,8 +1822,8 @@ export function oneLine(text) {
 function landsWhen(m) {
     if (m.paused)
         return "  The manager is paused — nothing is armed until you resume it.";
-    return ("  This changes what the next arming says; it types nothing now.\n" +
-        "  The next arming comes when the session stops — or immediately, with `now`.");
+    return ("  This arms on the next tick — every ask is now, and a line typed at a\n" +
+        "  session mid-turn queues at the turn boundary and interrupts nothing.");
 }
 /**
  * Standing rules: how to work, written once, typed at every arming.
@@ -2091,6 +2091,32 @@ export function applySupervise(m, goal, until, every) {
     m.paused = false;
     note(m, `supervise: until ${until !== null ? hhmm(until) : "open-ended"}, nudge every ${m.nudgeEveryMin ?? "-"} min`);
 }
+/**
+ * Change the standing objective on a managed entry.
+ *
+ * EVERY ask for arming is now (2026-10-17 14:48), and a changed objective is
+ * an ask: the new text must reach the session, not whenever the lapse timer
+ * next gets around to it, but on the very next tick. `0` is the sentinel the
+ * arm gates read as "arm now" — idle or queued behind a running turn, which
+ * is safe because a queued line lands at the turn boundary and interrupts
+ * nothing.
+ */
+export function setObjective(m, objective) {
+    m.objective = objective;
+    m.lastRearmAt = 0;
+}
+/**
+ * Queue an operator instruction, and demand the arming that delivers it.
+ *
+ * The queue only goes out with an arming, so an instruction that did not
+ * demand one waited for the lapse timer — an arming that had nothing to do
+ * with what the operator just said, and one they may wait the better part of
+ * an hour for. Every ask is now: the instruction rides out on the next tick.
+ */
+export function queueInstruction(m, instruction) {
+    m.pending.push(instruction);
+    m.lastRearmAt = 0;
+}
 // ── only the operator ends or shortens a goal ────────────────────────────────
 export const AGENT_REFUSAL = 'refused: only the operator ends or shortens a goal (say "manage <session> off" yourself in a session, or run it from your own terminal)';
 const TOKEN_TTL_MS = 5 * 60_000;
@@ -2194,6 +2220,54 @@ export function nudgeDue(m, content, now) {
     return due !== null && now >= due;
 }
 export const NUDGE_TEXT = "Continue working toward your standing goal.";
+/**
+ * The API-retry banner, seen live 2026-10-17 14:50:
+ *
+ *   Goal still active · the API was unavailable or the connection dropped ·
+ *   retrying in 1 min (1/3) · send a message to retry now
+ *
+ * Claude Code retries three times, then gives up — and the goal sits frozen
+ * over a session that is not working but sleeping between retries. The banner
+ * itself offers the way out — any message retries now — so the manager takes
+ * it: one minimal continue per minute, for as long as the banner lasts,
+ * deterministically and with no cap, because a stretch of API trouble can
+ * outlast any count.
+ */
+export const API_RETRY = /the API was unavailable or the connection dropped|retrying in \d+ min \(\d+\/3\)/;
+/** At most one retry-breaking message per minute while the banner persists. */
+export const API_RETRY_EVERY_MS = 60_000;
+/** The history note about the banner dedups; the nudge itself is 1/60s, not the note. */
+const API_RETRY_NOTE_EVERY_MS = 5 * 60_000;
+export const API_RETRY_TEXT = "Continue now — the API is back. Pick the turn up where it dropped.";
+/**
+ * Type the retry-breaking continue when this pane shows the banner and a
+ * minute has passed since the last one. Never over text sitting unsent on the
+ * input line (skip silently; the next tick tries again), never while paused,
+ * never past a shift's end — the banner is not a reason to restart a
+ * stood-down session. Returns true when a line went out.
+ *
+ * The tick calls it before the busy gate: the retry wait IS the busy state
+ * here, and typing mid-turn is safe because the line queues at the turn
+ * boundary. `type` is injectable so the caller's exact behavior is testable
+ * without a terminal; the tick passes nothing and gets the real one.
