botmux 3.2.1 → 3.4.0

package/dist/core/worker-pool.js

@@ -18,7 +18,7 @@ import { config } from '../config.js';
 import * as sessionStore from '../services/session-store.js';
 import { persistStreamCardState, rememberLastCliInput } from './session-manager.js';
 import { fallbackTurnId, isSubstituteTurn } from './reply-target.js';
-import { updateMessage, deleteMessage, sendEphemeralCard, sendUserMessage, addReaction, removeReaction, MessageWithdrawnError } from '../im/lark/client.js';
+import { updateMessage, deleteMessage, sendEphemeralCard, sendUserMessage, addReaction, removeReaction, getMessageChatId, MessageWithdrawnError } from '../im/lark/client.js';
 import { buildStreamingCard, buildPrivateSnapshotCard, buildSessionCard, buildTuiPromptCard, buildTuiPromptResolvedCard, buildRelayedFrozenCard, getCliDisplayName } from '../im/lark/card-builder.js';
 import { loadFrozenCards, saveFrozenCards } from '../services/frozen-card-store.js';
 import { hashUrlForLog, cancelRiffTaskById } from '../adapters/backend/riff-backend.js';
@@ -77,6 +77,8 @@ import { neutralizeLarkAtTags } from '../services/send-policy.js';
 import { recordVcMeetingListenerMessage } from '../services/vc-meeting-listener-message-store.js';
 import { isLocalCliOpenEnabled, isLocalCliOpenReady } from '../services/local-cli-opener.js';
 import { isSilentScheduledTurn } from './silent-schedule-turns.js';
+import { writeDeferredTopicBinding } from './deferred-topic-binding.js';
+import { deferWorkerSpawnDuringDeviceIsolation } from './device-isolation-activation.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const WORKER_SIGTERM_BACKSTOP_MS = 2_000;
@@ -1075,6 +1077,7 @@ export function ensureClaudeFolderTrust(workingDir, stateJsonPath = join(homedir
 // ─── Kill worker ────────────────────────────────────────────────────────────
 export function killWorker(ds) {
     clearUsageLimitState(ds);
+    ds.localProcessAttestation = undefined;
     // A managed-turn capability belongs to one concrete worker generation.
     // Retiring (or observing the absence of) that generation must revoke the
     // daemon-side copy synchronously; the worker may never get a chance to send
@@ -1192,6 +1195,7 @@ export function suspendWorker(ds, reason = 'suspended_idle') {
     }
     armWorkerKillBackstop(w, tag(ds));
     ds.worker = null;
+    ds.localProcessAttestation = undefined;
     ds.workerPort = null;
     ds.workerToken = null;
     ds.workerViewToken = null;
@@ -1626,6 +1630,19 @@ export function sendWorkerInput(ds, payload, turnId, opts = {}) {
     return true;
 }
 export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
+    // Device enrollment briefly freezes every daemon before the one-way host
+    // marker is installed and legacy local CLIs are torn down. Do this before
+    // ANY session mutation or child fork. One deferred spawn per logical session
+    // is replayed after the exact freeze lease is released; a session closed by
+    // the activation transaction is deliberately not revived.
+    if (deferWorkerSpawnDuringDeviceIsolation(ds.session.sessionId, () => {
+        if (findActiveBySessionId(ds.session.sessionId) === ds) {
+            forkWorker(ds, promptInput, resumeOrTurnId);
+        }
+    })) {
+        logger.info(`[${tag(ds)}] worker spawn deferred during device credential activation`);
+        return;
+    }
     const cb = requireCallbacks();
     const bot = getBot(ds.larkAppId);
     const botCfg = bot.config;
@@ -1644,6 +1661,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
     // worker.js lives in the same directory as daemon.js (src/)
     const workerPath = join(__dirname, '..', 'worker.js');
     const t = tag(ds);
+    ds.localProcessAttestation = undefined;
     let resume = false;
     let initTurnId;
     let initDispatchAttempt;
@@ -1877,6 +1895,7 @@ export function forkWorker(ds, promptInput, resumeOrTurnId = false) {
         backendConfig: botCfg.riff,
         riffParentTaskId: ds.session.riffParentTaskId,
         riffRepoDirs: ds.session.riffRepoDirs,
+        deferredScheduleRun: ds.session.deferredScheduleRun,
         prompt,
         ...(promptCodexAppInput ? { promptCodexAppInput } : {}),
         resume,
@@ -2043,6 +2062,24 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
     worker.on('message', async (msg) => {
         const effectiveCliId = sessionCliId(ds, botCfg);
         switch (msg.type) {
+            case 'local_process_attestation': {
+                // This message arrives over the private parent<->worker IPC channel;
+                // unlike .botmux-cli-pids it cannot be forged or deleted by the CLI.
