aiterm-mcp 0.61.14 → 0.61.16

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.16] - 2026-10-24
+
+### Fixed
+
+- Registration and returned launch/send receipt binding perform asynchronous native observation outside the shared metadata mutex. Registration rechecks current admission before adding its record; receipt binding rechecks the exact original issued slot before accepting it. Slow observation no longer blocks unrelated room targets, and uncertain actions remain unreplayed.
+
+## [0.61.15] - 2026-10-24
+
+### Fixed
+
+- Completion checks observe the original request boundary outside the shared metadata mutex, then revalidate the unchanged original record and all uncertainty/slot gates before committing. Slow transcript/native completion observation no longer blocks unrelated admission; unknown sends are never reconciled or replayed.
+
 ## [0.61.14] - 2026-10-24
 
 ### Fixed
@@ -2842,7 +2854,9 @@ prototype (preserved under `prototype/python/` as the porting source and referen
   `ubuntu-latest` for Node 18/20/22, publishing to npm on `v*` tags with
   provenance.
 
-[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.14...HEAD
+[Unreleased]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.16...HEAD
+[0.61.16]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.15...v0.61.16
+[0.61.15]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.14...v0.61.15
 [0.61.14]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.13...v0.61.14
 [0.61.13]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.12...v0.61.13
 [0.61.12]: https://github.com/kitepon/aiterm-mcp/compare/v0.61.11...v0.61.12

package/README.ja.md

@@ -209,7 +209,7 @@ runtime-error store は canonical dotagents config の `collection.enabled: true
 場合だけ収集し、既定OFF、network送信は行いません。tag起点CIのnpm provenance（OIDC Trusted
 Publishing）で公開し、GitHub Release が Official MCP Registry を再登録します。
 
-**状態:** 開発継続中 · 現行公開版 **v0.61.14** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
+**状態:** 開発継続中 · 現行公開版 **v0.61.16** · 動作対象は Linux · WSL2 · macOS · Windows ネイティブ · MIT · [変更履歴](CHANGELOG.md)。
 
 ### 更新と巻き戻し
 

package/README.md

@@ -227,7 +227,7 @@ collection is off by default and performs no network I/O. It ships via
 tag-triggered CI with npm provenance (OIDC Trusted Publishing); the GitHub
 Release re-registers the Official MCP Registry entry.
 
-**Status:** actively maintained · current public release **v0.61.14** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
+**Status:** actively maintained · current public release **v0.61.16** · runs on Linux · WSL2 · macOS · native Windows (tmux on POSIX, the tmux-CLI-compatible [psmux](https://github.com/psmux/psmux) on native Windows — no WSL required) · MIT · see the [CHANGELOG](CHANGELOG.md).
 
