botmux 3.9.2 → 3.10.0

package/dist/worker.js

@@ -52,6 +52,7 @@ import { deriveTerminalViewToken, deriveTerminalWriteToken, resolveTerminalAcces
 import { readPlatformBinding } from './platform/binding.js';
 import { loadDashboardSecret, loadPersistedToken } from './dashboard/auth.js';
 import { InflightInputTracker } from './core/inflight-input-tracker.js';
+import { InputTurnDeduper } from './core/input-turn-dedupe.js';
 import { shouldRunQuietRotation, evaluatePidResolverPullback, decideFingerprintSwitch, shouldHealAbsentBaseline, sessionIdFromJsonlPath, SESSION_ID_FILENAME_RE, } from './services/bridge-rotation-policy.js';
 import { CodexBridgeQueue } from './services/codex-bridge-queue.js';
 import { detectCodexComposerState } from './services/codex-composer-state.js';
@@ -1160,7 +1161,7 @@ let closeRequested = false;
 let capturedSpawnCommand = null;
 let deferredTopicOutputTail = '';
 const reportedDeferredTopicRoots = new Set();
-const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff' };
+const CLI_DISPLAY_NAMES = { 'claude-code': 'Claude', seed: 'Seed', relay: 'Relay', aiden: 'Aiden', coco: 'CoCo', codex: 'Codex', 'codex-app': 'Codex App', cursor: 'Cursor', gemini: 'Gemini', genius: 'Genius', opencode: 'OpenCode', antigravity: 'Antigravity', mtr: 'MTR', hermes: 'Hermes', mira: 'Mira', mir: 'Mir CLI', traex: 'TRAE', pi: 'Pi', copilot: 'Copilot', 'oh-my-pi': 'Oh My Pi', kimi: 'Kimi', grok: 'Grok Build', 'kiro-cli': 'Kiro', riff: 'Riff', reasonix: 'Reasonix' };
 function cliName() {
     return (lastInitConfig?.cliRuntime?.source === 'configured'
         ? (lastInitConfig.cliRuntime.displayName?.trim() || lastInitConfig.cliRuntime.id)
@@ -1171,6 +1172,10 @@ function cliName() {
 let isPromptReady = false;
 /** Mutex for async flushPending — prevents concurrent flush loops. */
 let isFlushing = false;
+/** An init prompt exists but spawn/RPC policy has not yet established whether
+ * it is argv-baked, RPC-owned, or queued. Concurrent follow-ups may enter the
+ * queue during async init, but must not flush ahead of this first turn. */
+let initialInputOwnershipPending = false;
 /** True from the moment an owned CLI restart begins until the replacement
  * backend has been synchronously installed. Async backends (notably Riff)
  * keep the old backend object alive while destroySession() awaits remote
@@ -1476,6 +1481,13 @@ async function runStartupCommands() {
 }
 const freshnessInputQueue = new CodexRunnerFreshnessInputQueue(() => codexRunnerFreshness, state => { codexRunnerFreshness = state; });
 const pendingMessages = freshnessInputQueue.normal;
+/** Ordinary Lark IM turns may be retransmitted by the daemon when the exact
+ * receipt ACK times out. Fence those retries before any renderer / adapter side
+ * effects so one Lark message can enter the CLI input queue at most once per
+ * worker generation. Durable receiver attempts already have their own lease
+ * protocol and adopt writes have an ambiguity journal, so this gate stays on
+ * non-adopt `om_` turns without dispatchAttempt. */
+const ordinaryImTurnDedupe = new InputTurnDeduper(256);
 /** Correlation ids that this worker actually wrote into the owned Codex App
  * runner. Runner lifecycle/final markers may route only to ids in this bounded
  * local set; model/user display bytes cannot add entries. */
@@ -6519,6 +6531,8 @@ async function flushPending() {
     // backend's idle/task-done callback) write across that restart boundary.
