npm - conductor-remote - Versions diffs - 1.30.2 → 1.30.3 - Mend

conductor-remote 1.30.2 → 1.30.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/dist/assets/index-B2SjHT-B.js +41 -0
package/dist/index.html +1 -1
package/dist/sw.js +1 -1
package/dist-node/src/config.js +8 -1
package/dist-node/src/firstprompt.js +198 -0
package/dist-node/src/server.js +81 -51
package/dist-node/src/writes.js +34 -9
package/package.json +1 -1
package/dist/assets/index-Bzpilddl.js +0 -43

package/dist/index.html CHANGED Viewed

@@ -13,7 +13,7 @@
 		<title>Conductor Remote</title>
 		<!-- Runs before the module bundle so it can catch a stale shell that fails to boot. -->
 		<script src="/self-heal.js"></script>
-		<script type="module" crossorigin src="/assets/index-Bzpilddl.js"></script>
+		<script type="module" crossorigin src="/assets/index-B2SjHT-B.js"></script>
 		<link rel="stylesheet" crossorigin href="/assets/index-8aCnDSQJ.css">
 	<link rel="manifest" href="/manifest.webmanifest"></head>
 	<body>

package/dist/sw.js CHANGED Viewed

	@@ -1 +1 @@
1	- if(!self.define){let e,i={};const n=(n,s)=>(n=new URL(n+".js",s).href,i[n]\|\|new Promise(i=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=i,document.head.appendChild(e)}else e=n,importScripts(n),i()}).then(()=>{let e=i[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(s,r)=>{const o=e\|\|("document"in self?document.currentScript.src:"")\|\|location.href;if(i[o])return;let l={};const t=e=>n(e,o),c={module:{uri:o},exports:l,require:t};i[o]=Promise.all(s.map(e=>c[e]\|\|t(e))).then(e=>(r(...e),l))}}define(["./workbox-9c191d2f"],function(e){"use strict";self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"self-heal.js",revision:"49bd63adb25a09341f8d2610e8bd3c76"},{url:"index.html",revision:"~~a34e4b0b1556a8c24be6825befa11735~~"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/index-~~Bzpilddl~~.js",revision:null},{url:"assets/index-8aCnDSQJ.css",revision:null},{url:"apple-touch-icon.png",revision:"2b9301416b880d45d4bb655f2600d1f2"},{url:"icon-192.png",revision:"c5e01ac58768627e18ee7b8b6a9239ef"},{url:"icon-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon-maskable-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon.svg",revision:"c1aee186821798733dd477e69a0ef243"},{url:"manifest.webmanifest",revision:"cf88fbc5755108a7fe0616fa160a8a15"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api\//]}))});
1	+ if(!self.define){let e,i={};const n=(n,s)=>(n=new URL(n+".js",s).href,i[n]\|\|new Promise(i=>{if("document"in self){const e=document.createElement("script");e.src=n,e.onload=i,document.head.appendChild(e)}else e=n,importScripts(n),i()}).then(()=>{let e=i[n];if(!e)throw new Error(`Module ${n} didn’t register its module`);return e}));self.define=(s,r)=>{const o=e\|\|("document"in self?document.currentScript.src:"")\|\|location.href;if(i[o])return;let l={};const c=e=>n(e,o),t={module:{uri:o},exports:l,require:c};i[o]=Promise.all(s.map(e=>t[e]\|\|c(e))).then(e=>(r(...e),l))}}define(["./workbox-9c191d2f"],function(e){"use strict";self.addEventListener("message",e=>{e.data&&"SKIP_WAITING"===e.data.type&&self.skipWaiting()}),e.clientsClaim(),e.precacheAndRoute([{url:"self-heal.js",revision:"49bd63adb25a09341f8d2610e8bd3c76"},{url:"index.html",revision:"32efee3d01d4dec7873e83faf76854ca"},{url:"assets/workbox-window.prod.es5-BBnX5xw4.js",revision:null},{url:"assets/index-B2SjHT-B.js",revision:null},{url:"assets/index-8aCnDSQJ.css",revision:null},{url:"apple-touch-icon.png",revision:"2b9301416b880d45d4bb655f2600d1f2"},{url:"icon-192.png",revision:"c5e01ac58768627e18ee7b8b6a9239ef"},{url:"icon-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon-maskable-512.png",revision:"a40638c55e310312457a621c9a0002c8"},{url:"icon.svg",revision:"c1aee186821798733dd477e69a0ef243"},{url:"manifest.webmanifest",revision:"cf88fbc5755108a7fe0616fa160a8a15"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/api\//]}))});

