cawdev-cli 1.2.1 → 1.2.2

package/lib/sonar-analysis.mjs

@@ -4,14 +4,48 @@
 // for the server's analysis task. One place, so the two cannot drift (R584).
 // Zero dependencies, like all of tools/.
 
-/** A GET against the SonarQube server a scan just reported to, authorised with the scanner's own token. */
-export function sonarAsker(serverUrl, token) {
-  return async (path) => {
-    const response = await fetch(`${serverUrl}${path}`, { headers: { authorization: `Bearer ${token}` } });
-    if (!response.ok) {
-      throw new Error(`SonarQube answered ${response.status} to ${path.split('?')[0]}`);
+export const SONAR_REQUEST_TIMEOUT_MS = 30_000;
+
+const isAbort = (error) =>
+  ['TimeoutError', 'AbortError'].includes(error?.name) || ['TimeoutError', 'AbortError'].includes(error?.cause?.name);
+
+/**
+ * A GET against the SonarQube server a scan just reported to, authorised with the
+ * scanner's own token. Every request is bounded (R622): by `requestTimeoutMs`, by
+ * the asker's `deadline`, and by a per-call `timeoutMs`, whichever is smallest.
+ * A cut-off request throws an error with `code === 'SONAR_TIMEOUT'`, and
+ * `byDeadline` true when the deadline or the per-call limit set the limit.
+ */
+export function sonarAsker(serverUrl, token, { requestTimeoutMs = SONAR_REQUEST_TIMEOUT_MS, deadline = Infinity } = {}) {
+  return async (path, { timeoutMs } = {}) => {
+    const pathOnly = path.split('?')[0];
+    const left = Math.min(deadline - Date.now(), timeoutMs ?? Infinity);
+    const byDeadline = left < requestTimeoutMs;
+    const limit = Math.max(1, Math.min(requestTimeoutMs, left));
+    try {
+      const response = await fetch(`${serverUrl}${path}`, {
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(limit),
+      });
+      if (!response.ok) {
+        await response.body?.cancel().catch(() => {});
+        throw new Error(`SonarQube answered ${response.status} to ${pathOnly}`);
+      }
+      return await response.json();
+    } catch (error) {
+      if (!isAbort(error)) {
+        throw error;
+      }
+      const timeout = new Error(
+        byDeadline
+          ? `SonarQube did not answer ${pathOnly} before the reading's time ran out`
+          : `SonarQube did not answer ${pathOnly} within ${Math.ceil(limit / 1000)}s`,
+      );
+      timeout.code = 'SONAR_TIMEOUT';
+      timeout.limitMs = limit;
+      timeout.byDeadline = byDeadline;
+      throw timeout;
     }
-    return response.json();
   };
 }
 
@@ -19,16 +53,28 @@ export function sonarAsker(serverUrl, token) {
  * Waits for a queued analysis to settle — shared by every scan path, BRANCH,
  * MAIN and PROJECT alike. Throws rather than reports: every caller runs
  * inside `scanQuality`'s own try/catch, which turns it into an error reading.
+ * Each poll is limited to the time left (R622), so one unanswered request
+ * cannot outlive the deadline.
  */
 export async function waitForAnalysis(ask, ceTaskId, deadline, timeoutSeconds) {
   let settled = null;
   while (Date.now() < deadline) {
-    const { task: current } = await ask(`/api/ce/task?id=${encodeURIComponent(ceTaskId)}`);
+    let current;
+    try {
+      ({ task: current } = await ask(`/api/ce/task?id=${encodeURIComponent(ceTaskId)}`, {
+        timeoutMs: deadline - Date.now(),
+      }));
+    } catch (error) {
+      if (error?.code === 'SONAR_TIMEOUT' && error.byDeadline) {
+        break;
+      }
+      throw error;
+    }
     if (['SUCCESS', 'FAILED', 'CANCELED'].includes(current?.status)) {
       settled = current;
       break;
     }
-    await new Promise((wake) => setTimeout(wake, 3000));
+    await new Promise((wake) => setTimeout(wake, Math.min(3000, Math.max(0, deadline - Date.now()))));
   }
   if (!settled) {
     throw new Error(`SonarQube had not finished analysing after ${timeoutSeconds}s.`);

package/mcp/server.mjs

@@ -301,10 +301,14 @@ function renderRounds(where) {
  * by counting is an agent one skipped question away from acting on the wrong
  * one.
  */
+/** R612: the platform closes a question with no person behind it; it reaches us as this. */
+const THE_PLATFORM = '(the platform)';
+const bySomeone = (email) => Boolean(email) && email !== THE_PLATFORM;
+
 function renderRound(asked, answered) {
   const title = asked?.title ?? 'The round';
   const lines = answered.map((question, at) => {
-    const said = question.answeredByEmail
+    const said = bySomeone(question.answeredByEmail)
       ? `${question.answeredByEmail}: ${question.answer}`
       : question.answer;
     const opinions = (question.opinions ?? [])
@@ -329,7 +333,10 @@ function renderAnswer(answered) {
     .map((opinion) => `  ${opinion.authorEmail}: ${opinion.body}`)
     .join('\n');
 
