atris 3.80.0 → 3.82.1

package/lib/engine-ask.js

@@ -246,7 +246,7 @@ function assertAskModelSupported(engine, model) {
 function resolveAskModel(engine, modelName = '') {
   const requested = String(modelName || '').trim();
   if (requested) {
-    // A display name ("opus 5.5") becomes an id only for the claude cli; every
+    // A spaced display name becomes an id only for the claude cli; every
     // other engine gets its model name as typed.
     return engine === 'claude' || engine === 'fable' || engine === 'haiku'
       ? claudeModelId(requested)

package/lib/engine-receipt-sweep.js

@@ -93,6 +93,70 @@ function sweepEngineAskReceipts(root, deps = {}) {
   return summary;
 }
 
+// Fleet and dispatch flights write a running receipt with the driver's pid
+// and rewrite it when they finish. A crashed flight never rewrites it, so the
+// receipt read as running forever. Flights run long, so the age bar is an hour
+// and a live pid always keeps the receipt as it is.
+const DISPATCH_RECEIPT_SCHEMA = 'atris.dispatch_receipt.v1';
+const FLEET_GRACE_MS = 60 * 60 * 1000;
+const FLEET_SWEEP_NOTE = 'stale receipt sweep marked this flight presumed dead: its process is gone and it never finished.';
+
+function isFleetReceipt(name, receipt) {
+  if (receipt.schema === DISPATCH_RECEIPT_SCHEMA) return name.startsWith('dispatch-');
+  return !receipt.schema && name.startsWith('fleet-') && Array.isArray(receipt.results);
+}
+
+function sweepFleetReceipts(root, deps = {}) {
+  const fsModule = deps.fs || fs;
+  const kill = deps.kill || process.kill;
+  const now = deps.now ? deps.now() : new Date();
+  const nowMs = now.getTime();
+  const graceMs = deps.graceMs === undefined ? FLEET_GRACE_MS : Number(deps.graceMs);
+  const summary = { scanned: 0, finalized: 0, skipped_alive: 0, skipped_young: 0 };
+  const runsDir = path.join(root, 'atris', 'runs');
+  let names;
+  try {
+    names = fsModule.readdirSync(runsDir)
+      .filter((name) => name.endsWith('.json') && (name.startsWith('fleet-') || name.startsWith('dispatch-')))
+      .sort();
+  } catch {
+    return summary;
+  }
+  for (const name of names) {
+    const receiptPath = path.join(runsDir, name);
+    let receipt;
+    let stat;
+    try {
+      receipt = JSON.parse(fsModule.readFileSync(receiptPath, 'utf8'));
+      stat = fsModule.statSync(receiptPath);
+    } catch {
+      continue;
+    }
+    if (!receipt || typeof receipt !== 'object' || receipt.status !== 'running' || !isFleetReceipt(name, receipt)) continue;
+    summary.scanned += 1;
+    // Age from the last write, not the start: a long flight rewrites its
+    // receipt as tasks land.
+    const lastWriteMs = Math.max(receiptStartedMs(receipt, stat), stat.mtimeMs);
+    if (nowMs - lastWriteMs < graceMs) {
+      summary.skipped_young += 1;
+      continue;
+    }
+    if (processIsAlive(Number(receipt.pid), kill)) {
+      summary.skipped_alive += 1;
+      continue;
+    }
+    atomicWriteReceipt(receiptPath, {
+      ...receipt,
+      status: 'presumed_dead',
+      swept_at: now.toISOString(),
+      note: FLEET_SWEEP_NOTE,
+    }, fsModule);
+    summary.finalized += 1;
+  }
+  return summary;
+}
+
 module.exports = {
   sweepEngineAskReceipts,
+  sweepFleetReceipts,
 };

