commandmate 0.49.0 → 0.49.2

package/dist/server/src/lib/push/failure-episode-state.js

@@ -31,7 +31,10 @@
  *
  * ## Why the edge alone is not enough: the cooldown
  *
- * The fault is judged on the **last 100 rows** of the pane, so a retry storm
+ * The fault is judged on the rows `realtimeSnippet` publishes
+ * (`matchPaneUpstreamFault` in `lib/realtime-snippet`: the last 100 rows, or the
+ * 100 ending at the last content row when that tail is blank, plus — codex split
+ * screen only — the transcript's last row; Issue #3946), so a retry storm
  * scrolls its own banner out of scope between polls. Measured shape of a 529
  * storm (#1839): `API Error: Repeated 529 Overloaded errors …` followed by
  * `Retrying in 34s · attempt 9/10`. Those match two different signatures

package/dist/server/src/lib/realtime/terminal-broadcast.js

@@ -21,7 +21,6 @@ const db_instance_1 = require("../../lib/db/db-instance");
 const current_output_builder_1 = require("../../lib/session/current-output-builder");
 const logger_1 = require("../../lib/logger");
 const manager_1 = require("../../lib/cli-tools/manager");
-const tmux_capture_cache_1 = require("../../lib/tmux/tmux-capture-cache");
 const global_state_1 = require("../global-state");
 const terminal_session_ownership_1 = require("./terminal-session-ownership");
 const poller_owner_1 = require("../../lib/polling/poller-owner");
@@ -135,9 +134,7 @@ async function isPushableSession(worktreeId, cliToolId, instanceId) {
 async function captureFreshPayload(worktreeId, cliToolId, instanceId) {
     if (!(await isPushableSession(worktreeId, cliToolId, instanceId)))
         return null;
-    const tool = manager_1.CLIToolManager.getInstance().getTool(cliToolId);
-    (0, tmux_capture_cache_1.invalidateCache)(tool.getSessionName(worktreeId, instanceId));
-    return (0, current_output_builder_1.buildCurrentOutput)((0, db_instance_1.getDbInstance)(), worktreeId, cliToolId, instanceId);
+    return (0, current_output_builder_1.buildCurrentOutput)((0, db_instance_1.getDbInstance)(), worktreeId, cliToolId, instanceId, undefined, { freshCapture: true });
 }
 function emitTerminalSnapshot(worktreeId, cliToolId, payload, instanceId) {
     const resolvedInstanceId = instanceId ?? cliToolId;