package/dist-node/src/config.js CHANGED Viewed

@@ -4,9 +4,16 @@ import os from 'node:os';
 import path from 'node:path';
 import { packageRoot } from "./pkg-root.js";
 const home = os.homedir();
+/**
+ * The relay's own state directory — its token, its Funnel posture, its undelivered
+ * first prompts. Never Conductor's: everything about Conductor is read from the DB.
+ */
+export function stateDir() {
+    return path.join(home, 'Library', 'Application Support', 'conductor-remote');
+}
 /** Where a generated token is persisted so a phone's saved URL stays valid across relay restarts. */
 function tokenStorePath() {
-    return path.join(home, 'Library', 'Application Support', 'conductor-remote', 'token');
+    return path.join(stateDir(), 'token');
 }
 /**
  * Stable shared secret. Explicit `RELAY_TOKEN` wins; otherwise reuse a persisted token (or mint and

package/dist-node/src/firstprompt.js ADDED Viewed

@@ -0,0 +1,198 @@
+/**
+ * The first prompt of a workspace created from the phone, delivered by the relay
+ * once Conductor has finished setting the worktree up.
+ *
+ * Conductor's deep link creates the workspace and *pre-fills* its composer, but
+ * never presses Enter — so something has to, ~30s later, when the worktree turns
+ * `ready` and the chat exists. That "something" used to be the PWA, which is the
+ * worst possible scheduler for it: the phone sleeps, iOS suspends a backgrounded
+ * PWA outright, and it may not be on the network at all. Meanwhile the relay is a
+ * daemon on the same Mac as the target, already holding the DB and the actuator.
+ * So the relay owns delivery and the phone only *watches* it (`/api/state`
+ * carries the pending prompt, `DELETE …/prompt` dismisses one).
+ *
+ * Three properties this has to keep:
+ *
+ * - **One owner.** If the phone delivered too, `last_user_message_at` wouldn't
+ *   save us — it's a read, not a lock, and both sides can read it null. The PWA
+ *   no longer parks anything.
+ * - **It survives a restart.** `autoupdate` deliberately `exit()`s to reload new
+ *   code, and launchd brings us straight back; a queue that only lived in memory
+ *   would drop the prompt mid-setup, which is the same swallowed prompt in a new
+ *   house. Hence the JSON file, rewritten on every change.
+ * - **It gives up in public.** After `MAX_ATTEMPTS` sends or `MAX_AGE_MS` of a
+ *   workspace that never turns ready, the entry flips to `failed` *and stays*, so
+ *   the phone can show the text with the reason next to it. Nothing is silently
+ *   dropped — and the text is still sitting pre-filled in Conductor's composer on
+ *   the Mac regardless.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/** How often the loop re-reads the DB while waiting for a worktree. */
+const POLL_MS = 1000;
+/** Breathing room between failed sends — Conductor may be mid-launch or showing a dialog. */
+const RETRY_DELAY_MS = 5000;
+const MAX_ATTEMPTS = 3;
+/** A workspace that hasn't turned ready in this long isn't going to. */
+const MAX_AGE_MS = 15 * 60 * 1000;
+/** Failed entries the user never dismissed are still dropped eventually. */
+const KEEP_FAILED_MS = 7 * 24 * 60 * 60 * 1000;
+const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+export class FirstPromptQueue {
+    // Explicit field assignment, not parameter properties: the dev run type-*strips*
+    // rather than transforms, and parameter properties need a transform (see CLAUDE.md).
+    file;
+    deps;
+    entries;
+    pumping = false;
+    /** Resolvers waiting on a specific entry to settle (`POST /api/workspaces` with `send:true`). */
+    waiters = new Map();
+    constructor(file, deps) {
+        this.file = file;
+        this.deps = deps;
+        this.entries = this.load();
+    }
+    /** Everything the phone should see, including entries that have already failed. */
+    list() {
+        return this.entries;
+    }
+    get(workspaceId) {
+        return this.entries.find(e => e.workspaceId === workspaceId) ?? null;
+    }
+    /**
+     * Park a prompt and start delivering it. The returned promise settles when the
+     * prompt lands (`null`) or is given up on (the failed entry) — awaited by API
+     * callers that asked to block, ignored by the phone.
+     */
+    enqueue(workspaceId, text) {
+        this.entries = [
+            ...this.entries.filter(e => e.workspaceId !== workspaceId),
+            { workspaceId, text, status: 'waiting', attempts: 0, createdAt: Date.now() }
+        ];
+        this.save();
+        const settled = new Promise(resolve => {
+            const list = this.waiters.get(workspaceId) ?? [];
+            list.push(resolve);
+            this.waiters.set(workspaceId, list);
+        });
+        void this.pump();
+        return settled;
+    }
