codexteer 0.18.1 → 0.18.2

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 公開日は日本時間です。
 
+## 0.18.2 — 2026-11-01公開
+
+- 停止済みの監督IDが、別の監督への交代後に古い本文から再登録できる問題を修正しました。停止履歴を監督記録に保持し、登録前のdoctor・再登録・観測・送信で`SUPERVISOR_STOPPED`を返します。旧形式の停止済み記録も、交代時に履歴へ引き継ぎます。保存済み旧CLIを使う監督には、更新後のCLIでプロンプトを生成し直してください。
+- 同じ監督IDの別タスクへの登録を拒否します。既存データでIDが重複している場合も`supervise list --json`は全件を返し、`session_conflict.thread_ids`と、他タスクの観測記録を除外した項目の`observation_error`で衝突を示します。各タスクの`supervise stop`で停止できます。
+
 ## 0.18.1 — 2026-10-31
 
 - ローカルロックの保持者と回収者が続けてクラッシュした後、`RECORD_BUSY`から自動回復できなくなる問題を修正しました。回収処理にもPIDと世代トークンを持つロックを使い、生きた保持者・回収者の排他を維持します。

package/README.md

@@ -253,6 +253,10 @@ codexteer supervise stop <thread-id>
 
 直接起動はエージェントを起動する前に登録し、終了時に停止を記録します。本文だけの生成では未登録で、貼り付け先が本文中の`supervise register`を実行して開始します。一つのタスクに一つの監督を登録でき、競合は`SUPERVISOR_CONFLICT`になります。異常終了などで残った登録は、`status`で確認して明示的に`stop`してから開始し直してください。停止済みIDや古い本文で再開はできません。同じ本文の再登録で一時停止が解除されることもありません。
 
+停止済みIDは交代後も監督記録の履歴に保持し、登録前の`doctor`・再登録・観測・送信を`SUPERVISOR_STOPPED`で拒否します。更新前の停止済み記録も、交代時に履歴へ引き継ぎます。更新前にすでに上書きされて失われた停止履歴は復元できません。保存済み旧CLIには修正が反映されないため、更新後のCLIでプロンプトを生成し直してください。
+
+同じ`CODEX_HOME`・接続先ホストの中では、監督IDを別タスクへ登録できません（`SUPERVISOR_CONFLICT`。停止済みなら`SUPERVISOR_STOPPED`）。旧版で同じIDを複数タスクに登録したデータも、`supervise list --json`は全件を返し、該当項目の`session_conflict.thread_ids`に衝突先を示します。他タスクの観測記録は`observation: null`と`observation_error`で明示し、そのタスクの観測として扱いません。重複したIDでの観測・送信は拒否されます。ユーザーの端末から各タスクを`supervise stop`し、新しいIDの監督を開始してください。
+
 送信中の`pause`/`stop`は`RECORD_BUSY`で失敗します。配送結果を確認して制御を再実行し、成功するまでは停止したと扱わないでください。監督役が自分で`resume`したり、生成コマンドから`--supervisor`を外して回避したりしないよう、必須テンプレートにも指示します。
 
 この制御は新しい監督ID付きコマンドに適用します。以前の版で開始した監督、IDなしの手動送信、同じOSユーザーが実行する任意のコードを隔離する機能ではありません。監督IDは秘密情報ではなく、古いセッションや操作の競合を検出する識別子です。

package/docs/distribution.md

@@ -5,6 +5,8 @@
 
 `0.18.1`は、保持者と回収者の連続クラッシュでローカルロックが永久に`RECORD_BUSY`になる問題を修正します。更新前に、同じ`CODEX_HOME`を使う旧版CLIの操作と、保存済み旧CLIで動く監督を終了してください。旧版と修正版の回収方式の混在は非対応です。旧`.recover`ディレクトリは修正版では無視されます。監督は更新後のCLIで起動し直すか、プロンプトを生成し直してください。
 
