codex-overleaf-link 2.5.0 → 2.6.0

package/native-host/src/subagentBroker.js

@@ -20,6 +20,7 @@ const path = require('node:path');
 
 const { SUBAGENT_QUEUE_DIR } = require('./mirrorWorkspace');
 const { safeWorkspaceRelativePath } = require('./subagentWorkspacePath');
+const { estimateWorkerWaves } = require('./subagentAdmission');
 const { compactEvent, publicText } = require('./subagentTelemetry');
 const { createSubagentWorkspace } = require('./subagentWorkspace');
 
@@ -46,7 +47,10 @@ function createSubagentBroker(options = {}) {
   if (typeof runWorkerTask !== 'function') {
     throw new Error('subagent broker requires a runWorkerTask function');
   }
-  const emit = typeof options.emit === 'function' ? options.emit : () => {};
+  const emit = (...args) => {
+    try { if (typeof options.emit === 'function') options.emit(...args); }
+    catch (_error) { /* Observability cannot prevent worker cleanup. */ }
+  };
   const onMirrorDirty = typeof options.onMirrorDirty === 'function' ? options.onMirrorDirty : () => {};
   const parentSignal = options.signal || null;
   const env = options.env || process.env;
@@ -84,6 +88,8 @@ function createSubagentBroker(options = {}) {
   let anyWorkerStarted = false;
   let cancelled = false;
   let closed = false;
+  let brokerError = null;
+  let stopping = null;
 
   function start() {
     // Stale queue dirs from a previous run carry old results/logs — clear
@@ -129,11 +135,22 @@ function createSubagentBroker(options = {}) {
       intakeJobs();
       fillSlots();
       processAdoptions();
-    } catch (_error) {
-      // The queue is adversarial model output; the broker never throws on it.
+    } catch (error) {
+      recordFailure(error);
     }
   }
 
+  function recordFailure(error, jobId) {
+    accepting = false;
+    if (brokerError) return;
+    brokerError = Object.assign(new Error('Subagent broker results or cleanup could not be persisted.'), {
+      code: 'subagent_io_failed', cause: error
+    });
+    emit('codex.subagent.failed', 'Subagent result storage failed', {
+      jobId, status: 'failed', reason: brokerError.message, code: brokerError.code
+    }, 'warning');
+  }
+
   function intakeJobs() {
     if (!accepting || !fs.existsSync(jobsDir)) {
       return;
@@ -177,11 +194,12 @@ function createSubagentBroker(options = {}) {
   }
 
   function idFromFileName(name) {
-    return name.replace(/\.json$/, '').slice(0, 32) || 'unknown';
+    const id = name.replace(/\.json$/, '');
+    return JOB_ID_PATTERN.test(id) ? id : `rejected-${crypto.randomBytes(11).toString('hex')}`;
   }
 
   function jobIdOrFallback(job, name) {
-    return typeof job?.id === 'string' && job.id ? job.id.slice(0, 32) : idFromFileName(name);
+    return typeof job?.id === 'string' && JOB_ID_PATTERN.test(job.id) ? job.id : idFromFileName(name);
   }
 
   function validateJob(job) {
@@ -214,13 +232,11 @@ function createSubagentBroker(options = {}) {
       }
       owned.push(safe);
     }
-    // Overlapping ownership no longer rejects: same-file jobs are admitted
-    // and SERIALIZED by the scheduler (fillSlots never runs two jobs whose
-    // files intersect). Prompt-scoped same-file delegation is then safe —
-    // the physical lost-update race only exists under concurrency (v1.6.1).
-    // Wave-aware admission: the parent turn has no default absolute deadline,
-    // so the broker enforces its own wall-clock envelope across ALL waves.
-    const projectedWaves = Math.ceil((queued.length + running.size + 1) / limits.maxWorkers);
+    // Reserve serial waves for overlapping ownership, matching fillSlots.
+    // The budget covers worker admission; parent/OS cleanup has separate limits.
+    const projectedWaves = estimateWorkerWaves(
+      [...running.keys()].map(id => jobs.get(id).job.files),
+      [...queued.map(id => jobs.get(id).job.files), owned], limits.maxWorkers);
     if (Date.now() + projectedWaves * limits.perWorkerTimeoutMs > startedAt + limits.brokerBudgetMs) {
       return { reason: 'insufficient_time' };
     }
@@ -245,6 +261,10 @@ function createSubagentBroker(options = {}) {
   }
 
   function writeResult(result) {
+    // Rejection receipts cross the same filesystem boundary as accepted jobs.
+    if (typeof result.id !== 'string' || !JOB_ID_PATTERN.test(result.id)) {
+      throw new Error('Invalid subagent result ID');
+    }
     atomicWrite(path.join(resultsDir, `${result.id}.json`), JSON.stringify(result, null, 2));
   }
 