+    /** Drop an entry — dismissed from the phone, or superseded by a send the user made themselves. */
+    forget(workspaceId) {
+        if (!this.entries.some(e => e.workspaceId === workspaceId))
+            return false;
+        this.entries = this.entries.filter(e => e.workspaceId !== workspaceId);
+        this.save();
+        this.settle(workspaceId, null);
+        return true;
+    }
+    /** Resume delivery of anything left over from a previous process. */
+    start() {
+        const waiting = this.entries.filter(e => e.status === 'waiting').length;
+        if (waiting)
+            console.info(`[relay] resuming ${waiting} undelivered first prompt(s)`);
+        void this.pump();
+    }
+    /**
+     * The delivery loop. One pass per second over everything still waiting; exits
+     * when nothing is (and `enqueue`/`start` re-enter it). Single-flight, so the
+     * loop can't be stacked by a burst of creations.
+     */
+    async pump() {
+        if (this.pumping)
+            return;
+        this.pumping = true;
+        try {
+            while (this.entries.some(e => e.status === 'waiting')) {
+                for (const entry of this.entries.filter(e => e.status === 'waiting'))
+                    await this.step(entry);
+                if (this.entries.some(e => e.status === 'waiting'))
+                    await sleep(POLL_MS);
+            }
+        }
+        catch (err) {
+            // A throw here would strand every waiting prompt with no loop to retry it.
+            console.error('[relay] first-prompt delivery loop crashed:', err);
+        }
+        finally {
+            this.pumping = false;
+        }
+    }
+    async step(entry) {
+        if (Date.now() - entry.createdAt > MAX_AGE_MS) {
+            return this.fail(entry, 'the workspace never finished setting up');
+        }
+        const target = this.deps.inspect(entry.workspaceId);
+        // No row yet is normal right after creation, and a workspace that really is
+        // gone falls out through the age cap above rather than being guessed at here.
+        if (!target?.ready || !target.sessionId)
+            return;
+        // It already went — the user sent it from the Mac, where the deep link left it
+        // pre-filled in the composer. Sending again would double it.
+        if (target.alreadySent)
+            return this.delivered(entry);
+        entry.attempts += 1;
+        this.save();
+        const result = await this.deps.send(entry.workspaceId, target.sessionId, entry.text);
+        if (result.ok)
+            return this.delivered(entry);
+        const error = result.error ?? 'the send didn’t land';
+        console.warn(`[relay] first prompt for ${entry.workspaceId} failed (attempt ${entry.attempts}): ${error}`);
+        if (entry.attempts >= MAX_ATTEMPTS)
+            return this.fail(entry, error);
+        await sleep(RETRY_DELAY_MS);
+    }
+    /** Delivered: the entry's job is done, so it stops existing. */
+    delivered(entry) {
+        this.entries = this.entries.filter(e => e !== entry);
+        this.save();
+        this.settle(entry.workspaceId, null);
+    }
+    /** Given up on: kept, so the phone can show the text and the reason. */
+    fail(entry, error) {
+        entry.status = 'failed';
+        entry.error = error;
+        this.save();
+        this.settle(entry.workspaceId, entry);
+    }
+    settle(workspaceId, result) {
+        const list = this.waiters.get(workspaceId);
+        if (!list)
+            return;
+        this.waiters.delete(workspaceId);
+        for (const resolve of list)
+            resolve(result);
+    }
+    load() {
+        let raw;
+        try {
+            raw = fs.readFileSync(this.file, 'utf8');
+        }
+        catch {
+            return []; // nothing parked yet — the common case
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (!Array.isArray(parsed))
+                return [];
+            return parsed.filter(e => typeof e?.workspaceId === 'string' &&
+                typeof e.text === 'string' &&
+                Date.now() - (e.createdAt ?? 0) < KEEP_FAILED_MS);
+        }
+        catch (err) {
+            console.warn(`[relay] ignoring unreadable ${this.file}: ${err instanceof Error ? err.message : err}`);
+            return [];
+        }
+    }
+    save() {
+        try {
+            fs.mkdirSync(path.dirname(this.file), { recursive: true });
+            fs.writeFileSync(this.file, JSON.stringify(this.entries, null, 2));
+        }
+        catch (err) {
+            // Delivery still works this run; only the restart guarantee is lost.
+            console.warn(`[relay] could not persist pending prompts: ${err instanceof Error ? err.message : err}`);
+        }
+    }
+}

