create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/session-create/prepared.js

@@ -4,6 +4,15 @@
 // the ONE fingerprint definition lives in lib/session-create/identity.js; this module stamps it on a
 // session it fully owned and compares it on the next same-id create.
 const { createFingerprint } = require('./identity');
+// WP-0a (docs/session-create-accept-then-complete-2026-11-01.html §6.1 D-8): the phase clock and the
+// one `[create]` line. Every phase of this measured create is marked HERE — the provider prepare, the
+// PTY spawn and the `created` send are inside the awaited `handleCreate` call and are the last phase
+// (`providerMs`), so nothing else has to read the clock; `createFingerprint` reads only its nine
+// named fields.
+const { createPhaseClock, formatCreateLine } = require('./create-phases');
+// The one-hop `X-CTM-Forwarded-By` accessor (never a second header reader) and the box's own load.
+const { forwardedByOf } = require('../remote-machine-create');
+const os = require('node:os');
 
 // WP-2b (docs/session-model-authority-and-display-2026-10-15.html §9): the COMPLETE prepared-create
 // orchestration, moved verbatim out of server.js's `handleCreatePrepared`. It owns one whole
@@ -41,6 +50,22 @@ const { createFingerprint } = require('./identity');
 // stays the generation runtime's business).
 const _inflightCreates = new Map();
 
+/** WP-0a (§6.1): the hop that FORWARDED this create, or '' for a local browser create. */
+function _forwardedBy(ws) {
+  return String(forwardedByOf({ ws }) || '');
+}
+
+/**
+ * WP-0a (§6.1): write the one `[create]` line to the console the host injected (server.js passes the
+ * process console). A host that hands over a partial console still prints through the real one, and a
+ * console without `log` is skipped rather than thrown from the create's `finally` — telemetry may
+ * never turn a completed create into a rejection.
+ */
+function _logCreateLine(console_, line) {
+  const sink = console_ && typeof console_.log === 'function' ? console_ : globalThis.console;
+  if (sink && typeof sink.log === 'function') sink.log(line);
+}
+
 function createPreparedSessionCreate(host) {
   const {
     // Admission / identity
@@ -81,55 +106,127 @@ function createPreparedSessionCreate(host) {
   // WP-4 (§5 D-13): admission, then the in-flight claim, then the unchanged orchestration. The
   // claim's `finally` wraps the WHOLE body, so every exit of the orchestration releases it -- and no
   // line of the orchestration itself had to move to make that true.
+  //
+  // WP-0a (§6.1 D-8): that same `finally` (now wrapping the ADMISSION too, so a duplicate re-answer,
+  // an in-flight refusal and an unrecognized-profile refusal are covered as well) writes exactly ONE
+  // `[create]` line per create, from the clock this handler owns — every phase, `providerMs` (the
+  // awaited `handleCreate`) included, is marked inside this module. The line is the only new output:
+  // no frame, timer, code path or return value changed.
   async function handleCreatePrepared(ws, msg) {
-    if (host._ownerRecovery.rejectRequest(ws, msg)) return null; const id = msg?.id || crypto.randomUUID();
-    const preparedMsg = { ...(msg || {}), id };
-    // WP-1 (§6.1 S-3): reject an unrecognized mcp_profile rather than silently defaulting -- pure input validation, deliberately AHEAD of the durable generation reservation (a typo'd profile must never depend on, or consume, store availability).
-    const _rawMcpProfile = preparedMsg.mcp_profile ?? preparedMsg.mcpProfile;
-    if (_rawMcpProfile !== undefined && _rawMcpProfile !== null && String(_rawMcpProfile).trim() !== '' && !_sessionMcpProfileSetting(preparedMsg)) {
-      if (ws?.readyState === 1) _wsSend(ws, JSON.stringify({ type: 'error', code: 'mcp_profile_invalid', message: `Unknown mcp_profile: ${JSON.stringify(_rawMcpProfile)}` }));
-      return null;
-    }
-    // WP-4 (§5 D-12/D-13): a client-supplied id is the Idempotency-Key, and both duplicate answers
-    // are decided HERE, before any generation reservation, plan, markSpawning or markLive:
-    //   - the id names a LIVE session spawned by an identical create => re-answer ONE `created`
-    //     frame (same builder a fresh create uses) and return it; nothing is attached or rolled back;
-    //   - an identical create is still in flight => one typed `create_in_progress` refusal.
