conductor-remote 1.41.0 → 1.42.1

package/dist-node/src/shared.js

@@ -0,0 +1,59 @@
+/**
+ * The handful of things the relay and the phone must compute *identically*, in the
+ * one place both can import.
+ *
+ * `src/` and `web/src/` are one TypeScript project (tsconfig.json includes both), so
+ * a plain relative import crosses between them fine. What does not cross is Node: the
+ * moment this file imports `node:anything` it stops being bundleable and every web
+ * import of it becomes a build failure. **So this module stays stdlib-free — no
+ * `node:` imports, ever.** It is the only file under `src/` the web app may import a
+ * *value* from; everything else it may only `import type` (see src/wire.ts), which
+ * `verbatimModuleSyntax` erases before the bundler ever sees it.
+ *
+ * Each of these was a second copy before, and each copy was a way for two screens to
+ * disagree about the same workspace.
+ */
+/**
+ * The branch minus its prefix, sentence-cased — Conductor's own fallback title while a
+ * workspace is still in progress. Prefix-agnostic (github_username / custom / none): it
+ * strips the first path segment rather than reading Conductor's `branch_prefix_type`
+ * setting, because the branch already embeds whichever prefix was resolved.
+ */
+export function humanizeBranch(branch) {
+    const b = branch ?? '';
+    const slug = b.includes('/') ? b.slice(b.indexOf('/') + 1) : b;
+    const words = slug.replace(/[-_]/g, ' ').trim();
+    return words ? words[0].toUpperCase() + words.slice(1) : '';
+}
+/**
+ * Conductor's own sidebar title for a workspace: manual name, then PR title, then the
+ * humanized branch, then the worktree codename, then the id.
+ *
+ * `pr_title` is Conductor's cached PR title, present exactly when the workspace has a PR
+ * (in-review or done) and cleared back to empty otherwise, so it is the live sidebar
+ * title rather than a stale value. `directory_name` (the worktree codename, e.g.
+ * "managua-v2") is the last resort for a branchless workspace.
+ *
+ * Three callers have to agree — the sidebar list on the phone, the workspace a push
+ * notification names (src/notify.ts), and the workspace an MCP tool result names
+ * (src/mcp-tools.ts). A notification that titles a workspace differently from the list
+ * it came from reads as a different workspace.
+ */
+export function workspaceTitle(w) {
+    return w.workspace_name || w.pr_title || humanizeBranch(w.branch) || w.directory_name || w.id.slice(0, 8);
+}
+/**
+ * The words a query actually searches for. The phone filters the live workspace list
+ * with these while the relay searches the transcript index with the same call, so two
+ * different splits would make one list disagree with the other on the same keystroke.
+ */
+export function queryTokens(raw) {
+    return raw.toLowerCase().match(/[\p{L}\p{N}_]+/gu) ?? [];
+}
+/**
+ * Markers the relay wraps search hits in (src/search.ts, via FTS5 `snippet()`). They
+ * are control characters, so they must never reach the DOM: an unsplit snippet renders
+ * as invisible garbage between the words it was meant to emphasise.
+ */
+export const HIT_OPEN = '\u0001';
+export const HIT_CLOSE = '\u0002';

package/dist-node/src/wire.js

@@ -0,0 +1,23 @@
+/**
+ * The HTTP contract: every shape that crosses `/api`, in one place, named once.
+ *
+ * This file holds **no runtime code**. It re-exports the relay's own domain types
+ * under the names the wire uses, and declares the response envelopes the route
+ * handlers assemble. Three callers read it and none of them may disagree:
+ *
+ *   - `src/server.ts` builds these payloads,
+ *   - `web/src/lib/types.ts` re-exports the lot for the PWA,
+ *   - `src/mcp-tools.ts` annotates its relay calls with them.
+ *
+ * Before this, the phone kept a hand-written mirror of all of it and `mcp-tools.ts`
+ * kept a third copy inline. Nothing enforced the copies — a field renamed in
+ * `reads.ts` typechecked cleanly on both sides and surfaced as `undefined` on a
+ * phone. So the rule is: **a shape that leaves the relay is declared here, and
+ * nowhere else.**
+ *
+ * The web app may only `import type` from `src/` (see `scripts/check-imports.ts`).
+ * `verbatimModuleSyntax` erases those imports, so nothing here reaches the bundle —
+ * which is what lets a type live beside the `node:sqlite` code that produces it.
+ * The one exception is `src/shared.ts`, which is stdlib-free on purpose.
+ */
+export {};