 ### Update and rollback
 

package/dist/execution-service.js

@@ -701,7 +701,7 @@ export class ExecutionService {
         }, { readOnly: true });
     }
     async register(args, context, closeExpectation) {
-        return this.store.transaction(async (state) => {
+        const previous = (state) => {
             if (closeExpectation)
                 assertCloseLaunchExpectation(state, closeExpectation, args.reservation.request);
             const previous = state.records.find(record => same(record.reservation.request, args.reservation.request));
@@ -712,20 +712,32 @@ export class ExecutionService {
             }
             if (interruptionBlocksRequest(state, args.reservation.request))
                 throw new ExecutionError("EXECUTION_STOPPING");
-            const source = assessExecutionSource(args.reservation.source, await this.runtime.sourceEvidence(args, context));
-            if (source.status === "stale")
+            return undefined;
+        };
+        const found = await this.store.transaction(previous, { readOnly: true });
+        if (found)
+            return found;
+        // Registration has no native effect. Observe outside the shared writer
+        // mutex, then recheck current admission metadata before adding the record.
+        // Actual invocation still proves the generation at its effect gate.
+        const source = assessExecutionSource(args.reservation.source, await this.runtime.sourceEvidence(args, context));
+        if (source.status === "stale")
+            throw new ExecutionError("EXECUTION_STALE_GENERATION");
+        if (args.reservation.source.launch && source.status !== "verified") {
+            const currentSource = await this.runtime.observe(args.reservation.source.launch.session_id);
+            if (currentSource.state === "absent" || (currentSource.state === "present" && currentSource.launch
+                && !same(currentSource.launch, args.reservation.source.launch)))
                 throw new ExecutionError("EXECUTION_STALE_GENERATION");
-            if (args.reservation.source.launch && source.status !== "verified") {
-                const currentSource = await this.runtime.observe(args.reservation.source.launch.session_id);
-                if (currentSource.state === "absent" || (currentSource.state === "present" && currentSource.launch
-                    && !same(currentSource.launch, args.reservation.source.launch)))
-                    throw new ExecutionError("EXECUTION_STALE_GENERATION");
-            }
+        }
+        const target = args.reservation.target;
+        const current = structuredClone(await this.runtime.observe(target.session_id));
+        return this.store.transaction(state => {
+            const found = previous(state);
+            if (found)
+                return found;
             sourceAdmission(state, source.point, args.source_session_id);
-            const target = args.reservation.target;
             if (targetBlocked(state, args.reservation.request, target.session_id, target.expected_launch_id))
                 throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
-            const current = await this.runtime.observe(target.session_id);
             this.expectTarget(current, target.expected_launch_id, target.session_id);
             if (current.state === "present" && stopped(state, current.launch))
                 throw new ExecutionError("EXECUTION_STOPPING");
@@ -998,44 +1010,56 @@ export class ExecutionService {
         }
         // Parsed above after issuance; null is supported only for an unissued noop.
         const targetPoint = outcome.target;
-        const record = await this.store.transaction(async (state) => {
-            if (closeExpectation)
-                assertCloseLaunchExpectation(state, closeExpectation, request);
-            const record = find(state, request);
-            const slot = state.slots.find(value => same(value.request, request));
-            if (!slot || slot.stage !== stage || record.operations[stage] !== "issued")
-                throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
-            const expected = slot.expected_launch_id;
-            if (targetPoint.launch.session_id !== slot.session_id
-                || (expected !== null && targetPoint.launch.launch_id !== expected))
-                throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
-            const current = await this.runtime.observe(slot.session_id);
-            const closing = request.kind === "mcp" && ["pty_close", "agent_auth.cancel"].includes(request.tool);
-            if (closing ? current.state !== "absent" : current.state !== "present" || !same(current.launch, targetPoint.launch))
-                throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
-            record.operations[stage] = "accepted";
-            // A launch with an initial prompt already performed this reference's
-            // send. Only an empty launch may be followed by a separate pty_send.
-            if (stage === "launch" && targetPoint.boundary)
-                record.operations.send = "accepted";
-            record.relation.target = targetPoint;
-            record.relation.phase = "invoked";
-            record.relation.completion = closing ? "interrupted" : "open";
-            if (closing)
-                record.relation.target_fence = "closed";
-            if (state.stopping.some(value => same(value, record.relation.source?.launch)) && !state.stopping.some(value => same(value, targetPoint.launch)))
-                state.stopping.push(targetPoint.launch);
-            state.slots = state.slots.filter(value => !same(value.request, request));
-            if (closing) {
-                // Actual management close plus confirmed absence releases only these
-                // failed send admissions. Old callbacks still fail their missing-slot
-                // guard, and their records remain unknown and cannot be invoked again.
-                const recovered = recoverableCloseSlots(state, request, slot.session_id, expected);
-                state.slots = state.slots.filter(value => !recovered.includes(value));
-                this.interruptRelations(state, targetPoint.launch);
-            }
-            return view(state, record);
-        }).catch(async () => {
+        const record = await (async () => {
+            const originalSlot = await this.store.transaction(state => {
+                const record = find(state, request);
+                const slot = state.slots.find(value => same(value.request, request));
+                if (!slot || slot.stage !== stage || record.operations[stage] !== "issued")
+                    throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+                return slot;
+            }, { readOnly: true });
+            // A returned action must not monopolize all targets while its native
+            // generation is observed. Keep its exact issued slot until commit, and
+            // reject any concurrent uncertainty/replacement without replaying it.
+            const current = structuredClone(await this.runtime.observe(originalSlot.session_id));
+            return this.store.transaction(state => {
+                if (closeExpectation)
+                    assertCloseLaunchExpectation(state, closeExpectation, request);
+                const record = find(state, request);
+                const slot = state.slots.find(value => same(value.request, request));
+                if (!slot || !same(slot, originalSlot) || slot.stage !== stage || record.operations[stage] !== "issued")
+                    throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+                const expected = slot.expected_launch_id;
+                if (targetPoint.launch.session_id !== slot.session_id
+                    || (expected !== null && targetPoint.launch.launch_id !== expected))
+                    throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+                const closing = request.kind === "mcp" && ["pty_close", "agent_auth.cancel"].includes(request.tool);