-    // A DIFFERENT fingerprint is NOT a duplicate (D-14): it walks today's path (attach, or the
-    // generation runtime's model-switch relaunch) and leaves the other fingerprint's entry alone.
-    let _claimedInflight = false;
-    const fingerprint = msg?.id ? createFingerprint(preparedMsg) : '';
-    if (fingerprint) {
-      const live = getSession(id);
-      if (ws && live?.ptyProcess && live._createFingerprint === fingerprint) {
-        sendNativeSessionCreated(ws, live);
-        return live;
-      }
-      const inFlight = _inflightCreates.get(id);
-      if (inFlight && inFlight.fingerprint === fingerprint) {
-        sendPreparedError(ws, {
-          type: 'error',
-          code: 'create_in_progress',
-          id,
-          message: 'A create for this session is already in progress',
-        });
+    // `report` is this create's own running outcome: the phase clock, the exit word, the last typed
+    // code and the agent word. It is mutated by the orchestration below and read only by the `finally`.
+    const report = {
+      clock: createPhaseClock(),
+      outcome: 'failed', // 'created' | 'duplicate' | 'refused' | 'failed'; the last is the safe default
+      code: '-',
+      // The launch's agent, filled in by the orchestration the moment it resolves it (the same
+      // detectAgentType call it already made); a refusal before that keeps the client's own word.
+      agent: typeof msg?.agentType === 'string' && msg.agentType ? msg.agentType : '-',
+      // The last typed code this create reported (a refusal's own code, or sendPreparedError's
+      // payload.code). Kept here so the `finally` can name the exit whatever produced it.
+      noteCode(value) {
+        if (value !== undefined && value !== null && value !== '') this.code = String(value);
+      },
+    };
+    let id = '';
+    let claimedInflight = false;
+    try {
+      if (host._ownerRecovery.rejectRequest(ws, msg)) return null;
+      id = msg?.id || crypto.randomUUID();
+      const preparedMsg = { ...(msg || {}), id, _createPhaseClock: report.clock };
+      // WP-1 (§6.1 S-3): reject an unrecognized mcp_profile rather than silently defaulting -- pure input validation, deliberately AHEAD of the durable generation reservation (a typo'd profile must never depend on, or consume, store availability).
+      const _rawMcpProfile = preparedMsg.mcp_profile ?? preparedMsg.mcpProfile;
+      if (_rawMcpProfile !== undefined && _rawMcpProfile !== null && String(_rawMcpProfile).trim() !== '' && !_sessionMcpProfileSetting(preparedMsg)) {
+        if (ws?.readyState === 1) _wsSend(ws, JSON.stringify({ type: 'error', code: 'mcp_profile_invalid', message: `Unknown mcp_profile: ${JSON.stringify(_rawMcpProfile)}` }));
+        report.outcome = 'refused';
+        report.noteCode('mcp_profile_invalid');
         return null;
       }
-      if (!inFlight) { _inflightCreates.set(id, { fingerprint }); _claimedInflight = true; }
-    }
-    try {
-      return await _prepareCreateAdmitted(ws, msg, preparedMsg, id, fingerprint);
+      // WP-4 (§5 D-12/D-13): a client-supplied id is the Idempotency-Key, and both duplicate answers
+      // are decided HERE, before any generation reservation, plan, markSpawning or markLive:
+      //   - the id names a LIVE session spawned by an identical create => re-answer ONE `created`
+      //     frame (same builder a fresh create uses) and return it; nothing is attached or rolled back;
+      //   - an identical create is still in flight => one typed `create_in_progress` refusal.
+      // A DIFFERENT fingerprint is NOT a duplicate (D-14): it walks today's path (attach, or the
+      // generation runtime's model-switch relaunch) and leaves the other fingerprint's entry alone.