-  const answer = `${answered.answeredByEmail} answered:\n\n${answered.answer}`;
+  // R612: no answeredByEmail means the platform closed it, not a person.
+  const answer = bySomeone(answered.answeredByEmail)
+    ? `${answered.answeredByEmail} answered:\n\n${answered.answer}`
+    : `Nobody answered — the question was closed:\n\n${answered.answer}`;
   return said ? `${answer}\n\nWhat people said before deciding:\n${said}` : answer;
 }
 
@@ -1693,7 +1700,7 @@ const TOOLS = [
       if (answered) {
         return renderRound(null, answered);
       }
-      return `Still unfinished. Call await_group again with group_id ${args.group_id}.`;
+      return `Still unfinished. Call await_group again with group_id ${args.group_id} to keep waiting. If you carry on instead, the round stays in their inbox — and the run reads as waiting on them — until this stage ends; then it is closed, and an answer given after that is refused.`;
     },
   },
 
@@ -1774,7 +1781,7 @@ const TOOLS = [
       if (answered) {
         return renderAnswer(answered);
       }
-      return `Still nothing. Call await_answer again with question_id ${args.question_id}.`;
+      return `Still nothing. Call await_answer again with question_id ${args.question_id} to keep waiting. If you carry on instead, the question stays in their inbox — and the run reads as waiting on them — until this stage ends; then it is closed, and an answer given after that is refused.`;
     },
   },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cawdev-cli",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "cawdev's terminal client and runner daemon — zero dependencies, on purpose",
   "type": "module",
   "bin": {

package/runner/README.md

@@ -358,6 +358,33 @@ having none.
 
 ### Advanced mode: one card per session
 
+**Advanced mode is the default terminal (R624).** `cawdev` opens in it wherever
+the terminal can draw it — a TTY, not `TERM=dumb`, at least 80×24. Below that,
+or through a pipe (`--watch-only | …`), it is the scrollback, with one line
+saying why. `cawdev --simple` and `/simple` are the scrollback terminal;
+`/advanced-mode` is the way back; the choice is remembered per platform in
+`prefs.mjs` (`mode: simple|advanced`) beside `/agent` and `/matrix`. This does
+not reopen R81 — it weighs it again: with several sessions and a roadmap on one
+machine, R81's reason (a full-screen repaint eats the scrollback) no longer
+wins, and the scrollback is one key away. `/export` (or `/export 3`,
+`/export R29`) lays a session's log into the normal screen so the terminal's own
+search and copy reach it; quitting and `/simple` lay in what the focused
+session said.
+
+**The motion is a spinner and a robot, not rain.** The rain is **off by
+default** (`/matrix on` brings it back exactly as it was, remembered). A
+running card's status mark, and the mark on the current stage of its walk,
+turn: `◴ ◵ ◶ ◷` for a stage that writes (plan, code, merge, release, roadmap,
+interview), `◜ ◝ ◞ ◟` for one that only reads (test, ask, audit, scope), a
+frame every two ticks of the 120 ms clock. A waiting card holds `◆`, a queued
+one rests on the spinner's first frame. A status that changes is drawn
+reversed for four ticks. The robots (a finished plan, a finished development
+docked at `▶ review`, nothing built, a landing at `▶ main`, a merge in flight)
+move whether the rain is on or off. `n`/`N` move to the next/previous card
+that needs you (`n` still refuses when the focused card holds a permission
+request); `/close 3`, `/close all` and `w` close ended cards. A running card is
+refused with `that session is still running · x x cancels it`.
+
 `/advanced-mode` gives **one card per session** this machine is running, or
 has run since you attached. The cards sit above **the prompt, which stays at
 the bottom** the way a shell's does. A session's log scrolling past in a corner was neither readable
@@ -1116,7 +1143,13 @@ files at all. R47 removes the need for this by giving each run a workspace.
    and leaves the run exactly as the platform has it; if it is QUEUED, the next
    poll offers it again and it is claimed properly. Only 400, 404, 409 and 410
    count as a refusal; any other status (401, 403, 408, 429), a network error or
-   a 5xx still fails the run.
+   a 5xx still fails the run. For a MERGE run (R621), the merge the daemon
+   prepared is undone before it lets go, on a refusal and on a failure alike
+   (`git merge --abort`, or a `reset --keep` past its own merge commit), so the
+   checkout is offered again as it was; the FAILED summary says so. A checkout
+   found mid-merge that the daemon did not start is refused with a sentence
+   naming `git commit` and `git merge --abort`, and is not touched; a MERGE run
+   carrying on its own branch is the exception.
 3. **Spawns the agent** in that directory, in its own process group, with the
    run token in its environment and an `.mcp.json` pointing at cawdev's MCP
    server. **Your own token never reaches the child.**