c8ctl-plugin-nano 1.44.6 → 1.44.8

package/c8ctl-plugin.js

@@ -135,6 +135,11 @@ const READINESS_TIMEOUT_MS = 60_000;
 const READINESS_POLL_MS = 500;
 const HEALTH_TIMEOUT_MS = 1_500;
 const STOP_GRACE_MS = 8_000;
+// Backoff applied when a poller fails a lease fast because the worker is already
+// running another job (issue #142 single-flight). Long enough that the deferred
+// job doesn't tight-loop re-activating while the first runs, short enough that it
+// is picked up promptly once the worker frees up.
+const WORKER_BUSY_RETRY_BACKOFF_MS = 5_000;
 // Upper bound on one `--auto` engine-read reconcile (enumerate deployed
 // definitions + fetch each BPMN). A read that stalls past this is treated as a
 // transient failure so the running poller set is KEPT and, crucially, shutdown
@@ -4568,6 +4573,15 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
     // One-time warning latch for the reserved escalate/filter policies so the
     // deferral is observable (not silent) but never spams a warning per request.
     let interimWarned = false;
+    // #137: count of canonical transcript chunks actually PUBLISHED to the relay's
+    // transcript-chunk seam, plus a one-time latch for the fallback floor. Some ACP
+    // agents (e.g. copilot 1.0.82 on some hosts) complete a turn without ever
+    // emitting a mappable `session/update`, so `emitTranscript` never fires and the
+    // cockpit drill-in would show an empty session. When the turn completes having
+    // published zero chunks, we synthesise ONE structured floor chunk so the
+    // drill-in shows the outcome instead of nothing (see `maybeEmitTranscriptFloor`).
+    let transcriptChunksPublished = 0;
+    let floorEmitted = false;
 
     // Live "spy" tee (--stream), line-buffered, mirroring the other paths.
     // Separate line buffers per lane (stdout-human vs stderr) so a partial line
@@ -4638,6 +4652,13 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
       if (idleMon) idleMon.stop();
       if (settleTimer) { clearTimeout(settleTimer); settleTimer = null; }
       if (detachSteer) { try { detachSteer(); } catch { /* best effort */ } detachSteer = null; }
+      // #137: a turn that completed but produced no mappable session/update gets a
+      // synthesised structured floor so the cockpit drill-in isn't empty. Only for
+      // a resolved turn (`promptResolved`) — a handshake/spawn failure has nothing
+      // to floor and its error is surfaced in the result envelope. Best-effort and
+      // guarded, so it can never turn a settle into a throw. Runs before the tee is
+      // flushed so a --stream watcher sees the floored line too.
+      if (promptResolved) { try { maybeEmitTranscriptFloor(); } catch { /* floor best-effort */ } }
       if (teeSink) { tee('', true); teeErr('', true); }
       // Reap the child if it is still alive (turn resolved but agent lingering).
       try { if (child && childClosed === null) killTree(child); } catch { /* best effort */ }
@@ -4775,6 +4796,7 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
         let published = false;
         try { relayTap.relayTranscriptChunk(chunk); published = true; } catch { /* relay best-effort */ }
         if (published) {
+          transcriptChunksPublished++;
           // Mirror the human text locally (spy tee + captured stdout) so the
           // result envelope and --stream spy are unchanged — without re-emitting
           // raw text onto the relay lane, which now carries the canonical chunk.
@@ -4787,6 +4809,76 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
       emitHuman(describeUpdate(update));
     };
 
