create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/raw-codex-history-window.js

@@ -23,6 +23,7 @@ const MAX_CURSOR_BYTES = 16 * 1024;
 // A request keeps consuming blocks until it holds maxRows rows or has read maxBytes; this bounds
 // the work when many consecutive blocks hold only hidden record kinds.
 const MAX_FILL_BLOCKS = 16;
+const MAX_EMPTY_RUN_BLOCKS = 256; // D-1: while no row is collected a fill keeps consuming up to 256 × BLOCK_BYTES = 8 MiB of hidden records before answering an empty page
 // leadPrompt: when no loaded unit before the page holds a prompt, scan this many EARLIER blocks (2 MiB) for one.
 const LEAD_SCAN_MAX_BLOCKS = 64;
 // Per-process LRU of scan answers. A page inside one long turn would otherwise re-scan the same blocks on every
@@ -323,7 +324,7 @@ function getRawCodexHistoryWindow(sources, options = {}, fileOps = transcriptSou
   // maxBytes budgets the source bytes CONSUMED (the logical blocks); readRawHistoryBlock also reads a
   // block of look-around each side to resolve record ownership, so counting raw reads would stop at ~3 blocks.
   const consumedBytes = () => segments.reduce((sum, one) => sum + (one.block.end - one.block.start), 0);
-  while (all.length < maxRows && !(all.length && consumedBytes() >= maxBytes) && segments.length < MAX_FILL_BLOCKS) {
+  while (all.length < maxRows && !(all.length && consumedBytes() >= maxBytes) && segments.length < (all.length ? MAX_FILL_BLOCKS : MAX_EMPTY_RUN_BLOCKS)) {
     const at = forward ? nextBlockOf(seg, all.at(-1)) : prevBlockOf(seg);
     if (!at) break;
     seg = loadBlock(at.x, at.b);
@@ -466,7 +467,8 @@ function getRawCodexHistoryWindow(sources, options = {}, fileOps = transcriptSou
   // A block with only non-display records must still advance rather than claim an edge.
   if (!items.length && all.length) return base('retryable-error', generation, 'response-budget-too-small');
   if (!items.length) {
-    // Every block consumed was hidden-only: hand back cursors just past the oldest/newest one read.
+    // Every block consumed (up to MAX_EMPTY_RUN_BLOCKS while no row was collected) was hidden-only: hand back
+    // cursors just past the oldest/newest one read, so the next request resumes after the hidden run it walked.
     const oldest = forward ? segments[0] : segments.at(-1); const newest = forward ? segments.at(-1) : segments[0];
     const older = prevBlockOf(oldest); const newer = nextBlockOf(newest, null);
     response.olderCursor = cursorAt(older && { ...older, u: Number.MAX_SAFE_INTEGER, f: Number.MAX_SAFE_INTEGER });
@@ -484,4 +486,4 @@ function getRawCodexHistoryWindow(sources, options = {}, fileOps = transcriptSou
   return response;
 }
 
-module.exports = { FAMILY, BLOCK_BYTES, encodeRawCodexHistoryCursor, decodeRawCodexHistoryCursor, isRawCodexHistoryCursor, getRawCodexHistoryWindow, historyRowKindOfRole };
+module.exports = { FAMILY, BLOCK_BYTES, MAX_EMPTY_RUN_BLOCKS, encodeRawCodexHistoryCursor, decodeRawCodexHistoryCursor, isRawCodexHistoryCursor, getRawCodexHistoryWindow, historyRowKindOfRole };

package/template/coding-task-manager/lib/raw-history-block.js

@@ -412,8 +412,10 @@ function unitKind(unit) {
 function renderUnit(unit, render, lane = 'legacy') {
   const message = { role: unit.role, text: inertText(unit.text), timestamp: unit.timestamp,
     ...(unit.metadata ? { metadata: inertText(unit.metadata) } : {}) };
+  // D-4: the rollout's own session cwd reaches BOTH lanes — a legacy-lane local file link draws the
+  // same cwd-relative target Codex's screen draws; `shape`/`tzOffsetMinutes` stay items-only.
   const out = renderCodexHistoryAnsi([message], { cols: render.cols, cliVersion: render.cliVersion || '', fidelity: true,
-    ...(lane === 'items' ? { shape: 'owned', cwd: render.cwd, tzOffsetMinutes: render.tzOffsetMinutes } : {}) });
+    cwd: render.cwd, ...(lane === 'items' ? { shape: 'owned', tzOffsetMinutes: render.tzOffsetMinutes } : {}) });
   if (out.fallbackCount > 0) return null;
   const lines = out.ansi.split('\r\n').map(line => line.replace(RENDERED_ROW_RE, (match, sgr) => (sgr ? match : '�')));
   while (lines.length && lines.at(-1) === '') lines.pop();

package/template/coding-task-manager/lib/read-pool-client.js

@@ -165,6 +165,7 @@ const {
   _cloneHistogram,
   buildRefusalSnapshot,
   formatRefusalLogLine,
+  oldestOccupied,
 } = require('./read-pool-telemetry');
 