+ */
+export function apiRetryNudge(m, content, now, type = typeIntoSession) {
+    if (m.paused || shiftOver(m, now))
+        return false;
+    if (!API_RETRY.test(content))
+        return false;
+    if (promptUnsentText(content) !== null)
+        return false;
+    if (now - (m.lastApiRetryAt ?? 0) < API_RETRY_EVERY_MS)
+        return false;
+    type(m.sessionId, API_RETRY_TEXT);
+    m.lastApiRetryAt = now;
+    if (!m.apiRetryNotedAt || now - m.apiRetryNotedAt >= API_RETRY_NOTE_EVERY_MS) {
+        note(m, "API-retry banner on the pane — typed a continue to break the retry wait (1/min while it lasts)");
+        m.apiRetryNotedAt = now;
+    }
+    return true;
+}
 const hhmm = (t) => {
     const d = new Date(t);
     return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
@@ -2499,7 +2573,7 @@ export async function tryExclusive(busy, id, fn) {
         busy.delete(id);
     }
 }
-async function arm(m, reason) {
+export async function arm(m, reason) {
     const { text } = goalText(m);
     /**
      * NEVER TYPE A GOAL INTO A BARE SHELL.
@@ -2524,12 +2598,12 @@ async function arm(m, reason) {
     const live = await readSessionContentAsync(m.sessionId, 5);
     if (!live) {
         note(m, "the session could not be read — not typing anything");
-        return false;
+        return "failed";
     }
     if (live.atPrompt && !isClaudePane(live.name)) {
         m.paused = true;
         notify(m, "PAUSED — that pane is at a shell prompt, so the session has exited. Not typing a goal into a shell. `resume` once it is back.");
-        return false;
+        return "failed";
     }
     /**
      * TEXT ON THE INPUT LINE — READ BACK FIRST, NEVER DESTROY LIVE INPUT.
@@ -2546,9 +2620,12 @@ async function arm(m, reason) {
      * SKIPPED and retried next tick — never cleared, never typed over —
      * unless the IDENTICAL text has sat there for GHOST_TICKS consecutive
      * ticks (2 minutes) while the session is idle, which is inputLineDecision's
-     * job to decide. Skips still count toward armFails/armFailStreak below, so
-     * a line occupied for minutes still reaches blockedReason's operator alert
-     * (with a screenshot) — the daemon does not stall silently either way.
+     * job to decide. A skip is NOT a failure: it counts toward nothing (on
+     * 2026-10-17 14:42 the operator typing while a demanded arm waited was
+     * counted as arm failures, crossed the cap, and the arm was never even
+     * typed — see test/manage-arm-skip.test.ts). The skip says so in the log at
+     * most once per 5 minutes; a DEMANDED arm held this way says so loudly, and
+     * once.
      */
     const onLine = promptUnsentText(await readPaneAsync(m.sessionId));
     const armIdleMs = Math.max(0, Date.now() - m.lastChangeAt);
@@ -2561,8 +2638,23 @@ async function arm(m, reason) {
         inputLineTracking.delete(m.sessionId);
     const lineDecision = inputLineDecision({ text: onLine ?? "", sameForTicks, idle: armIdle, idleMs: armIdleMs });
     if (lineDecision.action === "skip") {
-        note(m, `arm deferred: input line holds '${onLine}' (unsent for ${sameForTicks} tick${sameForTicks === 1 ? "" : "s"}, idle ${Math.round(armIdleMs / 1000)}s)`);
-        return false;
+        if (m.lastRearmAt !== 0) {
+            delete m.forcedArmHoldNotedAt;
+            if (!m.armSkipNotedAt || Date.now() - m.armSkipNotedAt >= 5 * 60_000) {
+                note(m, `arm deferred: input line holds '${onLine}' (unsent for ${sameForTicks} tick${sameForTicks === 1 ? "" : "s"}, idle ${Math.round(armIdleMs / 1000)}s)`);
+                m.armSkipNotedAt = Date.now();
+            }
+        }
+        else {
+            // The operator demanded this arm; what is holding it is their own
+            // unsent line. Say so, once, where it will be seen.
