commandmate 0.49.3 → 0.50.0

package/dist/server/src/lib/hooks/sources/opencode/client.js

@@ -45,6 +45,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OPENCODE_SHARE_REQUEST_TIMEOUT_MS = exports.MAX_OPENCODE_DIFF_PATCH_CHARS = exports.MAX_OPENCODE_DIFF_FILES = exports.OPENCODE_CONTEXT_MESSAGE_WINDOW = exports.MAX_OPENCODE_SESSION_MESSAGES = exports.MAX_OPENCODE_SSE_FRAME_CHARS = exports.MAX_OPENCODE_SESSION_STATUSES = exports.OPENCODE_EVENT_CONTENT_TYPE = exports.OPENCODE_JSON_CONTENT_TYPE = exports.OPENCODE_FETCH_REDIRECT = exports.OPENCODE_REQUEST_TIMEOUT_MS = exports.OPENCODE_SERVER_HOST = void 0;
 exports.opencodeBaseUrl = opencodeBaseUrl;
 exports.probeOpencodeHealth = probeOpencodeHealth;
+exports.fetchOpencodeConfig = fetchOpencodeConfig;
 exports.fetchOpencodeHealth = fetchOpencodeHealth;
 exports.fetchOpencodePendingPermissions = fetchOpencodePendingPermissions;
 exports.fetchOpencodePendingQuestions = fetchOpencodePendingQuestions;
@@ -242,6 +243,25 @@ async function probeOpencodeHealth(port) {
         health: { healthy: true, version: typeof body.version === 'string' ? body.version : null },
     };
 }
+/**
+ * The resolved config, for the role's evidence (Issue #4115, §14). May hold secrets,
+ * so the caller compares it and keeps none of it. Null when nothing answered.
+ */
+async function fetchOpencodeConfig(port) {
+    try {
+        const response = await loopbackFetch(`${opencodeBaseUrl(port)}/config`, {
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.status !== 200) {
+            await response.body?.cancel().catch(() => { });
+            return null;
+        }
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Ask whether an opencode server is listening on this port.
  *

package/dist/server/src/lib/hooks/sources/opencode-v2/client.js

@@ -32,6 +32,7 @@ exports.OPENCODE_V2_CONTEXT_MESSAGE_WINDOW = exports.MAX_OPENCODE_V2_DECISION_BO
 exports.opencodeV2BaseUrl = opencodeV2BaseUrl;
 exports.opencodeV2AuthorizationHeader = opencodeV2AuthorizationHeader;
 exports.probeOpencodeV2Server = probeOpencodeV2Server;
+exports.fetchOpencodeV2Config = fetchOpencodeV2Config;
 exports.createOpencodeV2SseParser = createOpencodeV2SseParser;
 exports.parseOpencodeV2Frame = parseOpencodeV2Frame;
 exports.openOpencodeV2EventStream = openOpencodeV2EventStream;
@@ -92,6 +93,29 @@ async function probeOpencodeV2Server(port, password) {
         return { kind: 'unreachable' };
     }
 }
+/**
+ * The config sources, for the role's evidence (Issue #4115, §14): on 2.0.18 an array
+ * in order of strength, not one merged object. Holds the role's text and possibly
+ * secrets, so the caller compares it and keeps none of it. Null when the server did
+ * not answer.
+ */
+async function fetchOpencodeV2Config(port, password, directory) {
+    try {
+        const response = await fetch(`${opencodeV2BaseUrl(port)}/api/config?directory=${encodeURIComponent(directory)}`, {
+            headers: { Authorization: opencodeV2AuthorizationHeader(password) },
+            redirect: 'error',
+            signal: AbortSignal.timeout(exports.OPENCODE_V2_PROBE_TIMEOUT_MS),
+        });
+        if (response.status !== 200) {
+            await response.body?.cancel().catch(() => { });
+            return null;
+        }
+        return await response.json();
+    }
+    catch {
+        return null;
+    }
+}
 /** A fresh {@link OpencodeV2SseParser}. */
 function createOpencodeV2SseParser() {
     let buffer = '';

package/dist/server/src/lib/hooks/sources/opencode-v2/history.js

@@ -24,7 +24,15 @@
  *    ending close together write each turn once;
  *  - and it recovers what the stream missed. A turn that ended while the
  *    connection was down is in the document the next time any turn of the
- *    session ends.