+    // #137: build the human-readable text for a fallback transcript FLOOR — used
+    // only when a turn completed having produced no mappable session/update, so
+    // the cockpit drill-in shows the run's OUTCOME instead of an empty session.
+    // Prefer the agent's own structured result (from $AGENT_RESULT_FILE: summary,
+    // status, pr), then its stderr diagnostics, then a fixed explanatory note.
+    const buildFloorText = () => {
+      const resultPath = env && typeof env === 'object' ? env[AGENT_RESULT_FILE_ENV] : null;
+      const res = readAgentResultFile(resultPath);
+      if (res && typeof res === 'object') {
+        const parts = [];
+        if (typeof res.summary === 'string' && res.summary.trim()) parts.push(res.summary.trim());
+        if (typeof res.status === 'string' && res.status.trim()) parts.push(`(status: ${res.status.trim()})`);
+        if (typeof res.pr === 'string' && res.pr.trim()) parts.push(`PR: ${res.pr.trim()}`);
+        else if (res.pr && typeof res.pr === 'object' && typeof res.pr.url === 'string' && res.pr.url.trim()) parts.push(`PR: ${res.pr.url.trim()}`);
+        if (parts.length) return parts.join(' ');
+      }
+      const diag = joinCapped(stderrChunks).trim();
+      if (diag) {
+        // Surface the tail of the agent's stderr (its own diagnostics) as the
+        // floor — capped so a chatty agent can't blow up a single transcript card.
+        const FLOOR_DIAG_CAP = 2_000;
+        const tail = diag.length > FLOOR_DIAG_CAP ? `…${diag.slice(diag.length - FLOOR_DIAG_CAP)}` : diag;
+        return `Agent published no structured/canonical transcript content. Diagnostics:\n${tail}`;
+      }
+      return 'Agent completed the turn but published no structured/canonical transcript content, so no transcript messages were produced.';
+    };
+
+    // #137: synthesise ONE structured transcript-chunk FLOOR when a completed turn
+    // published zero canonical chunks. The floor rides the SAME canonical bridge
+    // (an `agent_message_chunk` run through `acpUpdateToTranscriptChunk`) so the
+    // cockpit renders a real assistant-message card — never a hand-rolled envelope
+    // — and honours the acceptance's "structured/raw transcript floor" so the
+    // drill-in shows something useful rather than an empty session. Idempotent
+    // (one-time latch), inert unless the relay exposes the transcript-chunk seam,
+    // and skipped entirely when any real chunk already reached the lane.
+    const maybeEmitTranscriptFloor = () => {
+      if (floorEmitted) return;
+      if (transcriptChunksPublished > 0) return;
+      if (!relayTap || typeof relayTap.relayTranscriptChunk !== 'function') return;
+      floorEmitted = true;
+      const text = buildFloorText();
+      if (!text) return;
+      const chunk = encodeTranscriptChunk({ sessionUpdate: 'agent_message_chunk', content: { type: 'text', text } });
+      if (!chunk) {
+        // Canonical bridge couldn't produce a chunk (bridge throw or unmapped
+        // classification) → emit the floor on the text lane rather than dropping
+        // it, exactly like `emitTranscript`, so the cockpit transcript is never
+        // left empty in the very failure mode this floor exists to mitigate.
+        emitHuman(text);
+        return;
+      }
+      // Only skip the text lane when the chunk publish ACTUALLY succeeded. If the
+      // seam throws (a downstream tap implementation bug, not just the built-in
+      // best-effort guard), the floor never reached the relay lane — so fall back
+      // to the text lane, exactly like `emitTranscript`, or the cockpit transcript
+      // could still be empty in that failure mode.
+      let published = false;
+      try { relayTap.relayTranscriptChunk(chunk); published = true; } catch { /* relay best-effort */ }
+      if (published) {
+        transcriptChunksPublished++;
+        // Mirror locally (spy tee + captured stdout) so a --stream watcher and the
+        // result envelope also reflect the floor, matching the mapped-update path.
+        captureHuman(text);
+        return;
+      }
+      // Chunk publish threw → emit the floor on the text lane (relay text + spy
+      // tee + capture) so nothing is dropped.
+      emitHuman(text);
+    };
+
     const handleMessage = (msg) => {
       if (!msg || typeof msg !== 'object') return;
       // A response to one of OUR requests.
@@ -5077,6 +5169,44 @@ function baseAgentEnv(profile, job) {
   };
 }
 
