commandmate 0.46.0 → 0.47.0

package/dist/server/src/lib/polling/pending-scraped-response.js

@@ -8,6 +8,9 @@ exports.holdScrapedResponse = holdScrapedResponse;
 exports.discardPendingScrapedResponse = discardPendingScrapedResponse;
 exports.flushPendingScrapedResponse = flushPendingScrapedResponse;
 exports.settleExpiredPendingScrapedResponse = settleExpiredPendingScrapedResponse;
+exports.listPendingScrapedResponseKeys = listPendingScrapedResponseKeys;
+exports.retargetPendingScrapedResponse = retargetPendingScrapedResponse;
+exports.movePendingScrapedResponses = movePendingScrapedResponses;
 const db_instance_1 = require("../../lib/db/db-instance");
 const db_1 = require("../../lib/db");
 const ws_server_1 = require("../../lib/ws-server");
@@ -17,6 +20,7 @@ const response_dedup_1 = require("./response-dedup");
 const structured_history_gate_1 = require("./structured-history-gate");
 const stop_history_capture_1 = require("../../lib/hooks/stop-history-capture");
 const global_state_1 = require("../global-state");
+const poller_owner_1 = require("./poller-owner");
 const logger = (0, logger_1.createLogger)('response-poller');
 // ============================================================================
 // The held scrape (Issue #2436)
@@ -71,14 +75,35 @@ function hasPendingScrapedResponse(pollerKey) {
  * deadline. Replaces, because a frame that moved on is a better copy of the
  * same turn; keeps, because a pane that redraws every tick would otherwise push
  * its own deadline forward forever and the hold would stop being bounded.
+ *
+ * Issue #3663: refused to a tick whose chain has been stopped (see
+ * `mayActForPollerKey`) — a stop, a stalled-tick restart or a worktree-ID
+ * migration retired it while it awaited the reader, and whatever is held under
+ * the key now belongs to someone else. The response hash that tick registered
+ * is not taken back here: a migration does not hand a running tick's hash on in
+ * the first place (`migrateResponsePollerWorktreeIds`), so the successor judges
+ * the screen itself.
+ *
+ * @returns Whether the reply is held
  */
 function holdScrapedResponse(pollerKey, pending) {
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey)) {
+        const caller = (0, poller_owner_1.currentPollerOwner)();
+        logger.info('pending-scrape-hold-refused', {
+            worktreeId: pending.worktreeId,
+            cliToolId: pending.cliToolId,
+            instanceId: pending.instanceId,
+            generation: caller?.generation,
+        });
+        return false;
+    }
     const existing = pendingScrapedResponses.get(pollerKey);
     if (existing) {
         existing.content = pending.content;
-        return;
+        return true;
     }
     pendingScrapedResponses.set(pollerKey, pending);
+    return true;
 }
 /**
  * Drop a held scrape without writing it (Issue #2436).
@@ -88,6 +113,10 @@ function holdScrapedResponse(pollerKey, pending) {
  * duplicate this Issue exists to stop.
  */
 function discardPendingScrapedResponse(pollerKey) {
+    // Issue #3663: a stopped tick's reader answer is about a turn it no longer
+    // owns; what is held under the key now may be another chain's.
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey))
+        return;
     pendingScrapedResponses.delete(pollerKey);
 }
 /**
@@ -110,15 +139,26 @@ function discardPendingScrapedResponse(pollerKey) {
  * conversation log is fired afterwards and not waited for, because it is a
  * secondary record and the row is the one History reads.
  *
+ * Issue #3663: refused (false, nothing written or dropped) to a tick whose
+ * chain has been stopped. `stopPollingByKey` already turns such a tick's stop
+ * away; this covers the expiry settle, the other caller.
+ *
  * @param pollerKey - Poller key ("worktreeId:instanceId")
  * @param reason - What ended the hold; logged, for the operator reading back
  * @returns Whether a held reply was written
  */
 function flushPendingScrapedResponse(pollerKey, reason) {
+    // Issue #3663: a stopped tick does not confirm what is held under the key.
