borgmcp 3.11.1 → 3.12.0

package/src/log-stream.ts

@@ -125,12 +125,14 @@ function isProcessAlive(pid: number): boolean {
  * Used by defaultDeps when no explicit injectOpenCode is supplied.
  */
 let _moduleInjectOpenCode:
-  | ((text: string, entryId: string, allowSubmit: boolean, sourceEntryId?: string) => Promise<boolean>)
+  | ((text: string, entryId: string, allowSubmit: boolean, sourceEntryId?: string,
+      isSourcePending?: () => Promise<boolean>) => Promise<boolean>)
   | undefined;
 let _moduleSettleOpenCodeEntry: ((sourceEntryId: string) => void) | undefined;
 
 export function setModuleInjectOpenCode(
-  fn: (text: string, entryId: string, allowSubmit: boolean, sourceEntryId?: string) => Promise<boolean>,
+  fn: (text: string, entryId: string, allowSubmit: boolean, sourceEntryId?: string,
+    isSourcePending?: () => Promise<boolean>) => Promise<boolean>,
   settle: (sourceEntryId: string) => void,
 ): void {
   _moduleInjectOpenCode = fn;
@@ -392,7 +394,7 @@ export interface StreamDeps {
     renderedLine: string
   ) => Promise<boolean>;
   /** Optional Codex app-server wake sink; tests inject a spy. */
-  wakeCodex?: (reason: string, deliveryIdentity?: string) => void;
+  wakeCodex?: (reason: string, deliveryIdentity?: string, sourceEntryId?: string) => void;
   /** Override the heartbeat watchdog timeout. */
   heartbeatTimeoutMs?: number;
   /** Override HWM divergence grace for focused tests. */
@@ -409,6 +411,7 @@ export interface StreamDeps {
     entryId: string,
     allowSubmit: boolean,
     sourceEntryId?: string,
+    isSourcePending?: () => Promise<boolean>,
   ) => Promise<boolean>;
   /** Inspect whether one retry source remains beyond the durable unread cursor. */
   hasPendingWakeEntry?: (active: ActiveCube, entryId: string) => Promise<boolean>;
@@ -422,16 +425,16 @@ const defaultDeps: Required<StreamDeps> = {
   getCursor: getLocalServerCursor,
   appendLine: defaultAppendLine,
   hasInboxEntryId: defaultHasInboxEntryId,
-  wakeCodex: (reason, deliveryIdentity) =>
-    wakeCodexViaAppServer(reason, process.env, {}, deliveryIdentity),
+  wakeCodex: (reason, deliveryIdentity, sourceEntryId) =>
+    wakeCodexViaAppServer(reason, process.env, {}, deliveryIdentity, sourceEntryId),
   heartbeatTimeoutMs: HEARTBEAT_TIMEOUT_MS,
   hwmDivergenceGraceMs: HWM_DIVERGENCE_GRACE_MS,
   abortSignal: new AbortController().signal,
   ownerDeps: {},
   ownerStaleMs: 70_000,
-  injectOpenCode: (text, entryId, allowSubmit, sourceEntryId) =>
+  injectOpenCode: (text, entryId, allowSubmit, sourceEntryId, isSourcePending) =>
     _moduleInjectOpenCode
-      ? _moduleInjectOpenCode(text, entryId, allowSubmit, sourceEntryId)
+      ? _moduleInjectOpenCode(text, entryId, allowSubmit, sourceEntryId, isSourcePending)
       : Promise.resolve(false),
   hasPendingWakeEntry: (active, entryId) => hasPendingDurableWakeEntry(
     active as Parameters<typeof hasPendingDurableWakeEntry>[0],
@@ -902,7 +905,10 @@ export async function streamOnce(
       // OpenCode queue. A still-unread re-ping may reconcile the prior attempt;
       // its source entry ID prevents a new nonce from resubmitting that prompt.
       if (isReping) {
-        await injectOpenCode(formatOpenCodeWakePrompt(line), deliveryId, true, ev.id);
+        await injectOpenCode(
+          formatOpenCodeWakePrompt(line), deliveryId, true, ev.id,
+          () => hasPendingWakeEntry(active, ev.id),
+        );
       }
       markEventPersisted(ev.id, ev.data?.created_at ?? '');
       return 'persisted-skip';
@@ -910,12 +916,12 @@ export async function streamOnce(
     // The inbox append is the durable record. OpenCode injection is only the
     // wake attempt and may return before the agent finishes processing.
     await appendLine(active.cubeId, active.droneId, line);
-    const openCodeDelivered = isReping
-      ? await injectOpenCode(formatOpenCodeWakePrompt(line), deliveryId, true, ev.id)
-      : await injectOpenCode(formatOpenCodeWakePrompt(line), deliveryId, true);
+    const openCodeDelivered = await injectOpenCode(
+      formatOpenCodeWakePrompt(line), deliveryId, true, ev.id,
+      () => hasPendingWakeEntry(active, ev.id),
+    );
     if (!openCodeDelivered) {
-      if (ev.wake_nonce === undefined) wakeCodex(formatCodexWakePrompt(line));
-      else wakeCodex(formatCodexWakePrompt(line), ev.wake_nonce);
+      wakeCodex(formatCodexWakePrompt(line), ev.wake_nonce, ev.id);
     }
     return 'written';
   };
@@ -1234,9 +1240,12 @@ export async function streamOnce(
           if (
             wakeNonce !== undefined &&
             await shouldDeliverWakeRetry(event.id) &&
-            !(await injectOpenCode(formatOpenCodeWakePrompt(line), wakeNonce, true, event.id))
+            !(await injectOpenCode(
+              formatOpenCodeWakePrompt(line), wakeNonce, true, event.id,
+              () => hasPendingWakeEntry(active, event.id),
+            ))
           ) {
-            wakeCodex(formatCodexWakePrompt(line), wakeNonce);
+            wakeCodex(formatCodexWakePrompt(line), wakeNonce, event.id);
           }
           continue;
         }