package/dist/server/src/lib/realtime-snippet.js

@@ -22,7 +22,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.REALTIME_SNIPPET_ROW_COUNT = void 0;
 exports.selectRealtimeSnippetRows = selectRealtimeSnippetRows;
 exports.buildRealtimeSnippet = buildRealtimeSnippet;
+exports.selectTranscriptTailRow = selectTranscriptTailRow;
+exports.matchPaneUpstreamFault = matchPaneUpstreamFault;
 const ansi_1 = require("../lib/detection/ansi");
+const upstream_faults_1 = require("../lib/detection/upstream-faults");
 /** Rows in the snippet. The 100 that Issue #1839 / #2095 read their verdicts off. */
 exports.REALTIME_SNIPPET_ROW_COUNT = 100;
 function isBlankRow(row) {
@@ -51,3 +54,54 @@ function selectRealtimeSnippetRows(lines) {
 function buildRealtimeSnippet(output) {
     return selectRealtimeSnippetRows(output.split('\n')).join('\n');
 }
+/**
+ * The last content row of a split screen's transcript, when it lies above the
+ * snippet window (Issue #3946).
+ *
+ * codex 0.160 paints its transcript from the top of the 1000-row canvas and its
+ * composer at the bottom, with blank rows in between. The window
+ * {@link selectRealtimeSnippetRows} returns then holds the composer (so #2768's
+ * blank-tail branch does not apply) and the transcript's last row — where codex
+ * draws an error such as `■ Selected model is at capacity` — is outside it.
+ *
+ * Returns that one row only when the window's first row is blank, the blank run
+ * continues above the window, and content sits above the run; `null` otherwise.
+ * One row, not the transcript: a healthy next turn replaces it, so an old error
+ * row stops counting, and no reply body (which may quote an error) is read.
+ *
+ * @param lines - every row of the capture, in order
+ */
+function selectTranscriptTailRow(lines) {
+    const windowStart = lines.length - exports.REALTIME_SNIPPET_ROW_COUNT;
+    if (windowStart <= 0)
+        return null;
+    // A blank tail means #2768 already anchored the window to the last content row.
+    if (lines.slice(windowStart).every(isBlankRow))
+        return null;
+    if (!isBlankRow(lines[windowStart]))
+        return null;
+    let row = windowStart - 1;
+    while (row >= 0 && isBlankRow(lines[row]))
+        row -= 1;
+    return row >= 0 ? lines[row] : null;
+}
+/**
+ * The upstream fault `capture --json` publishes and the push poller rings on —
+ * one entry for both, so they cannot judge different rows (#3936, #3946).
+ *
+ * The window ({@link selectRealtimeSnippetRows}, what `realtimeSnippet` carries)
+ * is judged on every rule first. Only if nothing matched, and only for codex, the
+ * row {@link selectTranscriptTailRow} returns is judged on the rules anchored to
+ * codex's `■ ` error row. A match there is outside `realtimeSnippet`; its
+ * `matchedText` is the row, which is how an operator can check it.
+ *
+ * @param lines - every row of the capture, in order
+ * @param cliToolId - the agent the pane belongs to
+ */
+function matchPaneUpstreamFault(lines, cliToolId) {
+    const inWindow = (0, upstream_faults_1.matchUpstreamFault)(selectRealtimeSnippetRows(lines).join('\n'));
+    if (inWindow || cliToolId !== 'codex')
+        return inWindow;
+    const tailRow = selectTranscriptTailRow(lines);
+    return tailRow === null ? null : (0, upstream_faults_1.matchCodexErrorRowFault)(tailRow);
+}