+/**
+ * Process-wide single-flight guard (issue #142).
+ *
+ * `maxParallelJobs = 1` only caps concurrency WITHIN one job-type poller, but a
+ * single `work` process runs one poller per job type (rank×capability matrix, or
+ * every deployed agent type under `--auto`). Without a shared gate a worker
+ * serving N job types could lease and run up to N jobs at once — each holding its
+ * own PTY + git workspace + broker lock-extender — the exact failure the
+ * "one job per worker" invariant exists to prevent.
+ *
+ * This is a capacity-1, non-blocking mutex shared by EVERY per-type poller: the
+ * first poller to `tryAcquire()` runs its job to completion (releasing in a
+ * `finally`); any other poller that finds the permit already held must NOT begin
+ * a second job (the caller fails the lease fast so the broker re-queues it rather
+ * than leaving it "claimed but idle"). `tryAcquire`/`release` are synchronous
+ * check-and-set, so the single-threaded event loop makes them race-free across
+ * the concurrently-invoked async job handlers.
+ */
+function createSingleFlight() {
+  let held = false;
+  return {
+    /** Take the permit if free; returns false when a job is already in flight. */
+    tryAcquire() {
+      if (held) return false;
+      held = true;
+      return true;
+    },
+    /** Release the permit. Idempotent: redundant calls are safe no-ops, though the normal path releases once per acquire (in a `finally`). */
+    release() {
+      held = false;
+    },
+    /** True while a job holds the permit. */
+    get busy() {
+      return held;
+    },
+  };
+}
+
 /**
  * Keep a leased job's broker activation lock ahead of *now* while the harness is
  * running, so a long agent run never has its lock lapse and get re-activated (a
@@ -6179,6 +6309,13 @@ async function workAgent(req, flags) {
   // SDK derives maxJobsToActivate = maxParallelJobs - activeJobs, so 1 means
   // "activate one job, then stop polling until it completes".
   const maxParallelJobs = 1;
+  // Process-wide single-flight guard (issue #142). The SDK's maxParallelJobs=1
+  // only serializes ONE job-type poller, but this process runs one poller per
+  // job type, so nothing stops N pollers from each leasing + running a job
+  // concurrently. This capacity-1 mutex, shared by every poller's jobHandler,
+  // enforces the real "one job per worker" invariant: while any job is in flight
+  // on any job type, no other poller starts a second one.
+  const singleFlight = createSingleFlight();
   // The broker job-activation lock is NOT hardcoded up front. A fixed timeout is
   // impossible to size for an agent: too short reclaims a still-working job (a
   // second agent starts + the stale complete/fail is rejected 409), too long
@@ -6378,7 +6515,7 @@ async function workAgent(req, flags) {
   }
   const extraNote = extraJobTypes.length > 0 ? ` (${extraJobTypes.length} via --job-type)` : '';
   logger.info(`  listening on ${jobTypes.length} job type(s)${extraNote}: ${jobTypes.join('  ')}`);
-  logger.info(`  one job per worker; recovery window: ${recoveryWindowMs}ms; idle timeout: ${idleTimeoutMs}ms; hard cap: ${hardCapMs > 0 ? `${hardCapMs}ms` : 'off'}; poll timeout: ${pollTimeoutMs}ms`);
+  logger.info(`  one job per worker (single-flight across all ${jobTypes.length} job type(s)); recovery window: ${recoveryWindowMs}ms; idle timeout: ${idleTimeoutMs}ms; hard cap: ${hardCapMs > 0 ? `${hardCapMs}ms` : 'off'}; poll timeout: ${pollTimeoutMs}ms`);
   // Warm the gh-token cache now, off the job-handling path: githubCloneToken()
   // may consult `gh auth token` (a synchronous spawn, up to 10s) as its default
   // credential fallback, and doing that inside a job handler would block the
@@ -6666,6 +6803,27 @@ async function workAgent(req, flags) {
       jobTimeoutMs: recoveryWindowMs,
       pollTimeoutMs,
       jobHandler: async (job) => {
+        // Process-wide single-flight (issue #142): if another job is already
+        // running on ANY poller, do not start a second harness. Fail this lease
+        // FAST — before recording it active, extending its lock, or provisioning
+        // anything — so the broker re-queues it (retries preserved) instead of it
+        // sitting "claimed but idle" while the first job runs. Gating here, at the
+        // point activation surfaces as a handler call, is the cross-poller gate
+        // the per-type maxParallelJobs cannot provide.
+        if (!singleFlight.tryAcquire()) {
+          // Not a failure — preserve the broker-provided retries verbatim so
+          // re-dispatch doesn't decrement (or resurrect) the job. Keep a real 0
+          // as 0 (an already-incidentable job must stay that way); only default
+          // to 1 when the count is missing/invalid.
+          const rawRetries = Number(job.retries);
+          const retries = Number.isInteger(rawRetries) && rawRetries >= 0 ? rawRetries : 1;
+          logger.info(`[${jobType}] job ${job.jobKey} deferred — worker already running another job; releasing lease for re-dispatch.`);
+          return job.fail({
+            errorMessage: 'worker busy: one job per worker (single-flight across all job types)',
+            retries,
+            retryBackOff: WORKER_BUSY_RETRY_BACKOFF_MS,
+          });
+        }
         recordJobStart(job, jobType);
         // Auto-extend the broker lock for the whole life of this job (harness run
         // + git finalize + complete/fail), stopped in the outer finally. The lock
@@ -7004,6 +7162,10 @@ async function workAgent(req, flags) {
         } finally {
           stopLockExtender();
           recordJobEnd(job);
+          // Release the process-wide single-flight permit LAST, once this job's
+          // lock-extender is stopped and its bookkeeping cleared, so another
+          // poller can only begin after this job is fully settled.
+          singleFlight.release();
         }
       },
     });
@@ -11644,6 +11806,7 @@ export {
   parsePsTime,
   ensureAcpFlag,
   startLockExtender,
+  createSingleFlight,
   provisionRepo,
   finalizeGit,
   describeGitFailure,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "c8ctl-plugin-nano",
-  "version": "1.44.6",
+  "version": "1.44.8",
   "type": "module",
   "description": "c8ctl plugin to start, inspect, and stop a local Nano BPM (nanobpmn) cluster",
   "main": "c8ctl-plugin.js",
@@ -57,12 +57,12 @@
   },
   "optionalDependencies": {
     "node-pty": "^1.0.0",
-    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.44.6",
-    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.44.6",
-    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.44.6",
-    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.44.6",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.44.6",
-    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.44.6",
-    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.44.6"
+    "@nanobpm/c8ctl-plugin-nano-darwin-arm64": "1.44.8",
+    "@nanobpm/c8ctl-plugin-nano-darwin-x64": "1.44.8",
+    "@nanobpm/c8ctl-plugin-nano-linux-x64": "1.44.8",
+    "@nanobpm/c8ctl-plugin-nano-linux-arm64": "1.44.8",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv7": "1.44.8",
+    "@nanobpm/c8ctl-plugin-nano-linux-armv6": "1.44.8",
+    "@nanobpm/c8ctl-plugin-nano-win32-x64": "1.44.8"
   }
 }