package/src/opencode-drone.ts

@@ -89,6 +89,7 @@ interface OpenCodeDelivery {
   acceptedSubmission: boolean;
   sessionId: string | null;
   settled: boolean;
+  isSourcePending?: () => Promise<boolean>;
   state: Exclude<OpenCodeDeliveryState, 'failed'>;
   resolve: (delivered: boolean) => void;
   promise: Promise<boolean>;
@@ -628,6 +629,14 @@ async function deliverOpenCodeEntry(
 ): Promise<OpenCodeDeliveryOutcome> {
   let target: OCSession | null = null;
 
+  const sourcePending = async (): Promise<boolean> => {
+    if (!delivery.isSourcePending) return true;
+    if (await delivery.isSourcePending()) return true;
+    delivery.settled = true;
+    settleOpenCodeEntry(delivery.sourceEntryId);
+    return false;
+  };
+
   // Before the one allowed POST, retries are safe: no submission has happened.
   // OpenCode must generate the message ID: its run loop treats IDs as
   // lexicographically ordered, so arbitrary caller IDs can persist without
@@ -636,6 +645,7 @@ async function deliverOpenCodeEntry(
   for (let attempt = 0; attempt < OPEN_CODE_DELIVERY_RETRY_DELAYS_MS.length; attempt++) {
     if (delivery.settled) return 'delivered';
     if (state !== owner || !owner.connected) return 'failed';
+    if (!(await sourcePending())) return 'delivered';
     if (attempt > 0) {
       delivery.state = 'retried';
       owner.totalEntriesRetried++;
@@ -688,6 +698,7 @@ async function deliverOpenCodeEntry(
       delivery.state = 'delivered-unconfirmed';
     } else {
       if (delivery.settled) return 'delivered';
+      if (!(await sourcePending())) return 'delivered';
       owner.pendingSubmissions.set(delivery.entryId, {
         sourceEntryId: delivery.sourceEntryId,
         sessionId: target.id,
@@ -864,6 +875,7 @@ export function injectOpenCodeEntry(
   entryId: string = createHash('sha256').update(text).digest('hex'),
   allowSubmit: boolean = true,
   sourceEntryId: string = entryId,
+  isSourcePending?: () => Promise<boolean>,
 ): Promise<boolean> {
   const owner = state;
   if (!owner?.connected) {
@@ -882,7 +894,7 @@ export function injectOpenCodeEntry(
   );
   if (pendingSource) {
     log(`entry ${entryId} reconciles pending source ${sourceEntryId}`);
-    return injectOpenCodeEntry(text, pendingSource[0], false, sourceEntryId);
+    return injectOpenCodeEntry(text, pendingSource[0], false, sourceEntryId, isSourcePending);
   }
   for (const [deliveredEntryId, record] of owner.deliveredEntries) {
     if (deliveredEntryId !== entryId && record.sourceEntryId === sourceEntryId) {
@@ -967,6 +979,7 @@ export function injectOpenCodeEntry(
     acceptedSubmission: false,
     sessionId: null,
     settled: false,
+    isSourcePending,
     state: 'queued',
     resolve: resolveDelivery,
     promise,

package/src/remote-client.ts

@@ -16,6 +16,7 @@ import {
 import { randomUUID } from 'node:crypto';
 import {
   createProtocolEnvelope,
+  decodeAppendLogResult,
   decodeDeleteCubeResponse,
   decodeDeleteRoleRequest,
   decodeDeleteRoleResult,
@@ -90,7 +91,7 @@ const UNREAD_CURSOR_MAX_TRANSPORT_RETRIES = 1;
 // Replay is opt-in: most local requests are mutations or have ambiguous
 // delivery, while unread-log reads carry an explicit cursor and are safe to
 // repeat with the exact same request body.
-type AuthedFetchRetryMode = 'unread-cursor';
+type AuthedFetchRetryMode = 'unread-cursor' | 'append-log';
 export const LOCAL_SERVER_RESPONSE_LIMIT_BYTES = 32 * 1024 * 1024;
 // A typed auth-error envelope is tiny; anything larger is hostile and the
 // bounded read throws → the 401 fails closed to non-destructive CREDENTIAL_REJECTED.
@@ -790,17 +791,17 @@ async function authedFetch(
     return res;
   };
 