package/dist/server/src/lib/relay/relay-bind.js

@@ -0,0 +1,294 @@
+"use strict";
+/**
+ * The send half of a bound relay (Issue #3957).
+ *
+ * `send --reply-to` / `ask --async` open the relay BEFORE the message goes out
+ * (#2377: a session that answers at once must not finish in the gap), so the
+ * relay alone cannot say when its question reached the worker. Until this
+ * module the delivery took the newest reply after the relay was OPENED — and a
+ * send that queued for the input lock (S3) or failed (S5) was answered with
+ * somebody else's reply.
+ *
+ * A relay opened with `bind: true` is instead tied to the one send that names
+ * it, in four steps the send route drives:
+ *
+ *  1. **Reserve** ({@link reserveRelaySend}) — before any side effect, one
+ *     conditional UPDATE under a fresh attempt id. A second send, a closed or
+ *     expired relay, or one addressed elsewhere is refused and nothing is typed.
+ *  2. **Boundary** ({@link RelaySendBinding.hooks}) — the REQUIRED hook the
+ *     sender runs right before the first key (or right before opencode's HTTP
+ *     dispatch). It writes the lower bound, the turn reading and the
+ *     observation source in one UPDATE under the token; when that write fails
+ *     the hook throws and the body is never typed.
+ *  3. **Dispatch fallback** — opencode's HTTP send says whether a failed
+ *     dispatch is known not to have sent (the keyboard's own input start then
+ *     replaces the boundary) or cannot be told (the relay is held as
+ *     `dispatch_unknown`).
+ *  4. **Settle** ({@link RelaySendBinding.finish}) — `sent`, `failed` or
+ *     `unknown`, again under the token and the expected state, and the
+ *     `sendOutcome` the route hands back to the CLI.
+ *
+ * Nothing here awaits inside a DB transaction, and nothing here delivers: the
+ * delivery reads what this module wrote (`relay-delivery`).
+ *
+ * @module lib/relay/relay-bind
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RelaySendBinding = exports.RELAY_HOLD_REASONS = void 0;
+exports.reserveRelaySend = reserveRelaySend;
+const crypto_1 = require("crypto");
+const relay_db_1 = require("../../lib/db/relay-db");
+const relay_boot_1 = require("../../lib/relay/relay-boot");
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('relay-bind');
+/** crypto.randomUUID() output; anything else was never a relay id. */
+const RELAY_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Hold reasons this module writes. Published as is. */
+exports.RELAY_HOLD_REASONS = {
+    sendUnknown: 'send_unknown',
+    dispatchUnknown: 'dispatch_unknown',
+    generationChanged: 'generation_changed',
+    noInputBoundary: 'no_input_boundary',
+    serverRestarted: 'server_restarted',
+    serverRestartedBeforeInput: 'server_restarted_before_input',
+};
+/**
+ * Reserve a bound relay for this send attempt, before any side effect.
+ *
+ * 400 for an id that is not a relay id, a legacy relay or one addressed to
+ * another session; 409 for a closed, expired or already reserved one; 500 when
+ * the ledger cannot be written. None of them types anything.
+ */
+function reserveRelaySend(db, target, now = Date.now()) {
+    if (!RELAY_ID_PATTERN.test(target.relayId)) {
+        return {
+            ok: false,
+            refusal: { status: 400, code: 'RELAY_BIND_INVALID', message: 'relayId must be a relay id' },
+        };
+    }
+    const attemptId = (0, crypto_1.randomUUID)();
+    try {
+        const reserved = (0, relay_db_1.reserveRelayBind)(db, {
+            relayId: target.relayId,
+            attemptId,
+            owner: (0, relay_boot_1.relayServerBootId)(),
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId,
+            now,
+        });
+        if (!reserved) {
+            return {
+                ok: false,
+                refusal: (0, relay_db_1.explainRelayBindRefusal)(db, target.relayId, target.worktreeId, target.instanceId, now),
+            };
+        }
+    }
+    catch (error) {
+        logger.warn('relay-bind-reserve-failed', {
+            relayId: target.relayId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return {
+            ok: false,
+            refusal: { status: 500, code: 'RELAY_BIND_FAILED', message: 'Failed to reserve the relay' },
+        };
+    }
+    logger.info('relay-bind-reserved', { relayId: target.relayId, attemptId });
+    return { ok: true, binding: new RelaySendBinding(db, target, attemptId) };
+}
+/**
+ * One reserved send attempt. Created by {@link reserveRelaySend}.
+ *
+ * Every write is keyed on the attempt id, so a write from an attempt that has
+ * lost the relay (cancelled, expired, recovered after a restart) changes
+ * nothing.
+ */
+class RelaySendBinding {
+    db;
+    target;
+    attemptId;
+    generationBefore = null;
+    boundaryWritten = false;
+    observationInvalid = false;
+    refused = false;
+    dispatch = 'none';
+    /** A later HTTP dispatch noted after one ended `unknown`, not (yet) failed. */
+    retryDispatchOpen = false;
+    constructor(db, target, attemptId) {
+        this.db = db;
+        this.target = target;
+        this.attemptId = attemptId;
+    }
+    get relayId() {
+        return this.target.relayId;
+    }
+    /** Remember the session's generation before the send begins. */
+    begin(generationBefore) {
+        this.generationBefore = generationBefore;
+    }
+    /** The hooks to hand the send service (`sendUserMessage({ inputBoundary })`). */
+    hooks() {
+        return {
+            beforeInput: (at, kind) => this.beforeInput(at, kind),
+            onDispatchFailed: (verdict) => this.onDispatchFailed(verdict),
+        };
+    }
+    beforeInput(at, kind) {
+        // A dispatch that may already have delivered: the keyboard fallback is the
+        // operator's message and is typed as before, but it says nothing new about
+        // the relay, which stays held. A further HTTP dispatch (opencode's image
+        // send falling back to its text send) is remembered: only its delivery may
+        // lift the hold.
+        if (this.dispatch === 'unknown') {
+            if (kind === 'dispatch')
+                this.retryDispatchOpen = true;
+            return;
+        }
+        const reading = this.target.readTurn();
+        const sameGeneration = reading.generation === this.generationBefore;
+        const obsState = !sameGeneration