+`0.18.2`は、監督が交代した後も停止済みIDを履歴に保持し、古い本文からの再登録・観測・送信を`SUPERVISOR_STOPPED`で拒否します。登録前の`doctor`にも同じ判定を適用します。同じIDの別タスクへの登録を拒否し、旧版で重複したIDを持つ記録も`supervise list --json`で全件と衝突先を返します。該当タスクはそれぞれ`supervise stop`で停止できます。更新前の停止済み記録は交代時に引き継ぎますが、すでに上書きされて失われた停止履歴は復元できません。保存済み旧CLIには修正が反映されないため、更新後のCLIで監督を起動し直すか、プロンプトを生成し直してください。runtime protocolとcapability契約はv1を維持し、Desktopの再起動は必要ありません。
+
 `package.json` は `private` を持たず、`publishConfig` でnpm公式レジストリへのpublic公開を指定しています。公開可能な設定であることと、実際に公開済みであることは別です。
 
 公開後の基本的な実行形式は次のとおりです。通常はバージョン指定なしで使えます。監督開始後は保存したCLIを使い続けるため、監督中の一貫性を保つために版を明示する必要はありません。起動側と操作側の製品バージョンも、必要な通信仕様が対応していれば異なっていても使えます。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codexteer",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Send steering messages to running Codex Desktop threads from a terminal.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -15,7 +15,7 @@ import { acquireResource, resourceStatus, renewResource, releaseResource, listRe
 import { playSendSound } from "./sound.mjs";
 import { prepareSupervisorPrompt, superviseAgent } from "./supervise.mjs";
 import { prepareOrchestrationPrompt, orchestrateAgent } from "./orchestrate.mjs";
-import { supervisorId, registerSupervisor, getSupervisor, assertSupervisor, controlSupervisor, supervisorStatus, listSupervisors } from "./supervision.mjs";
+import { supervisorId, registerSupervisor, getSupervisor, assertSupervisor, assertSupervisorRegistration, controlSupervisor, supervisorStatus, listSupervisors } from "./supervision.mjs";
 import { createFinding, findingStatus, listFindings, resolveFinding, dismissFinding, reopenFinding, evaluateFinding, findingStats } from "./findings.mjs";
 import { connectionMode, observationConnection, desktopReadOnly } from "./connection.mjs";
 import { repairTurns } from "./turn-repair.mjs";
@@ -141,7 +141,7 @@ function printThreads(threads) {
 function printSupervisor(data) {
   if (Array.isArray(data)) {
     if (!data.length) console.log("No supervisor sessions registered.");
-    for (const entry of data) console.log(`${entry.thread_id}  ${entry.state}  ${entry.owner}  ${entry.connection}  observed:${entry.observation?.last_observed_at ?? "none"}`);
+    for (const entry of data) console.log(`${entry.thread_id}  ${entry.state}  ${entry.owner}  ${entry.connection}  observed:${entry.observation?.last_observed_at ?? "none"}${entry.session_conflict ? `  session-conflict:${entry.session_conflict.thread_ids.join(",")}` : ""}${entry.observation_error ? `  observation-error:${entry.observation_error.code}` : ""}`);
     return;
   }
   console.log(`${data.thread_id}  ${data.state}${data.owner ? `  ${data.owner}  ${data.connection}` : ""}`);
@@ -459,11 +459,7 @@ async function mainOnTarget(argv) {
       const target = takeOption(args, "--thread", undefined);
       if (target !== undefined && backend !== "app-server") throw new Error("doctor --thread requires --backend app-server.");
       const threadId = target === undefined ? undefined : normalizeThreadId(target);
-      if (supervisor && threadId) {
-        const record = await getSupervisor(threadId);
-        if (record && record.session_id !== supervisor && record.state !== "stopped") throw Object.assign(new Error("Another supervisor is registered for this task."), { code: "SUPERVISOR_CONFLICT" });
-        if (record?.session_id === supervisor) await assertSupervisor(threadId, supervisor, { connection });
-      }
+      if (supervisor && threadId) await assertSupervisorRegistration(threadId, supervisor, { connection });
       if (args.length) throw new Error(`Unexpected argument: ${args[0]}`);
       if (targetHost() !== "local" && backend === "ui") throw remoteReadOnly();
       const report = backend === "ui" ? desktopDoctor() : await appServerDoctor({ threadId, ...connectionDependencies });