+ *    session ends — and, since Issue #4187, when the stream reconnects
+ *    ({@link recoverOpencodeV2History}, which reads back past the newest
+ *    `user` message, to the page cap).
+ *
+ * The screen scraper never writes a V2 reply (Issue #4187's decision): the turns
+ * of a stream that is not live are this module's to write, later, under their
+ * `oc-turn:` key — a scraped row cannot carry that key, so both writing would
+ * double the turn. A pane with no subscription at all (`--standalone`) or one
+ * whose subscription ended on its own is not recorded.
  *
  * ## One turn in the document
  *
@@ -103,6 +111,7 @@ exports.buildOpencodeV2TurnsFromMessages = buildOpencodeV2TurnsFromMessages;
 exports.readLatestOpencodeV2AssistantModel = readLatestOpencodeV2AssistantModel;
 exports.resetOpencodeV2HistoryQueue = resetOpencodeV2HistoryQueue;
 exports.syncOpencodeV2History = syncOpencodeV2History;
+exports.recoverOpencodeV2History = recoverOpencodeV2History;
 const logger_1 = require("../../../../lib/logger");
 const agent_event_state_1 = require("../../../../lib/session/agent-event-state");
 const agent_transcript_1 = require("../../../../types/agent-transcript");
@@ -167,19 +176,9 @@ function readOpencodeV2ContentPart(messageId, index, item) {
             : null,
     };
 }
-/**
- * Rebuild the turns of a session from `GET /api/session/{id}/message` entries.
- *
- * Order-agnostic: the entries are sorted oldest first by `time.created` (the
- * id, which is time-ordered, breaks ties), so a desc page, an asc page or
- * several pages concatenated give the same turns. Assistant messages before the
- * first `user` message belong to a turn whose head is outside what was read,
- * and are dropped rather than attached to nothing.
- *
- * Pure: no fetch, no database.
- */
-function buildOpencodeV2TurnsFromMessages(entries, sessionId) {
-    const messages = entries
+/** `entries`' messages oldest first, as {@link buildOpencodeV2TurnsFromMessages} orders them. */
+function sortOpencodeV2MessagesOldestFirst(entries) {
+    return entries
         .filter(event_mapper_1.isPlainObject)
         .filter((message) => (0, event_mapper_1.readStringField)(message, 'id') !== null)
         .map((message, index) => ({ message, index }))
@@ -192,6 +191,20 @@ function buildOpencodeV2TurnsFromMessages(entries, sessionId) {
         return aId < bId ? -1 : aId > bId ? 1 : a.index - b.index;
     })
         .map(({ message }) => message);
+}
+/**
+ * Rebuild the turns of a session from `GET /api/session/{id}/message` entries.
+ *
+ * Order-agnostic: the entries are sorted oldest first by `time.created` (the
+ * id, which is time-ordered, breaks ties), so a desc page, an asc page or
+ * several pages concatenated give the same turns. Assistant messages before the
+ * first `user` message belong to a turn whose head is outside what was read,
+ * and are dropped rather than attached to nothing.
+ *
+ * Pure: no fetch, no database.
+ */
+function buildOpencodeV2TurnsFromMessages(entries, sessionId) {
+    const messages = sortOpencodeV2MessagesOldestFirst(entries);
     const turns = [];
     let open = null;
     const close = (closed) => {
@@ -304,6 +317,78 @@ async function readRecentMessages(port, password, sessionId) {
     }
     return entries;
 }
+/** Whether History already holds the turn opened by this user message. */
+async function isOpencodeV2TurnSaved(target, userMessageId) {
+    const [{ getDbInstance }, { findMessageByRequestId }] = await Promise.all([
+        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
+        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
+    ]);
+    return (findMessageByRequestId(getDbInstance(), target.worktreeId, (0, agent_transcript_1.opencodeTurnRequestId)(userMessageId)) !==
+        null);
+}
+/**
+ * Read newest-first pages up to {@link MAX_OPENCODE_V2_HISTORY_PAGES} (or the
+ * document's end) for the recovery sync (Issue #4187, C6).