 // One timeout code for every client-leg expiry (pool-side and worker-side expiry already carry it): retry, not blame.
@@ -1104,8 +1105,11 @@ class CtmReadPoolClient {
       const timer = setTimeout(resolve, 500);
       timer.unref?.();
     });
-    const results = await Promise.all(this._workers.map(worker => worker.requestReadonlyRecycle(reason)));
-    return { requested: this._workers.length, recycled: results.filter(Boolean).length };
+    // Only a slot with an isolate can hold a read connection; a retired / never-started slot is
+    // already in a reader gap (sqlite.org/wal.html "reader gaps").
+    const live = this._workers.filter((worker) => worker.isLive);
+    const results = await Promise.all(live.map((worker) => worker.requestReadonlyRecycle(reason)));
+    return { requested: live.length, recycled: results.filter(Boolean).length, skippedNoIsolate: this._workers.length - live.length };
   }
 
   // `idleMs` (WP-4): when set, only workers idle (no completed op) at least this long
@@ -1274,28 +1278,36 @@ class CtmReadPoolClient {
         .filter((waiter) => waiter.active)
         .map((waiter) => Date.now() - waiter.enqueuedAt)),
       resourceLimits: { ...this.resourceLimits },
-      workers: this._workers.map((w) => ({
-        ready: w.ready,
-        retiring: w.retiring,
-        closing: w.closing,
-        idleMs: Date.now() - w.lastActiveAt,
-        retired: w.retired,
-        retiredAt: w.retiredAt,
-        inFlight: w.inFlight,
-        heavyInFlight: w.heavyInFlight,
-        responseCount: w.responseCount,
-        responseBytes: w.responseBytes,
-        peakResponseBytes: w.peakResponseBytes,
-        inputCount: w.inputCount,
-        inputBytes: w.inputBytes,
-        peakInputBytes: w.peakInputBytes,
-        memory: { ...w.memory },
-        heapStatistics: w.heapStatistics,
-        openConnections: w.openConnections,
-        connection: w.connection,
-        currentOpBytes: w.currentOpBytes,
-        errors: { ...w.errors },
-      })),
+      workers: this._workers.map((w) => {
+        // WP-A P-2 (freeze-probes): what this worker is running RIGHT NOW, so a memory step can be
+        // read against the work in flight. Same "oldest occupied" helper buildRefusalSnapshot uses.
+        const current = oldestOccupied(w.occupied);
+        return {
+          currentOp: current ? current.op : null,
+          currentOpAgeMs: current ? Date.now() - current.startedAt : 0,
+          occupiedCount: w.occupied.size,
+          ready: w.ready,
+          retiring: w.retiring,
+          closing: w.closing,
+          idleMs: Date.now() - w.lastActiveAt,
+          retired: w.retired,
+          retiredAt: w.retiredAt,
+          inFlight: w.inFlight,
+          heavyInFlight: w.heavyInFlight,
+          responseCount: w.responseCount,
+          responseBytes: w.responseBytes,
+          peakResponseBytes: w.peakResponseBytes,
+          inputCount: w.inputCount,
+          inputBytes: w.inputBytes,
+          peakInputBytes: w.peakInputBytes,
+          memory: { ...w.memory },
+          heapStatistics: w.heapStatistics,
+          openConnections: w.openConnections,
+          connection: w.connection,
+          currentOpBytes: w.currentOpBytes,
+          errors: { ...w.errors },
+        };
+      }),
       inFlight: this._workers.reduce((s, w) => s + w.inFlight, 0),
       responseCount: this._workers.reduce((s, w) => s + w.responseCount, 0),
       responseBytes: this._workers.reduce((s, w) => s + w.responseBytes, 0),