+                if (closing ? current.state !== "absent" : current.state !== "present" || !same(current.launch, targetPoint.launch))
+                    throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+                record.operations[stage] = "accepted";
+                // A launch with an initial prompt already performed this reference's
+                // send. Only an empty launch may be followed by a separate pty_send.
+                if (stage === "launch" && targetPoint.boundary)
+                    record.operations.send = "accepted";
+                record.relation.target = targetPoint;
+                record.relation.phase = "invoked";
+                record.relation.completion = closing ? "interrupted" : "open";
+                if (closing)
+                    record.relation.target_fence = "closed";
+                if (state.stopping.some(value => same(value, record.relation.source?.launch)) && !state.stopping.some(value => same(value, targetPoint.launch)))
+                    state.stopping.push(targetPoint.launch);
+                state.slots = state.slots.filter(value => !same(value.request, request));
+                if (closing) {
+                    // Actual management close plus confirmed absence releases only these
+                    // failed send admissions. Old callbacks still fail their missing-slot
+                    // guard, and their records remain unknown and cannot be invoked again.
+                    const recovered = recoverableCloseSlots(state, request, slot.session_id, expected);
+                    state.slots = state.slots.filter(value => !recovered.includes(value));
+                    this.interruptRelations(state, targetPoint.launch);
+                }
+                return view(state, record);
+            });
+        })().catch(async () => {
             // The side effect already returned, but its result could not be safely
             // bound/committed. Absence/replacement is not permission to replay it.
             try {
@@ -1113,6 +1137,8 @@ export class ExecutionService {
         });
     }
     async finish(args) {
+        if (args.evidence.kind === "completion")
+            return this.finishCompletion(args.request, args.evidence.target);
         return this.store.transaction(async (state) => {
             const record = find(state, args.request);
             if (record.operations.launch === "issued" || record.operations.send === "issued"
@@ -1134,34 +1160,63 @@ export class ExecutionService {
                 const target = record.relation.target;
                 if (!target)
                     throw new ExecutionError("EXECUTION_CONFLICT");
-                if (args.evidence.kind === "completion") {
-                    if (!target.boundary || !same(target, args.evidence.target))
-                        throw new ExecutionError("EXECUTION_CONFLICT", "possible");
-                    if (record.relation.completion === "completed" && record.relation.target_fence === "closed")
-                        return view(state, record);
-                    const observed = await this.runtime.completion(target);
-                    if (observed.state === "unknown")
-                        throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
-                    record.relation.completion = observed.state;
-                    record.relation.target_fence = pendingParentReturn(state, args.request) ? "unknown"
-                        : observed.state === "completed" ? "closed" : observed.fence;
-                }
-                else {
-                    if (!same(target.launch, args.evidence.target))
-                        throw new ExecutionError("EXECUTION_CONFLICT", "possible");
-                    if (record.relation.completion === "interrupted" && record.relation.target_fence === "closed")
-                        return view(state, record);
-                    const observed = await this.runtime.observe(target.launch.session_id);
-                    if (observed.state !== "absent" || state.slots.some(slot => slot.session_id === target.launch.session_id))
-                        throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
-                    record.relation.completion = "interrupted";
-                    record.relation.target_fence = "closed";
-                }
+                if (!same(target.launch, args.evidence.target))
+                    throw new ExecutionError("EXECUTION_CONFLICT", "possible");
+                if (record.relation.completion === "interrupted" && record.relation.target_fence === "closed")
+                    return view(state, record);
+                const observed = await this.runtime.observe(target.launch.session_id);
+                if (observed.state !== "absent" || state.slots.some(slot => slot.session_id === target.launch.session_id))
+                    throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+                record.relation.completion = "interrupted";
+                record.relation.target_fence = "closed";
             }
             retireSettledBranches(state);
             return view(state, record);
         });
     }
+    /** Completion evidence is for one fixed historical request/Point. Native
+     * transcript/generation observation must not hold the global writer mutex.
+     * Commit only if the original record and all uncertainty gates still match;
+     * an unrelated writer is allowed to progress while evidence is observed.
+     */
+    async finishCompletion(request, target) {
+        const eligible = (state) => {
+            const record = find(state, request);
+            if ([record.operations.launch, record.operations.send].some(stage => stage === "issued" || stage === "unknown")
+                || state.slots.some(slot => slot.request && same(slot.request, request))
+                || openParentEffect(state, request))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+            if (!record.relation.target)
+                throw new ExecutionError("EXECUTION_CONFLICT");
+            if (!record.relation.target.boundary || !same(record.relation.target, target))
+                throw new ExecutionError("EXECUTION_CONFLICT", "possible");
+            return record;
+        };
+        const settled = (record) => record.relation.completion === "completed" && record.relation.target_fence === "closed";
+        const initial = await this.store.transaction(state => {
+            const record = eligible(state);
+            return { record, result: view(state, record) };
+        }, { readOnly: true });
+        if (settled(initial.record))
+            return initial.result;
+        const observed = { ...await this.runtime.completion(executionPointSchema.parse(target)) };
+        if (observed.state === "unknown")
+            throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+        return this.store.transaction(state => {
+            const record = eligible(state);
+            if (settled(record))
+                return view(state, record);
+            // Do not overwrite a concurrent cancellation, target rebinding, phase
+            // change or interruption with an earlier read's completion evidence.
+            if (!same(record, initial.record))
+                throw new ExecutionError("EXECUTION_UNCONFIRMED", "possible");
+            record.relation.completion = observed.state;
+            record.relation.target_fence = pendingParentReturn(state, request) ? "unknown"
+                : observed.state === "completed" ? "closed" : observed.fence;
+            retireSettledBranches(state);
+            return view(state, record);
+        });
+    }
     /** Adapter for existing restart/configuration/close paths. It shares the
      * same per-seat issuance slots as dispatch and stop, without creating a job ID.
      * Callers must not wrap a multi-step restart in one unobserved callback:

