create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/api/sessions.js

@@ -49,6 +49,7 @@ const { registerApiRoutes } = require('../api-router');
 // injected so the route table needs no server.js plumbing beyond the deps it already has; the
 // module resolves its own dependencies lazily and is inert until a machine is registered.
 const remoteMachineCatalog = require('../remote-machine-catalog');
+const remoteSessionForward = require('../remote-session-forward'); // WP-2/D-3 (docs/remote-session-history-reads-and-box-status-hooks-2026-10-26.html): box-owned terminal-history reads forwarded to the owning machine.
 const workerAdmission = require('../worker-admission');
 const workerObservability = require('../session-create/worker-observability');
 const { createWaitWatcherReadTail, WATCH_MODES } = require('../session-create/worker-wait-watcher');
@@ -104,6 +105,7 @@ function configure({
   sendJsonResponse,
   apiSessionWorkspace,
   apiResumeSession,
+  apiResumeDeferredSessions,
   apiSessionPark,
   apiSessionPin,
   apiSessionWake,
@@ -169,6 +171,7 @@ function configure({
     sendJsonResponse,
     apiSessionWorkspace,
     apiResumeSession,
+    apiResumeDeferredSessions,
     apiSessionPark,
     apiSessionPin,
     apiSessionWake,
@@ -486,9 +489,17 @@ function projectNativeSubagentLaunch(session) {
   const unknown = { state: 'unknown' };
   if (!session || typeof session !== 'object') return unknown;
   const agent = normalizeAgentType(session.agentType || session._providerId || session._resumeAgentType || '');
-  if (agent !== 'codex' && agent !== 'claude') return unknown;
-  const knownAgent = { state: 'unknown', agent };
+  // WP-5 (§9 S-20, opencode-lead-and-delegate-model-selection-2026-10-28.html §8): an OpenCode LEAD
+  // is a live lead whose applied pick rides its inline OPENCODE_CONFIG_CONTENT, so its own harness
+  // (and pin) must be reported exactly like a Claude/Codex lead's -- Wall-E keys the delegate ladder
+  // on it (llm/delegate-lead-prefs.js, S-16). The projection itself is unchanged.
+  if (agent !== 'codex' && agent !== 'claude' && agent !== 'opencode' && agent !== 'dsh') return unknown; // dsh (D-24): reported so Wall-E keys a dsh lead 'dsh' and refuses its native picks
   const pick = session.subagent_pick || (session.meta && session.meta.subagent_pick) || null;
+  // WP-1 (codex-native-subagent-pick-enforcement-2026-10-28.html §6, S-6): the one additive key -- the recorded
+  // fact that THIS launch refused native sub-agents (v58), on both the unknown and known shapes.
+  const denied = !!pick && typeof pick === 'object' && !Array.isArray(pick) && pick.native_subagents === 'disabled'
+    ? { native_subagents: 'disabled' } : {};
+  const knownAgent = { state: 'unknown', agent, ...denied };
   if (!pick || typeof pick !== 'object' || Array.isArray(pick)) return knownAgent;
   if (!ACTIVE_SUBAGENT_LAUNCH_KINDS.has(pick.kind)) return knownAgent;
   const model = _boundedLaunchToken(pick.model, 200);
@@ -497,7 +508,7 @@ function projectNativeSubagentLaunch(session) {
   // role effort override"; a bounded token = the effort the launch actually wrote.
   const effort = typeof pick.effort === 'string' ? pick.effort : null;
   if (effort && !_boundedLaunchToken(effort, 32)) return knownAgent;
-  return { state: 'known', agent, kind: pick.kind, model, effort: effort === null ? null : effort.trim() };
+  return { state: 'known', agent, kind: pick.kind, model, effort: effort === null ? null : effort.trim(), ...denied };
 }
 
 function liveNativeSubagentLaunch(sessionId) {
@@ -1129,6 +1140,21 @@ function handleLeadModelRequestCancel(res, sessionId) {
   return sendLeadModelResult(res, _deps.leadModelSwitch.cancel(sessionId));
 }
 
+// WP-2 (docs/remote-box-model-access-2026-10-26.html §6.3, §5.1 R-4): the four lead-model calls of
+// a MIRROR session are answered BY THE BOX that owns it (the hub holds no session for the id, so
+// the handlers below can only 404). A local id is untouched: the mirror lookup misses and the
+// handler runs byte-identically. Same shape as the lifecycle forward at the park/wake route.