@@ -265,6 +285,11 @@ function createSubagentBroker(options = {}) {
       }
       const [jobId] = queued.splice(index, 1);
       const entry = jobs.get(jobId);
+      if (Date.now() + limits.perWorkerTimeoutMs > startedAt + limits.brokerBudgetMs) {
+        entry.status = 'rejected';
+        writeRejection({ id: jobId, reason: 'insufficient_time' });
+        continue;
+      }
       try {
         startWorker(entry);
       } catch (error) {
@@ -338,6 +363,7 @@ function createSubagentBroker(options = {}) {
         } catch (_error) { /* Observability must not fail or stop the worker. */ }
       }
     }).then(workerResult => {
+      if (controller.signal.aborted) throw controller.signal.reason || new Error('Subagent aborted');
       finishWorker(entry, {
         status: 'completed',
         summary: String(workerResult?.assistantMessage || '').slice(0, SUMMARY_LIMIT_CHARS),
@@ -345,21 +371,22 @@ function createSubagentBroker(options = {}) {
       }, workerResult);
     }).catch(error => {
       // Any broker-initiated abort that is not the wall-clock deadline
-      // (parent cancel, drain) reads as 'cancelled'; only genuine worker
-      // errors read as 'failed'.
-      const status = timedOut ? 'timeout' : controller.signal.aborted ? 'cancelled' : 'failed';
+      // (parent cancel, drain), or an interrupted worker turn, is cancelled.
+      const status = timedOut ? 'timeout' : controller.signal.aborted || error?.code === 'codex_cancelled' ? 'cancelled' : 'failed';
       appendLog(job.id, `${status}: ${error?.stack || error?.message || String(error)}`);
       finishWorker(entry, { status, reason: error?.message || String(error) });
-    }).finally(() => {
+    }).catch(error => recordFailure(error, job.id)).finally(() => {
       clearTimeout(deadlineTimer);
       running.delete(job.id);
       if (running.size === 0) {
         endWave();
       }
+      writeBrokerFile(closed ? 'closed' : 'ready');
       fillSlots();
-    });
+    }).catch(error => recordFailure(error, job.id));
 
     running.set(job.id, { controller, deadlineTimer, promise });
+    try { writeBrokerFile('ready'); } catch (error) { recordFailure(error, job.id); }
   }
 
   function finishWorker(entry, resultFields, workerResult) {
@@ -451,7 +478,6 @@ function createSubagentBroker(options = {}) {
       // Workers have exited before this capability is published. A worker
       // cannot pre-authorize its own incomplete output while still running.
       adoptionToken = crypto.randomBytes(24).toString('hex');
-      writeBrokerFile('ready');
     }
   }
 
@@ -498,69 +524,56 @@ function createSubagentBroker(options = {}) {
     for (const { controller } of running.values()) {
       controller.abort(new Error('run cancelled'));
     }
-    for (const jobId of queued.splice(0)) {
-      const entry = jobs.get(jobId);
-      entry.status = 'cancelled';
-      writeResult({ id: jobId, status: 'cancelled', reason: 'run cancelled' });
-      emit('codex.subagent.failed', publicText(entry.job.title || jobId, 160), {
-        jobId, status: 'cancelled', reason: 'run cancelled'
-      }, 'warning');
-    }
     if (anyWorkerStarted) {
-      // Partial worker edits must be deterministically discarded: cancellation
-      // already skips writeback, and the dirty mark forces the next run's
-      // mirror sync to rebuild the workspace from Overleaf (spec P1-3 fix).
-      onMirrorDirty();
+      try { onMirrorDirty(); } catch (error) { recordFailure(error); }
     }
-    close();
+    // Event listeners cannot expose an async rejection. The same sticky stop
+    // promise is still awaited by the parent runner and reports any I/O error.
+    stop({ drain: false }).catch(() => {});
   }
 