+            if (!m.forcedArmHoldNotedAt) {
+                notify(m, `a demanded arm (${reason}) is NOT being typed: the input line holds the operator's own unsent text ` +
+                    `("${(onLine ?? "").slice(0, 60)}") — clear or send that line to let the arm through; it is not typed over`);
+                m.forcedArmHoldNotedAt = Date.now();
+            }
+        }
+        return "skipped";
     }
     if (lineDecision.action === "clear-then-type") {
         note(m, lineDecision.logCleared ?? "clearing persistent input-line text before typing");
@@ -2591,7 +2683,7 @@ async function arm(m, reason) {
     }
     if (!pasteTextIntoSession(m.sessionId, text)) {
         note(m, `could not type into the session (${reason}) — will retry`);
-        return false;
+        return "failed";
     }
     const { line: echoedLine, waitedMs } = await readBackTyped({
         read: async () => promptUnsentText(await readPaneAsync(m.sessionId, { fresh: true })) ?? "",
@@ -2602,7 +2694,7 @@ async function arm(m, reason) {
         await sleep(300);
         const left = promptUnsentText(await readPaneAsync(m.sessionId, { fresh: true })) ?? "";
         note(m, `arm aborted: after ${waitedMs}ms line read back as "${echoedLine.slice(0, 60)}" not "${text.slice(0, 60)}"; after Ctrl-U the input ${left ? `still holds ${left.length} chars ("${left.slice(0, 60)}")` : "is empty"}`);
-        return false;
+        return "failed";
     }
     sendEnterKey(m.sessionId);
     // Typed is not sent, and sent is not received.
@@ -2613,14 +2705,70 @@ async function arm(m, reason) {
     });
     if (landed) {
         m.lastRearmAt = Date.now();
+        delete m.forcedArmHoldNotedAt;
         const carried = m.pending.length;
         m.pending = [];
         armingsSinceReport.set(m.sessionId, (armingsSinceReport.get(m.sessionId) ?? 0) + 1);
         note(m, `armed: ${reason}${carried ? ` (carrying ${carried} operator instruction${carried > 1 ? "s" : ""})` : ""}`);
-        return true;
+        return "armed";
     }
     notify(m, `typed but the goal never took (no active marker, or the line stayed in the input) — input cleared, treating as NOT armed (${reason})`);
-    return false;
+    return "failed";
+}
+/**
+ * The book-keeping one arm attempt's outcome earns, shared by every caller
+ * that retries on the tick.
+ *
+ * ONLY a "failed" counts. A skip is not here because it is not a fault: the
+ * guard that declined (the operator's own text on the input line) is doing
+ * its job, and the demand — or the lapse — is still pending on the next tick.
+ * Counting skips is the 2026-10-17 14:42 fault: three ticks of the operator
+ * typing crossed this cap, the cap consumed the forced-arm sentinel, and the
+ * manager went silent exactly when it had been told to act.
+ */
+export function applyArmResult(m, result, now) {
+    if (result === "armed") {
+        m.armFails = 0;
+        m.armFailStreak = 0;
+        delete m.stuckSince;
+        delete m.blockedSince;
+        delete m.blockedAlertedAt;
+        return;
+    }
+    if (result === "skipped")
+        return;
+    m.armFails = (m.armFails ?? 0) + 1;
+    m.armFailStreak = (m.armFailStreak ?? 0) + 1;
+    if (m.armFails >= ARM_ATTEMPTS) {
+        m.armFails = 0;
+        // The cap must not eat the sentinel: `lastRearmAt === 0` is a pending
+        // DEMANDED arm, and stamping it with `now` is what turned "arm NOW" into
+        // a 90-second cooldown and then a permanent mute on 2026-10-17 14:42.
+        // A pending forced arm survives the cap.