+                // Bind it to the daemon's current worker generation so a late message
+                // from a replaced worker never attests the replacement process.
+                if (ds.worker !== worker)
+                    break;
+                ds.localProcessAttestation = {
+                    backendType: msg.backendType,
+                    credentialIsolated: msg.credentialIsolated,
+                    ...(msg.cliPid !== undefined ? { cliPid: msg.cliPid } : {}),
+                    ...(msg.cliProcStart !== undefined ? { cliProcStart: msg.cliProcStart } : {}),
+                    ...(ds.workerGeneration !== undefined
+                        ? { workerGeneration: ds.workerGeneration }
+                        : {}),
+                };
+                break;
+            }
             case 'ready': {
                 startupState.ready = true;
                 ds.workerPort = msg.port;
@@ -2335,6 +2372,11 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                         recordUsageForDaemonSession(ds);
                         void finishTurnReactions(ds);
                     }
+                    if (ds.lastScreenStatus === 'idle'
+                        && msg.turnId
+                        && ds.session.deferredScheduleRun?.turnId === msg.turnId) {
+                        void cb.onDeferredScheduleTurnSettled?.(ds, { turnId: msg.turnId, source: 'idle' });
+                    }
                     // If every over-cap process was busy, the earlier check deliberately
                     // left them alone. Re-check on the first idle edge so capacity is
                     // reclaimed immediately instead of waiting for the 60s backstop.
@@ -2667,6 +2709,43 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                 sessionStore.updateSession(ds.session);
                 break;
             }
+            case 'deferred_topic_materialized': {
+                if (ds.worker !== worker || msg.sessionId !== ds.session.sessionId) {
+                    logger.warn(`[${t}] Dropped deferred topic binding from stale/wrong worker`);
+                    break;
+                }
+                // Local backends claim through the host-visible sidecar directly. Only
+                // Riff needs the terminal-output relay, and terminal text is agent-
+                // controlled, so never let a fabricated local line create a binding.
+                if ((ds.initConfig?.backendType ?? ds.session.backendType) !== 'riff') {
+                    logger.warn(`[${t}] Dropped deferred topic relay from non-Riff backend`);
+                    break;
+                }
+                const run = ds.session.deferredScheduleRun;
+                if (!run || msg.turnId !== run.turnId || !msg.rootMessageId.startsWith('om_')) {
+                    logger.warn(`[${t}] Dropped deferred topic binding with mismatched run identity`);
+                    break;
+                }
+                // Defense in depth for the remote stdout relay: prove the claimed
+                // message actually exists in this run's target chat before persisting
+                // the host-side binding. This fences fabricated/cross-chat message ids.
+                const claimedChatId = await getMessageChatId(ds.larkAppId, msg.rootMessageId);
+                if (claimedChatId !== ds.chatId) {
+                    logger.warn(`[${t}] Dropped deferred topic binding outside target chat`);
+                    break;
+                }
+                writeDeferredTopicBinding(config.session.dataDir, {
+                    sessionId: ds.session.sessionId,
+                    turnId: run.turnId,
+                    chatId: ds.chatId,
+                    larkAppId: ds.larkAppId,
+                    routingAnchor: run.routingAnchor,
+                    rootMessageId: msg.rootMessageId,
+                    createdAt: new Date().toISOString(),
+                });
+                logger.info(`[${t}] Deferred topic root recorded ${msg.rootMessageId.substring(0, 12)}`);
+                break;
+            }
             case 'bridge_source_session': {
                 if (msg.bridge !== 'hermes')
                     break;
@@ -2728,6 +2807,12 @@ function setupWorkerHandlers(ds, worker, startupState = { ready: false, failureN
                     // never let a projection/store failure crash the worker IPC loop.
                     logger.error(`[${t}] Failed to persist turn_terminal for ${msg.turnId.substring(0, 8)}: ${err.message}`);
                 }
+                try {
+                    await cb.onDeferredScheduleTurnSettled?.(ds, { turnId: msg.turnId, source: 'terminal' });
+                }
+                catch (err) {
+                    logger.error(`[${t}] Failed to settle deferred schedule turn ${msg.turnId.substring(0, 8)}: ${err.message}`);
+                }
                 break;
             }
             case 'receiver_reset_ready': {