botmux 3.1.0 → 3.2.0

package/dist/core/worker-pool.js

@@ -76,6 +76,7 @@ import { finishVcMeetingImReply, prepareVcMeetingDeliveryReply, prepareVcMeeting
 import { neutralizeLarkAtTags } from '../services/send-policy.js';
 import { recordVcMeetingListenerMessage } from '../services/vc-meeting-listener-message-store.js';
 import { isLocalCliOpenEnabled, isLocalCliOpenReady } from '../services/local-cli-opener.js';
+import { isSilentScheduledTurn } from './silent-schedule-turns.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const WORKER_SIGTERM_BACKSTOP_MS = 2_000;
@@ -1657,14 +1658,12 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     else {
         resume = resumeOrTurnId;
     }
-    // An empty prompt is a pure worker reattach/restore, not a newly accepted
-    // user turn. Never inherit the previous reply target in that case: doing so
-    // would re-publish stale per-turn authority (notably an explicit meeting IM
-    // origin) into a fresh worker lifetime after a daemon restart. Non-empty
-    // prompts keep the historical fallback for callers that accepted a turn
-    // before they learned to pass its id explicitly.
-    const initAttributionTurnId = initTurnId
-        ?? (prompt.length > 0 ? ds.currentReplyTarget?.turnId : undefined);
+    // Per-turn authority is never inferred from mutable session state. Human
+    // message routes pass their accepted Lark message id explicitly; restore,
+    // scheduler, card retry and other system starts stay unattributed. Falling
+    // back to currentReplyTarget here would let a later system prompt reuse an
+    // older human turn after a worker replacement.
+    const initAttributionTurnId = initTurnId;
     // A fork() whose cwd no longer exists emits an unhandled 'error' (spawn
     // ENOENT) that crashes the WHOLE daemon (→ pm2 crash-loop). Fall back to
     // home so a stale session workingDir can never take the daemon down.
@@ -1780,7 +1779,9 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         },
     });
     const startupState = {
-        ready: false, failureNotified: false, initTurnId, initDispatchAttempt,
+        ready: false, failureNotified: false,
+        initTurnId: initAttributionTurnId,
+        initDispatchAttempt,
     };
     // A fork-level failure (spawn ENOENT, etc.) emits 'error'; without a handler
     // the unhandled event crashes the daemon. It also happens before worker IPC
@@ -1791,21 +1792,21 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         if (startupState.failureNotified)
             return;
         startupState.failureNotified = true;
-        // A dedicated VC receiver has no auxiliary Lark output channel. Durable
-        // failures stay on the receipt/lease chain, and exact IM turns may only
-        // produce their ledgered final reply — never a fork diagnostic.
-        if (ds.session.vcMeetingReceiver) {
-            logger.info(`[${t}] VC receiver fork failure kept out of auxiliary Lark UI `
-                + `turn=${initTurnId?.slice(0, 12) ?? '-'} attempt=${initDispatchAttempt}: ${reason}`);
-            return;
-        }
-        const cliName = getCliDisplayName(agentCfg.cliId);
-        const message = tr('worker.start_failed', { cliName, reason }, botLocale(botCfg));
         emitSessionLifecycleHook(ds, 'session.requires_attention', {
             reason: 'worker_fork_error',
             message: reason,
         });
-        void cb.sessionReply(sessionAnchorId(ds), message, 'text', ds.larkAppId, fallbackTurnId(ds, initTurnId), ds.session.vcMeetingReceiver
+        // A dedicated VC receiver and a silent schedule have no auxiliary Lark
+        // output channel. Keep lifecycle/dashboard state above, but never leak a
+        // fork diagnostic into the chat.
+        if (ds.session.vcMeetingReceiver || isSilentScheduledTurn(ds, initAttributionTurnId)) {
+            logger.info(`[${t}] Managed/silent fork failure kept out of auxiliary Lark UI `
+                + `turn=${initAttributionTurnId?.slice(0, 12) ?? '-'} attempt=${initDispatchAttempt}: ${reason}`);
+            return;
+        }
+        const cliName = getCliDisplayName(agentCfg.cliId);
+        const message = tr('worker.start_failed', { cliName, reason }, botLocale(botCfg));
+        void cb.sessionReply(sessionAnchorId(ds), message, 'text', ds.larkAppId, fallbackTurnId(ds, initAttributionTurnId), ds.session.vcMeetingReceiver
             ? { sourceSessionId: ds.session.sessionId }
             : undefined).catch(replyErr => logger.error(`[${t}] Failed to deliver worker fork error to Lark: ${replyErr}`));
     });
@@ -1976,6 +1977,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     /** Auxiliary worker UI is never an authorized output channel for a dedicated
      * VC receiver. Dashboard/audit state is still updated before these guards. */
     const managedAuxUiSuppressed = (turnId, dispatchAttempt) => {
+        if (isSilentScheduledTurn(ds, turnId))
+            return true;
         if (ds.session.vcMeetingReceiver)
             return true;
         return ordinaryManagedSuppression(turnId, dispatchAttempt);
@@ -1983,6 +1986,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     /** final_output is the sole exception: listener_thread and exact IM replies
      * may proceed into the durable action ledger; silent/stale attempts do not. */
     const managedFinalOutputSuppressed = (turnId, dispatchAttempt) => {
+        if (isSilentScheduledTurn(ds, turnId))
+            return true;
         if (!ds.session.vcMeetingReceiver) {
             return ordinaryManagedSuppression(turnId, dispatchAttempt);
         }
@@ -2007,22 +2012,22 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
         if (startupState.failureNotified)
             return;
         startupState.failureNotified = true;
+        emitSessionLifecycleHook(ds, 'session.requires_attention', {
+            reason: 'worker_start_failed',
+            message: reason,
+        });
         // A durable VC meeting delivery attempt must not surface its startup/relaunch
         // failure out-of-band. The worker-generation exit is fenced to the receipt
         // (marked ambiguous and retried under the side-effect boundary); a direct
         // sessionReply here would bypass that and could post on a silent delivery.