+            ? 'invalid'
+            : this.target.hooksReportTurns
+                ? 'valid'
+                : 'turn_unknown';
+        const turnOpenAtSend = this.target.hooksReportTurns && sameGeneration ? reading.open : null;
+        let written;
+        try {
+            written = (0, relay_db_1.recordRelayInputBoundary)(this.db, {
+                relayId: this.target.relayId,
+                attemptId: this.attemptId,
+                at: at.getTime(),
+                kind,
+                turnOpenAtSend,
+                obsState,
+                obsSource: (0, relay_boot_1.relayObservationSource)(this.target.worktreeId, this.target.cliToolId, this.target.instanceId),
+                replaceDispatch: this.dispatch === 'not_sent',
+            });
+        }
+        catch (error) {
+            this.refused = true;
+            throw error;
+        }
+        if (!written) {
+            this.refused = true;
+            throw new Error(`relay ${this.target.relayId} is no longer reserved for this send`);
+        }
+        this.boundaryWritten = true;
+        this.observationInvalid = obsState === 'invalid';
+        if (kind === 'dispatch')
+            this.dispatch = 'pending';
+    }
+    onDispatchFailed(verdict) {
+        // Issue #3957: once one dispatch of this send may have delivered, a later
+        // attempt that did not deliver proves nothing about the first — `unknown`
+        // stays, and only a delivered send can change it.
+        if (this.dispatch === 'unknown') {
+            this.retryDispatchOpen = false;
+            return;
+        }
+        if (verdict === 'not_sent') {
+            // The HTTP boundary is discarded: the keyboard's own input start, which
+            // comes after the lock wait, replaces it. The HTTP time must not be the
+            // lower bound, or a reply that ended while the fallback queued is taken.
+            this.dispatch = 'not_sent';
+            return;
+        }
+        this.dispatch = 'unknown';
+        (0, relay_db_1.settleRelaySendState)(this.db, {
+            relayId: this.target.relayId,
+            attemptId: this.attemptId,
+            from: ['input_started'],
+            to: 'unknown',
+            holdReason: exports.RELAY_HOLD_REASONS.dispatchUnknown,
+        });
+    }
+    /**
+     * Record how the send ended and say what the CLI may do with the relay.
+     *
+     * `not_sent` only when nothing can have reached the worker: the send stopped
+     * before the boundary, the boundary hook refused, or the send service said
+     * `not-sent`. A failure after the boundary that the service could not place
+     * is `unknown` (held, never cancelled by the CLI).
+     */
+    finish(result) {
+        try {
+            return this.settle(result);
+        }
+        catch (error) {
+            logger.warn('relay-bind-settle-failed', {
+                relayId: this.target.relayId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return result.kind === 'sent' ? 'sent' : 'unknown';
+        }
+    }
+    settle(result) {
+        const base = { relayId: this.target.relayId, attemptId: this.attemptId };
+        if (this.dispatch === 'unknown') {
+            // A later HTTP dispatch that delivered: the message is in, and the first
+            // dispatch's boundary (the earlier one) stays the lower bound.
+            if (result.kind === 'sent' && this.retryDispatchOpen) {
+                // The same generation check as the ordinary `sent` below: a relaunch
+                // keeps the relay held, and says why, rather than reading as cleared.
+                const relaunched = this.observationInvalid || result.generationAfter !== this.generationBefore;
+                (0, relay_db_1.settleRelaySendState)(this.db, {
+                    ...base,
+                    from: ['unknown'],
+                    to: 'sent',
+                    inputMessageId: result.messageId,
+                    ...(relaunched
+                        ? { holdReason: exports.RELAY_HOLD_REASONS.generationChanged, invalidateObservation: true }
+                        : { clearHoldReason: true }),
+                });
+                return 'sent';
+            }
+            return 'unknown';
+        }
+        if (result.kind === 'sent') {
+            if (!this.boundaryWritten) {
+                // A sender that reported neither an input start nor a dispatch. The
+                // reply cannot be bounded, so the relay is held rather than guessed.
+                (0, relay_db_1.settleRelaySendState)(this.db, {
+                    ...base,
+                    from: ['awaiting'],
+                    to: 'unknown',
+                    holdReason: exports.RELAY_HOLD_REASONS.noInputBoundary,
+                });
+                return 'unknown';
+            }
+            const relaunched = this.observationInvalid || result.generationAfter !== this.generationBefore;
+            (0, relay_db_1.settleRelaySendState)(this.db, {
+                ...base,
+                from: ['input_started'],
+                to: 'sent',
+                inputMessageId: result.messageId,
+                holdReason: relaunched ? exports.RELAY_HOLD_REASONS.generationChanged : null,
+                invalidateObservation: relaunched,
+            });
+            return 'sent';
+        }
+        // The history write failed after the transport confirmed the submit.
+        if (result.attempt === 'sent') {
+            (0, relay_db_1.settleRelaySendState)(this.db, {
+                ...base,
+                from: ['awaiting', 'input_started'],
+                to: 'unknown',
+                holdReason: exports.RELAY_HOLD_REASONS.sendUnknown,
+            });
+            return 'unknown';
+        }
+        const nothingTyped = !this.boundaryWritten || this.refused || result.attempt === 'not-sent';
+        if (nothingTyped) {
+            (0, relay_db_1.settleRelaySendState)(this.db, { ...base, from: ['awaiting', 'input_started'], to: 'failed' });
+            return 'not_sent';
+        }
+        (0, relay_db_1.settleRelaySendState)(this.db, {
+            ...base,
+            from: ['input_started'],
+            to: 'unknown',
+            holdReason: exports.RELAY_HOLD_REASONS.sendUnknown,
+        });
+        return 'unknown';
+    }
+}
+exports.RelaySendBinding = RelaySendBinding;