+async function leadModelRoute(req, res, params, kind) {
+  let sessionId = '';
+  try { sessionId = decodeURIComponent(params['1'] || ''); }
+  catch { return _deps.sendJsonResponse(res, 400, { ok: false, error: 'invalid_session_id' }); }
+  if (await remoteMachineCatalog.forwardLeadModelRequest(req, res, sessionId, kind)) return undefined;
+  if (kind === 'switch') return handleLeadModelSwitch(req, res, sessionId);
+  if (kind === 'options') return handleLeadModelOptions(res, sessionId);
+  if (kind === 'request') return handleLeadModelRequestRead(res, sessionId);
+  return handleLeadModelRequestCancel(res, sessionId);
+}
+
 async function handleDelegateProbe(req, res) {
   try {
     const body = await _deps.readJsonRequestBody(req, { limitBytes: 16 * 1024 });
@@ -1175,6 +1201,8 @@ async function handleWorkersRetire(req, res) {
   if (hasIds && b.ids.length > 200) {
     return _deps.sendJsonResponse(res, 400, { error: 'bad_request', reason: 'too_many_ids' });
   }
+  // WP-1/AC-1h: a box-owned lead's workers are retired on the box that owns them.
+  if (await remoteMachineCatalog.forwardWorkersRetireRequest(req, res, b, _deps)) return undefined;
   const ids = [];
   if (hasIds) {
     for (const raw of b.ids) {
@@ -1274,7 +1302,7 @@ function handleSessionTranscripts(res, ctmSessionId) {
 
 function register() {
   registerApiRoutes('sessions', [
-    { method: 'GET', path: '/api/recent-sessions', handler: (req, res, url) => _deps._perfWrap('apiRecentSessions', _deps.apiRecentSessions)(req, res, url) },
+    { method: 'GET', path: '/api/recent-sessions', handler: require('../remote-machine-proxy').machineRouted('GET /api/recent-sessions', require('../fleet-session-list-routes').fleetRouted('GET /api/recent-sessions', (req, res, url) => _deps._perfWrap('apiRecentSessions', _deps.apiRecentSessions)(req, res, url), require('../fleet-session-list-routes').FLEET_LIST_ROUTES['GET /api/recent-sessions'])) },
     { method: 'GET', path: '/api/smart-routing/sessions', handler: (req, res, url) => _deps._perfWrap('apiSmartRoutingSessions', _deps.apiSmartRoutingSessions)(req, res, url) },
     { method: 'POST', path: '/api/smart-routing/route', handler: (req, res, url) => _deps._perfWrap('apiSmartRoutingRoute', _deps.apiSmartRoutingRoute)(req, res, url) },
     {
@@ -1292,13 +1320,13 @@ function register() {
     { method: 'GET', path: '/api/session/prompt-version', handler: (req, res, url) => _deps._perfWrap('apiSessionPromptVersion', _deps.apiSessionPromptVersion)(req, res, url) },
     { method: 'GET', path: '/api/session/prompts', handler: (req, res, url) => _deps._perfWrap('apiSessionPrompts', _deps.apiSessionPrompts)(req, res, url) },
     { method: 'GET', path: '/api/session/message-content', handler: (req, res, url) => _deps._perfWrap('apiSessionMessageContent', _deps.apiSessionMessageContent)(req, res, url) },
-    { method: 'GET', path: '/api/session/messages', handler: (req, res, url) => _deps._perfWrap('apiSessionMessages', _deps.apiSessionMessages)(req, res, url) },
+    { method: 'GET', path: '/api/session/messages', handler: require('../remote-machine-proxy').machineRouted('GET /api/session/messages', (req, res, url) => remoteSessionForward.serveMirrorOrLocal(req, res, url, url.searchParams.get('id'), (r, s, u) => _deps._perfWrap('apiSessionMessages', _deps.apiSessionMessages)(r, s, u))) },
     { method: 'GET', path: '/api/session/runtime-diagnostics', handler: (req, res, url) => _deps.apiSessionRuntimeDiagnostics(req, res, url) },
     // WP-1C: serve paged rows out of the on-disk scrollback archive (lib/scrollback-archive-store.js).
