conductor-remote 1.32.0 → 1.33.0

package/dist-node/src/writes.js

@@ -25,6 +25,55 @@ function uiTurn(op) {
     uiTail = turn.catch(() => undefined);
     return turn;
 }
+/**
+ * How long one AppleScript run may take before it's killed.
+ *
+ * Sized from measurement, not taste. A send that *worked* measured 23.6s end to
+ * end on a 30-workspace sidebar — past the 20s ceiling this replaces, which is why
+ * ordinary sends were being killed mid-run and reported as "Conductor took too long
+ * to respond". The cost is Accessibility round trips, not waiting: activating a
+ * backgrounded Conductor and reading the pane cost ~10s cold, and finding the
+ * sidebar row to press another ~10s (see `atTargetWorkspace`, which is why a warm
+ * send is now ~2s). A ceiling costs nothing when a send is fast — only a doomed one
+ * waits it out, and the caller's own deadline is what bounds that.
+ */
+export const SEND_ATTEMPT_MS = 28_000;
+/**
+ * A run's own ceiling, taken off the caller's deadline at the moment it actually
+ * starts.
+ *
+ * Both halves matter. `uiTurn` above means a run can sit in the queue behind
+ * another write, so a duration computed when it was *requested* would let a queued
+ * run overshoot a deadline the caller is still holding a phone open on.
+ * `SEND_ATTEMPT_MS` then caps it, because a caller with a minute of budget still
+ * shouldn't spend all of it on one doomed run when a retry is the thing that works.
+ * The floor keeps a squeezed run honest instead of passing `timeout: 0`, which node
+ * reads as "no timeout at all".
+ */
+function runCeiling(deadline) {
+    return Math.max(5_000, Math.min(SEND_ATTEMPT_MS, deadline - Date.now()));
+}
+/**
+ * Failures no amount of retrying will fix, so a caller that retries can stop at
+ * once instead of spending a whole budget to arrive at the same sentence.
+ *
+ * Matched on phrases this file writes itself — the first two from `refusalReason`,
+ * the rest from the target checks below — never on macOS's own wording, which we
+ * quote verbatim precisely because it drifts. The refusals are the ones a node
+ * upgrade causes by silently revoking Accessibility: they fail instantly and
+ * identically every time, so making the phone sit through a whole retry budget to
+ * be told a permission is missing is worse than being told at once. The rest are
+ * malformed targets — no session, no branch — which no attempt can turn into one.
+ */
+const TERMINAL_ERRORS = [
+    'not trusted for Accessibility',
+    'blocked the relay from controlling the UI',
+    'no session id to target',
+    'workspace has no branch to focus'
+];
+export function retryWontHelp(error) {
+    return error !== undefined && TERMINAL_ERRORS.some(phrase => error.includes(phrase));
+}
 /**
  * The sidecar IPC path — the precise, per-session write. Delivers straight to
  * `sessionId` over Conductor's own dispatch socket (see sidecar.ts), so it needs
@@ -42,7 +91,8 @@ export class SidecarActuator {
     available() {
         return sidecarAvailable();
     }
-    async send(target, text) {
+    /** `deadline` is ignored — the sidecar is one socket write, with no UI to wait on. */
+    async send(target, text, _deadline) {
         const sessionId = target.sessionId ?? target.workspace.active_session_id;
         if (!sessionId)
             return { ok: false, strategy: this.name, error: 'no session id to target' };
@@ -333,34 +383,39 @@ on sidebarLinks()
 	end tell
 end sidebarLinks
 
-on focusViaSidebar()
-	-- Press the workspace's sidebar row: no keystrokes at all, so nothing can be
-	-- swallowed by a focused field or fire a palette *command*. Only rows that are
-	-- actually rendered exist in the AX tree (a collapsed section has none), and
-	-- the title precedence is Conductor's, so we try each candidate and require a
-	-- unique hit — anything ambiguous falls back to the palette. Being wrong is
-	-- survivable here: assertWorkspace re-checks before we type.
+on findSidebarRow()
+	-- The workspace's own sidebar row. Only rows that are actually rendered exist
+	-- in the AX tree (a collapsed section has none), and the title follows
+	-- Conductor's precedence, so we try each candidate and require a *unique* hit —
+	-- anything ambiguous returns nothing rather than guessing at a neighbour.
 	set titles to my splitLines(system attribute "RELAY_WS_TITLES")
-	if (count of titles) is 0 then return false
+	if (count of titles) is 0 then return missing value
 	set repoName to system attribute "RELAY_WS_REPO"
 	set rows to my sidebarLinks()
-	set hit to missing value
 	repeat with candidate in titles
 		if (candidate as text) is not "" then
 			set matches to {}
 			repeat with entry in rows
 				set row to contents of entry
-				set rowName to my tabLabel(row)
+				-- Guarded read: the sidebar re-renders constantly (every commit
+				-- changes a row's "+adds -dels"), and one row that goes stale
+				-- mid-scan must not take the whole search down with it.