package/docs/DESIGN.md

@@ -62,6 +62,14 @@ source/target世代の観測は保持せず、従来どおり各受付で再照
 実killの直前にもruntimeの同期世代読取を通し、scope/actor/期待launchの交代を拒否する。
 注入runtimeのclose欠測をcore既定処理で補わず、作用後の応答欠測は消失観測があってもunknown slotを保持する。
 完了の照会点は固定し、終了fenceの非同期応答後にも現在世代を確認する。実受取番/終了fenceの証拠adapterは未了。
+通常のcompletion終了確認は元request/Pointを共有lock内で固定し、native/transcript観測をlock外で行う。
+反映時に同じrecord全体・issued/unknown・元slot・親作用を再照合し、途中変更があれば反映しない。
+親返却のpending判定は反映時のstateで行い、元unknownの解除や送信の再実行には使わない。
+実行登録も同じrequestの既存予約を短い共有lock内で確認してから、source/targetの非同期観測をlock外で行う。
+登録反映時に同じ予約・取消・source/targetの受付条件を再確認し、実作用直前の同期世代gateは維持する。
+launch/sendの返却結果は元issued slotを固定してlock外で世代観測し、同じslotとissued状態だけに結合する。
+途中のunknown化・slot交代・観測した世代の不一致はpossibleとして保持し、元作用を再実行しない。
+遅延した要求取消は本物の受付結果を消さず、共有lock内へ非同期の観測待ちを戻さない。
 private producer/worker factoryを構築したprocessではnative effect scopeを必須にする。
 coreの公開変更入口も、打鍵や設定・認証・lock/metadata準備に入る前に対象のrequest contextを要求する。
 この入口確認はissuedへの昇格ではない。実作用時には既存の同期受付を別に通す。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiterm-mcp",
-  "version": "0.61.14",
+  "version": "0.61.16",
   "mcpName": "io.github.kitepon/aiterm-mcp",
   "description": "Persistent terminal MCP with one harness-based launcher for Claude Code, Codex CLI, Grok CLI, and Cursor Agent CLI, plus durable PTYs for SSH, containers, and REPLs.",
   "keywords": [