package/dist-node/src/server.js CHANGED Viewed

@@ -4,8 +4,9 @@ import http from 'node:http';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import { startAutoUpdate, updateStatus } from "./autoupdate.js";
-import { loadConfig } from "./config.js";
+import { loadConfig, stateDir } from "./config.js";
 import { ConductorDb } from "./db.js";
+import { FirstPromptQueue } from "./firstprompt.js";
 import { startFunnelWatchdog } from "./funnel-watchdog.js";
 import { workspaceDiff } from "./git.js";
 import { installLogCapture, isManaged, LOG_FILE_NAMES, logFiles, processStartedAt, recentLogs, redactSecrets, tailLogFile } from "./logbuf.js";
@@ -77,35 +78,60 @@ async function confirmAgentOptions(ws, sessionId, opts) {
     return false;
 }
 /**
- * Send a freshly-created workspace's first prompt. Never fails the request: the
- * workspace exists either way, so an unsent prompt is a `warning` (it's still
- * pre-filled in Conductor's composer, one tap from going) rather than an error.
+ * Deliver a prompt to one chat and confirm it landed. The single write path: the
+ * phone's own sends go through it, and so does the first-prompt queue, so both
+ * get the same targeting, the same read-back and the same errors.
  */
-async function submitFirstPrompt(workspaceId, prompt) {
-    // A new workspace is 'setting_up' while its worktree (and setup script) runs;
-    // its composer isn't the visible pane yet, so wait for 'ready' before typing.
-    let ws = reads.getWorkspace(workspaceId);
-    for (let attempt = 0; attempt < 60 && ws?.state !== 'ready'; attempt++) {
-        await sleep(500);
-        ws = reads.getWorkspace(workspaceId);
-    }
-    if (ws?.state !== 'ready') {
-        return { sent: false, warning: 'Workspace created; still setting up, so the prompt is pre-filled but not sent.' };
-    }
-    const located = locateChat(ws, reads.listSessions(workspaceId)[0]?.id ?? '');
-    const tab = 'error' in located ? undefined : located.tab;
-    const sessionId = reads.listSessions(workspaceId)[0]?.id;
-    if (!sessionId)
-        return { sent: false, warning: 'Workspace created, but it has no chat yet — prompt is pre-filled.' };
+async function deliverPrompt(ws, sessionId, text) {
+    const located = locateChat(ws, sessionId);
+    if ('error' in located)
+        return { ok: false, strategy: actuator.name, error: located.error };
+    // Snapshot the transcript cursor so we can confirm the prompt actually lands.
     const beforeRowid = reads.getMessages(sessionId).cursor;
-    const result = await actuator.send({ workspace: ws, sessionId, tab }, prompt);
-    if (!result.ok)
-        return { sent: false, warning: `Workspace created; the prompt is pre-filled but wasn’t sent (${result.error}).` };
-    if (!(await confirmDelivery(sessionId, prompt, beforeRowid))) {
-        return { sent: false, warning: 'Workspace created; the prompt is pre-filled but didn’t land — send it again.' };
+    const result = await actuator.send({ workspace: ws, sessionId, tab: located.tab }, text);
+    if (!result.ok) {
+        console.warn(`[relay] send to ${ws.branch ?? ws.id} failed: ${result.error}`);
+        return result;
+    }
+    if (!(await confirmDelivery(sessionId, text, beforeRowid))) {
+        // The phone only ever sees "try again"; the reason a send goes missing lives
+        // on this side, so leave a trail in relay.log rather than nothing at all.
+        console.warn(`[relay] send to ${ws.branch ?? ws.id} drove the UI but never landed in the chat`);
+        return {
+            ok: false,
+            strategy: result.strategy,
