commandmate 0.45.1 → 0.46.1

package/dist/server/src/lib/polling/pending-scraped-response.js

@@ -8,6 +8,9 @@ exports.holdScrapedResponse = holdScrapedResponse;
 exports.discardPendingScrapedResponse = discardPendingScrapedResponse;
 exports.flushPendingScrapedResponse = flushPendingScrapedResponse;
 exports.settleExpiredPendingScrapedResponse = settleExpiredPendingScrapedResponse;
+exports.listPendingScrapedResponseKeys = listPendingScrapedResponseKeys;
+exports.retargetPendingScrapedResponse = retargetPendingScrapedResponse;
+exports.movePendingScrapedResponses = movePendingScrapedResponses;
 const db_instance_1 = require("../../lib/db/db-instance");
 const db_1 = require("../../lib/db");
 const ws_server_1 = require("../../lib/ws-server");
@@ -17,6 +20,7 @@ const response_dedup_1 = require("./response-dedup");
 const structured_history_gate_1 = require("./structured-history-gate");
 const stop_history_capture_1 = require("../../lib/hooks/stop-history-capture");
 const global_state_1 = require("../global-state");
+const poller_owner_1 = require("./poller-owner");
 const logger = (0, logger_1.createLogger)('response-poller');
 // ============================================================================
 // The held scrape (Issue #2436)
@@ -71,14 +75,35 @@ function hasPendingScrapedResponse(pollerKey) {
  * deadline. Replaces, because a frame that moved on is a better copy of the
  * same turn; keeps, because a pane that redraws every tick would otherwise push
  * its own deadline forward forever and the hold would stop being bounded.
+ *
+ * Issue #3663: refused to a tick whose chain has been stopped (see
+ * `mayActForPollerKey`) — a stop, a stalled-tick restart or a worktree-ID
+ * migration retired it while it awaited the reader, and whatever is held under
+ * the key now belongs to someone else. The response hash that tick registered
+ * is not taken back here: a migration does not hand a running tick's hash on in
+ * the first place (`migrateResponsePollerWorktreeIds`), so the successor judges
+ * the screen itself.
+ *
+ * @returns Whether the reply is held
  */
 function holdScrapedResponse(pollerKey, pending) {
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey)) {
+        const caller = (0, poller_owner_1.currentPollerOwner)();
+        logger.info('pending-scrape-hold-refused', {
+            worktreeId: pending.worktreeId,
+            cliToolId: pending.cliToolId,
+            instanceId: pending.instanceId,
+            generation: caller?.generation,
+        });
+        return false;
+    }
     const existing = pendingScrapedResponses.get(pollerKey);
     if (existing) {
         existing.content = pending.content;
-        return;
+        return true;
     }
     pendingScrapedResponses.set(pollerKey, pending);
+    return true;
 }
 /**
  * Drop a held scrape without writing it (Issue #2436).
@@ -88,6 +113,10 @@ function holdScrapedResponse(pollerKey, pending) {
  * duplicate this Issue exists to stop.
  */
 function discardPendingScrapedResponse(pollerKey) {
+    // Issue #3663: a stopped tick's reader answer is about a turn it no longer
+    // owns; what is held under the key now may be another chain's.
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey))
+        return;
     pendingScrapedResponses.delete(pollerKey);
 }
 /**
@@ -110,15 +139,26 @@ function discardPendingScrapedResponse(pollerKey) {
  * conversation log is fired afterwards and not waited for, because it is a
  * secondary record and the row is the one History reads.
  *
+ * Issue #3663: refused (false, nothing written or dropped) to a tick whose
+ * chain has been stopped. `stopPollingByKey` already turns such a tick's stop
+ * away; this covers the expiry settle, the other caller.
+ *
  * @param pollerKey - Poller key ("worktreeId:instanceId")
  * @param reason - What ended the hold; logged, for the operator reading back
  * @returns Whether a held reply was written
  */
 function flushPendingScrapedResponse(pollerKey, reason) {
+    // Issue #3663: a stopped tick does not confirm what is held under the key.
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey))
+        return false;
     const pending = pendingScrapedResponses.get(pollerKey);
     if (!pending)
         return false;
     pendingScrapedResponses.delete(pollerKey);
+    return writePendingScrapedResponse(pending, reason);
+}
+/** Write one held reply that has already been taken off its key. */
+function writePendingScrapedResponse(pending, reason) {
     try {
         const db = (0, db_instance_1.getDbInstance)();
         const message = (0, db_1.createMessage)(db, {
@@ -171,12 +211,28 @@ function flushPendingScrapedResponse(pollerKey, reason) {
  * parse against writing a pane dump that is about to be superseded.