-  async function stop({ drain = true } = {}) {
-    processAdoptions();
-    accepting = false;
-    // Queued-but-unstarted jobs would otherwise vanish with no result file,
-    // hanging a lead still polling for its job count. Settle them first
-    // (mirrors onParentAbort's queue handling).
+  function cancelQueued(reason) {
     for (const jobId of queued.splice(0)) {
       const entry = jobs.get(jobId);
-      if (entry) {
-        entry.status = 'cancelled';
-      }
-      writeResult({ id: jobId, status: 'cancelled', reason: 'The run ended before this subagent started.' });
+      if (entry) entry.status = 'cancelled';
+      try { writeResult({ id: jobId, status: 'cancelled', reason }); }
+      catch (error) { recordFailure(error, jobId); }
       emit('codex.subagent.failed', publicText(entry?.job?.title || jobId, 160), {
-        jobId, status: 'cancelled', reason: 'The run ended before this subagent started.'
+        jobId, status: 'cancelled', reason
       }, 'warning');
     }
-    if (drain && running.size) {
-      let graceTimer = null;
-      const grace = new Promise(resolve => {
-        graceTimer = setTimeout(resolve, limits.drainGraceMs);
-      });
-      await Promise.race([
-        Promise.allSettled([...running.values()].map(worker => worker.promise)),
-        grace
-      ]);
-      // The grace timer gates an awaited race; if the workers settled first it
-      // must be cleared or it keeps the event loop alive for drainGraceMs
-      // (the "keep timers gated, then clear" discipline from c3cd357).
-      if (graceTimer) {
-        clearTimeout(graceTimer);
+  }
+
+  function stop({ drain = true } = {}) {
+    accepting = false;
+    if (!stopping) stopping = Promise.resolve().then(() => stopWorkers(drain));
+    return stopping.then(() => { if (brokerError) throw brokerError; });
+  }
+
+  async function stopWorkers(drain) {
+    accepting = false;
+    try {
+      try { processAdoptions(); } catch (error) { recordFailure(error); }
+      cancelQueued(cancelled ? 'run cancelled' : 'The run ended before this subagent started.');
+      if (drain && !cancelled && !brokerError) await settleRunningWithin(limits.drainGraceMs);
+    } finally {
+      for (const { controller } of running.values()) controller.abort(new Error('broker drained'));
+      // Keep bounded waiting for workers that ignore abort; their own deadline
+      // remains active until settlement. OS exit proof belongs to the runner.
+      try { await settleRunningWithin(limits.drainGraceMs); } finally {
+        for (const jobId of running.keys()) for (const file of jobs.get(jobId).job.files) {
+          quarantined.set(file, { jobId, status: 'cancelled', adoptedHash: '' });
+        }
+        close();
       }
     }
-    for (const { controller } of running.values()) {
-      controller.abort(new Error('broker drained'));
-    }
-    // Bounded final settle: a worker that ignores its abort must not hang
-    // stop() forever — that strands codex.run and leaks the project lock (the
-    // very zombie-lock case handleCodexCancel exists to recover from).
-    await settleRunningWithin(limits.drainGraceMs);
     if (jobs.size) {
       emit('codex.subagent.drained', 'subagents drained', {
         jobs: jobs.size,
         violations: violations.length
-      }, 'completed');
+      }, brokerError ? 'warning' : 'completed');
     }
-    close();
+    if (brokerError) throw brokerError;
   }
 
   async function settleRunningWithin(timeoutMs) {
@@ -591,7 +604,7 @@ function createSubagentBroker(options = {}) {
     parentSignal?.removeEventListener?.('abort', onParentAbort);
     try {
       writeBrokerFile('closed');
-    } catch (_error) { /* workspace may already be gone */ }
+    } catch (error) { recordFailure(error); }
   }
 
   return {

package/native-host/src/subagentTelemetry.js

@@ -3,15 +3,14 @@
 // Observation only: never resumes a thread, starts a turn or settles a run.
 const CHILD_ID = /^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,159}$/;
 const MAX_CHILDREN = 16;
+const MAX_HISTORY_READ_FAILURES = 3;
 const TERMINAL = new Set(['completed', 'failed', 'cancelled']);
 const EVIDENCE = { history: 1, agent: 2, turn: 3 };
 