+				set rowName to my axName(row)
 				if rowName contains (candidate as text) then
 					if repoName is "" or rowName contains repoName then set end of matches to row
 				end if
 			end repeat
-			if (count of matches) is 1 then
-				set hit to item 1 of matches
-				exit repeat
-			end if
+			if (count of matches) is 1 then return item 1 of matches
 		end if
 	end repeat
+	return missing value
+end findSidebarRow
+
+on focusViaSidebar()
+	-- Press that row: no keystrokes at all, so nothing can be swallowed by a
+	-- focused field or fire a palette *command*. Being wrong is survivable here —
+	-- assertWorkspace re-checks before we type — and a miss falls back to the palette.
+	set hit to my findSidebarRow()
 	if hit is missing value then return false
 	tell application "System Events" to tell process "Conductor"
 		perform action "AXPress" of hit
@@ -382,16 +437,35 @@ on focusViaPalette()
 	end tell
 end focusViaPalette
 
+on paneAgrees()
+	-- Nothing in the open pane contradicts the target: a chat pane is there and its
+	-- header assertion passed (which is a no-op when there's no branch to check it
+	-- against). This is what confirms a sidebar press landed.
+	try
+		set strips to my tabGroups()
+		if (count of strips) is 0 then return false
+		my assertWorkspace(item 1 of strips)
+		return true
+	end try
+	return false
+end paneAgrees
+
+on atTargetWorkspace()
+	-- "Are we already there?" — the *strict* form of the question, so it needs a
+	-- branch to have been checked and not merely skipped. Worth asking first because
+	-- the pane header answers in ~0.5s where reading the sidebar's rows to press one
+	-- measured 5-7s, the single largest cost in a send: a phone sends to the same
+	-- workspace over and over, and Conductor stays where it was left. Safe as a
+	-- shortcut because it *is* the assertion the send makes before typing anyway.
+	if (system attribute "RELAY_WS_BRANCH") is "" then return false
+	return my paneAgrees()
+end atTargetWorkspace
+
 on focusWorkspace()
 	if (system attribute "RELAY_WS_QUERY") is "" then return
+	if my atTargetWorkspace() then return
 	if my focusViaSidebar() then
-		try
-			set strips to my tabGroups()
-			if (count of strips) > 0 then
-				my assertWorkspace(item 1 of strips)
-				return
-			end if
-		end try
+		if my paneAgrees() then return
 	end if
 	my focusViaPalette()
 end focusWorkspace
@@ -799,7 +873,164 @@ on applyAgentOptions()
 	if wantEffort is not "" then my setEffort(wantEffort)
 	if wantPlan is not "" then my setPlan(wantPlan)
 	if wantFast is "1" then my pressFast()
-end applyAgentOptions`;
+end applyAgentOptions
+
+on axRole(el)
+	tell application "System Events" to tell process "Conductor"
+		try
+			return role of el
+		on error
+			return ""
+		end try
+	end tell
+end axRole
+
+on axKids(el)
+	tell application "System Events" to tell process "Conductor"
+		try
+			return UI elements of el
+		on error
+			return {}
+		end try
+	end tell
+end axKids
+
+on menusUnder(root, maxDepth)
+	-- Every AXMenu at or below root, breadth-first and bounded. The status
+	-- submenu opens *nested inside* the row menu rather than beside it, so a
+	-- search that stops at the first hit (the way setModel scans the web area's
+	-- direct children) never sees it.
+	set level to {root}
+	set found to {}
+	set depth to 0
+	repeat while (count of level) > 0 and depth < maxDepth
+		set nextLevel to {}
+		repeat with entry in level
+			set node to contents of entry
+			if (my axRole(node)) is "AXMenu" then set end of found to node
+			set nextLevel to nextLevel & (my axKids(node))
+		end repeat
+		set level to nextLevel
+		set depth to depth + 1
+	end repeat
+	return found
+end menusUnder
+
+on axName(el)
+	-- Guarded: a menu re-renders under us, and reading the name of an element that
+	-- has since gone throws an object-specifier error from wherever we happened to be.