  */
 async function settleExpiredPendingScrapedResponse(pollerKey) {
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey))
+        return;
     const pending = pendingScrapedResponses.get(pollerKey);
     if (!pending || Date.now() < pending.expiresAt)
         return;
     const captured = await (0, structured_history_gate_1.captureStructuredHistoryTurn)(pending.worktreeId, pending.cliToolId, pending.instanceId, { worktreePath: pending.worktreePath, transcriptPathHint: pending.transcriptPathHint });
+    // Issue #3663: the read is awaited, and a migration, a stop or a restart can
+    // land in between. The answer is acted on only if this caller still owns the
+    // key AND the hold under it is the one that was read about — after an A↔B
+    // swap the key holds B's reply, and dropping or writing it on A's answer
+    // would lose it or write it twice.
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey) || pendingScrapedResponses.get(pollerKey) !== pending) {
+        logger.info('pending-scrape-settle-abandoned', {
+            worktreeId: pending.worktreeId,
+            cliToolId: pending.cliToolId,
+            instanceId: pending.instanceId,
+            captured,
+        });
+        return;
+    }
     if (captured) {
-        discardPendingScrapedResponse(pollerKey);
+        pendingScrapedResponses.delete(pollerKey);
         (0, response_dedup_1.settleStructuredHistoryRecheck)(pollerKey);
         logger.info('pending-scrape-superseded', {
             worktreeId: pending.worktreeId,
@@ -186,5 +242,65 @@ async function settleExpiredPendingScrapedResponse(pollerKey) {
         });
         return;
     }
-    flushPendingScrapedResponse(pollerKey, 'hold-expired');
+    pendingScrapedResponses.delete(pollerKey);
+    writePendingScrapedResponse(pending, 'hold-expired');
+}
+// ============================================================================
+// Worktree-ID migration (Issue #3663)
+// ============================================================================
+/** Keys that hold a scrape right now. For the migration to choose what moves. */
+function listPendingScrapedResponseKeys() {
+    return Array.from(pendingScrapedResponses.keys());
+}
+/**
+ * Point the scrape held under `pollerKey` at `newWorktreeId`, in place.
+ *
+ * For a chain the migration stops instead of moving (it could not resolve the
+ * chain's tool): the stop writes the hold, and written under the old ID it
+ * would fail the row's foreign key — the rename has already happened — and be
+ * lost.
+ *
+ * @returns Whether a scrape was held under the key
+ */
+function retargetPendingScrapedResponse(pollerKey, newWorktreeId) {
+    const pending = pendingScrapedResponses.get(pollerKey);
+    if (!pending)
+        return false;
+    pendingScrapedResponses.set(pollerKey, { ...pending, worktreeId: newWorktreeId });
+    return true;
+}
+/**
+ * Move the held scrapes of a whole migration batch.
+ *
+ * Every source is lifted before any destination is written, so a swap (A→B,
+ * B→A) or a chain (A→B→C) cannot overwrite a scrape that has not moved yet —
+ * the rule the dedup state follows (#3553). Each scrape keeps its content,
+ * deadline, timestamp and metadata; only its worktree ID becomes the new one.
+ *
+ * A scrape already under a destination is never dropped to make room: it is
+ * written first, under the ID it carries, and the moved one takes the key.
+ *
+ * Moves with `oldKey === newKey` and sources holding nothing are ignored.
+ *
+ * @param moves - Poller key moves applied together
+ */
+function movePendingScrapedResponses(moves) {
+    const lifted = [];
+    for (const { oldKey, newKey, newWorktreeId } of moves) {
+        if (oldKey === newKey)
+            continue;
+        const pending = pendingScrapedResponses.get(oldKey);
+        if (!pending)
+            continue;
+        pendingScrapedResponses.delete(oldKey);
+        lifted.push({ newKey, pending: { ...pending, worktreeId: newWorktreeId } });
+    }
+    for (const { newKey, pending } of lifted) {
+        const displaced = pendingScrapedResponses.get(newKey);
+        if (displaced) {
+            pendingScrapedResponses.delete(newKey);
+            writePendingScrapedResponse(displaced, 'migration-displaced');
+        }
+        pendingScrapedResponses.set(newKey, pending);
+    }
 }

package/dist/server/src/lib/polling/poller-owner.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * The ownership token of one response poller chain, and the question "may the
+ * code running now still act for this poller key?" (Issue #2223, #3663).