+        if (m.lastRearmAt !== 0)
+            m.lastRearmAt = now;
+        m.stuckSince ??= now;
+        // No operator push here. Pushing on every cap is the 144-alerts-overnight
+        // bug: this fires again every ~2-4 minutes for as long as arming keeps
+        // failing, and it is content-agnostic — it cannot tell "mid-turn, will
+        // clear itself" from "stuck on a modal for hours". The blocked check
+        // above owns the operator alert now: it has `armFailStreak`/`stuckSince`
+        // (which survive this reset) plus a static-pane confirmation, and its
+        // own BLOCKED_REALERT_MS dedup. This stays log-only.
+        note(m, `arming keeps failing (streak ${m.armFailStreak}) — holding off; the blocked check owns the operator alert now`);
+    }
+}
+/**
+ * Whether the stuck backoff — arming having crossed ARM_ATTEMPTS — may hold
+ * this session's arm back.
+ *
+ * A DEMANDED arm (`lastRearmAt === 0`) is never held by it. This is the other
+ * half of the 2026-10-17 14:42 fix: once the cap had marked the session stuck
+ * mid-demand, this gate muted every later tick, so the demanded arm was never
+ * even typed. A demand outranks a backoff it had no part in earning.
+ */
+export function stuckBackoffHolds(m) {
+    return m.stuckSince !== undefined && m.lastRearmAt !== 0;
 }
 /**
  * Why a managed session should be treated as BLOCKED — waiting on a human
@@ -2676,23 +2824,40 @@ export function turnStoppedIdle(t, paneText, now) {
     return !QUEUED_HINT_RE.test(last) && !SPINNER_RE.test(last) && !BACKGROUND_RUNNING_RE.test(last);
 }
 export const GOAL_GONE_REASON = "goal gone before until, re-armed";
+export const FORCED_ARM_REASON = "asked to arm now";
 /** How long one queued arm is awaited before another may be typed. */
 export const QUEUED_ARM_WAIT_MS = 10 * 60_000;
 export const GOAL_GONE_BUSY_REASON = "goal gone before until, re-armed (session busy, queued)";
+export const GOAL_FORCED_BUSY_REASON = "asked to arm now (session busy, queued)";
 /**
- * Goal gone while the session is mid-turn: Claude Code queues a submitted line
- * and runs it at the next turn boundary, so arming now interrupts nothing.
- * Same guards as the idle rule (not paused, until ahead, input line empty) plus
- * at most one pending arm. Clears the pending mark once the marker is back or
- * the turn is over.
+ * An arm due while the session is mid-turn: Claude Code queues a submitted
+ * line and runs it at the next turn boundary, so arming now interrupts
+ * nothing. Same guards as the idle rule (not paused, until ahead, input line
+ * empty) plus at most one pending arm. Clears the pending mark once the marker
+ * is back or the turn is over.
+ *
+ * Forced arms too (`lastRearmAt === 0`, set by `now`, a new objective, a
+ * queued instruction, or supervise with a new goal), because a session arming
+ * ITSELF through the MCP tool is by definition mid-turn when it asks —
+ * waiting for an idle pane defers its request until a hard-working session
+ * happens to go quiet, which may be never. Unlike the goal-gone case the
+ * forced arm fires with the old marker still on screen: the point of the call
+ * is to replace that goal with the new text.
  */
 export function busyGoalGoneReason(m, content, now, busy) {
-    if (!busy || GOAL_ACTIVE.test(content)) {
+    if (!busy) {
+        delete m.queuedArmAt;
+        return null;
+    }
+    const forced = reasonToArm(m, content, now) === FORCED_ARM_REASON;
+    if (!forced && GOAL_ACTIVE.test(content)) {
         delete m.queuedArmAt;
         return null;
     }
     if (m.queuedArmAt !== undefined && now - m.queuedArmAt < QUEUED_ARM_WAIT_MS)
         return null;
+    if (forced)
+        return GOAL_FORCED_BUSY_REASON;
     return reasonToArm({ ...m, lastRearmAt: m.lastRearmAt || 1 }, content, now) === GOAL_GONE_REASON
         ? GOAL_GONE_BUSY_REASON
         : null;
@@ -2709,7 +2874,7 @@ export function reasonToArm(m, content, now) {
     // true of a number and nonsense about the world — the kind of line that costs
     // somebody ten minutes at three in the morning.
     if (m.lastRearmAt === 0)
-        return "asked to arm now";
+        return FORCED_ARM_REASON;
     const quietFor = Math.max(0, now - m.lastChangeAt);
     const armedFor = Math.max(0, now - m.lastRearmAt);
     const marker = GOAL_ACTIVE.test(content);
@@ -3349,7 +3514,21 @@ async function tick() {
          * from when it would otherwise fire — it never suppresses one, since a
          * genuinely stuck session goes quiet on the transcript too.