+      const fingerprint = msg?.id ? createFingerprint(preparedMsg) : '';
+      if (fingerprint) {
+        const live = getSession(id);
+        if (ws && live?.ptyProcess && live._createFingerprint === fingerprint) {
+          sendNativeSessionCreated(ws, live);
+          report.outcome = 'duplicate';
+          return live;
+        }
+        const inFlight = _inflightCreates.get(id);
+        if (inFlight && inFlight.fingerprint === fingerprint) {
+          sendPreparedError(ws, {
+            type: 'error',
+            code: 'create_in_progress',
+            id,
+            message: 'A create for this session is already in progress',
+          });
+          report.outcome = 'duplicate';
+          report.noteCode('create_in_progress');
+          return null;
+        }
+        if (!inFlight) { _inflightCreates.set(id, { fingerprint }); claimedInflight = true; }
+      }
+      // WP-0a (§6.1): admission (owner recovery, input validation, both idempotency answers) ends here.
+      report.clock.mark('admitMs');
+      // WP-2 (§6.2 D-2): the box says `create-accepted` ONCE, the instant admission is over and
+      // BEFORE the first slow phase. Every awaited phase from here on (the generation reservation,
+      // launch planning, the scrollback/rung/preflight work, the codex-MCP readiness await, the PTY
+      // spawn and the `created` send) is a wait the hub's phase-A timer would otherwise burn as a
+      // timeout on a loaded box, so the acceptance is the last thing said before the first of them.
+      // The three exits ABOVE return before this line and therefore never accept: the live duplicate
+      // (D-12) and the in-flight duplicate (D-13) already answer for themselves, and an unrecognized
+      // mcp_profile (WP-1) is a refusal. Same injected `_wsSend` and the same `readyState === 1` gate
+      // the mcp_profile refusal above uses; the create's own flow is otherwise untouched.
+      if (ws && ws.readyState === 1) {
+        try {
+          _wsSend(ws, JSON.stringify({
+            type: 'create-accepted',
+            id,
+            load1: Math.round(os.loadavg()[0] * 10) / 10,
+            cores: os.cpus().length,
+            at: Date.now(),
+          }));
+        } catch { /* expected: create-accepted is advisory — a socket that cannot take it is the hub's own close/timeout path, and the create proceeds */ }
+      }
+      const created = await _prepareCreateAdmitted(ws, msg, preparedMsg, id, fingerprint, report);
+      report.outcome = created ? 'created' : 'failed';
+      return created;
     } finally {
-      if (_claimedInflight) _inflightCreates.delete(id);
+      if (claimedInflight) _inflightCreates.delete(id);
+      _logCreateLine(console, formatCreateLine({
+        id,
+        agent: report.agent,
+        forwardedBy: _forwardedBy(ws),
+        outcome: report.outcome,
+        code: report.code,
+        clock: report.clock,
+        load1: Math.round(os.loadavg()[0] * 10) / 10,
+        cores: os.cpus().length,
+      }));
     }
   }
 
   // The orchestration itself: byte-for-byte the body that used to be handleCreatePrepared's, from
   // the generation reservation on, plus the one D-11 fingerprint stamp on the owned success path.
   // Split out ONLY so the D-13 claim above can wrap every exit.
-  async function _prepareCreateAdmitted(ws, msg, preparedMsg, id, fingerprint) {
+  async function _prepareCreateAdmitted(ws, msg, preparedMsg, id, fingerprint, report) {
+    // WP-0a (§6.1 S-7): one `clock.mark(key)` after each awaited phase of this orchestration. The
+    // clock is the one carried on the prepared message, so provider-process.js and response.js mark
+    // the SAME clock across the whole create (see lib/session-create/create-phases.js).
+    const clock = report.clock;
     const reserved = _codingSessionGenerationRuntime.revalidateReservation(await _codingSessionGenerationRuntime.reserveSessionGeneration(id));
-    if (!reserved.ok) { recordSessionDiagnostic(id, 'launch-generation-refused', { code: reserved.code, message: reserved.message }); if (ws?.readyState === 1) _wsSend(ws, JSON.stringify({ type: 'error', code: reserved.code, message: `Launch refused: ${reserved.message}` })); return null; }
+    clock.mark('reserveMs');
+    if (!reserved.ok) {
+      recordSessionDiagnostic(id, 'launch-generation-refused', { code: reserved.code, message: reserved.message });
+      report.noteCode(reserved.code);
+      if (ws?.readyState === 1) _wsSend(ws, JSON.stringify({ type: 'error', code: reserved.code, message: `Launch refused: ${reserved.message}` }));
+      return null;
+    }
     const generation = reserved.generation;
     // WP-15e: an explicit (non-restore) create for a blocked id is the user's resume-from-store launch; drop the block.