package/src/cloud-cli.mjs

@@ -10,7 +10,7 @@ import { observeThread, printObservation } from "./observe.mjs";
 import { monitorCommand } from "./monitor.mjs";
 import { notificationOptions } from "./notify.mjs";
 import { prepareSupervisorPrompt, superviseAgent } from "./supervise.mjs";
-import { supervisorId, registerSupervisor, getSupervisor, assertSupervisor, controlSupervisor, supervisorStatus, listSupervisors } from "./supervision.mjs";
+import { supervisorId, registerSupervisor, getSupervisor, assertSupervisor, assertSupervisorRegistration, controlSupervisor, supervisorStatus, listSupervisors } from "./supervision.mjs";
 import { createFinding, findingStatus, listFindings, resolveFinding, dismissFinding, reopenFinding, evaluateFinding, findingStats } from "./findings.mjs";
 import { sendTrackedMessage, listMessages, getMessage, messageSummary, reconcileMessages, markMessage, listInstructions } from "./journal.mjs";
 import { createCloudTask, cloudTaskDiff, listCloudTasks, cloudCreationReceipt } from "./cloud.mjs";
@@ -84,9 +84,8 @@ export async function mainCloud(argv) {
   const bound = async (target, { allowUnregistered = false } = {}) => {
     const id = targetId(target);
     if (supervisor) {
-      const record = allowUnregistered ? await getSupervisor(id) : null;
-      if (!allowUnregistered || record?.session_id === supervisor) await assertSupervisor(id, supervisor, { connection });
-      else if (record && record.state !== "stopped") throw failure("Another supervisor owns this cloud task.", "SUPERVISOR_CONFLICT");
+      if (allowUnregistered) await assertSupervisorRegistration(id, supervisor, { connection });
+      else await assertSupervisor(id, supervisor, { connection });
     }
     return id;
   };

package/src/supervision.mjs

@@ -21,12 +21,35 @@ export function supervisorId(value) {
   return value.toLowerCase();
 }
 
+// Keep retired generations in the same atomic record as the current owner.
+// A legacy stopped record contributes its ID even before its first rewrite.
+function stoppedSessionIds(record) {
+  return [...new Set([...(record?.stopped_session_ids ?? []), ...(record?.state === "stopped" ? [record.session_id] : [])])];
+}
+
+function assertNotStopped(record, sessionId) {
+  if (stoppedSessionIds(record).includes(sessionId)) throw failure("This supervisor session has stopped. Start a new supervisor when needed.", "SUPERVISOR_STOPPED");
+}
+
+async function supervisorRecords(storage) {
+  return (await Promise.all([listRecords("supervisors", storage), listRecords("cloud-supervisors", storage)])).flat().filter(Boolean);
+}
+
+async function assertSessionBinding(threadId, sessionId, storage) {
+  const others = (await supervisorRecords(storage)).filter(record => record.thread_id !== threadId);
+  // A stopped ID stays retired even when a caller changes its target task.
+  for (const record of others) assertNotStopped(record, sessionId);
+  if (others.some(record => record.session_id === sessionId)) throw failure("This supervisor session is already registered for another task. Start a new supervisor for this task.", "SUPERVISOR_CONFLICT");
+}
+
 export async function getSupervisor(threadInput, storage = {}) {
   const threadId = normalizeTaskId(threadInput), record = await readRecord(supervisorBucket(threadId), threadId, storage);
   if (!record) return null;
   if (record.schema !== 1 || record.thread_id !== threadId || !states.has(record.state)
     || !["shared", "desktop", "cloud", "desktop-cloud"].includes(record.connection)
     || supervisorId(record.session_id) !== record.session_id || typeof record.owner !== "string"
+    || (record.stopped_session_ids !== undefined && (!Array.isArray(record.stopped_session_ids)
+      || record.stopped_session_ids.some(id => supervisorId(id) !== id)))
     || (record.launcher_pid !== null && (!Number.isSafeInteger(record.launcher_pid) || record.launcher_pid <= 0))) {
     throw failure("Invalid supervisor state. Inspect the local record before continuing.", "SUPERVISOR_INVALID");
   }
@@ -34,35 +57,45 @@ export async function getSupervisor(threadInput, storage = {}) {
 }
 