package/template/coding-task-manager/lib/read-pool-op-registry.js

@@ -140,8 +140,10 @@ const READ_POOL_OP_DECLARATIONS = {
     maxInputBytes: 8 * 1024,
     maxOutputBytes: REMOTE_COMMAND_RECEIPT_WIRE_MAX_BYTES + 16 * 1024,
   },
+  // Accepted prompt delivery needs this bounded row read in reserved interactive capacity.
+  // Background scans must not hold delivery behind service admission.
   getAcceptedRootJobText: {
-    class: 'service', expectedMs: 1000, maxRows: 1,
+    class: 'interactive', expectedMs: 1000, maxRows: 1,
     maxInputBytes: 8 * 1024, maxOutputBytes: 16 * 1024, resumable: false,
   },
   hasLegacyRemoteCommandPresence: {
@@ -372,6 +374,13 @@ const READ_POOL_OP_DECLARATIONS = {
   startupTasksScan: {
     class: 'service', expectedMs: 250, maxRows: 200, maxOutputBytes: 512 * 1024,
   },
+  // WP-6 (session-name-agent-title-precedence §§6/8): the one-shot agent-title backfill's read
+  // half — up to 20 candidate rows plus a ≤64 KiB positional tail read per row. Background
+  // maintenance (service class, not user-visible): it is dispatched by the boot job, never by a
+  // keystroke, and 20 rows × a 64 KiB window is the whole budget of one task.
+  backfillAgentTitles: {
+    class: 'service', expectedMs: 5000, maxRows: 20, maxOutputBytes: 2 * 1024 * 1024,
+  },
   drain: { class: 'interactive', expectedMs: 25 },
   // WP-5 (composer-typing-freeze doc §13): the 15s walle-permission-reconcile tick's
   // two plain reads (approval_decisions forwarding rows + non-terminal pty:

package/template/coding-task-manager/lib/read-pool-telemetry.js

@@ -32,6 +32,17 @@ function countGhosts(occupied) {
   return count;
 }
 
+// The worker's oldest occupied entry (insertion-order tie-break, matching the refusal snapshot's own
+// loop), or null. Shared by buildRefusalSnapshot and ReadPoolClient.getStatus()'s per-worker rows
+// (freeze-probes WP-A P-2) so "what is this worker running right now" has ONE implementation.
+function oldestOccupied(occupied) {
+  let oldest = null;
+  for (const entry of occupied.values()) {
+    if (!oldest || entry.startedAt < oldest.startedAt) oldest = entry;
+  }
+  return oldest;
+}
+
 // A ghost's deadline span: the caller's full timeout (fallbackSpanMs when it had none).
 function ghostSpanMs(entry, fallbackSpanMs) {
   return entry.deadline > 0 && entry.enqueuedAt > 0 ? entry.deadline - entry.enqueuedAt : fallbackSpanMs;
@@ -50,11 +61,8 @@ function findOverdueGhost(occupied, now, fallbackSpanMs, multiple = 2, floorMs =
 function buildRefusalSnapshot({ now, op, requestClass, reason, workers, liveSize, waitersByClass, running, lastEmptyAtInteractive }) {
   let ghosts = 0;
   const perWorker = workers.map((w) => {
-    let oldest = null;
-    for (const occupied of w.occupied.values()) {
-      if (occupied.orphanedAt) ghosts += 1;
-      if (!oldest || occupied.startedAt < oldest.startedAt) oldest = occupied;
-    }
+    ghosts += countGhosts(w.occupied);
+    const oldest = oldestOccupied(w.occupied);
     return {
       index: w.index,
       ready: w.ready,
@@ -112,6 +120,7 @@ module.exports = {
   buildRefusalSnapshot,
   formatRefusalLogLine,
   countGhosts,
+  oldestOccupied,
   findOverdueGhost,
   ghostSpanMs,
 };