     if (msg?.id && !preparedMsg._isRestore && isSessionResumeBlocked(id)) { clearSessionResumeBlocked(id); const blocked = getSession(id); if (blocked) blocked._resumeBlocked = false; }
@@ -138,12 +235,14 @@ function createPreparedSessionCreate(host) {
       if (!path.isAbsolute(requestedCwd)) requestedCwd = path.join(serverConfig.HOME || '', requestedCwd);
       try {
         await fs.promises.mkdir(requestedCwd, { recursive: true });
+        clock.mark('mkdirMs');
         preparedMsg.cwd = requestedCwd;
         preparedMsg.createCwd = false;
         if (ws?.readyState === 1) {
           _wsSend(ws, JSON.stringify({ type: 'toast', message: `Created folder ${requestedCwd}`, level: 'success' }));
         }
       } catch (error) {
+        report.noteCode('launch_cwd_create_failed');
         if (ws?.readyState === 1) {
           _wsSend(ws, JSON.stringify({ type: 'error', code: 'launch_cwd_create_failed', message: `Could not create folder: ${error.message}` }));
         }
@@ -151,6 +250,9 @@ function createPreparedSessionCreate(host) {
       }
     }
     const initialAgentType = detectAgentType(preparedMsg.cmd || preparedMsg.shell || serverConfig.SHELL || '/bin/zsh');
+    // WP-0a (§6.1): the agent word for the `[create]` line, taken from the launch's own detection
+    // (never a second call site), so the line can never disagree with the plan that was built.
+    report.agent = initialAgentType || report.agent;
     const initialResume = extractResumeTarget(initialAgentType, Array.isArray(preparedMsg.args) ? preparedMsg.args : []);
     const launchCwd = String(preparedMsg.cwd || serverConfig.HOME || '').replace(/^~/, serverConfig.HOME);
     // WI-6 item 5: only ever computed when the caller hasn't already supplied one — reused
@@ -172,6 +274,7 @@ function createPreparedSessionCreate(host) {
         // declared 'interactive' class (no downgrade needed here, unlike the deferred
         // auto-resume path in _startDeferredRestoreSessionNow).
       }, { timeoutMs: 10_000 });
+      clock.mark('metaMs');
       _cacheSessionOwnershipProjection(id, launchMetadata?.resolved || launchMetadata || null);
       const mcpProfileSetting = _sessionMcpProfileSetting(preparedMsg); // WP-6/WP-1: '' = no setting (unrecognized already rejected above)
       const warmPlanInputs = await _launchPlanWarmInputs({
@@ -180,6 +283,7 @@ function createPreparedSessionCreate(host) {
         launchMetadata,
         mcpProfile: mcpProfileSetting,
       });
+      clock.mark('warmMs');
       const prepared = await _launchPlanCoordinator.prepare(id, generation, {
         cmd: preparedMsg.cmd || preparedMsg.shell || serverConfig.SHELL || '/bin/zsh',
         args: Array.isArray(preparedMsg.args) ? preparedMsg.args : [],
@@ -201,6 +305,7 @@ function createPreparedSessionCreate(host) {
         lane: 'interactive', // always a real launch, never launch-plan-pool maintenance
         transcriptTrashRoot: SESSION_TRANSCRIPT_TRASH_ROOT, // WP-2 R8: findTrashedTranscript() seam
       }, previousPlan ? { replacesPlan: previousPlan } : undefined);
+      clock.mark('planMs');
       if (prepared?.plan) _noteLaunchPlanReadinessGeneration(prepared.plan);
       return prepared;
     };
@@ -223,14 +328,17 @@ function createPreparedSessionCreate(host) {
         result = await launchPlanPromise;
       }
     } catch (error) {
+      report.noteCode(error?.code || 'launch_plan_failed');
       sendPreparedError(ws, { type: 'error', code: error?.code || 'launch_plan_failed', message: 'Could not prepare this session launch.' });
       return null;
     }
     if (result.status === 'stale') return null;
     const rungHook = await _resolveMissingTranscriptRung(id, result.plan, initialAgentType);
+    clock.mark('rungMs');
     if (rungHook.restored) {
       // The archived copy is back on disk: prepare the launch again and continue natively.