package/dist-node/src/writes.js

@@ -1,31 +1,89 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import { execFile } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import { sidecarAvailable, sidecarSendUserMessage } from "./sidecar.js";
 const exec = promisify(execFile);
+/** Waiting runs past this are refused rather than queued. */
+const MAX_UI_QUEUE = 4;
+const uiPriorityScope = new AsyncLocalStorage();
+/** Run `fn` with every UI operation it triggers marked at `priority`. */
+export function withUiPriority(priority, fn) {
+    return uiPriorityScope.run(priority, fn);
+}
+export class UiBusyError extends Error {
+    waiting;
+    constructor(waiting) {
+        super(`Conductor's UI is busy — ${waiting} operation${waiting === 1 ? '' : 's'} already queued. Try again shortly.`);
+        this.name = 'UiBusyError';
+        this.waiting = waiting;
+    }
+}
+let uiRunning = false;
+let uiSeq = 0;
+const uiWaiting = [];
+/** What the UI lock is doing right now — `waiting` excludes the run in flight. */
+export function uiQueueDepth() {
+    return { waiting: uiWaiting.length, busy: uiRunning };
+}
+function pumpUi() {
+    if (uiRunning)
+        return;
+    const next = uiWaiting.shift();
+    if (!next)
+        return;
+    uiRunning = true;
+    next.start();
+}
 /**
- * One UI operation at a time.
- *
- * Every script below drives Conductor's *shared, single* window — focus a
- * workspace, select a tab, write the composer — so two of them overlapping
- * interleaves their steps and lands a prompt in whatever the other one focused.
- * That is the exact failure the whole fail-closed AX design exists to prevent,
- * and no amount of per-step assertion catches it, because each script's reads
- * are true at the moment it makes them.
- *
- * It was unreachable while every write was one person tapping one button. It
- * stopped being unreachable when the relay grew a first-prompt queue that sends
- * on its own schedule (`firstprompt.ts`), so the queue can now fire while the
- * phone is mid-send. Cheap insurance either way: these run for seconds, the
- * caller is already awaiting, and there is never a real queue of them.
+ * Take the lock, run `op`, release it. Exported for `scripts/check-uilock.ts`,
+ * which is the only way this queue's control flow gets read by anything.
  */
-let uiTail = Promise.resolve();
-function uiTurn(op) {
-    // `.then(op, op)` so a previous failure doesn't skip the next turn.
-    const turn = uiTail.then(op, op);
-    uiTail = turn.catch(() => undefined);
-    return turn;
+export function uiTurn(op) {
+    const rank = uiPriorityScope.getStore() === 'background' ? 1 : 0;
+    if (uiWaiting.length >= MAX_UI_QUEUE)
+        return Promise.reject(new UiBusyError(uiWaiting.length));
+    return new Promise((resolve, reject) => {
+        const waiter = {
+            rank,
+            seq: uiSeq++,
+            start: () => {
+                // A throw *before* the first await is still this run's failure, not a crash
+                // that would leave the lock held forever.
+                let settled;
+                try {
+                    settled = op();
+                }
+                catch (err) {
+                    settled = Promise.reject(err);
+                }
+                // Release *before* resolving the caller, not after. Settling first and cleaning
+                // up in a chained `.then` frees the lock one microtask late, so code that awaits
+                // a write and then reads `uiQueueDepth()` is told a run is still in flight when
+                // none is — and the next turn starts a tick later than it could.
+                const release = () => {
+                    uiRunning = false;
+                    pumpUi();
+                };
+                settled.then(value => {
+                    release();
+                    resolve(value);
+                }, err => {
+                    release();
+                    reject(err);
+                });
+            }
+        };
+        // Stable insert: by rank, FIFO within a rank. A background run already started
+        // keeps the lock — this decides who is next, never who is interrupted.
+        const at = uiWaiting.findIndex(w => w.rank > rank);
+        if (at < 0)
+            uiWaiting.push(waiter);
+        else
+            uiWaiting.splice(at, 0, waiter);
+        pumpUi();
+    });
 }
 /**
  * How long one AppleScript run may take before it's killed.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "conductor-remote",
-	"version": "1.41.0",
+	"version": "1.42.1",
 	"type": "module",
 	"packageManager": "yarn@4.15.0",
 	"description": "Phone control panel for local Conductor agents. Reads ride SQLite + git; prompts ride Conductor's own dispatch path.",
@@ -50,12 +50,14 @@
 		"typecheck": "tsc -p tsconfig.json",
 		"lint": "biome check .",
 		"fix": "biome check . --fix",
-		"verify": "yarn typecheck && yarn lint && yarn check:applescript && yarn check:nosleep",
+		"verify": "yarn typecheck && yarn lint && yarn check:imports && yarn check:applescript && yarn check:nosleep && yarn check:uilock",
 		"release": "semantic-release",
 		"prepack": "yarn build && yarn build:node",
 		"postinstall": "husky || true",
 		"check:applescript": "node scripts/check-applescript.ts",
-		"check:nosleep": "node scripts/check-nosleep.ts"
+		"check:imports": "node scripts/check-imports.ts",
+		"check:nosleep": "node scripts/check-nosleep.ts",
+		"check:uilock": "node scripts/check-uilock.ts"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.3.8",