     if (cliRestartInProgress)
         return;
+    if (initialInputOwnershipPending)
+        return;
     if (shouldHoldCodexRunnerInput(codexRunnerFreshness))
         return;
     if (isFlushing)
@@ -6923,8 +6937,6 @@ async function flushPending() {
     }
 }
 function sendToPty(content, turnId, opts = {}) {
-    if (!cliAdapter)
-        return false;
     const next = {
         content,
         turnId,
@@ -6943,6 +6955,8 @@ function sendToPty(content, turnId, opts = {}) {
         log(`Queued message while CLI backend is restarting (${pendingMessages.length} pending)`);
         return true;
     }
+    if (!cliAdapter)
+        return false;
     const supportsTypeAhead = pendingInputAllowsTypeAhead(cliAdapter.supportsTypeAhead === true, durableTurnInFlight, next);
     const shouldMergeQueued = opts.dispatchAttempt === undefined && !durableTurnInFlight
         && !isFlushing && !shouldWriteNow({
@@ -7272,8 +7286,18 @@ function setupAdoptInputAdapter(cfg) {
         cliAdapter = createCliAdapterSync(cfg.cliId, cfg.cliPathOverride);
     }
 }
+function wireIdleDetectorBusyTransition(detector, label) {
+    detector.onBusy(() => {
+        if (!isPromptReady)
+            return;
+        isPromptReady = false;
+        log(`Explicit busy marker detected — ${label}`);
+        publishScreenStatus('working', { force: true });
+    });
+}
 function setupAdoptIdleDetection(cfg, label) {
     idleDetector = new IdleDetector(adoptIdleAdapter(cfg));
+    wireIdleDetectorBusyTransition(idleDetector, `${label} adopt mode`);
     idleDetector.onIdle(() => {
         if (backend && deferPromptReadyWhileBusy(`${label} adopt-idle`, backend))
             return;
@@ -9482,11 +9506,12 @@ async function spawnCli(cfg, opts = {}) {
     //     `ps -A` ppid links) so the ownership gate can actually admit the id;
     //     it fails closed to the launcher pid when no leaf is found yet (the async
     //     retry below re-resolves once bwrap has forked traex).
+    //   - reasonix: identify the lease owned by this process tree
     // Claude's sessionId is set ONCE at process start (2.1.123); a `--resume`
     // lookup will surface here, but in-pane `/clear` won't. The pinned
     // claudeJsonlPath above is still the initial guess; the resolver corrects
     // it on first write when Claude was started with `--resume`.
-    if (cliPid && (claudeDataDir || cfg.cliId === 'grok' || cfg.cliId === 'traex')) {
+    if (cliPid && (claudeDataDir || cfg.cliId === 'grok' || cfg.cliId === 'traex' || cfg.cliId === 'reasonix')) {
         // TRAE under outer bwrap: best-effort immediate resolve (leaf may already be
         // forked), then a bounded retry below covers the not-yet-forked case.
         const wiredPid = cfg.cliId === 'traex' ? resolveTraexOwnershipPid(cliPid, outerBwrapActive) : cliPid;
@@ -9522,7 +9547,7 @@ async function spawnCli(cfg, opts = {}) {
                         log(`Failed to write CLI PID marker (async): ${err.message}`);
                     }
                 }
-                if (claudeDataDir || cfg.cliId === 'grok' || cfg.cliId === 'traex') {
+                if (claudeDataDir || cfg.cliId === 'grok' || cfg.cliId === 'traex' || cfg.cliId === 'reasonix') {
                     const wiredPid = cfg.cliId === 'traex' ? resolveTraexOwnershipPid(pid, outerBwrapActive) : pid;
                     backend.cliPid = wiredPid;
                     backend.cliCwd = cfg.workingDir;
@@ -9754,6 +9779,7 @@ async function spawnCli(cfg, opts = {}) {
     // quiescence, repeatedly triggering markPromptReady() and duplicate cards.