     {
       method: 'GET',
       regex: /^\/api\/session\/([^/]+)\/scrollback$/,
-      handler: (req, res, url, params) => _deps.apiSessionScrollbackArchive(req, res, url, params['1']),
+      handler: (req, res, url, params) => remoteSessionForward.serveMirrorOrLocal(req, res, url, params['1'], _deps.apiSessionScrollbackArchive),
     },
     // WP-4 (terminal-memory-endgame S-14): the transcript-session sibling of the scrollback
     // archive route above -- pages rendered rollout-history windows on demand instead of
@@ -1306,12 +1334,12 @@ function register() {
     {
       method: 'GET',
       regex: /^\/api\/session\/([^/]+)\/history-window$/,
-      handler: (req, res, url, params) => _deps.apiSessionHistoryWindow(req, res, url, params['1']),
+      handler: (req, res, url, params) => remoteSessionForward.serveMirrorOrLocal(req, res, url, params['1'], _deps.apiSessionHistoryWindow),
     },
     {
       method: 'GET',
       regex: /^\/api\/session\/([^/]+)\/painted-rows$/,
-      handler: (req, res, url, params) => _deps.apiSessionPaintedRows(req, res, url, params['1']),
+      handler: (req, res, url, params) => remoteSessionForward.serveMirrorOrLocal(req, res, url, params['1'], _deps.apiSessionPaintedRows),
     },
     { method: 'GET', path: '/api/session/export', handler: (req, res, url) => _deps.apiSessionExport(req, res, url) },
     { method: 'DELETE', path: '/api/session', handler: (req, res, url) => _deps.apiDeleteSession(req, res, url) },
@@ -1321,7 +1349,7 @@ function register() {
     { method: 'GET', path: '/api/sessions/integrity', handler: (req, res) => handleSessionsIntegrity(req, res) },
     { method: 'POST', path: '/api/sessions/integrity/fix', handler: (req, res) => handleSessionsIntegrityFix(req, res) },
     { method: 'GET', path: '/api/sessions/relink-audit', handler: (req, res) => handleSessionsRelinkAudit(req, res) },
-    { method: 'GET', path: '/api/sessions/search', handler: (req, res, url) => _deps.apiSessionSearch(req, res, url) },
+    { method: 'GET', path: '/api/sessions/search', handler: require('../remote-machine-proxy').machineRouted('GET /api/sessions/search', require('../fleet-session-list-routes').fleetRouted('GET /api/sessions/search', (req, res, url) => _deps.apiSessionSearch(req, res, url), require('../fleet-session-list-routes').FLEET_LIST_ROUTES['GET /api/sessions/search'])) },
     { method: 'GET', path: '/api/sessions/search-status', handler: (req, res) => _deps.apiSessionSearchStatus(res) },
     { method: 'POST', path: '/api/sessions/ai-search', handler: (req, res) => _deps.apiAiSearch(req, res) },
     { method: 'POST', path: '/api/sessions/analyze', handler: (req, res) => _deps.apiAnalyzeSessions(req, res) },
@@ -1329,19 +1357,26 @@ function register() {
     { method: 'POST', path: '/api/sessions/generate-titles', handler: (req, res) => _deps.apiGenerateTitles(req, res) },
     { method: 'POST', path: '/api/sessions/rename', handler: (req, res) => _deps.apiRenameSession(req, res) },
     { method: 'POST', path: '/api/sessions/workers/retire', handler: (req, res) => handleWorkersRetire(req, res) },
-    { method: 'POST', regex: /^\/api\/sessions\/([^/]+)\/native-subagents\/clear$/, handler: (req, res, url, params) => handleNativeSubagentsClear(req, res, params['1']) },
+    // WP-1 (docs/remote-session-child-transcript-model-truth-and-restart-2026-10-27.html §5 D-2, §8
+    // WP-1): the native clear cutoff, the native/worker transcript reviews and the worker-retire call
+    // below all answer from the BOX that owns a mirror session (the hub holds no row for the id).