 export async function assertSupervisor(threadInput, sessionInput, { sending = false, connection, ...storage } = {}) {
-  const sessionId = supervisorId(sessionInput), record = await getSupervisor(threadInput, storage);
+  const threadId = normalizeTaskId(threadInput), sessionId = supervisorId(sessionInput), record = await getSupervisor(threadId, storage);
+  assertNotStopped(record, sessionId);
+  await assertSessionBinding(threadId, sessionId, storage);
   if (!record) throw failure("Register this supervisor session before observing or sending.", "SUPERVISOR_NOT_REGISTERED");
   if (record.session_id !== sessionId) throw failure("Another supervisor session owns this task. This command belongs to an older or different session.", "SUPERVISOR_MISMATCH");
   if (connection !== undefined && record.connection !== connection) throw failure("The supervisor is registered for another connection. Keep the original command intact.", "SUPERVISOR_MISMATCH");
   if (targetHost() !== "local" && (record.remote_transport ?? "native") !== remoteTransport()) throw failure("The supervisor belongs to a different remote transport. Keep the generated route intact.", "SUPERVISOR_MISMATCH");
-  if (record.state === "stopped") throw failure("This supervisor session has stopped. Start a new supervisor when needed.", "SUPERVISOR_STOPPED");
   if (launcherAlive(record) === false) throw failure("The supervisor launcher exited. Stop the stale session before starting another supervisor.", "SUPERVISOR_ORPHANED");
   if (sending && record.state === "paused") throw failure("Automatic intervention is paused. Observation can continue; only the user should resume intervention.", "SUPERVISOR_PAUSED");
   return record;
 }
 
+// Read-only bootstrap check shared by doctor and registration. Registration
+// repeats it under the task lock; a successful doctor does not reserve an ID.
+export async function assertSupervisorRegistration(threadInput, sessionInput, { connection, ...storage } = {}) {
+  const threadId = normalizeTaskId(threadInput), sessionId = supervisorId(sessionInput), current = await getSupervisor(threadId, storage);
+  assertNotStopped(current, sessionId);
+  await assertSessionBinding(threadId, sessionId, storage);
+  if (current?.session_id === sessionId) return assertSupervisor(threadInput, sessionId, { connection, ...storage });
+  if (current && current.state !== "stopped") throw failure("A supervisor already owns this task. Use supervise status, then stop it explicitly before replacing it.", "SUPERVISOR_CONFLICT");
+  return current;
+}
+
 export async function registerSupervisor(threadInput, sessionInput, { owner = "external", launcherPid = null, connection = "shared", ...storage } = {}) {
   const threadId = normalizeTaskId(threadInput), sessionId = supervisorId(sessionInput);
   if (typeof owner !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,79}$/.test(owner)) throw failure("Supervisor owner must be a short agent name.", "SUPERVISOR_INVALID");
   if (launcherPid !== null && (!Number.isSafeInteger(launcherPid) || launcherPid <= 0)) throw failure("Invalid supervisor launcher PID.", "SUPERVISOR_INVALID");
   if (!["shared", "desktop", "cloud", "desktop-cloud"].includes(connection)) throw failure("Invalid supervisor connection.", "SUPERVISOR_INVALID");
-  return withStoreLock(`supervisor-${threadId}`, async () => {
-    const current = await getSupervisor(threadId, storage);
-    if (current?.session_id === sessionId) {
-      if (current.connection !== connection) throw failure("The supervisor is registered for another connection. Keep the original command intact.", "SUPERVISOR_MISMATCH");
-      return assertSupervisor(threadId, sessionId, storage);
-    }
-    if (current && current.state !== "stopped") throw failure("A supervisor already owns this task. Use supervise status, then stop it explicitly before replacing it.", "SUPERVISOR_CONFLICT");
+  // Registrations take the namespace-wide lock before the task lock. Stop,
+  // pause and sends only take the task lock and never acquire in reverse order.
+  return withStoreLock("supervisor-registration", () => withStoreLock(`supervisor-${threadId}`, async () => {
+    const current = await assertSupervisorRegistration(threadId, sessionId, { connection, ...storage });
+    if (current?.session_id === sessionId) return current;
     const now = new Date().toISOString();
     const record = { schema: 1, thread_id: threadId, session_id: sessionId, owner, launcher_pid: launcherPid, connection,
-      state: "active", registered_at: now, updated_at: now, last_delivery: null };
+      state: "active", stopped_session_ids: stoppedSessionIds(current), registered_at: now, updated_at: now, last_delivery: null };
     await writeRecord(supervisorBucket(threadId), threadId, record, storage);
     return record;
-  }, storage);
+  }, storage), storage);
 }
 