+ *
+ * The ordinary read ({@link readRecentMessages}) stops at the first page with a
+ * `user` message, so a turn that closed while the stream was down and is a page
+ * further back is never read. This one does not stop at a turn History already
+ * has either: no such turn marks the gap's edge for sure — an ordinary sync can
+ * write a newer turn before the loss is noticed, and V2's times are another
+ * clock — so it reads the whole cap, and the rows' keys (`oc-turn:<id>`) and
+ * the per-instance queue keep a turn from being written twice.
+ */
+async function readMessagesToCap(target, port, password, sessionId) {
+    const entries = [];
+    let cursor = null;
+    for (let page = 0; page < exports.MAX_OPENCODE_V2_HISTORY_PAGES; page += 1) {
+        const result = await (0, client_1.fetchOpencodeV2SessionMessagesPage)(port, password, sessionId, cursor);
+        if (result === null)
+            return { entries, unreadable: true, pages: page, truncated: false };
+        entries.push(...result.data);
+        if (result.next === null || result.data.length === 0) {
+            return { entries, unreadable: false, pages: page + 1, truncated: false };
+        }
+        if (page === exports.MAX_OPENCODE_V2_HISTORY_PAGES - 1) {
+            return {
+                entries,
+                unreadable: false,
+                pages: page + 1,
+                truncated: headUnread(entries) || (await holdsUnsavedTurn(target, result.data)),
+            };
+        }
+        cursor = result.next;
+    }
+    return { entries, unreadable: false, pages: exports.MAX_OPENCODE_V2_HISTORY_PAGES, truncated: false };
+}
+/**
+ * Whether the oldest turn read has messages but not its head: an `assistant`
+ * older than every `user` read. Its `user` is beyond the cap, so the turn
+ * cannot be built (or told saved) from what was read — a turn longer than the
+ * pages read included. Counted as possibly missing: without its `user` id
+ * there is no way to ask History.
+ */
+function headUnread(entries) {
+    for (const message of sortOpencodeV2MessagesOldestFirst(entries)) {
+        const type = (0, event_mapper_1.readStringField)(message, 'type');
+        if (type === 'user')
+            return false;
+        if (type === 'assistant')
+            return true;
+    }
+    return false;
+}
+/** Whether `page` has a `user` message whose turn History does not have. */
+async function holdsUnsavedTurn(target, page) {
+    for (const entry of page) {
+        if (!(0, event_mapper_1.isPlainObject)(entry) || (0, event_mapper_1.readStringField)(entry, 'type') !== 'user')
+            continue;
+        const id = (0, event_mapper_1.readStringField)(entry, 'id');
+        if (id !== null && !(await isOpencodeV2TurnSaved(target, id)))
+            return true;
+    }
+    return false;
+}
 /**
  * Write one rendered turn, unless its row is already there.
  *
@@ -358,6 +443,43 @@ async function writeOpencodeV2Turn(target, rendered, timestampMs) {
     });
     return true;
 }
+/**
+ * Latch the answering model, then write the closed turns of `entries` that
+ * History does not have, oldest first. Shared by the ordinary sync and the
+ * recovery sync (Issue #4187).
+ *
+ * @returns How many rows were written, and how many turns History does not
+ *   have the newest-kept cap dropped
+ */
+async function writeOpencodeV2Turns(target, sessionId, entries, isCurrent) {
+    // Issue #2964: the model that answered, onto the hook latch the UI and
+    // `capture --json` read. Before the rows, so a failed write cannot cost it.
+    // Issue #3733: not for a subscription closed or replaced during the read —
+    // a restarted or stopped session would show the old model, and its change
+    // broadcast and Push (#2357) would fire for a session that is not there.
+    // Issue #4187 (C5): the subscription's `isCurrent` also asks that the session
+    // read is still the one it is following, so a late sync of the previous
+    // session does not put that session's model back on the display.