+    // A local/unclaimed id runs its handler in the same tick, unchanged.
+    { method: 'POST', regex: /^\/api\/sessions\/([^/]+)\/native-subagents\/clear$/,
+      handler: (req, res, url, params) => remoteSessionForward.serveMirrorOrLocal(req, res, url, params['1'],
+        (q, s, u, id) => handleNativeSubagentsClear(q, s, id)) },
     {
       method: 'GET',
       regex: /^\/api\/sessions\/([^/]+)\/native-subagents\/([^/]+)\/messages$/,
-      handler: (req, res, url, params) => serveNativeSubagentReview({
-        req, res, url, leadId: params['1'], key: params['2'],
-        getSession: _deps.getSession,
-        getRuntime: _deps.nativeSubagentRuntime,
-        runReadPoolOp: _deps._runReadPoolOp,
-        dbPath: _deps.dbModule.getDbPath(),
-        cursorSecret: _deps.nativeReviewCursorSecret,
-        sendJsonResponse: _deps.sendJsonResponse,
-      }),
+      handler: (req, res, url, params) => remoteSessionForward.serveMirrorOrLocal(req, res, url, params['1'],
+        () => serveNativeSubagentReview({
+          req, res, url, leadId: params['1'], key: params['2'],
+          getSession: _deps.getSession,
+          getRuntime: _deps.nativeSubagentRuntime,
+          runReadPoolOp: _deps._runReadPoolOp,
+          dbPath: _deps.dbModule.getDbPath(),
+          cursorSecret: _deps.nativeReviewCursorSecret,
+          sendJsonResponse: _deps.sendJsonResponse,
+        })),
     },
     // D-1 (docs/exited-worker-transcript-view-2026-10-17.html §6c): an EXITED routed worker's own
     // provider transcript, keyed by the WORKER id only. Same reader, response shape, error map,
@@ -1350,17 +1385,18 @@ function register() {
     {
       method: 'GET',
       regex: /^\/api\/sessions\/([^/]+)\/worker-transcript\/messages$/,
-      handler: (req, res, url, params) => serveNativeSubagentReview({
-        req, res, url, leadId: params['1'], key: null,
-        resolveTarget: (lead) => resolveWorkerTranscriptTarget(lead, {
-          getWorkerSession: _deps.dbModule.getWorkerSession,
-          listWorkerTranscriptRows: _deps.dbModule.listWorkerTranscriptRows,
-        }),
-        runReadPoolOp: _deps._runReadPoolOp,
-        dbPath: _deps.dbModule.getDbPath(),
-        cursorSecret: _deps.nativeReviewCursorSecret,
-        sendJsonResponse: _deps.sendJsonResponse,
-      }),
+      handler: (req, res, url, params) => remoteSessionForward.serveMirrorOrLocal(req, res, url, params['1'],
+        () => serveNativeSubagentReview({
+          req, res, url, leadId: params['1'], key: null,
+          resolveTarget: (lead) => resolveWorkerTranscriptTarget(lead, {
+            getWorkerSession: _deps.dbModule.getWorkerSession,
+            listWorkerTranscriptRows: _deps.dbModule.listWorkerTranscriptRows,
+          }),
+          runReadPoolOp: _deps._runReadPoolOp,
+          dbPath: _deps.dbModule.getDbPath(),
+          cursorSecret: _deps.nativeReviewCursorSecret,
+          sendJsonResponse: _deps.sendJsonResponse,
+        })),
     },
     { method: 'POST', path: '/api/sessions/resume-cwd', handler: (req, res) => _deps.apiResumeCwd(req, res) },
     // Regex carries a method CHECK at the legacy call site (POST or GET
@@ -1407,6 +1443,10 @@ function register() {
       },
     },
     { method: 'POST', path: '/api/sessions/resume', handler: (req, res) => _deps.apiResumeSession(req, res) },
+    // WP-2 (docs/external-causality-kill-session-loss-2026-10-27.html §6, §8 WP-2): the dead
+    // adopted host's "Resume N sessions" control. Static path, registered beside its siblings so
+    // the `:id` regexes below never see it.