package/dist/server/src/lib/relay/relay-boot.js

@@ -0,0 +1,51 @@
+"use strict";
+/**
+ * Who observed a relay's send, and when (Issue #3957).
+ *
+ * A bound relay records the server boot that reserved it and the session
+ * generation its input was observed in. Both live in memory — the turn record
+ * a reply is judged against is in memory too — so a row written by a previous
+ * boot, or against a session that has since been relaunched, describes a
+ * process that no longer exists and must not be matched with a reply from the
+ * one that does.
+ *
+ * On `globalThis` for the reason every shared value of this subsystem is
+ * (#1736): the send route's bundle and the poller's bundle must agree on one
+ * boot id, or every send would look like it came from another server.
+ *
+ * @module lib/relay/relay-boot
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.relayServerBootId = relayServerBootId;
+exports.resetRelayServerBootId = resetRelayServerBootId;
+exports.relayObservationSource = relayObservationSource;
+exports.bootOfObservationSource = bootOfObservationSource;
+const crypto_1 = require("crypto");
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+const agent_event_turn_1 = require("../../lib/session/agent-event-turn");
+const global_state_1 = require("../global-state");
+/** This server process's boot id. Stable for the life of the process. */
+function relayServerBootId() {
+    return (0, global_state_1.getOrInitGlobal)('__relayServerBootId', () => (0, crypto_1.randomUUID)());
+}
+/** Forget the boot id, so the next read mints a new one. Test seam: a "restart". */
+function resetRelayServerBootId() {
+    globalThis.__relayServerBootId = undefined;
+}
+/**
+ * `<boot id>#<generation>` for one session — what `obs_source` stores.
+ *
+ * `-` for a session that has no generation yet (none was ever launched by this
+ * process), which is itself a fact a later read must match.
+ */
+function relayObservationSource(worktreeId, cliToolId, instanceId) {
+    const generation = (0, agent_event_turn_1.currentGeneration)((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId));
+    return `${relayServerBootId()}#${generation ?? '-'}`;
+}
+/** The boot part of an `obs_source`, or null for a malformed one. */
+function bootOfObservationSource(source) {
+    if (source === null)
+        return null;
+    const at = source.lastIndexOf('#');
+    return at <= 0 ? null : source.slice(0, at);
+}