+	tell application "System Events" to tell process "Conductor"
+		try
+			set n to name of el
+			if n is missing value then return ""
+			return n as text
+		on error
+			return ""
+		end try
+	end tell
+end axName
+
+on menuItemNamed(m, wanted)
+	repeat with mi in (my axKids(m))
+		set node to contents of mi
+		if (my axRole(node)) is "AXMenuItem" and (my axName(node)) is wanted then return node
+	end repeat
+	return missing value
+end menuItemNamed
+
+on waitForMenuWith(root, maxDepth, itemName, attempts)
+	-- Identify the menu by an item it *contains*, never as "the first AXMenu on
+	-- screen": a model picker left open, or a menu from the run before, is also an
+	-- AXMenu, and picking it produced "no Set status item" on a menu that had never
+	-- been the workspace's. A menu is drawn by the webview, not by us, so how long
+	-- it takes varies with what Conductor is busy doing — poll rather than guess
+	-- one delay; the common case costs a single sweep.
+	repeat with i from 1 to attempts
+		repeat with entry in my menusUnder(root, maxDepth)
+			set node to contents of entry
+			if (my menuItemNamed(node, itemName)) is not missing value then return node
+		end repeat
+		delay 0.5
+	end repeat
+	return missing value
+end waitForMenuWith
+
+on dismissMenus()
+	-- Two escapes: one for the submenu, one for the row menu. Leaving either open
+	-- would swallow the next run's keystrokes.
+	tell application "System Events"
+		key code 53
+		delay 0.25
+		key code 53
+	end tell
+end dismissMenus
+
+on setWorkspaceStatus()
+	-- Conductor has no menu-bar or palette command for this, so the only lever is
+	-- the sidebar row's own context menu (Mark as unread / Pin / Set status /
+	-- Rename / Copy link / Archive). Right-clicking the row needs no focus change,
+	-- so unlike a send this never disturbs which workspace is on screen.
+	set wanted to system attribute "RELAY_SET_STATUS"
+	if wanted is "" then error "no status requested"
+	set theRow to my findSidebarRow()
+	if theRow is missing value then
+		error "couldn't find this workspace in the sidebar — a collapsed section hides its row from Accessibility"
+	end if
+	-- Scroll it into view first. A row that exists in the AX tree but sits outside
+	-- the sidebar's visible strip accepts AXShowMenu and draws nothing — which is
+	-- exactly what happens right after a status change moves it to another group.
+	tell application "System Events" to tell process "Conductor"
+		try
+			perform action "AXScrollToVisible" of theRow
+		end try
+	end tell
+	delay 0.4
+	-- Clear anything already open (a picker, or a menu a previous run left behind)
+	-- so the sweep below can only match the one this right-click draws.
+	tell application "System Events" to key code 53
+	delay 0.3
+	tell application "System Events" to tell process "Conductor"
+		perform action "AXShowMenu" of theRow
+	end tell
+	-- Depth 4, not the whole tree: the row menu is a portal near the top of the web
+	-- area, and the *transcript* hangs off that same root — a deep sweep walks every
+	-- message bubble and costs more than the rest of this write put together (it
+	-- grows with the conversation, so it degrades as you use the app).
+	set rowMenu to my waitForMenuWith(my webArea(), 4, "Set status", 6)
+	if rowMenu is missing value then
+		my dismissMenus()
+		error "the workspace's menu didn't open — or it no longer offers Set status"
+	end if
+	set statusItem to my menuItemNamed(rowMenu, "Set status")
+	tell application "System Events" to tell process "Conductor"
+		perform action "AXPress" of statusItem
+	end tell
+	-- The submenu is an AXMenu nested a few levels *inside* the row menu (Conductor
+	-- expands it in place rather than opening a sibling), so search from that menu —
+	-- searching the web area again would re-walk the world. Two things make this a
+	-- poll rather than a read: the row-menu handle goes stale across the expansion
+	-- (it reports no children instead of erroring), so it is re-found each pass; and
+	-- the submenu's *items* arrive a beat after the submenu itself, so the thing we
+	-- wait for is the wanted status, not the container that will hold it.
+	set subMenu to missing value
+	repeat with attempt from 1 to 8
+		set liveMenu to my waitForMenuWith(my webArea(), 4, "Set status", 1)
+		if liveMenu is not missing value then
+			set subMenu to my waitForMenuWith(liveMenu, 5, wanted, 1)
+		end if
+		if subMenu is not missing value then exit repeat
+		delay 0.4
+	end repeat
+	if subMenu is missing value then
+		my dismissMenus()
+		error "Conductor never offered a status called " & wanted
+	end if
+	set choice to my menuItemNamed(subMenu, wanted)
+	tell application "System Events" to tell process "Conductor"
+		perform action "AXPress" of choice
+	end tell
+	delay 0.6
+end setWorkspaceStatus`;
 /** Conductor's command palette matches workspaces by branch — its unique key. A
  * looser query (directory name) can match a command like unarchive, so prefer
  * branch and only fall back when it's absent. */
@@ -884,7 +1115,7 @@ export class AppleScriptActuator {
     name = 'applescript';
     caveat = 'Focuses the target workspace (Cmd+K) and its chat tab before sending.';
     precise = true;
-    async send(target, text) {
+    async send(target, text, deadline = Date.now() + SEND_ATTEMPT_MS) {
         // Focus the target workspace, select its chat tab, fill the composer, send.