+ *
+ * In a module of its own, importing nothing from the poller, so that
+ * `./pending-scraped-response` can ask the question without importing
+ * `./response-poller-core` — which imports the checker that imports the held
+ * scrape, and would close a new import cycle (#3482).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RetiredSnapshotError = exports.snapshotOwnerStorage = exports.pollerOwnerStorage = void 0;
+exports.currentPollerOwner = currentPollerOwner;
+exports.mayActForPollerKey = mayActForPollerKey;
+exports.pollerKeyOf = pollerKeyOf;
+exports.mayActForAgentInstance = mayActForAgentInstance;
+exports.maySnapshotPublish = maySnapshotPublish;
+const async_hooks_1 = require("async_hooks");
+const global_state_1 = require("../global-state");
+/**
+ * Carries the running tick's ownership token through `checkForResponse()`.
+ *
+ * On `globalThis` for the reason the coordinator is (#2223): the poller module
+ * is evaluated once per bundle, and a token stored by one bundle's tick has to
+ * be readable by the code another bundle's copy of the checker runs.
+ */
+exports.pollerOwnerStorage = (0, global_state_1.getOrInitGlobal)('__responsePollerOwnerStorage', () => new async_hooks_1.AsyncLocalStorage());
+/** The ownership token of the tick the caller is running inside, if any. */
+function currentPollerOwner() {
+    return exports.pollerOwnerStorage.getStore();
+}
+/**
+ * Whether the code running now may change what is kept under `pollerKey`
+ * (Issue #3663), or save a reply under it at once (Issue #3684).
+ *
+ * What is turned away is exactly one thing: a tick whose chain has been
+ * stopped, acting on its OWN key. Code outside any tick — a route,
+ * `session-cleanup`, the migration itself — may. So may code acting on another
+ * key from inside a tick: the relay a worker's tick fires on completion
+ * delivers to the requester and restarts the requester's poller in the
+ * worker's async context, and that restart's stop must write the requester's
+ * held reply (the same line `stopPollingByKey`'s stale-stop check draws). A
+ * chain that is merely `superseded` (a restart queued behind the
+ * tick it is running) still owns the turn it is finishing: its hold is what the
+ * restart's stop writes out (#2436), so it is not turned away here.
+ */
+function mayActForPollerKey(pollerKey) {
+    const caller = currentPollerOwner();
+    return caller === undefined || caller.pollerKey !== pollerKey || !caller.stopped;
+}
+/**
+ * The poller key of an agent instance (Issue #3705) — the same spelling as
+ * `getPollerKey` in `./response-poller-core`, which delegates here, so that the
+ * transcript readers, the user-turn recorder, the cursor advance and the
+ * Markdown log can name the key they write under without importing the core.
+ */
+function pollerKeyOf(worktreeId, cliToolId, instanceId) {
+    return `${worktreeId}:${instanceId ?? cliToolId}`;
+}
+/**
+ * {@link mayActForPollerKey} for an agent instance (Issue #3705).
+ *
+ * Asked by the writers a tick reaches through an `await` of its own — the four
+ * transcript readers, `recordUserTurn`, `advanceCapturedLineForTranscriptTurn` —
+ * after their last `await` and before their first write. The Stop hook, a
+ * route and every other caller outside a tick are not turned away, and neither
+ * is a tick acting for another instance.
+ */
+function mayActForAgentInstance(target) {
+    return mayActForPollerKey(pollerKeyOf(target.worktreeId, target.cliToolId, target.instanceId));
+}
+/**
+ * Carries the ownership token of the tick whose terminal snapshot is being
+ * built (Issue #3705).
+ *
+ * A storage of its own rather than {@link pollerOwnerStorage}: only the core
+ * enters it, around `broadcastTerminalSnapshot`, so a snapshot started by a
+ * route or by the Auto-Yes poller — or by code that merely inherited a tick's
+ * context — is never asked about an owner it does not carry.
+ */
+exports.snapshotOwnerStorage = (0, global_state_1.getOrInitGlobal)('__responsePollerSnapshotStorage', () => new async_hooks_1.AsyncLocalStorage());
+/**
+ * Whether the snapshot being built now may still write and publish
+ * (Issue #3705).