     if (effectiveBackendType !== 'riff') {
         idleDetector = new IdleDetector(cliAdapter);
+        wireIdleDetectorBusyTransition(idleDetector, `${cliName()} PTY`);
         idleDetector.onIdle(async (evidenceSource) => {
             log('Prompt detected (idle)');
             // Snapshot-only backends (ZMX) must complete one authoritative refresh
@@ -11527,8 +11553,23 @@ function send(msg) {
     process.send?.(payload);
 }
 function acknowledgeTurnInputCommitted(turnId) {
+    if (!turnId)
+        return;
+    ordinaryImTurnDedupe.commit(turnId);
+    send({ type: 'turn_input_committed', turnId });
+}
+function acknowledgeTurnInputReceived(turnId) {
     if (turnId)
-        send({ type: 'turn_input_committed', turnId });
+        send({ type: 'turn_input_received', turnId });
+}
+function receiveOrdinaryImTurn(turnId) {
+    const state = ordinaryImTurnDedupe.begin(turnId);
+    acknowledgeTurnInputReceived(turnId);
+    return state;
+}
+function rejectOrdinaryImTurn(turnId, reason) {
+    ordinaryImTurnDedupe.release(turnId);
+    send({ type: 'turn_input_rejected', turnId, reason });
 }
 function publishLocalProcessAttestation(cliPid) {
     const cliProcStart = cliPid ? readProcessStartIdentity(cliPid) : undefined;
@@ -11618,9 +11659,44 @@ process.on('message', async (raw) => {
     switch (msg.type) {
         case 'init': {
             const initStartedAtMs = Date.now();
-            if (lastInitConfig)
-                return; // already initialized
+            const ordinaryImTurnId = !msg.adoptMode
+                && msg.dispatchAttempt === undefined
+                && !!msg.prompt
+                && msg.turnId?.startsWith('om_')
+                ? msg.turnId
+                : undefined;
+            if (lastInitConfig) {
+                // Only an exact retry of this generation's init may be acknowledged.
+                // A different init is still rejected as an invalid re-initialization.
+                if (ordinaryImTurnId && lastInitConfig.turnId === ordinaryImTurnId) {
+                    const duplicateState = receiveOrdinaryImTurn(ordinaryImTurnId);
+                    if (duplicateState === 'committed') {
+                        log(`Re-ACKing committed duplicate init turn ${ordinaryImTurnId.substring(0, 16)}`);
+                        acknowledgeTurnInputCommitted(ordinaryImTurnId);
+                    }
+                    else {
+                        log(`Re-ACKing received duplicate init turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    }
+                }
+                return;
+            }
+            if (ordinaryImTurnId) {
+                const duplicateState = receiveOrdinaryImTurn(ordinaryImTurnId);
+                // Receipt is the daemon ↔ worker transport boundary. Publish it before
+                // startup work can await a slow backend, plugin gateway, or Codex
+                // metadata read. The later committed ACK keeps its existing meaning.
+                if (duplicateState === 'committed') {
+                    log(`Re-ACKing committed duplicate init turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    acknowledgeTurnInputCommitted(ordinaryImTurnId);
+                    break;
+                }
+                if (duplicateState === 'inflight') {
+                    log(`Re-ACKing received duplicate init turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    break;
+                }
+            }
             lastInitConfig = msg;
+            initialInputOwnershipPending = !!msg.prompt;
             activeRestartAttemptId = msg.restartAttemptId;
             sessionId = msg.sessionId;
             refreshTerminalViewToken();
@@ -11775,7 +11851,10 @@ process.on('message', async (raw) => {
                     passesInitialPromptViaArgs: cliAdapter?.passesInitialPromptViaArgs === true,
                     deferInitialPrompt,
                 })) {
-                    pendingMessages.push({
+                    // Follow-up IPC handlers can run while this async init is awaiting
+                    // backend startup. They queue safely behind !backend above, but the
+                    // original init prompt must remain first in logical turn order.