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey))
+        return false;
     const pending = pendingScrapedResponses.get(pollerKey);
     if (!pending)
         return false;
     pendingScrapedResponses.delete(pollerKey);
+    return writePendingScrapedResponse(pending, reason);
+}
+/** Write one held reply that has already been taken off its key. */
+function writePendingScrapedResponse(pending, reason) {
     try {
         const db = (0, db_instance_1.getDbInstance)();
         const message = (0, db_1.createMessage)(db, {
@@ -171,12 +211,28 @@ function flushPendingScrapedResponse(pollerKey, reason) {
  * parse against writing a pane dump that is about to be superseded.
  */
 async function settleExpiredPendingScrapedResponse(pollerKey) {
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey))
+        return;
     const pending = pendingScrapedResponses.get(pollerKey);
     if (!pending || Date.now() < pending.expiresAt)
         return;
     const captured = await (0, structured_history_gate_1.captureStructuredHistoryTurn)(pending.worktreeId, pending.cliToolId, pending.instanceId, { worktreePath: pending.worktreePath, transcriptPathHint: pending.transcriptPathHint });
+    // Issue #3663: the read is awaited, and a migration, a stop or a restart can
+    // land in between. The answer is acted on only if this caller still owns the
+    // key AND the hold under it is the one that was read about — after an A↔B
+    // swap the key holds B's reply, and dropping or writing it on A's answer
+    // would lose it or write it twice.
+    if (!(0, poller_owner_1.mayActForPollerKey)(pollerKey) || pendingScrapedResponses.get(pollerKey) !== pending) {
+        logger.info('pending-scrape-settle-abandoned', {
+            worktreeId: pending.worktreeId,
+            cliToolId: pending.cliToolId,
+            instanceId: pending.instanceId,
+            captured,
+        });
+        return;
+    }
     if (captured) {
-        discardPendingScrapedResponse(pollerKey);
+        pendingScrapedResponses.delete(pollerKey);
         (0, response_dedup_1.settleStructuredHistoryRecheck)(pollerKey);
         logger.info('pending-scrape-superseded', {
             worktreeId: pending.worktreeId,
@@ -186,5 +242,65 @@ async function settleExpiredPendingScrapedResponse(pollerKey) {
         });
         return;
     }
-    flushPendingScrapedResponse(pollerKey, 'hold-expired');
+    pendingScrapedResponses.delete(pollerKey);
+    writePendingScrapedResponse(pending, 'hold-expired');
+}
+// ============================================================================
+// Worktree-ID migration (Issue #3663)
+// ============================================================================
+/** Keys that hold a scrape right now. For the migration to choose what moves. */
+function listPendingScrapedResponseKeys() {
+    return Array.from(pendingScrapedResponses.keys());
+}
+/**
+ * Point the scrape held under `pollerKey` at `newWorktreeId`, in place.
+ *
+ * For a chain the migration stops instead of moving (it could not resolve the
+ * chain's tool): the stop writes the hold, and written under the old ID it
+ * would fail the row's foreign key — the rename has already happened — and be
+ * lost.
+ *
+ * @returns Whether a scrape was held under the key
+ */
+function retargetPendingScrapedResponse(pollerKey, newWorktreeId) {
+    const pending = pendingScrapedResponses.get(pollerKey);
+    if (!pending)
+        return false;
+    pendingScrapedResponses.set(pollerKey, { ...pending, worktreeId: newWorktreeId });
+    return true;
+}
+/**
+ * Move the held scrapes of a whole migration batch.
+ *
+ * Every source is lifted before any destination is written, so a swap (A→B,
+ * B→A) or a chain (A→B→C) cannot overwrite a scrape that has not moved yet —
+ * the rule the dedup state follows (#3553). Each scrape keeps its content,
+ * deadline, timestamp and metadata; only its worktree ID becomes the new one.
+ *
+ * A scrape already under a destination is never dropped to make room: it is
+ * written first, under the ID it carries, and the moved one takes the key.