+ *
+ * Asked after every `await` of the snapshot — in `broadcastTerminalSnapshot`,
+ * `buildCurrentOutput` and the chat-turn progress it detaches — not only when
+ * the tick decides to start one: a successor that takes the key while the
+ * capture is in flight would otherwise have its screen, its status latch and
+ * its progress frames overwritten by the turn that just ended. A chain that was
+ * merely stopped and has no successor still publishes its final snapshot, as
+ * before #2223. Outside a snapshot the core started, always true.
+ */
+function maySnapshotPublish() {
+    const owner = exports.snapshotOwnerStorage.getStore();
+    return owner === undefined || !owner.superseded;
+}
+/**
+ * Thrown by `buildCurrentOutput` when {@link maySnapshotPublish} turns it away
+ * mid-build (Issue #3705), so that nothing after the `await` it resumed from —
+ * the status latch, the unclassified-frame row, the structured prompt row, the
+ * progress frame — is written. `broadcastTerminalSnapshot` catches it.
+ */
+class RetiredSnapshotError extends Error {
+    constructor() {
+        super('terminal snapshot of a superseded poller tick');
+        this.name = 'RetiredSnapshotError';
+    }
+}
+exports.RetiredSnapshotError = RetiredSnapshotError;

package/dist/server/src/lib/polling/prompt-dedup-state.js

@@ -37,6 +37,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.recordPromptDedupSkip = recordPromptDedupSkip;
 exports.getPromptDedupSkips = getPromptDedupSkips;
 exports.renamePromptDedupSkips = renamePromptDedupSkips;
+exports.renamePromptDedupSkipsBatch = renamePromptDedupSkipsBatch;
 exports.clearPromptDedupSkips = clearPromptDedupSkips;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const global_state_1 = require("../global-state");
@@ -80,13 +81,31 @@ function getPromptDedupSkips(worktreeId, cliToolId, instanceId) {
  * No-op when the IDs match or nothing is recorded under the old one.
  */
 function renamePromptDedupSkips(oldWorktreeId, newWorktreeId, cliToolId, instanceId) {
-    if (oldWorktreeId === newWorktreeId)
-        return;
-    const oldKey = (0, auto_yes_state_1.buildCompositeKey)(oldWorktreeId, cliToolId, instanceId);
-    const record = promptDedupSkips.get(oldKey);
-    promptDedupSkips.delete(oldKey);
-    if (record !== undefined) {
-        promptDedupSkips.set((0, auto_yes_state_1.buildCompositeKey)(newWorktreeId, cliToolId, instanceId), record);
+    renamePromptDedupSkipsBatch([{ oldWorktreeId, newWorktreeId, cliToolId, instanceId }]);
+}
+/**
+ * Carry the tallies of a whole batch of sessions across a worktree-ID rename
+ * (Issue #3553).
+ *
+ * Every source tally is lifted before any is written, so a swap (A→B, B→A) or
+ * a chain (A→B→C) cannot overwrite a tally that has not moved yet. Per entry
+ * this is exactly {@link renamePromptDedupSkips}.
+ */
+function renamePromptDedupSkipsBatch(renames) {
+    const lifted = [];
+    for (const { oldWorktreeId, newWorktreeId, cliToolId, instanceId } of renames) {
+        if (oldWorktreeId === newWorktreeId)
+            continue;
+        const oldKey = (0, auto_yes_state_1.buildCompositeKey)(oldWorktreeId, cliToolId, instanceId);
+        lifted.push({
+            newKey: (0, auto_yes_state_1.buildCompositeKey)(newWorktreeId, cliToolId, instanceId),
+            record: promptDedupSkips.get(oldKey),
+        });
+        promptDedupSkips.delete(oldKey);
+    }
+    for (const { newKey, record } of lifted) {
+        if (record !== undefined)
+            promptDedupSkips.set(newKey, record);
     }
 }
 /** Drop every recorded tally. Test seam. */

package/dist/server/src/lib/polling/prompt-dedup.js

@@ -34,6 +34,7 @@ exports.claimDuplicatePromptSkipLog = claimDuplicatePromptSkipLog;
 exports.resetDuplicatePromptSkipStreak = resetDuplicatePromptSkipStreak;
 exports.clearPromptHashCache = clearPromptHashCache;
 exports.renamePromptHashCacheKey = renamePromptHashCacheKey;
+exports.renamePromptHashCacheKeys = renamePromptHashCacheKeys;
 exports.normalizePromptForDedup = normalizePromptForDedup;
 const crypto_1 = require("crypto");
 const global_state_1 = require("../global-state");
@@ -95,10 +96,14 @@ function claimDuplicatePromptSkipLog(pollerKey) {
  * End the current run of duplicate prompt ticks for this pollerKey without
  * touching the cached hash (Issue #3538).