+            error: 'Send didn’t land in the chat — Conductor may have been asleep or unfocused. Try again.'
+        };
     }
-    return { sent: true };
+    return result;
 }
+/**
+ * Undelivered first prompts, owned by this process rather than by the phone (see
+ * firstprompt.ts for why). Everything Conductor-side it needs is a plain DB read.
+ */
+const firstPrompts = new FirstPromptQueue(path.join(stateDir(), 'first-prompts.json'), {
+    inspect: workspaceId => {
+        const ws = reads.getWorkspace(workspaceId);
+        if (!ws)
+            return null;
+        // A new workspace is 'setting_up' while its worktree (and setup script) runs;
+        // its composer isn't the visible pane yet, so wait for 'ready' before typing.
+        const sessions = reads.listSessions(workspaceId);
+        const session = sessions.find(s => s.id === ws.active_session_id) ?? sessions[0];
+        return {
+            ready: ws.state === 'ready',
+            sessionId: session?.id ?? null,
+            alreadySent: !!session?.last_user_message_at
+        };
+    },
+    send: async (workspaceId, sessionId, text) => {
+        const ws = reads.getWorkspace(workspaceId);
+        if (!ws)
+            return { ok: false, error: 'the workspace is gone' };
+        const result = await deliverPrompt(ws, sessionId, text);
+        return { ok: result.ok, error: result.error };
+    }
+});
 const MIME = {
     '.html': 'text/html; charset=utf-8',
     '.js': 'text/javascript; charset=utf-8',
@@ -212,6 +238,10 @@ const server = http.createServer(async (req, res) => {
             const update = updateStatus();
             const workspaces = reads.listWorkspaces();
             attachPrStatus(workspaces); // colours pr_status from cache; refreshes stale entries in the background
+            // An undelivered first prompt rides along with its workspace: the phone renders it
+            // in that chat rather than tracking delivery itself (see src/firstprompt.ts).
+            for (const ws of workspaces)
+                ws.pending_prompt = firstPrompts.get(ws.id);
             return json(req, res, 200, {
                 workspaces,
                 actuator: await describeActuator(actuator),
@@ -285,18 +315,21 @@ const server = http.createServer(async (req, res) => {
                     error: 'Conductor didn’t create a workspace — check it’s running and not showing a dialog.'
                 });
             }
-            // Return as soon as the row exists (~2s) and let the caller submit the prompt
-            // once the worktree is ready. Waiting here would block the request through
-            // Conductor's whole setup — measured at 30s+ on a real repo, past the phone's
-            // own 25s budget. `send:true` opts into the blocking path for API callers.
+            // Return as soon as the row exists (~2s) — waiting for delivery would block the
+            // request through Conductor's whole setup, measured at 30s+ on a real repo and
+            // past the phone's own 25s budget. The queue delivers on its own schedule and
+            // the phone watches it in /api/state; `send:true` opts API callers into waiting.
             // Whatever happens, the prompt is already pre-filled in Conductor's composer.
-            const submitted = body.send === true && prompt ? await submitFirstPrompt(created.id, prompt) : { sent: false };
+            const settled = prompt ? firstPrompts.enqueue(created.id, prompt) : null;
+            const failed = settled && body.send === true ? await settled : null;
+            settled?.catch(() => undefined); // fire-and-forget: it reports failure, it never rejects