 export async function controlSupervisor(threadInput, action, { expectedSession, ...storage } = {}) {
@@ -76,23 +109,32 @@ export async function controlSupervisor(threadInput, action, { expectedSession,
     if (record.state === "stopped" && action !== "stop") throw failure("A stopped supervisor cannot be resumed. Start a new supervisor.", "SUPERVISOR_STOPPED");
     if (action === "resume") await assertSupervisor(threadId, record.session_id, storage);
     const updated = { ...record, state: { pause: "paused", resume: "active", stop: "stopped" }[action], updated_at: new Date().toISOString() };
+    updated.stopped_session_ids = stoppedSessionIds(updated);
     await writeRecord(supervisorBucket(threadId), threadId, updated, storage);
     return updated;
   }, storage);
 }
 
-export async function supervisorStatus(threadInput, storage = {}) {
+export async function supervisorStatus(threadInput, { allowObservationConflict = false, ...storage } = {}) {
   const threadId = normalizeTaskId(threadInput), record = await getSupervisor(threadId, storage);
   if (!record) return { thread_id: threadId, state: "unregistered", observation: null };
-  const observation = await readRecord("supervisor-observations", record.session_id, storage);
+  let observation = await readRecord("supervisor-observations", record.session_id, storage), observationError;
+  if (allowObservationConflict && observation?.schema === 1 && observation.session_id === record.session_id && observation.thread_id !== threadId) {
+    observationError = { code: "SUPERVISOR_INVALID", message: "The observation belongs to another task.", thread_id: observation.thread_id };
+    observation = null;
+  }
   if (observation && (observation.schema !== 1 || observation.thread_id !== threadId || observation.session_id !== record.session_id)) throw failure("Invalid supervisor observation record.", "SUPERVISOR_INVALID");
-  return { ...record, launcher_alive: launcherAlive(record),
+  return { ...record, launcher_alive: launcherAlive(record), ...(observationError ? { observation_error: observationError } : {}),
     observation, observation_age_ms: observation?.last_observed_at ? Math.max(0, Date.now() - Date.parse(observation.last_observed_at)) : null };
 }
 
 export async function listSupervisors(storage = {}) {
-  const records = (await Promise.all([listRecords("supervisors", storage), listRecords("cloud-supervisors", storage)])).flat();
-  return Promise.all(records.filter(Boolean).map(record => supervisorStatus(record.thread_id, storage)));
+  const records = await supervisorRecords(storage);
+  return Promise.all(records.map(async record => {
+    const status = await supervisorStatus(record.thread_id, { ...storage, allowObservationConflict: true });
+    const conflicts = records.filter(other => other.session_id === record.session_id).map(other => other.thread_id);
+    return conflicts.length > 1 ? { ...status, session_conflict: { thread_ids: conflicts.sort() } } : status;
+  }));
 }
 
 // Observation has its own record so a concurrent read never overwrites pause/stop.