         // Filling is an Accessibility write (no keystrokes, no clipboard); the
         // clipboard paste is kept only as a fallback, and stashes/restores around it.
@@ -914,7 +1145,7 @@ end tell
         try {
             await uiTurn(() => exec('osascript', ['-e', script], {
                 env: { ...process.env, RELAY_PROMPT_FILE: tmp, ...targetEnv(target) },
-                timeout: 20000
+                timeout: runCeiling(deadline)
             }));
             return { ok: true, strategy: this.name };
         }
@@ -968,6 +1199,55 @@ return "ok"`.trim();
                 RELAY_SET_FAST: opts.toggleFast ? '1' : '',
                 RELAY_SET_MODEL: opts.model ?? ''
             },
+            timeout: SEND_ATTEMPT_MS
+        }));
+        return { ok: true, strategy: 'applescript' };
+    }
+    catch (err) {
+        return { ok: false, strategy: 'applescript', error: osaError(err) };
+    }
+}
+/**
+ * The workspace statuses Conductor's sidebar groups by, mapped from the value it
+ * stores in `workspaces.manual_status` to the label on its own menu. `canceled`
+ * is on the menu but has never been written in this DB, so it's the one spelling
+ * here that is taken from the UI rather than confirmed against stored data — a
+ * mismatch surfaces as a failed confirmation naming what Conductor actually wrote.
+ */
+export const WORKSPACE_STATUS_LABELS = {
+    backlog: 'Backlog',
+    'in-progress': 'In progress',
+    'in-review': 'In review',
+    done: 'Done',
+    canceled: 'Canceled'
+};
+/**
+ * Move a workspace between the sidebar's status groups — the thing a merged PR
+ * that Conductor never linked can't do for itself.
+ *
+ * Unlike every other write here this one never changes what's on screen: it
+ * right-clicks the workspace's *row* (AXShowMenu) and works the menu, so the
+ * workspace you were reading stays open. It does need the row to be rendered,
+ * which a collapsed sidebar section prevents — that case is reported in words
+ * rather than guessed around, because there is no palette command to fall back to.
+ */
+export async function setWorkspaceStatus(workspace, status) {
+    const label = WORKSPACE_STATUS_LABELS[status];
+    if (!label)
+        return { ok: false, strategy: 'applescript', error: `unknown status ${status}` };
+    const script = `
+${SELECT_CHAT_TAB_HANDLERS}
+
+my activateConductor()
+my setWorkspaceStatus()
+return "ok"`.trim();
+    try {
+        await uiTurn(() => exec('osascript', ['-e', script], {
+            env: {
+                ...process.env,
+                ...targetEnv({ workspace, sessionId: null }),
+                RELAY_SET_STATUS: label
+            },
             timeout: 25000
         }));
         return { ok: true, strategy: 'applescript' };
@@ -988,7 +1268,7 @@ return my listModels()`.trim();
     try {
         const { stdout } = await uiTurn(() => exec('osascript', ['-e', script], {
             env: { ...process.env, ...targetEnv(target) },
-            timeout: 25000
+            timeout: SEND_ATTEMPT_MS
         }));
         const models = stdout
             .split('\n')
@@ -1060,9 +1340,11 @@ tell application "System Events"
 	keystroke "t" using {command down}
 end tell`.trim();
     try {
+        // Shares the focus path with a send, so it needs the same ceiling: 15s was under
+        // the cost of activating a cold Conductor and finding the row on its own.
         await uiTurn(() => exec('osascript', ['-e', script], {
             env: { ...process.env, ...targetEnv({ workspace, sessionId: null }) },
-            timeout: 15000
+            timeout: SEND_ATTEMPT_MS
         }));
         return { ok: true, strategy: 'applescript' };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "conductor-remote",
-	"version": "1.32.0",
+	"version": "1.33.0",
 	"type": "module",
 	"packageManager": "yarn@4.15.0",
 	"description": "Phone control panel for local Conductor agents. Reads ride SQLite + git; prompts ride Conductor's own dispatch path.",