+    if (isCurrent()) {
+        (0, agent_event_state_1.recordAgentReportedModel)(target.worktreeId, tool_id_1.OPENCODE_V2_CLI_TOOL_ID, target.instanceId ?? tool_id_1.OPENCODE_V2_CLI_TOOL_ID, readLatestOpencodeV2AssistantModel(entries));
+    }
+    const closed = buildOpencodeV2TurnsFromMessages(entries, sessionId).filter((turn) => turn.closed);
+    const kept = closed.slice(-exports.MAX_OPENCODE_V2_SYNCED_TURNS);
+    let droppedUnsaved = 0;
+    for (const turn of closed.slice(0, closed.length - kept.length)) {
+        if (!(await isOpencodeV2TurnSaved(target, turn.accumulator.userMessageId)))
+            droppedUnsaved += 1;
+    }
+    let written = 0;
+    // Oldest first, so the rows go in in conversation order.
+    for (const turn of kept) {
+        const rendered = (0, transcript_1.renderOpencodeTurn)(turn.accumulator);
+        const at = Math.max(turn.accumulator.startedAt, turn.completedAt ?? 0);
+        if (await writeOpencodeV2Turn(target, rendered, at))
+            written += 1;
+    }
+    return { written, droppedUnsaved };
+}
 /**
  * Record every closed turn of a session that History does not have yet.
  *
@@ -368,9 +490,10 @@ async function writeOpencodeV2Turn(target, rendered, timestampMs) {
  * @param port - Its server
  * @param sessionId - `ses_…` from the end-of-turn frame
  * @param isCurrent - Whether the subscription that asked is still the
- *   instance's (Issue #3733); checked after the read, right before the model
- *   is latched. False skips only the latch: the rows are still written (the
- *   turn did happen, and `requestId` keeps a later sync from doubling them)
+ *   instance's (Issue #3733) and still following `sessionId` (Issue #4187);
+ *   checked after the read, right before the model is latched. False skips
+ *   only the latch: the rows are still written (the turn did happen, and
+ *   `requestId` keeps a later sync from doubling them)
  * @returns How many rows were written
  */
 function syncOpencodeV2History(target, port, sessionId, isCurrent = () => true) {
@@ -397,25 +520,74 @@ function syncOpencodeV2History(target, port, sessionId, isCurrent = () => true)
                 });
                 return 0;
             }
-            // Issue #2964: the model that answered, onto the hook latch the UI and
-            // `capture --json` read. Before the rows, so a failed write cannot cost it.
-            // Issue #3733: not for a subscription closed or replaced during the read —
-            // a restarted or stopped session would show the old model, and its change
-            // broadcast and Push (#2357) would fire for a session that is not there.
-            if (isCurrent()) {
-                (0, agent_event_state_1.recordAgentReportedModel)(target.worktreeId, tool_id_1.OPENCODE_V2_CLI_TOOL_ID, target.instanceId ?? tool_id_1.OPENCODE_V2_CLI_TOOL_ID, readLatestOpencodeV2AssistantModel(entries));
+            return (await writeOpencodeV2Turns(target, sessionId, entries, isCurrent)).written;
+        }
+        catch (error) {
+            logger.error('opencode-v2-history-sync-failed', {
+                worktreeId: target.worktreeId,
+                instanceId,
+                port,
+                sessionId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return 0;
+        }
+    });
+}
+/**
+ * Record the closed turns of a session that ended while the instance's stream
+ * was not live (Issue #4187, the recovery sync on reconnect).
+ *
+ * The same rows, keys and queue as {@link syncOpencodeV2History} — a recovery
+ * and an ordinary sync that overlap still write each turn once (C8) — but read
+ * {@link MAX_OPENCODE_V2_HISTORY_PAGES} pages (or to the document's end)
+ * instead of to the newest `user` message (C6), never stopping early at a turn
+ * History has. A warn (`opencode-v2-history-recovery-truncated`) says only that
+ * turns History does not have may lie beyond the cap: the oldest page read held
+ * one, the oldest turn read has no `user` in what was read, or
+ * {@link MAX_OPENCODE_V2_SYNCED_TURNS} dropped one. Guaranteed: the
+ * closed, unsaved turns within those pages, whatever order rows were written in
+ * and whatever the clocks say — not every turn ever.
+ *
+ * Never throws.