 function publicText(value, limit = 4096) {
-  return String(value ?? '')
-    .replace(/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{12,}/g, '[REDACTED_SECRET]')
-    .replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED_SECRET]')
-    .replace(/((?:api[_-]?key|access[_-]?token|secret|password|authorization)\s*[:=]\s*["']?)[^\s"',;]+/gi, '$1[REDACTED_SECRET]')
-    .slice(0, limit);
+  // Preserve the delegated task and model/tool text. The event allowlist
+  // excludes credential fields; metadataText separately hides local paths.
+  return String(value ?? '').slice(0, limit);
 }
 
 function fields(value, names, limit = 4096) {
@@ -185,7 +184,7 @@ function createNativeSubagentObserver({ emit, request, getRoot, ownsParent, isSt
     return false;
   }
   function snapshot(child, terminal = false) {
-    if (!active() || child.readDisabled) return;
+    if (!active() || child.readDisabled || (child.readFailures || 0) >= MAX_HISTORY_READ_FAILURES) return;
     if (child.reading) { child.readAgain ||= terminal; return; }
     if (!terminal && Date.now() - child.lastRead < 2000) return;
     child.reading = true; child.lastRead = Date.now();
@@ -204,6 +203,11 @@ function createNativeSubagentObserver({ emit, request, getRoot, ownsParent, isSt
         if (!turn?.id || turn.id === getRoot().turnId
           || child.turnId && child.turnId !== turn.id) return;
         child.historyTurnId = turn.id;
+        child.readFailures = 0;
+        if (child.historyUnavailable) {
+          child.historyUnavailable = false;
+          publish(child, null, { historyUnavailable: false });
+        }
         const items = Array.isArray(turn.items) ? turn.items : [];
         // Recover real child input before compactEvent drops user content.
         // A fork's parent context and encrypted delegation are not task text.
@@ -231,11 +235,14 @@ function createNativeSubagentObserver({ emit, request, getRoot, ownsParent, isSt
             ? (interruptionObserved ? 'cancelled' : undefined) : turn.status;
           if (setStatus(child, next, EVIDENCE.history)) publish(child, null);
         }
-      }).catch(() => {
+      }).catch(error => {
         if (!active() || child.generation !== generation) return;
-        // Older app servers may lack this capability. Keep observed records;
-        // reading history must never interrupt or resume the parent or child.
-        child.readDisabled = true;
+        // Unsupported history stays disabled; other errors get a bounded retry
+        // only on later activity. Observation never interrupts or resumes work.
+        child.readDisabled = error?.code === -32601 || error?.code === '-32601'
+          || /(?:thread[ /]read.*(?:unsupported|not supported)|method (?:not found|not supported))/i.test(String(error?.message || ''));
+        child.readFailures = (child.readFailures || 0) + 1;
+        child.historyUnavailable = true;
         publish(child, null, { historyUnavailable: true });
       }).finally(() => {
         child.reading = false;
@@ -258,6 +265,8 @@ function createNativeSubagentObserver({ emit, request, getRoot, ownsParent, isSt
           if (known.retiredTurns.size > 100) known.retiredTurns.delete(known.retiredTurns.values().next().value);
           known.turnId = turnId;
           known.generation += 1;
+          known.readFailures = 0;
+          known.lastRead = -Infinity;
           known.statusEvidence = 0;
           known.interruptionObserved = false;
         }

package/native-host/src/subagentWorkspacePath.js

@@ -7,14 +7,17 @@ const { SUBAGENT_QUEUE_DIR } = require('./mirrorWorkspace');
     if (typeof value !== 'string' || !value.trim()) {
       return null;
     }
-    const normalized = value.trim().replace(/\\/g, '/').replace(/^\.\//, '');
+    const normalized = value.trim().replace(/\\/g, '/');
     if (!normalized || path.isAbsolute(normalized)) {
       return null;
     }
-    const segments = normalized.split('/');
+    let segments = normalized.split('/');
     if (segments.some(segment => segment === '..' || segment === '')) {
       return null;
     }
+    // All consumers use the same identity, including control guards and locks.
+    segments = segments.filter(segment => segment !== '.');
+    if (!segments.length) return null;
     if (segments[0] === SUBAGENT_QUEUE_DIR) {
       // The queue control plane (jobs/results/logs/broker.json) is never
       // ownable — but the work/ scratch zone IS: single-file fan-out slices