+ *
+ * Moves with `oldKey === newKey` and sources holding nothing are ignored.
+ *
+ * @param moves - Poller key moves applied together
+ */
+function movePendingScrapedResponses(moves) {
+    const lifted = [];
+    for (const { oldKey, newKey, newWorktreeId } of moves) {
+        if (oldKey === newKey)
+            continue;
+        const pending = pendingScrapedResponses.get(oldKey);
+        if (!pending)
+            continue;
+        pendingScrapedResponses.delete(oldKey);
+        lifted.push({ newKey, pending: { ...pending, worktreeId: newWorktreeId } });
+    }
+    for (const { newKey, pending } of lifted) {
+        const displaced = pendingScrapedResponses.get(newKey);
+        if (displaced) {
+            pendingScrapedResponses.delete(newKey);
+            writePendingScrapedResponse(displaced, 'migration-displaced');
+        }
+        pendingScrapedResponses.set(newKey, pending);
+    }
 }

package/dist/server/src/lib/polling/poller-owner.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * The ownership token of one response poller chain, and the question "may the
+ * code running now still act for this poller key?" (Issue #2223, #3663).
+ *
+ * In a module of its own, importing nothing from the poller, so that
+ * `./pending-scraped-response` can ask the question without importing
+ * `./response-poller-core` — which imports the checker that imports the held
+ * scrape, and would close a new import cycle (#3482).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RetiredSnapshotError = exports.snapshotOwnerStorage = exports.pollerOwnerStorage = void 0;
+exports.currentPollerOwner = currentPollerOwner;
+exports.mayActForPollerKey = mayActForPollerKey;
+exports.pollerKeyOf = pollerKeyOf;
+exports.mayActForAgentInstance = mayActForAgentInstance;
+exports.maySnapshotPublish = maySnapshotPublish;
+const async_hooks_1 = require("async_hooks");
+const global_state_1 = require("../global-state");
+/**
+ * Carries the running tick's ownership token through `checkForResponse()`.
+ *
+ * On `globalThis` for the reason the coordinator is (#2223): the poller module
+ * is evaluated once per bundle, and a token stored by one bundle's tick has to
+ * be readable by the code another bundle's copy of the checker runs.
+ */
+exports.pollerOwnerStorage = (0, global_state_1.getOrInitGlobal)('__responsePollerOwnerStorage', () => new async_hooks_1.AsyncLocalStorage());
+/** The ownership token of the tick the caller is running inside, if any. */
+function currentPollerOwner() {
+    return exports.pollerOwnerStorage.getStore();
+}
+/**
+ * Whether the code running now may change what is kept under `pollerKey`
+ * (Issue #3663), or save a reply under it at once (Issue #3684).
+ *
+ * What is turned away is exactly one thing: a tick whose chain has been
+ * stopped, acting on its OWN key. Code outside any tick — a route,
+ * `session-cleanup`, the migration itself — may. So may code acting on another
+ * key from inside a tick: the relay a worker's tick fires on completion
+ * delivers to the requester and restarts the requester's poller in the
+ * worker's async context, and that restart's stop must write the requester's
+ * held reply (the same line `stopPollingByKey`'s stale-stop check draws). A
+ * chain that is merely `superseded` (a restart queued behind the
+ * tick it is running) still owns the turn it is finishing: its hold is what the
+ * restart's stop writes out (#2436), so it is not turned away here.
+ */
+function mayActForPollerKey(pollerKey) {
+    const caller = currentPollerOwner();
+    return caller === undefined || caller.pollerKey !== pollerKey || !caller.stopped;
+}
+/**
+ * The poller key of an agent instance (Issue #3705) — the same spelling as
+ * `getPollerKey` in `./response-poller-core`, which delegates here, so that the
+ * transcript readers, the user-turn recorder, the cursor advance and the
+ * Markdown log can name the key they write under without importing the core.
+ */
+function pollerKeyOf(worktreeId, cliToolId, instanceId) {
+    return `${worktreeId}:${instanceId ?? cliToolId}`;
+}
+/**
+ * {@link mayActForPollerKey} for an agent instance (Issue #3705).