             return json(req, res, 200, {
                 ok: true,
                 workspaceId: created.id,
                 workspace: reads.getWorkspace(created.id) ?? created,
                 pendingPrompt: prompt || undefined,
-                ...submitted
+                sent: body.send === true ? !failed : false,
+                warning: failed?.error && `Workspace created; the prompt is pre-filled but wasn’t sent (${failed.error}).`
             });
         }
         // GET /api/repos/:name/icon — the repo's resolved sidebar icon (see src/icons.ts)
@@ -425,27 +458,21 @@ const server = http.createServer(async (req, res) => {
                 : (reads.listWorkspaces().find(w => w.active_session_id === sessionId) ?? null);
             if (!ws)
                 return json(req, res, 404, { error: 'workspace for session not found' });
-            const located = locateChat(ws, sessionId);
-            if ('error' in located)
-                return json(req, res, 409, { error: located.error });
-            const { tab } = located;
-            // Snapshot the transcript cursor so we can confirm the prompt actually lands.
-            const beforeRowid = reads.getMessages(sessionId).cursor;
-            const result = await actuator.send({ workspace: ws, sessionId, tab }, text);
-            if (result.ok && !(await confirmDelivery(sessionId, text, beforeRowid))) {
-                // The phone only ever sees "try again"; the reason a send goes missing lives
-                // on this side, so leave a trail in relay.log rather than nothing at all.
-                console.warn(`[relay] send to ${ws.branch ?? ws.id} drove the UI but never landed in the chat`);
-                return json(req, res, 502, {
-                    ok: false,
-                    strategy: result.strategy,
-                    error: 'Send didn’t land in the chat — Conductor may have been asleep or unfocused. Try again.'
-                });
-            }
-            if (!result.ok)
-                console.warn(`[relay] send to ${ws.branch ?? ws.id} failed: ${result.error}`);
+            const result = await deliverPrompt(ws, sessionId, text);
+            // Whatever the queue was still holding for this workspace has now been said by
+            // hand — including a failed entry the user retried from the chat.
+            if (result.ok)
+                firstPrompts.forget(ws.id);
             return json(req, res, result.ok ? 200 : 502, result);
         }
+        // DELETE /api/workspaces/:id/prompt — dismiss an undelivered first prompt
+        m = pathname.match(/^\/api\/workspaces\/([^/]+)\/prompt$/);
+        if (req.method === 'DELETE' && m) {
+            const workspaceId = decodeURIComponent(m[1]);
+            if (!firstPrompts.forget(workspaceId))
+                return json(req, res, 404, { error: 'no pending prompt' });
+            return json(req, res, 200, { ok: true });
+        }
         return json(req, res, 404, { error: 'no route', pathname });
     }
     catch (err) {
@@ -473,6 +500,9 @@ server.listen(cfg.port, cfg.host, () => {
         if (drift.length)
             console.info(`\n${drift.join('\n')}`);
     }
+    // Pick up any first prompt the previous process was still holding — an auto-update
+    // restart lands mid-setup often enough that this is the normal path, not a rare one.
+    firstPrompts.start();
     // Keep the managed global daemon current — no-ops for dev checkouts / unmanaged runs (see autoupdate.ts).
     startAutoUpdate();
     // Keep the phone's public URL reachable — re-registers Funnel when its ingress goes stale after a