         // Ordinary IM turns and non-receiver sessions still notify exactly once.
         if (managedAuxUiSuppressed(turnId, dispatchAttempt)) {
-            logger.info(`[${t}] VC receiver startup failure kept out of auxiliary Lark UI `
+            logger.info(`[${t}] Managed/silent startup failure kept out of auxiliary Lark UI `
                 + `turn=${turnId?.slice(0, 12) ?? '-'} attempt=${dispatchAttempt}: ${reason}`);
             return;
         }
         const cliName = getCliDisplayName(sessionCliId(ds, botCfg));
         const message = tr('worker.start_failed', { cliName, reason }, loc);
-        emitSessionLifecycleHook(ds, 'session.requires_attention', {
-            reason: 'worker_start_failed',
-            message: reason,
-        });
         try {
             await scopedReply(message, 'text', turnId);
         }
@@ -2068,7 +2073,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     void deliverSubstituteControlCard(ds);
                 }
                 if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
-                    logger.info(`[${t}] Managed VC receiver — suppressing ready/streaming card output`);
+                    logger.info(`[${t}] Managed/silent turn — suppressing ready/streaming card output`);
                     break;
                 }
                 // Bot opted out of the streaming card: the terminal is up and the
@@ -2240,6 +2245,8 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 if (ds.pendingRawInput && ds.worker && !ds.worker.killed) {
                     const rawInput = ds.pendingRawInput;
                     ds.pendingRawInput = undefined;
+                    const rawTurnId = ds.pendingRawTurnId;
+                    ds.pendingRawTurnId = undefined;
                     // Input buffered while the repo card was pending rides on the SAME
                     // IPC: worker message handlers run concurrently (async handlers
                     // don't serialize), so a separate `message` IPC could write into
@@ -2253,7 +2260,9 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     ds.worker.send({
                         type: 'raw_input',
                         content: rawInput,
+                        ...(rawTurnId ? { turnId: rawTurnId } : {}),
                         followUpContent: followUp?.cliInput,
+                        ...(followUp?.turnId ? { followUpTurnId: followUp.turnId } : {}),
                         ...(followUpCodexAppInput ? { followUpCodexAppInput } : {}),
                     });
                     logger.info(`[${t}] Sent pending raw input after prompt_ready: ${rawInput.substring(0, 80)}${followUp ? ` (+follow-up ${followUp.cliInput.length} chars)` : ''}`);
@@ -2277,7 +2286,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // is known, so consumers exclude this session from native parsers
                 // before its first positive-delta record exists.
                 recordOwnershipForDaemonSession(ds);
-                if (!managedAuxUiSuppressed()
+                if (!managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)
                     && !wasLocalCliOpenReady
                     && isLocalCliOpenReady(ds, { cliId: effectiveCliId })) {
                     scheduleLocalCliOpenReadinessPatch(ds);
@@ -2419,7 +2428,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     content: ds.lastScreenContent ?? '',
                 });
                 persistStreamCardState(ds);
-                if (managedAuxUiSuppressed())
+                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt))
                     break;
                 if ((ds.displayMode ?? 'hidden') !== 'screenshot')
                     break;
@@ -2459,7 +2468,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 // would temporarily overwrite a user-issued /rename until refresh.
                 ds.currentTurnTitle = msg.description;
                 if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
-                    logger.info(`[${t}] Managed VC receiver — TUI prompt kept in dashboard/audit only`);
+                    logger.info(`[${t}] Managed/silent turn — TUI prompt kept in dashboard/audit only`);
                     break;
                 }
                 try {
@@ -2476,7 +2485,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
             case 'tui_prompt_resolved': {
                 // TUI prompt is no longer showing — update card if it exists
                 logger.info(`[${t}] TUI prompt resolved${msg.selectedText ? `: ${msg.selectedText}` : ''}`);
-                if (managedAuxUiSuppressed()) {
+                if (managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt)) {
                     ds.tuiPromptCardId = undefined;
                     ds.tuiPromptOptions = undefined;
                     break;
@@ -2632,7 +2641,7 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 });
                 // Refresh the live streaming card (writable/AIO link) — parks a pending
                 // flag when the card POST is still in-flight and flushes once it lands.
-                if (!managedAuxUiSuppressed())
+                if (!managedAuxUiSuppressed(msg.turnId, msg.dispatchAttempt))
                     scheduleRiffAccessUrlPatch(ds);
                 break;
             }