          */
-        // Goal gone mid-turn: queue the arm behind the turn instead of waiting for an idle tick.
+        /**
+         * API-RETRY KEEP-ALIVE — ahead of every gate below that continues on a
+         * busy or blocked pane, because the retry wait IS the busy state here and
+         * waiting it out loses the stretch: Claude Code retries three times and
+         * gives up, leaving the goal frozen over a session that is only sleeping
+         * between its own retries. The banner coexists with "Goal still active",
+         * so this never re-arms — it only breaks the retry wait.
+         */
+        if (apiRetryNudge(m, content, now)) {
+            dirty = true;
+            continue;
+        }
+        // Goal gone — or a forced arm (now / supervise with a new goal, asked by a
+        // session that is itself mid-turn) — mid-turn: queue the arm behind the
+        // turn instead of waiting for an idle tick.
         const queuedReason = busyGoalGoneReason(m, content, now, working && !paneLooksIdle(content, now - m.lastChangeAt));
         if (queuedReason && now - m.lastRearmAt >= REARM_COOLDOWN_MS) {
             // Pending whether or not the read-back saw it land: a queued line is invisible until the turn ends.
@@ -3357,7 +3536,7 @@ async function tick() {
             const queued = await tryExclusive(arming, m.sessionId, () => arm(m, queuedReason));
             if (queued === undefined)
                 delete m.queuedArmAt;
-            else if (!queued)
+            else if (queued === "failed")
                 note(m, `${queuedReason} — not confirmed, waiting for the turn to end or the marker`);
             dirty = true;
             continue;
@@ -3424,7 +3603,12 @@ async function tick() {
         // REARM_COOLDOWN_MS. This is what actually fixes the overnight bug: the
         // old code kept re-arming (and re-spamming) forever because each retype
         // reset lastChangeAt and the freeze detector never got a quiet window.
-        if (m.stuckSince !== undefined)
+        //
+        // But a DEMANDED arm is never held here (2026-10-17 14:42): the cap had
+        // marked the session stuck while the operator was mid-demand, and this
+        // gate then muted every tick after it — the demanded arm was never even
+        // typed. A demand outranks a backoff it had no part in earning.
+        if (stuckBackoffHolds(m))
             continue;
         if (now - m.lastRearmAt < REARM_COOLDOWN_MS)
             continue;
@@ -3472,34 +3656,19 @@ async function tick() {
          * ordinary rules — the session is still managed, and the next genuine
          * lapse arms it — and the operator is told, because a manager that has
          * given up on delivering a goal is the one thing it must never do quietly.
+         *
+         * Counting is for GENUINE FAILURES only. On 2026-10-17 14:42 the count
+         * also took guard skips: the operator, mid-demand ("arm NOW"), was typing
+         * into the pane, three occupied-line ticks crossed the cap, the cap
+         * consumed the forced-arm sentinel, and the manager — told to act — never
+         * typed at all. A guard declining is the system working, not the attempt
+         * failing.