+ *
+ * Asked by the writers a tick reaches through an `await` of its own — the four
+ * transcript readers, `recordUserTurn`, `advanceCapturedLineForTranscriptTurn` —
+ * after their last `await` and before their first write. The Stop hook, a
+ * route and every other caller outside a tick are not turned away, and neither
+ * is a tick acting for another instance.
+ */
+function mayActForAgentInstance(target) {
+    return mayActForPollerKey(pollerKeyOf(target.worktreeId, target.cliToolId, target.instanceId));
+}
+/**
+ * Carries the ownership token of the tick whose terminal snapshot is being
+ * built (Issue #3705).
+ *
+ * A storage of its own rather than {@link pollerOwnerStorage}: only the core
+ * enters it, around `broadcastTerminalSnapshot`, so a snapshot started by a
+ * route or by the Auto-Yes poller — or by code that merely inherited a tick's
+ * context — is never asked about an owner it does not carry.
+ */
+exports.snapshotOwnerStorage = (0, global_state_1.getOrInitGlobal)('__responsePollerSnapshotStorage', () => new async_hooks_1.AsyncLocalStorage());
+/**
+ * Whether the snapshot being built now may still write and publish
+ * (Issue #3705).
+ *
+ * Asked after every `await` of the snapshot — in `broadcastTerminalSnapshot`,
+ * `buildCurrentOutput` and the chat-turn progress it detaches — not only when
+ * the tick decides to start one: a successor that takes the key while the
+ * capture is in flight would otherwise have its screen, its status latch and
+ * its progress frames overwritten by the turn that just ended. A chain that was
+ * merely stopped and has no successor still publishes its final snapshot, as
+ * before #2223. Outside a snapshot the core started, always true.
+ */
+function maySnapshotPublish() {
+    const owner = exports.snapshotOwnerStorage.getStore();
+    return owner === undefined || !owner.superseded;
+}
+/**
+ * Thrown by `buildCurrentOutput` when {@link maySnapshotPublish} turns it away
+ * mid-build (Issue #3705), so that nothing after the `await` it resumed from —
+ * the status latch, the unclassified-frame row, the structured prompt row, the
+ * progress frame — is written. `broadcastTerminalSnapshot` catches it.
+ */
+class RetiredSnapshotError extends Error {
+    constructor() {
+        super('terminal snapshot of a superseded poller tick');
+        this.name = 'RetiredSnapshotError';
+    }
+}
+exports.RetiredSnapshotError = RetiredSnapshotError;

package/dist/server/src/lib/polling/response-checker-dialog-gate.js

@@ -9,7 +9,7 @@ exports.isWithheldForWantOfReceipt = isWithheldForWantOfReceipt;
 exports.isNumberedDialogVouched = isNumberedDialogVouched;
 const logger_1 = require("../../lib/logger");
 const logger = (0, logger_1.createLogger)('response-poller');
-const antigravity_permission_receipts_1 = require("./antigravity-permission-receipts");
+const antigravity_receipt_episodes_1 = require("./antigravity-receipt-episodes");
 // Issue #2457: the same rollout table, `hasDialogRules` cross-check and
 // `detectDialog` seam Auto-Yes reads, reached through the presence helper rather
 // than through `evaluateAutoYesDialogGate` — see `isNumberedDialogVouched`.
@@ -36,7 +36,7 @@ const auto_yes_dialog_gate_1 = require("./auto-yes-dialog-gate");
 function isWithheldForWantOfReceipt(scope) {
     if (scope === undefined)
         return false;
-    if ((0, antigravity_permission_receipts_1.hasRecentAntigravityPermissionReceipt)(scope.worktreeId, 'antigravity', scope.instanceId))
+    if ((0, antigravity_receipt_episodes_1.judgeAntigravityPermissionReceipt)(scope.worktreeId, scope.instanceId).ok)
         return false;
     logger.debug('antigravity-dialog-no-recent-receipt', {
         worktreeId: scope.worktreeId,