package/template/coding-task-manager/lib/recent-catalog-query.js

@@ -110,6 +110,29 @@ function mapAgent(agent, parentRow) {
   };
 }
 
+/**
+ * WP-3 (remote-hub-followups D-10): the machine tag for a recent row — the row's EXECUTION host
+ * (falling back to its current owner) when that id names a REGISTERED machine and is not this host
+ * or its lineage (`machineTags.localIds`). `machineHealth` is deliberately not stamped on recents:
+ * they are history (D-10).
+ *
+ * `machineTags` is main's cheap registry snapshot (`{machines, localIds}`), passed through the
+ * read-pool op input. With NO machines the result is null, so the row gains no key at all and the
+ * response stays byte-identical to the pre-WP-3 projection (AC-3a).
+ */
+function machineFactsForRecentRow(row, options = {}) {
+  const tags = options && options.machineTags;
+  const machines = Array.isArray(tags?.machines) ? tags.machines : null;
+  if (!machines || machines.length === 0) return null;
+  const id = String(row?.execution_host_instance_id || row?.current_owner_instance_id || '').trim();
+  if (!id) return null;
+  const localIds = Array.isArray(tags.localIds) ? tags.localIds : [];
+  if (localIds.includes(id)) return null;
+  const machine = machines.find((candidate) => candidate && String(candidate.instanceId || '') === id);
+  if (!machine) return null;
+  return { machine: id, machineName: String(machine.displayName || '') };
+}
+
 function mapRecentSessionRow(row, options = {}) {
   const hostname = String(options.hostname || '');
   const agentSessions = (Array.isArray(row?.agent_sessions) ? row.agent_sessions : [])
@@ -179,6 +202,8 @@ function mapRecentSessionRow(row, options = {}) {
     parentAgentSessionId: row.parent_agent_session_id || primary?.parentAgentSessionId || '',
     agentNickname: row.agent_nickname || primary?.agentNickname || '',
     agentRole: row.agent_role || primary?.agentRole || '',
+    // WP-3 (D-10): the machine tag, only when this row's execution host is a registered box.
+    ...(machineFactsForRecentRow(row, options) || {}),
   };
   return sessionEmpty.applyRecentSessionEmptyState(session, row);
 }
@@ -228,6 +253,7 @@ function queryRecentCatalogSessions(db, options = {}) {
 module.exports = {
   isProviderChildAgentRow,
   isProviderChildSessionRow,
+  machineFactsForRecentRow,
   mapRecentSessionRow,
   mapRecentSessionRows,
   mapRecentSessionRowsCooperatively,

package/template/coding-task-manager/lib/recent-session-catalog-response.js

@@ -16,6 +16,9 @@ const RECENT_SESSION_FIELDS = Object.freeze([
   'jsonlPath', 'sourcePath', 'desktopCacheOnly', 'provisionalId', 'agentSessionId',
   'agentSessionIds', 'threadSource', 'parentAgentSessionId', 'parentThreadId',
   'agentNickname', 'agentRole',
+  // WP-3 (remote-hub-followups S-13/D-10): the box tag must survive the persisted cold-boot
+  // snapshot, or a warm restart would strip it and a box row would render as local.
+  'machine', 'machineName',
 ]);
 const RECENT_AGENT_FIELDS = Object.freeze([
   'agentSessionId', 'providerResumeId', 'ctmSessionId', 'provider', 'agent',
@@ -83,6 +86,12 @@ function activityMs(session) {
   return Number.isFinite(parsed) ? parsed : 0;
 }
 
+// S-5 (remote-machine-hub-sessions-2026-10-22.html §9): this function OVERWRITES every row's
+// `hostname` with THIS host's hostname. That is display metadata for a local (pre-multi-machine)
+// catalog and it stays that way — but it means a row's `hostname` says NOTHING about where the
+// session lives. Machine labeling MUST therefore use the machine's minted instance id
+// (`machine`/`machineName`, filled by lib/remote-machine-catalog.js) and NEVER a hostname: any
+// hostname-based label would silently claim a box's session is on this host (D-3).
 function buildRecentSessionCatalogResponse(input = {}) {
   const shape = normalizeRecentCatalogShape(input.query);
   const hostname = String(input.hostname || '');

package/template/coding-task-manager/lib/remote-command-context.js

@@ -2,6 +2,7 @@
 
 const crypto = require('crypto');
 const { getResolvedEnvCredentialIdentity } = require('./auth-context');
+const { hasPeerControlScope } = require('./auth-rules');
 const { isVerifiedOwner } = require('./owner-policy');
 
 function isValidIdentity(value) {
@@ -38,6 +39,17 @@ function deriveRemoteCommandNamespace(auth, actualInstanceId) {
     if (!digest || !/^[a-f0-9]{64}$/.test(digest)) return null;
     principalTuple = ['env', digest];
     principalKind = 'env';
+  } else if (auth.source === 'sync-peer-token' && hasPeerControlScope(auth)) {
+    // WP-3b (docs/remote-machine-hub-sessions-2026-10-22.html §6.2/D-7): a relayed root prompt
+    // arrives on the sync peer bearer, which is the only credential carrying the peer-control
+    // scope (lib/auth-rules.js). The peer's own identity is its `X-CTM-Sync-Peer` id
+    // (`peerInstanceId`); when the single-token form names no peer, the token's log hash is the
+    // only distinguishing label. Neither → no principal, no namespace.
+    const peerInstanceId = typeof auth.peerInstanceId === 'string' ? auth.peerInstanceId : '';
+    const tokenHint = typeof auth.tokenHashPrefix === 'string' ? auth.tokenHashPrefix : '';
+    if (!peerInstanceId && !tokenHint) return null;
+    principalTuple = ['peer', peerInstanceId || `token:${tokenHint}`];
+    principalKind = 'peer';
   } else if (auth.source === 'loopback' && auth.isLoopback === true) {
     principalTuple = ['local', 'loopback'];
     principalKind = 'local';