          */
         const armed = await tryExclusive(arming, m.sessionId, () => arm(m, reason));
         if (armed === undefined)
             continue; // another arm for this session is in flight
         dirty = true;
-        if (armed) {
-            m.armFails = 0;
-            m.armFailStreak = 0;
-            delete m.stuckSince;
-            delete m.blockedSince;
-            delete m.blockedAlertedAt;
-            continue;
-        }
-        m.armFails = (m.armFails ?? 0) + 1;
-        m.armFailStreak = (m.armFailStreak ?? 0) + 1;
-        if (m.armFails >= ARM_ATTEMPTS) {
-            m.armFails = 0;
-            m.lastRearmAt = now;
-            m.stuckSince ??= now;
-            // No operator push here. Pushing on every cap is the 144-alerts-overnight
-            // bug: this fires again every ~2-4 minutes for as long as arming keeps
-            // failing, and it is content-agnostic — it cannot tell "mid-turn, will
-            // clear itself" from "stuck on a modal for hours". The blocked check
-            // above owns the operator alert now: it has `armFailStreak`/`stuckSince`
-            // (which survive this reset) plus a static-pane confirmation, and its
-            // own BLOCKED_REALERT_MS dedup. This stays log-only.
-            note(m, `arming keeps failing (streak ${m.armFailStreak}) — holding off; the blocked check owns the operator alert now`);
-        }
+        applyArmResult(m, armed, now);
     }
     if (dirty)
         saveState(state);
@@ -3664,7 +3833,8 @@ export async function handleManage(sessionIdOrName, rawArg, opts = {}) {
                 `                a bounded stretch of autonomous work on the tracker's open\n` +
                 `                issues: objective, screen decision, expiry and arming in one\n` +
                 `                sentence. \`shift off\` stands it down without killing it\n` +
-                `  now           arm immediately, whatever the signals say\n` +
+                `  now           arm immediately, whatever the signals say — safe mid-turn,\n` +
+                `                the /goal line queues behind a running turn\n` +
                 `  pause         stop arming, keep the objective\n` +
                 `  resume        start arming again\n` +
                 `  off           stop managing entirely\n` +
@@ -3877,7 +4047,7 @@ export async function handleManage(sessionIdOrName, rawArg, opts = {}) {
     const setMatch = arg.match(/^(?:set|objective|replace|start)\s+([\s\S]+)$/i);
     if (setMatch && existing) {
         const before = existing.objective;
-        existing.objective = setMatch[1].trim();
+        setObjective(existing, setMatch[1].trim());
         // Notes written against the old objective may not make sense against the
         // new one; say so rather than silently carrying them over.
         const dropped = existing.pending.length;
@@ -3909,7 +4079,7 @@ export async function handleManage(sessionIdOrName, rawArg, opts = {}) {
     const addMatch = arg.match(/^(?:add|also|append|extend)\s+([\s\S]+)$/i);
     if (addMatch && existing) {
         const extra = addMatch[1].trim();
-        existing.objective = `${existing.objective} Also: ${extra}`;
+        setObjective(existing, `${existing.objective} Also: ${extra}`);
         note(existing, `objective extended: ${extra.slice(0, 80)}`);
         saveState(state);
         return {
@@ -4163,9 +4333,12 @@ export async function handleManage(sessionIdOrName, rawArg, opts = {}) {
             objective,
             pending: [],
             history: [],
-            // Give the session the benefit of the grace period rather than arming
-            // on top of whatever it is doing at the moment the operator types this.
-            lastRearmAt: Date.now(),
+            // EVERY ask for arming is now (2026-10-17 14:48). The grace period this
+            // line once gave — don't arm on top of whatever the session is doing as
+            // the operator types — predates safe mid-turn queuing: a queued arm
+            // lands at the turn boundary and interrupts nothing, so its reason is
+            // gone, and 0 arms on the very next tick.
+            lastRearmAt: 0,
             lastChangeAt: Date.now(),
             lastHash: hash(readPane(sessionId)),
             tty: snapshotTty(sessionId),
@@ -4191,7 +4364,7 @@ export async function handleManage(sessionIdOrName, rawArg, opts = {}) {
         return { ok: true, managed: true, message: `${name} will be armed on the next tick` };
     }
     const instruction = arg.match(/^instruct\s+([\s\S]+)$/i)?.[1].trim() ?? arg;
-    existing.pending.push(instruction);
+    queueInstruction(existing, instruction);
     note(existing, `operator: ${instruction.slice(0, 80)}`);
     saveState(state);
     return {