+ */
+function recoverOpencodeV2History(target, port, sessionId, options = {}) {
+    const isCurrent = options.isCurrent ?? (() => true);
+    return serialize((0, secrets_1.opencodeV2KeyOf)(target), async () => {
+        const instanceId = target.instanceId ?? target.cliToolId;
+        try {
+            const password = (0, secrets_1.readOpencodeV2Password)(target);
+            if (password === null) {
+                // The subscription ends on this too; nothing to try again for.
+                logger.info('opencode-v2-history-unavailable', {
+                    worktreeId: target.worktreeId,
+                    instanceId,
+                    reason: 'password-file-missing',
+                });
+                return { written: 0, unreadable: false };
+            }
+            const read = await readMessagesToCap(target, port, password, sessionId);
+            if (read.unreadable && read.entries.length === 0) {
+                logger.warn('opencode-v2-history-unavailable', {
+                    worktreeId: target.worktreeId,
+                    instanceId,
+                    port,
+                    sessionId,
+                    reason: 'messages-unreadable',
+                });
+                return { written: 0, unreadable: true };
             }
-            const closed = buildOpencodeV2TurnsFromMessages(entries, sessionId).filter((turn) => turn.closed);
-            const kept = closed.slice(-exports.MAX_OPENCODE_V2_SYNCED_TURNS);
-            let written = 0;
-            // Oldest first, so the rows go in in conversation order.
-            for (const turn of kept) {
-                const rendered = (0, transcript_1.renderOpencodeTurn)(turn.accumulator);
-                const at = Math.max(turn.accumulator.startedAt, turn.completedAt ?? 0);
-                if (await writeOpencodeV2Turn(target, rendered, at))
-                    written += 1;
+            const { written, droppedUnsaved } = await writeOpencodeV2Turns(target, sessionId, read.entries, isCurrent);
+            if (read.truncated || droppedUnsaved > 0) {
+                logger.warn('opencode-v2-history-recovery-truncated', {
+                    worktreeId: target.worktreeId,
+                    instanceId,
+                    sessionId,
+                    pages: read.pages,
+                    droppedTurns: droppedUnsaved,
+                });
             }
-            return written;
+            return { written, unreadable: read.unreadable };
         }
         catch (error) {
             logger.error('opencode-v2-history-sync-failed', {
@@ -423,9 +595,10 @@ function syncOpencodeV2History(target, port, sessionId, isCurrent = () => true)
                 instanceId,
                 port,
                 sessionId,
+                recovery: true,
                 error: error instanceof Error ? error.message : String(error),
             });
-            return 0;
+            return { written: 0, unreadable: true };
         }
     });
 }

package/dist/server/src/lib/hooks/sources/opencode-v2/secrets.js

@@ -65,10 +65,16 @@ exports.OPENCODE_V2_PASSWORD_SUFFIX = '.pw';
  *
  * `~/.commandmate/opencode-v2`, or `$CM_OPENCODE_V2_DIR`. Resolved on every call
  * so a test that points `HOME` or the variable somewhere else is honoured.
+ *
+ * Issue #4210: absolute, because a path under it leaves this process. The
+ * launch line hands `--password-file <file>` to `scripts/opencode-v2/launch.sh`
+ * (`./source.ts` `prepareOpencodeV2Launch`), which runs in the worktree
+ * (`cli-tools/base.ts` `createLaunchPane`) and would otherwise read another
+ * file than the one written here, or none.
  */
 function getOpencodeV2StateDir() {
     const fallback = (0, path_1.join)((0, os_1.homedir)(), '.commandmate', 'opencode-v2');
-    return (0, safe_directory_1.resolveSafeDirectory)(process.env[exports.OPENCODE_V2_DIR_ENV], fallback, exports.OPENCODE_V2_DIR_ENV);
+    return (0, safe_directory_1.resolveSafeAbsoluteDirectory)(process.env[exports.OPENCODE_V2_DIR_ENV], fallback, exports.OPENCODE_V2_DIR_ENV);
 }
 /**
  * Create the state directory with owner-only access.