+                    pendingMessages.unshift({
                         content: lastSpawnQueuedInitialPrompt ?? msg.prompt,
                         ...(lastSpawnQueuedInitialPromptLogicalContent
                             ? { logicalContent: lastSpawnQueuedInitialPromptLogicalContent }
@@ -11792,6 +11871,10 @@ process.on('message', async (raw) => {
                     // it into argv or the RPC engine already accepted it.
                     initialInputCommitted = true;
                 }
+                // The first turn is now either at queue head or already owned by the
+                // argv/RPC startup path. Only now may an early idle edge drain
+                // follow-ups that arrived while init was awaiting slow startup work.
+                initialInputOwnershipPending = false;
                 if (initialInputCommitted)
                     acknowledgeTurnInputCommitted(msg.turnId);
                 // A backend may become prompt-ready before spawnCli() returns. The
@@ -11818,6 +11901,7 @@ process.on('message', async (raw) => {
                 });
             }
             catch (err) {
+                initialInputOwnershipPending = false;
                 await sendFatalWorkerErrorAndExit(err);
                 return;
             }
@@ -11825,6 +11909,25 @@ process.on('message', async (raw) => {
         }
         case 'message': {
             const messageAdoptMode = lastInitConfig?.adoptMode === true;
+            const ordinaryImTurnId = !messageAdoptMode
+                && msg.dispatchAttempt === undefined
+                && msg.turnId?.startsWith('om_')
+                ? msg.turnId
+                : undefined;
+            if (ordinaryImTurnId) {
+                const duplicateState = receiveOrdinaryImTurn(ordinaryImTurnId);
+                // ACK process ownership synchronously, before crash recovery or any
+                // other awaited work. Actual queue ownership remains committed below.
+                if (duplicateState === 'committed') {
+                    log(`Re-ACKing committed duplicate IM turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    acknowledgeTurnInputCommitted(ordinaryImTurnId);
+                    break;
+                }
+                if (duplicateState === 'inflight') {
+                    log(`Re-ACKing received duplicate IM turn ${ordinaryImTurnId.substring(0, 16)}`);
+                    break;
+                }
+            }
             // Adopt IPC handlers can overlap. Delay their turn baseline until the
             // submission mutex is held so a queued message cannot steal attribution
             // from the write/verification already in flight.
@@ -11872,6 +11975,8 @@ process.on('message', async (raw) => {
                     await prepareCodexNativeTitleGeneration(restartCfg, codexRpcEngine);
                 }
                 catch (err) {
+                    if (ordinaryImTurnId)
+                        ordinaryImTurnDedupe.release(ordinaryImTurnId);
                     // Pass the message's own attempt (not the stale currentBotmux* from a
                     // prior IM turn) so a durable delivery relaunch failure carries the
                     // right attribution for the daemon's receipt/lease gate.
@@ -12062,6 +12167,8 @@ process.on('message', async (raw) => {
                 });
                 if (inputCommitted)
                     acknowledgeTurnInputCommitted(msg.turnId);
+                else if (ordinaryImTurnId)
+                    rejectOrdinaryImTurn(ordinaryImTurnId, 'cli_input_unavailable');
             }
             break;
         }
@@ -12509,6 +12616,13 @@ process.on('message', async (raw) => {
             killCli({ preserveSandbox: true });
             cleanup();
             await flushTransferDetachAck(msg.requestId);
+            // NOTE: process.exit(0) can wedge in node-pty's native teardown when a
+            // web-terminal client PTY was attached (the reader-thread join blocks and
+            // the JS event loop is already stopped, so this process cannot self-kill
+            // via a timer). killCli() above already detached the observer and the ACK
+            // just flushed, so the daemon force-kills this now-disposable process
+            // shortly after the ACK (see detachWorkerForTransfer's post-ACK kill).
+            // We still request a clean exit; the daemon SIGKILL is the hard backstop.
             process.exit(0);
         }
         case 'suspend': {