  *
- * Called by `response-checker` on every tick that does not reach the prompt
- * guard with a live prompt — a working screen, an unfinished frame, a reply.
- * The prompt is no longer on screen, so if the same prompt comes back the next
- * duplicate is the first of a new run and logs. The hash stays: whether the
+ * Called by `response-checker` in two places: `extractCompletedTurn`, when the
+ * frame was read and is unfinished (a working screen), and `checkForResponse`,
+ * when a finished frame carries no live prompt (a reply). The prompt is no
+ * longer on screen, so if the same prompt comes back the next duplicate is the
+ * first of a new run and logs. Not called on a tick that skipped extraction on
+ * the line count (a null result) or returned on the cursor, nor on a tick that
+ * ended before extraction: none of them says the prompt has left the screen,
+ * so the run carries on through them. The hash stays: whether the
  * returning prompt is saved again is the guard's question (#565), and this
  * Issue only thins the log line.
  *
@@ -126,30 +131,53 @@ function clearPromptHashCache(pollerKey) {
  * re-save the prompt it is currently sitting on as a fresh message, which is
  * the duplicate this module exists to prevent.
  *
- * No-op when nothing is cached under `oldKey`.
+ * No-op when nothing is cached under `oldKey`. A batch of renames whose keys
+ * overlap must go through {@link renamePromptHashCacheKeys} instead.
  *
  * @param oldKey - Poller key the cache entry lives under
  * @param newKey - Poller key it should live under
  */
 function renamePromptHashCacheKey(oldKey, newKey) {
-    if (oldKey === newKey)
-        return;
-    const hash = promptHashCache.get(oldKey);
-    const streak = duplicatePromptSkipStreak.get(oldKey);
-    promptHashCache.delete(oldKey);
-    duplicatePromptSkipStreak.delete(oldKey);
-    if (hash === undefined)
-        return;
-    promptHashCache.set(newKey, hash);
-    // Issue #3538: the skip count moves with the hash, so a rename mid-run does
-    // not restart the thinning and log as if a new run had begun. Whenever the
-    // hash under `newKey` is replaced, so is its count — a count left over from
-    // the hash that was there before is about a different prompt.
-    if (streak !== undefined) {
-        duplicatePromptSkipStreak.set(newKey, streak);
+    renamePromptHashCacheKeys([{ oldKey, newKey }]);
+}
+/**
+ * Move the prompt hash and its skip count for a whole batch of pollerKeys
+ * (Issue #3553).
+ *
+ * Every source key is lifted before any destination is written, so a swap
+ * (A→B, B→A) or a chain (A→B→C) cannot overwrite a source that has not moved
+ * yet. Per pair this is exactly {@link renamePromptHashCacheKey}: nothing
+ * happens at the destination when the source held no hash.
+ *
+ * @param renames - Poller key moves applied together; `oldKey === newKey` is ignored
+ */
+function renamePromptHashCacheKeys(renames) {
+    const lifted = [];
+    for (const { oldKey, newKey } of renames) {
+        if (oldKey === newKey)
+            continue;
+        lifted.push({
+            newKey,
+            hash: promptHashCache.get(oldKey),
+            streak: duplicatePromptSkipStreak.get(oldKey),
+        });
+        promptHashCache.delete(oldKey);
+        duplicatePromptSkipStreak.delete(oldKey);
     }
-    else {
-        duplicatePromptSkipStreak.delete(newKey);
+    for (const { newKey, hash, streak } of lifted) {
+        if (hash === undefined)
+            continue;
+        promptHashCache.set(newKey, hash);
+        // Issue #3538: the skip count moves with the hash, so a rename mid-run does
+        // not restart the thinning and log as if a new run had begun. Whenever the
+        // hash under `newKey` is replaced, so is its count — a count left over from
+        // the hash that was there before is about a different prompt.
+        if (streak !== undefined) {
+            duplicatePromptSkipStreak.set(newKey, streak);
+        }
+        else {
+            duplicatePromptSkipStreak.delete(newKey);
+        }
     }
 }
 /**