package/dist/server/src/lib/hooks/sources/opencode-v2/subscription.js

@@ -29,11 +29,18 @@
  * And (Issue #2981) `session.usage.updated` and the end of a turn have
  * `./usage` refresh the session's spend and context, which the subscription
  * drops again when it closes or ends — the place v1 drops them.
+ * And (Issue #4187) a reconnect — a successful connection after an earlier
+ * successful one — has `./history` read the sessions the stream was following
+ * when it was lost, once, after the pending resync
+ * ({@link recoverOpencodeV2History}), so a turn that closed while the stream
+ * was down is written even when no later turn of that session ends. The screen
+ * scraper never writes a V2 reply, live or not.
  *
  * @module lib/hooks/sources/opencode-v2/subscription
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OPENCODE_V2_MAX_RESYNCED_DECISIONS = exports.OPENCODE_V2_MAX_REJECTED_PROBES = exports.OPENCODE_V2_RECONNECT_BACKOFF_MS = exports.OPENCODE_V2_HEARTBEAT_TIMEOUT_MS = void 0;
+exports.OPENCODE_V2_HISTORY_RECOVERY_RETRY_MS = exports.OPENCODE_V2_MAX_RESYNCED_DECISIONS = exports.OPENCODE_V2_MAX_REJECTED_PROBES = exports.OPENCODE_V2_RECONNECT_BACKOFF_MS = exports.OPENCODE_V2_HEARTBEAT_TIMEOUT_MS = void 0;
+exports.setOpencodeV2HistoryRecoveryRetryDelaysForTests = setOpencodeV2HistoryRecoveryRetryDelaysForTests;
 exports.isOpencodeV2Subscribed = isOpencodeV2Subscribed;
 exports.getOpencodeV2Liveness = getOpencodeV2Liveness;
 exports.isOpencodeV2StructuredHistoryLive = isOpencodeV2StructuredHistoryLive;
@@ -72,6 +79,17 @@ exports.OPENCODE_V2_MAX_REJECTED_PROBES = 3;
  * off a server CommandMate does not police.
  */
 exports.OPENCODE_V2_MAX_RESYNCED_DECISIONS = 50;
+/**
+ * Waits before retrying a recovery sync whose document could not be read
+ * (Issue #4187, C7). Three retries, then the session is given up with a warn;
+ * its next turn end still has the ordinary sync read the newest turns.
+ */
+exports.OPENCODE_V2_HISTORY_RECOVERY_RETRY_MS = [2_000, 5_000, 15_000];
+let recoveryRetryDelays = exports.OPENCODE_V2_HISTORY_RECOVERY_RETRY_MS;
+/** Shorten the recovery retries. Test seam; null restores the defaults. */
+function setOpencodeV2HistoryRecoveryRetryDelaysForTests(delays) {
+    recoveryRetryDelays = delays ?? exports.OPENCODE_V2_HISTORY_RECOVERY_RETRY_MS;
+}
 const subscriptions = (0, global_state_1.getOrInitGlobal)('__opencodeV2Subscriptions', () => new Map());
 /** The last liveness of a subscription that ended on its own, for `liveness()`. */
 const endedLiveness = (0, global_state_1.getOrInitGlobal)('__opencodeV2EndedLiveness', () => new Map());
@@ -132,6 +150,10 @@ function openOpencodeV2Subscription(target, port, onEvent, normalize) {
         liveness: { state: 'unknown' },
         closed: false,
         watchdog: null,
+        connectedOnce: false,
+        currentSessionId: null,
+        recoverySessions: new Map(),
+        recoveryController: new AbortController(),
     };
     subscriptions.set(key, state);
     logger.info('opencode-v2-subscription-opened', {
@@ -172,6 +194,7 @@ function stop(state) {
     clearWatchdog(state);
     state.streamController.abort();
     state.lifetimeController.abort();
+    state.recoveryController.abort();
 }
 /** End a subscription from inside its own loop, remembering why. */
 function endSubscription(state, reason) {
@@ -263,6 +286,10 @@ async function runStream(state) {
             else {
                 rejected = 0;
                 const items = await (0, client_1.openOpencodeV2EventStream)(state.port, password, state.streamController.signal);
+                // Issue #4187 (C1): read before it is set, so only a success after an
+                // earlier success counts as a reconnect.