       try { result = await runLaunchPlan(result.plan); } catch (error) {
+        report.noteCode(error?.code || 'launch_plan_failed');
         sendPreparedError(ws, { type: 'error', code: error?.code || 'launch_plan_failed', message: 'Could not prepare this session launch.' });
         return null;
       }
@@ -239,6 +347,7 @@ function createPreparedSessionCreate(host) {
     const resumePreflight = rungHook.restored ? result.plan.resume?.preflight : (rungHook.preflight || result.plan.resume?.preflight);
     if (result.plan.blockReason) {
       const code = String(result.plan.blockReason.code || 'launch_blocked');
+      report.noteCode(code);
       _launchPlanCoordinator.markBlocked(id, generation, code, result.plan);
       const notifiedAsResumeFailure = resumePreflight?.ok === false
         ? _notifyPreparedResumePreflightFailure(id, ws, result.plan.agentType || initialAgentType, resumePreflight)
@@ -259,13 +368,16 @@ function createPreparedSessionCreate(host) {
       try { await transcriptSource.copyBakToMissingLive(resumePreflight.transcriptPath); }
       catch (error) {
         _launchPlanCoordinator.markFailed(id, generation, 'launch_transcript_restore_failed', result.plan);
+        report.noteCode('launch_transcript_restore_failed');
         if (ws?.readyState === 1) {
           _wsSend(ws, JSON.stringify({ type: 'error', code: 'launch_transcript_restore_failed', message: 'Could not restore the local transcript backup.' }));
         }
         return null;
       }
     }
+    clock.mark('restoreMs');
     await _awaitCodexMcpReadinessForPlan(id, result.plan, { source: 'create', announce: null });
+    clock.mark('codexMcpMs');
     // The resume-ready estimate is carried on the CREATE MESSAGE (`_resumeReadyEstimate`), exactly
     // like `_restoreSeedSnapshot` below -- never written onto `result.plan`. The plan is
     // deep-frozen by lib/launch-plan-pool.js's deepFreezePlan(), so `result.plan.X = ...` throws a
@@ -281,6 +393,9 @@ function createPreparedSessionCreate(host) {
         agentType: result.plan.agentType,
         fileSizeBytes,
       });
+      // WP-0a (§6.1): marked only when an estimate really ran — a fresh create has no resume and
+      // reads -1, which is exactly "this phase does not exist for this exit".
+      clock.mark('estimateMs');
     }
     preparedMsg._resumeReadyEstimate = resumeReadyEstimate;
     if (needsRestoreSeedSnapshot) preparedMsg._restoreSeedSnapshot = restoreSeedSnapshot;
@@ -294,12 +409,20 @@ function createPreparedSessionCreate(host) {
         _preparedLaunchPlan: result.plan,
         _ptyStartupAttempt: startupAttempt,
       });
+      // WP-0a (§6.1): the last phase, marked the moment the awaited call RETURNS — provider
+      // preparation, PTY spawn and the `created` send all live inside it, and both outcomes reach
+      // here: a session object or null. A call that throws never returns, so it stays -1, like every
+      // other phase whose await did not resolve (the rollback below logs its own code either way).
+      clock.mark('providerMs');
     } catch (error) {
       createError = error;
     }
     const created = getSession(id);
     const fullyOwned = !!created && (
       created.type === 'walle'
+        // An ACP (dsh) session has no PTY to commit: its create path registers the row only after the
+        // ACP handshake succeeded, and refuses with its own error frame otherwise.
+        || created.transport === 'acp'
         || ptyStartupCommitComplete(created, startupAttempt)
     );
     if (createError || !fullyOwned) {
@@ -310,6 +433,7 @@ function createPreparedSessionCreate(host) {
       const code = createError
         ? String(createError.code || 'session_setup_failed')
         : 'session_setup_incomplete';
+      report.noteCode(code);
       _launchPlanCoordinator.markFailed(id, generation, code, result.plan);
       recordSessionDiagnostic(id, 'session-create-rollback', {
         code,