package/lib/file-lock.js

@@ -0,0 +1,175 @@
+'use strict';
+
+// One exclusive lock file per resource, shared by the loops that must not run
+// twice at once (autoland tick, autopilot, mission, campaign run).
+//
+// - Create is exclusive (`wx`), so two takers never both win.
+// - The file records { pid, host, token, at }. Release removes it only while
+//   the token (or the open file) is still ours, so a tick that lost its lock
+//   to a stale-steal never deletes the next owner's lock.
+// - A stale lock is stolen by renaming it to a unique tombstone first. If the
+//   renamed file turns out not to be the one judged stale (someone replaced
+//   it in between), it is linked back without clobbering. Two waiters that
+//   both judged the same lock stale can no longer delete each other's fresh
+//   lock.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function pidAlive(pid) {
+  const n = Number(pid);
+  if (!Number.isInteger(n) || n <= 0) return false;
+  try {
+    process.kill(n, 0);
+    return true;
+  } catch (error) {
+    return Boolean(error) && error.code === 'EPERM';
+  }
+}
+
+function readRaw(file) {
+  try { return fs.readFileSync(file, 'utf8'); } catch { return null; }
+}
+
+function parseHolder(raw) {
+  if (raw == null) return null;
+  try {
+    const value = JSON.parse(raw);
+    return value && typeof value === 'object' ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+function sameFile(a, b) {
+  return Boolean(a && b) && a.ino === b.ino && a.dev === b.dev;
+}
+
+// Remove `file` only if it is still the file described by `judged` (stat) and
+// `judgedRaw` (contents). Returns true when the caller should retry create.
+function stealStaleLock(file, judged, judgedRaw) {
+  const tomb = `${file}.stale-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
+  try {
+    fs.renameSync(file, tomb);
+  } catch (error) {
+    if (error && error.code === 'ENOENT') return true;
+    throw error;
+  }
+  let moved = null;
+  try { moved = fs.statSync(tomb); } catch {}
+  const movedRaw = readRaw(tomb);
+  if (!sameFile(moved, judged) || (judgedRaw != null && movedRaw !== judgedRaw)) {
+    // We grabbed a lock that was replaced after we judged it. Put it back
+    // without overwriting anything created since.
+    try { fs.linkSync(tomb, file); } catch {}
+  }
+  try { fs.unlinkSync(tomb); } catch {}
+  return true;
+}
+
+// Decide whether a lock someone else holds may be taken over.
+function judgeHolder(holder, ageMs, { host, isAlive, staleAfterMs, unreadableGraceMs }) {
+  if (!holder) return ageMs > unreadableGraceMs ? 'stale' : 'held';
+  const holderPid = Number(holder.pid);
+  const atMs = typeof holder.at === 'number' ? holder.at : Date.parse(holder.at || holder.started_at || '');
+  const heldFor = Number.isFinite(atMs) ? Date.now() - atMs : ageMs;
+  if (Number.isFinite(staleAfterMs) && heldFor > staleAfterMs) return 'stale';
+  if (holder.host && holder.host !== host) return 'held';
+  if (!Number.isInteger(holderPid) || holderPid <= 0) return ageMs > unreadableGraceMs ? 'stale' : 'held';
+  return isAlive(holderPid) ? 'held' : 'stale';
+}
+
+// Returns { ok: true, file, token, fd?, release() } or { ok: false, file, holder }.
+// Options:
+//   meta              extra fields written into the lock record
+//   pid, host         identity written into the record (defaults: this process)
+//   staleAfterMs      a lock older than this is stale even with a live pid
+//   unreadableGraceMs an empty/unreadable lock younger than this is held
+//                     (its owner may still be writing the record)
+//   keepOpen          return the open fd (release then checks the inode)
+//   isAlive           pid liveness probe (tests)
+function acquireFileLock(file, options = {}) {
+  const {
+    meta = {},
+    pid = process.pid,
+    host = os.hostname(),
+    staleAfterMs = Infinity,
+    unreadableGraceMs = 5000,
+    keepOpen = false,
+    isAlive = pidAlive,
+    attempts = 5,
+  } = options;
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const token = crypto.randomBytes(8).toString('hex');
+  const record = JSON.stringify({ ...meta, pid, host, token, at: new Date().toISOString() });
+  let lastHolder = null;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    let fd;
+    try {
+      fd = fs.openSync(file, 'wx');
+    } catch (error) {
+      if (!error || error.code !== 'EEXIST') throw error;
+    }
+    if (fd !== undefined) {
+      try {
+        fs.writeSync(fd, record);
+      } catch (error) {
+        try { fs.closeSync(fd); } catch {}
+        try { fs.unlinkSync(file); } catch {}
+        throw error;
+      }
+      let ino = null;
+      try { ino = fs.fstatSync(fd); } catch {}
+      if (!keepOpen) {
+        try { fs.closeSync(fd); } catch {}
+        fd = undefined;
+      }
+      const lock = { ok: true, file, token, fd, stat: ino, record };
+      lock.release = () => releaseFileLock(lock);
+      return lock;
+    }
+    let judged;
+    try {
+      judged = fs.statSync(file);
+    } catch (error) {
+      if (error && error.code === 'ENOENT') continue;
+      throw error;
+    }
+    const raw = readRaw(file);
+    const holder = parseHolder(raw);
+    lastHolder = holder;
+    const verdict = judgeHolder(holder, Date.now() - judged.mtimeMs, { host, isAlive, staleAfterMs, unreadableGraceMs });
+    if (verdict === 'held') return { ok: false, file, holder };
+    stealStaleLock(file, judged, raw);
+  }
+  return { ok: false, file, holder: lastHolder || parseHolder(readRaw(file)) };
+}
+
+// Remove the lock only while it is still ours.
+function releaseFileLock(lock) {
+  if (!lock || !lock.ok || lock.released) return false;
+  lock.released = true;
+  let ours = false;
+  if (lock.fd != null) {
+    try {
+      ours = sameFile(fs.fstatSync(lock.fd), fs.statSync(lock.file));
+    } catch {
+      ours = false;
+    }
+    try { fs.closeSync(lock.fd); } catch {}
+  } else {
+    const holder = parseHolder(readRaw(lock.file));
+    ours = Boolean(holder) && holder.token === lock.token;
+  }
+  if (!ours) return false;
+  try { fs.unlinkSync(lock.file); } catch { return false; }
+  return true;
+}
+
+module.exports = {
+  acquireFileLock,
+  stealStaleLock,
+  pidAlive,
+};

package/lib/fleet.js

@@ -179,7 +179,7 @@ function buildFleetPrompt(task, { worktreePath, yolo = false } = {}) {
   lines.push(
     'Rules:',
     mapNotesPath(worktreePath || process.cwd())
-      ? '- Read atris/MAP.md first to locate the code, then atris/refs/MAP-NOTES.md for exact file:line refs; never guess file locations.'
+      ? '- Read atris/MAP.md first to locate the code, then atris/refs/MAP-NOTES.md (or the area note it points to) for exact file:line refs; never guess file locations.'
       : '- Read atris/MAP.md first to locate the code; never guess file locations.',
     ...SHARED_BRIEF_RULES,
     '- Run git status first. Stage ONLY files you changed. Never revert or touch files another agent modified.',