package/dist-node/src/writes.js CHANGED Viewed

@@ -2,6 +2,29 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { sidecarAvailable, sidecarSendUserMessage } from "./sidecar.js";
 const exec = promisify(execFile);
+/**
+ * One UI operation at a time.
+ *
+ * Every script below drives Conductor's *shared, single* window — focus a
+ * workspace, select a tab, write the composer — so two of them overlapping
+ * interleaves their steps and lands a prompt in whatever the other one focused.
+ * That is the exact failure the whole fail-closed AX design exists to prevent,
+ * and no amount of per-step assertion catches it, because each script's reads
+ * are true at the moment it makes them.
+ *
+ * It was unreachable while every write was one person tapping one button. It
+ * stopped being unreachable when the relay grew a first-prompt queue that sends
+ * on its own schedule (`firstprompt.ts`), so the queue can now fire while the
+ * phone is mid-send. Cheap insurance either way: these run for seconds, the
+ * caller is already awaiting, and there is never a real queue of them.
+ */
+let uiTail = Promise.resolve();
+function uiTurn(op) {
+    // `.then(op, op)` so a previous failure doesn't skip the next turn.
+    const turn = uiTail.then(op, op);
+    uiTail = turn.catch(() => undefined);
+    return turn;
+}
 /**
  * The sidecar IPC path — the precise, per-session write. Delivers straight to
  * `sessionId` over Conductor's own dispatch socket (see sidecar.ts), so it needs
@@ -889,10 +912,10 @@ end tell
         const tmp = path.join(os.tmpdir(), `relay-prompt-${process.pid}-${Date.now()}.txt`);
         await fs.writeFile(tmp, text, 'utf8');
         try {
-            await exec('osascript', ['-e', script], {
+            await uiTurn(() => exec('osascript', ['-e', script], {
                 env: { ...process.env, RELAY_PROMPT_FILE: tmp, ...targetEnv(target) },
                 timeout: 20000
-            });
+            }));
             return { ok: true, strategy: this.name };
         }
         catch (err) {
@@ -936,7 +959,7 @@ my selectChatTab()
 my applyAgentOptions()
 return "ok"`.trim();
     try {
-        await exec('osascript', ['-e', script], {
+        await uiTurn(() => exec('osascript', ['-e', script], {
             env: {
                 ...process.env,
                 ...targetEnv(target),
@@ -946,7 +969,7 @@ return "ok"`.trim();
                 RELAY_SET_MODEL: opts.model ?? ''
             },
             timeout: 25000
-        });
+        }));
         return { ok: true, strategy: 'applescript' };
     }
     catch (err) {
@@ -963,10 +986,10 @@ my focusWorkspace()
 my selectChatTab()
 return my listModels()`.trim();
     try {
-        const { stdout } = await exec('osascript', ['-e', script], {
+        const { stdout } = await uiTurn(() => exec('osascript', ['-e', script], {
             env: { ...process.env, ...targetEnv(target) },
             timeout: 25000
-        });
+        }));
         const models = stdout
             .split('\n')
             .map(s => s.trim())
@@ -1011,7 +1034,9 @@ export async function createWorkspace(prompt, repoPath) {
         .filter(Boolean)
         .join('&');
     try {
-        await exec('open', [`conductor://${query}`], { timeout: 15000 });
+        // Serialized with the AX writes: creating a workspace pulls Conductor forward and
+        // switches which one is showing, which is precisely what a concurrent send assumes.
+        await uiTurn(() => exec('open', [`conductor://${query}`], { timeout: 15000 }));
         return { ok: true, strategy: 'deeplink' };
     }
     catch (err) {
@@ -1035,10 +1060,10 @@ tell application "System Events"
 	keystroke "t" using {command down}
 end tell`.trim();
     try {
-        await exec('osascript', ['-e', script], {
+        await uiTurn(() => exec('osascript', ['-e', script], {
             env: { ...process.env, ...targetEnv({ workspace, sessionId: null }) },
             timeout: 15000
-        });
+        }));
         return { ok: true, strategy: 'applescript' };
     }
     catch (err) {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
 	"name": "conductor-remote",
-	"version": "1.30.2",
+	"version": "1.30.3",
 	"type": "module",
 	"packageManager": "yarn@4.15.0",
 	"description": "Phone control panel for local Conductor agents. Reads ride SQLite + git; prompts ride Conductor's own dispatch path.",