package/template/coding-task-manager/lib/remote-command-runtime.js

@@ -1,10 +1,11 @@
 'use strict';
 
 const crypto = require('crypto');
+const promptAdmissionTrace = require('./prompt-admission-trace');
 const { AsyncLocalStorage } = require('node:async_hooks');
 const remoteRelayProtocol = require('./remote-relay-protocol');
 const { createRemoteCommandCoordinator, projectIdentity } = require('./remote-command-coordinator');
-const { authorize: authorizeByRule, getHttpAuthRule, getWsAuthRule } = require('./auth-rules');
+const { authorize: authorizeByRule, getHttpAuthRule, getWsAuthRule, hasPeerControlScope } = require('./auth-rules');
 const { deriveRemoteCommandNamespace } = require('./remote-command-context');
 const { getDeviceCredentialProof } = require('./ws-device-credential-proof');
 const instanceIdentityAccess = require('./instance-identity-access');
@@ -82,12 +83,12 @@ function createRemoteCommandRuntime({
       reserve: (entry) => {
         const at = now();
         scopeForCoordinator(db);
-        return relayStore.reserveRemoteCommand(db, entry, at);
+        return promptAdmissionTrace.time('receipt.reserve', () => relayStore.reserveRemoteCommand(db, entry, at));
       },
       complete: (entry, result) => {
         const at = now();
         scopeForCoordinator(db);
-        return relayStore.completeRemoteCommand(db, entry, result, at);
+        return promptAdmissionTrace.time('receipt.complete', () => relayStore.completeRemoteCommand(db, entry, result, at));
       },
       markUnknown: (entry, reason) => {
         const at = now();
@@ -96,9 +97,9 @@ function createRemoteCommandRuntime({
       },
       lookupLegacyPresence: async (commandId) => {
         const scope = scopeForCoordinator(db);
-        const found = await runReadPoolOp('hasLegacyRemoteCommandPresence', {
+        const found = await promptAdmissionTrace.time('legacy.presence', () => runReadPoolOp('hasLegacyRemoteCommandPresence', {
           dbPath: scope.dbPath, commandId,
-        }, { telemetryReason: 'remote-command-legacy-presence' });
+        }, { telemetryReason: 'remote-command-legacy-presence' }));
         if (!scope.isCurrent()) throw new Error('remote command database lifetime unavailable');
         return found;
       },
@@ -334,6 +335,18 @@ function createRemoteCommandRuntime({
           || auth.source !== 'env-scoped-token' || auth.transport !== 'remote') return deny();
       const decision = authorizeByRule(auth, getWsAuthRule('submit-prompt'), { enforceStepUp: true });
       if (!decision.ok) return deny(decision.code, decision.status);
+    } else if (auth.source === 'sync-peer-token' && auth.authenticated === true && hasPeerControlScope(auth)) {
+      // WP-3b (docs/remote-machine-hub-sessions-2026-10-22.html §6.2/D-7, AC-3a): the hub relays a
+      // box-owned session's `submit-prompt` over the sync peer bearer (auth source
+      // `sync-peer-token`, scopes {'sync','peer-control'}; lib/auth-context.js resolveSyncPeerToken).
+      // The peer credential is env-configured (CTM_SYNC_PEER_TOKEN / CTM_SYNC_PEER_TOKENS) with no
+      // revocation store to re-read, so freshness is exactly the shared `guard()` — this socket is
+      // still open, `client.auth` is still this same object, and the instance id is unchanged.
+      // Peer-control rows short-circuit step-up by design (authorize(), lib/auth-rules.js), so this
+      // mirrors the env/loopback branches: authorize with step-up ENFORCED and let the flag decide.
+      if (!guard()) return deny();
+      const decision = authorizeByRule(auth, getWsAuthRule('submit-prompt'), { enforceStepUp: true });
+      if (!decision.ok) return deny(decision.code, decision.status);
     } else if (auth.authenticated === true && auth.source === 'loopback' && auth.isLoopback === true) {
       let isLocal = false;
       try { isLocal = typeof validateLoopbackSocket === 'function' && validateLoopbackSocket(client) === true; }