-  let transportRetriesRemaining = retryMode === 'unread-cursor'
+  let transportRetriesRemaining = retryMode === 'unread-cursor' || retryMode === 'append-log'
     ? UNREAD_CURSOR_MAX_TRANSPORT_RETRIES
     : 0;
   const requestWithRetry = async (): Promise<Response> => {
     try {
       return await buildRequest(token);
     } catch (error) {
-      if (retryMode !== 'unread-cursor' || !isConnectionReset(error)) throw error;
+      if ((retryMode !== 'unread-cursor' && retryMode !== 'append-log') || !isConnectionReset(error)) throw error;
       if (transportRetriesRemaining === 0) throw unreadLogTransportFailure(error);
       transportRetriesRemaining -= 1;
-      debugLog('↻ retrying unread log read after ECONNRESET');
+      debugLog(`↻ retrying ${retryMode === 'append-log' ? 'log append' : 'unread log read'} after ECONNRESET`);
       try {
         return await buildRequest(token);
       } catch (retryError) {
@@ -1334,31 +1335,14 @@ export async function appendLog(
     to?: string[];
     serverTrustIdentity?: string;
   } = {}
-): Promise<{
-  entry: {
-    id: string;
-    cube_id: string;
-    drone_id: string;
-    message: string;
-    visibility: 'broadcast' | 'direct';
-    created_at: string;
-  };
-  routing?: {
-    class: string | null;
-    recipients: string[];
-    fellOpen: boolean;
-    message: string | null;
-  } | null;
-  // gh#534: directed recipients currently unreachable via the wake path
-  // (wake-path:deaf). Empty/absent for broadcast or all-reachable sends.
-  unreachableRecipients?: { id: string; label: string }[];
-}> {
+): Promise<ReturnType<typeof decodeAppendLogResult>> {
   if (opts.visibility === 'broadcast' && (opts.to?.length ?? 0) > 0) {
     throw new Error(
       "Invalid input: visibility:'broadcast' cannot be combined with non-empty to:. " +
       'Remove visibility to direct to recipients, or remove to: to broadcast.',
     );
   }
+  const postId = randomUUID();
   const local = await localAuthorityContext(
     sessionToken,
     apiUrl,
@@ -1386,11 +1370,12 @@ export async function appendLog(
     } else if (visibility === undefined && recipientDroneIds !== undefined) {
       visibility = 'direct';
     }
-    const payload = await localServerRequest<{ entry: any }>(
+    const payload = await localServerRequest<ReturnType<typeof decodeAppendLogResult>>(
       local,
       `/api/cubes/${local.cubeId}/logs`,
       'POST',
       {
+        post_id: postId,
         message,
         ...(visibility ? { visibility } : {}),
         ...(visibility === 'direct' && recipientDroneIds
@@ -1401,9 +1386,10 @@ export async function appendLog(
         // visibility/recipients override it (server resolveMessageRouting).
         ...(opts.class ? { class: opts.class } : {}),
       },
+      { retryMode: 'append-log', decodePayload: decodeAppendLogResult },
     );
     if (!payload) throw new Error('Local Borg server returned an empty log response');
-  return { entry: payload.entry };
+  return payload;
 }
 
 /**

package/src/server-handshake.ts

@@ -211,10 +211,11 @@ export interface ServerAttachResult {
     sessionId: string;
   };
   result: 'created' | 'reused';
+  initial_log_cursor: { id: string; created_at: string } | null;
 }
 
 /**
- * Attach an enrolled client principal to one granted cube/role over protocol v8.
+ * Attach an enrolled client principal to one granted cube/role over protocol v9.
  * The client CSPRNG-generates the session bearer and persists it PENDING in the
  * OS keychain (keyed by the stable per-seat identity) BEFORE this request, so an
  * interrupted/lost response is recovered by re-sending the exact same bearer —
@@ -237,6 +238,7 @@ export interface PreparedServerAttach {
   drone: ServerAttachResult['drone'];
   session: { sessionId: string };
   result: 'created' | 'reused';
+  initialLogCursor: ServerAttachResult['initial_log_cursor'];
   credentialRef: string;
   pendingBearerDigest: string;
   /** The single-store ATOMIC activate+bind (CR#2 collapse): given the worktree
@@ -391,6 +393,7 @@ export async function sendBorgServerAttach(
         sessionId: decoded.session.id,
       },
       result: decoded.result,
+      initialLogCursor: decoded.initial_log_cursor,
       credentialRef,
       pendingBearerDigest,
       // The single-store ATOMIC activate+bind — invoked by FINALIZE with the decided