+                const reconnected = state.connectedOnce;
+                state.connectedOnce = true;
                 markAlive(state);
                 attempt = 0;
                 // Issue #2951: before the first live frame, so an approval raised while
@@ -270,6 +297,12 @@ async function runStream(state) {
                 // one. A frame for the same id on the new stream is then a duplicate by
                 // identity, not a second approval.
                 await resyncOpencodeV2Pending(state.target, state.port, password, (frame) => deliver(state, frame));
+                // Issue #4187 (C2, C3): once per reconnect, after the resync, and only
+                // for a subscription still the instance's. Started before the first
+                // live frame, so it is queued in `./history` ahead of any ordinary sync
+                // this connection's frames trigger.
+                if (reconnected && isCurrentSubscription(state))
+                    startHistoryRecovery(state);
                 for await (const item of items) {
                     if (state.closed)
                         break;
@@ -288,6 +321,15 @@ async function runStream(state) {
         if (state.closed)
             return;
         state.liveness = { state: 'lost', since: Date.now(), reason };
+        // Issue #4187 (C4): the session followed when the stream was lost is what a
+        // reconnect recovers, whatever session the resync then names. A new entry
+        // per loss, so a recovery read already running cannot take this loss out
+        // with its own success; that recovery stops here and the next reconnect
+        // starts anew.
+        state.recoveryController.abort();
+        if (state.currentSessionId !== null) {
+            state.recoverySessions.set(state.currentSessionId, { lostAt: state.liveness.since });
+        }
         logger.info('opencode-v2-subscription-disconnected', {
             worktreeId: state.target.worktreeId,
             instanceId: state.target.instanceId ?? state.target.cliToolId,
@@ -374,7 +416,74 @@ function deliverOpencodeV2Frame(frame, normalize, onEvent, receivedAt = Date.now
     onEvent(event);
     return true;
 }
+/**
+ * The recovery sync of one reconnect (Issue #4187, C2〜C8).
+ *
+ * Reads each session in `recoverySessions` back to the page cap; a
+ * session whose read succeeded leaves the set, one that could not be read stays
+ * and is retried after {@link OPENCODE_V2_HISTORY_RECOVERY_RETRY_MS}, three
+ * times at most, then is given up with a warn. A newer reconnect aborts this one
+ * and takes the set over (one recovery per reconnect); a loss of the stream,
+ * closing or ending the subscription aborts it too. A read already under way
+ * still writes its rows, but takes its session out of the set only if no loss
+ * replaced the entry it began on. Never throws.
+ */
+function startHistoryRecovery(state) {
+    state.recoveryController.abort();
+    const controller = new AbortController();
+    state.recoveryController = controller;
+    void runHistoryRecovery(state, controller.signal).catch((error) => {
+        logger.warn('opencode-v2-history-recovery-failed', {
+            worktreeId: state.target.worktreeId,
+            instanceId: state.target.instanceId ?? state.target.cliToolId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    });
+}
+async function runHistoryRecovery(state, signal) {
+    const stillOurs = () => !signal.aborted && isCurrentSubscription(state);
+    for (let retry = 0;; retry += 1) {
+        if (!stillOurs())
+            return;
+        const pending = [...state.recoverySessions];
+        if (pending.length === 0)
+            return;
+        for (const [sessionId, entry] of pending) {
+            if (!stillOurs())
+                return;
+            const result = await (0, history_1.recoverOpencodeV2History)(state.target, state.port, sessionId, {
+                isCurrent: () => isFollowing(state, sessionId),
+            });
+            // Only the entry this read began on: a loss during the read replaced it.
+            if (!result.unreadable && state.recoverySessions.get(sessionId) === entry) {
+                state.recoverySessions.delete(sessionId);
+            }
+        }
+        if (state.recoverySessions.size === 0 || !stillOurs())
+            return;
+        const delays = recoveryRetryDelays;
+        if (retry >= delays.length) {
+            const givenUp = [...state.recoverySessions].filter(([, entry]) => pending.some(([, read]) => read === entry));
+            logger.warn('opencode-v2-history-recovery-failed', {
+                worktreeId: state.target.worktreeId,
+                instanceId: state.target.instanceId ?? state.target.cliToolId,
+                port: state.port,
+                sessionIds: givenUp.map(([sessionId]) => sessionId),
+                attempts: retry + 1,
+            });
+            for (const [sessionId] of givenUp)
+                state.recoverySessions.delete(sessionId);
+            return;
+        }
+        await waitUnlessAborted(delays[retry], signal);
+    }
+}
 function deliver(state, frame) {
+    // Issue #4187 (C4): every frame naming a session moves the current one,
+    // resync frames included.