+    { method: 'POST', path: '/api/sessions/resume-deferred', handler: (req, res) => _deps.apiResumeDeferredSessions(req, res) },
     {
       // POST /api/sessions/:id/park, /api/sessions/:id/pin, /api/sessions/:id/wake
       method: 'POST',
@@ -1427,6 +1467,7 @@ function register() {
         return _deps.apiSessionRevive(req, res, sessionId);
       },
     },
+    { method: 'POST', regex: /^\/api\/sessions\/([^/]+)\/background\/([^/]+)\/stop$/, handler: (req, res, url, params) => require('../background-stop').handleStopRequest(req, res, params, _deps) },
     { method: 'POST', path: '/api/sessions/attach', handler: (req, res) => _deps.apiAttachSession(req, res) },
     { method: 'POST', path: '/api/sessions/repoint', handler: (req, res) => handleSessionsRepoint(req, res) },
     {
@@ -1450,27 +1491,12 @@ function register() {
       handler: (req, res, url, params) => handleWorkerResume(req, res, decodeURIComponent(params['1'])),
     },
     { method: 'POST', regex: /^\/api\/sessions\/([^/]+)\/worker-stop$/, handler: (req, res, url, params) => handleWorkerStop(req, res, decodeURIComponent(params['1'])) },
-    // Lead-model switch (WP-2): relaunch in place with a one-shot model flag, confirmed by the next turn.
-    {
-      method: 'POST',
-      regex: /^\/api\/sessions\/([^/]+)\/lead-model$/,
-      handler: (req, res, url, params) => handleLeadModelSwitch(req, res, decodeURIComponent(params['1'])),
-    },
-    {
-      method: 'GET',
-      regex: /^\/api\/sessions\/([^/]+)\/lead-model\/options$/,
-      handler: (req, res, url, params) => handleLeadModelOptions(res, decodeURIComponent(params['1'])),
-    },
-    {
-      method: 'GET',
-      regex: /^\/api\/sessions\/([^/]+)\/lead-model\/request$/,
-      handler: (req, res, url, params) => handleLeadModelRequestRead(res, decodeURIComponent(params['1'])),
-    },
-    {
-      method: 'DELETE',
-      regex: /^\/api\/sessions\/([^/]+)\/lead-model\/request$/,
-      handler: (req, res, url, params) => handleLeadModelRequestCancel(res, decodeURIComponent(params['1'])),
-    },
+    // Lead-model switch (WP-2): relaunch in place with a one-shot model flag, confirmed by the next
+    // turn. WP-2 (remote-box-model-access §6.3): a MIRROR id is forwarded to its box first.
+    { method: 'POST', regex: /^\/api\/sessions\/([^/]+)\/lead-model$/, handler: (req, res, url, params) => leadModelRoute(req, res, params, 'switch') },
+    { method: 'GET', regex: /^\/api\/sessions\/([^/]+)\/lead-model\/options$/, handler: (req, res, url, params) => leadModelRoute(req, res, params, 'options') },
+    { method: 'GET', regex: /^\/api\/sessions\/([^/]+)\/lead-model\/request$/, handler: (req, res, url, params) => leadModelRoute(req, res, params, 'request') },
+    { method: 'DELETE', regex: /^\/api\/sessions\/([^/]+)\/lead-model\/request$/, handler: (req, res, url, params) => leadModelRoute(req, res, params, 'request-cancel') },
     // WP-2 (delegated-implementation-workers-2026-09-24.html §6.2, §9 S-9).
     { method: 'POST', path: '/api/sessions/delegate', handler: (req, res) => handleDelegateSession(req, res) },
     { method: 'POST', path: '/api/sessions/delegate/probe', handler: (req, res) => handleDelegateProbe(req, res) },