+    const sessionId = (0, mappers_1.frameSessionId)(frame);
+    if (sessionId !== null)
+        state.currentSessionId = sessionId;
     try {
         deliverOpencodeV2Frame(frame, state.normalize, state.onEvent);
     }
@@ -386,12 +495,18 @@ function deliver(state, frame) {
             error: error instanceof Error ? error.message : String(error),
         });
     }
-    void recordOpencodeV2TurnEnd(state.target, state.port, frame, () => isCurrentSubscription(state));
+    // Issue #4187 (C5): latch only while this subscription still follows the
+    // session the frame ended a turn of.
+    void recordOpencodeV2TurnEnd(state.target, state.port, frame, () => sessionId !== null && isFollowing(state, sessionId));
     void refreshOpencodeV2UsageOnFrame(state.target, state.port, frame, () => isCurrentSubscription(state));
 }
 function isCurrentSubscription(state) {
     return !state.closed && subscriptions.get(state.key) === state;
 }
+/** Still the instance's subscription, and still following `sessionId` (C5). */
+function isFollowing(state, sessionId) {
+    return isCurrentSubscription(state) && state.currentSessionId === sessionId;
+}
 /**
  * Have `./usage` re-read the session's spend and context when this frame says
  * they moved (Issue #2981): `session.usage.updated`, or the end of a turn.

package/dist/server/src/lib/job-executor.js

@@ -23,6 +23,8 @@ exports.resolveScheduleExecuteOptions = resolveScheduleExecuteOptions;
 exports.executeSchedule = executeSchedule;
 const crypto_1 = require("crypto");
 const claude_executor_1 = require("./session/claude-executor");
+const role_launch_1 = require("./session/role-launch");
+const env_sanitizer_1 = require("../lib/security/env-sanitizer");
 const cmate_cli_tool_parser_1 = require("../lib/cmate-cli-tool-parser");
 const logger_1 = require("../lib/logger");
 const logger = (0, logger_1.createLogger)('job-executor');
@@ -191,7 +193,22 @@ async function executeSchedule(state) {
         }
         // Resolve the CLI options via the centralized helper (DR1-004, #2044)
         const options = resolveScheduleExecuteOptions(state.entry, worktree);
-        const result = await (0, claude_executor_1.executeClaudeCommand)(state.entry.message, worktree.path, state.entry.cliToolId, state.entry.permission, options);
+        // Issue #4115: the defaults for this worktree and tool, resolved here and not in
+        // `executeClaudeCommand`, which the daily summary shares (D2). A role that cannot
+        // be applied fails the run: it must not go ahead without one.
+        const scheduleRole = await (0, role_launch_1.resolveScheduleRole)(db, {
+            worktreeId: state.worktreeId,
+            cliToolId: state.entry.cliToolId,
+            worktreePath: worktree.path,
+            explicitAgent: options?.agent,
+            env: (0, env_sanitizer_1.sanitizeEnvForChildProcess)(),
+        });
+        if (scheduleRole.kind === 'refused') {
+            updateExecutionLog(logId, 'failed', scheduleRole.refusal.message, null);
+            logger.warn('execution:role-refused', { name: state.entry.name, reason: scheduleRole.refusal.reason });
+            return;
+        }
+        const result = await (0, claude_executor_1.executeClaudeCommand)(state.entry.message, worktree.path, state.entry.cliToolId, state.entry.permission, scheduleRole.kind === 'role' ? { ...options, role: scheduleRole.role } : options);
         // Issue #2253: `result.status` is not always "did the process exit 0".
         // command-code writes a `{"type":"result","subtype":…}` line even on a
         // non-zero exit and can pair `subtype: "success"` with exit 9, so