kernelpm 0.1.9 → 0.1.11

package/dist/daemon.js

@@ -51,6 +51,14 @@ const session_1 = require("./session");
 exports.DAEMON_VERSION = '0.1.0';
 /** Default model when a session doesn't specify one (GLM Coding Plan). */
 const DEFAULT_MODEL = 'zai-coding-plan/glm-5.2';
+/**
+ * Max concurrent `opencode serve` spawns during daemon startup recovery.
+ * Each serve is a node process that loads the model provider and indexes the
+ * project cwd on cold start — running too many at once tips the box over and
+ * they start timing out / exiting during startup. 2 is a safe default that
+ * still recovers multiple sessions in parallel; bump it on big hosts.
+ */
+const RECOVERY_CONCURRENCY = 2;
 function controlSocketPath() {
     return path.join((0, store_1.kernelpmHome)(), 'control.sock');
 }
@@ -83,7 +91,7 @@ class Daemon {
     async init() {
         await this.store.init();
         const metas = this.store.list().filter((m) => m.status !== 'exited');
-        // Kick off all session recoveries concurrently WITHOUT awaiting: the
+        // Kick off all session recoveries WITHOUT awaiting: the
         // control socket must open immediately so the broker can connect, and a
         // slow / stuck `opencode serve` (one that never becomes healthy) must not
         // keep the daemon from coming up — otherwise `kernelpm daemon start` polls
@@ -91,19 +99,58 @@ class Daemon {
         // time" even though the daemon is still busy reattaching. A session that
         // fails to recover is marked 'exited' so the app sees the truth instead of
         // a perpetual 'starting'.
-        for (const meta of metas) {
-            const session = this.spawn(meta);
-            void session
-                .start(true)
-                .catch(async (err) => {
-                console.error(`[kernelpm] could not recover session ${meta.id}:`, err);
-                try {
-                    await this.store.upsert({ ...meta, status: 'exited', updatedAt: Date.now() });
-                }
-                catch {
-                    /* best-effort — store may already be in a bad state */
-                }
-            });
+        //
+        // Concurrency is capped, though: spawning N `opencode serve` processes at
+        // once saturates the host (CPU/RAM/file descriptors) and turns the
+        // HEALTH_TIMEOUT_MS window into a coin flip — observed as
+        // `opencode serve exited during startup` cascading failures during a
+        // recovery with many sessions. PROCESS AT A TIME keeps each serve's cold
+        // start isolated.
+        void this.recoverAll(metas);
+    }
+    async recoverAll(metas) {
+        const queue = [...metas];
+        const workers = Array.from({ length: Math.min(RECOVERY_CONCURRENCY, queue.length) }, () => this.runRecoveryWorker(queue));
+        await Promise.all(workers);
+    }
+    async runRecoveryWorker(queue) {
+        while (queue.length) {
+            const meta = queue.shift();
+            if (!meta)
+                return;
+            await this.recoverOne(meta);
+        }
+    }
+    async recoverOne(meta) {
+        const session = this.spawn(meta);
+        try {
+            await session.start(true);
+        }
+        catch (err) {
+            console.error(`[kernelpm] could not recover session ${meta.id}:`, err);
+            await this.cleanupFailedSession(session, meta);
+        }
+    }
+    /**
+     * Tear down a Session whose `start()` threw: kill its (possibly still
+     * running) opencode serve child, drop it from the live registry, and mark
+     * the persisted meta as `exited` so the app sees the truth. Idempotent and
+     * best-effort — every step is guarded so a partial failure here never masks
+     * the original error.
+     */
+    async cleanupFailedSession(session, meta) {
+        try {
+            await session.kill();
+        }
+        catch {
+            /* driver may be half-initialized; the serve process is best-effort */
+        }
+        this.sessions.delete(meta.id);
+        try {
+            await this.store.upsert({ ...meta, status: 'exited', updatedAt: Date.now() });
+        }
+        catch {
+            /* store may already be in a bad state */
         }
     }
     list() {
@@ -127,7 +174,19 @@ class Daemon {
         };
         await this.store.upsert(meta);
         const session = this.spawn(meta, model);
-        await session.start(false);
+        try {
+            await session.start(false);
+        }
+        catch (err) {
+            // `start` bails on a serve that never became healthy, but the spawned
+            // `opencode serve` may still be running and the registry now holds a
+            // half-initialized Session. Without this cleanup the orphan keeps a
+            // process slot (and on a small VPS, repeated createSession failures
+            // cascade: each retry leaves another stuck serve + another 'starting'
+            // session forever).
+            await this.cleanupFailedSession(session, meta);
+            throw err;
+        }
         return this.store.get(id) ?? meta;
     }
     send(id, text) {

package/dist/opencodeDriver.js

@@ -56,8 +56,27 @@ const child_process_1 = require("child_process");
 const net = __importStar(require("net"));
 const decisions_1 = require("./decisions");
 const POLL_MS = 1000;
-const HEALTH_TIMEOUT_MS = 30_000;
+/**
+ * Window for `opencode serve` to respond healthy on `/global/health`. 60 s
+ * covers a cold start on a 1 GB VPS under moderate load (model provider
+ * handshake + project indexing). On a fast host it returns in 1–3 s, so the
+ * extra headroom costs nothing in the common case and avoids spurious
+ * "did not become healthy" failures when the box is busy.
+ */
+const HEALTH_TIMEOUT_MS = 60_000;
 const MAX_TOOL_SUMMARY = 400;
+/**
+ * Watchdog cadence. Once a session has been `working` for at least
+ * `WORKING_GRACE_MS`, the poll triggers a `reconcile()` (re-list opencode
+ * messages and flush any completed assistant turn we missed from the SSE
+ * stream). If `WORKING_HARD_TIMEOUT_MS` elapses with no progress at all, we
+ * force `awaiting_input` so the app doesn't sit on a permanently spinning
+ * session — the model may have finished but opencode never sent the
+ * completion event (or the daemon's `patch` silently dropped it, see the
+ * Store race fixed in store.ts).
+ */
+const WORKING_GRACE_MS = 15_000;
+const WORKING_HARD_TIMEOUT_MS = 180_000;
 /**
  * Inline permission config: allow everything, including the two safety guards
  * that default to "ask". Matches the old `--permission-mode bypassPermissions`.
@@ -95,6 +114,8 @@ class ServeOpencodeDriver {
     emittedTurn = new Set();
     abort = null;
     status = 'starting';
+    /** Timestamp (ms) of the last `working` emit; null when not working. */
+    workingSince = null;
     constructor(sessionId, cwd, title, opts, cb, initial) {
         this.sessionId = sessionId;
         this.cwd = cwd;
@@ -111,6 +132,15 @@ class ServeOpencodeDriver {
         await this.ensureSession(resume);
         this.startStreaming();
         this.startPoll();
+        // Once the serve is up and the session is bound, the session is ready and
+        // waiting for its first user message. Without this transition the meta
+        // stays 'starting' forever, and the app — which derives its typing
+        // indicator from `isWorking(status)` — keeps showing "escribiendo…" on a
+        // brand-new session that has never received a prompt. Only transition if
+        // no SSE event (e.g. an early session.status=busy) has moved the status
+        // already, so we don't clobber a legitimately-working resumed session.
+        if (this.status === 'starting')
+            this.emitStatus('awaiting_input');
     }
     async sendMessage(text) {
         await this.prompt(text);
@@ -237,9 +267,76 @@ class ServeOpencodeDriver {
             if (this.exited) {
                 this.emitStatus('exited');
                 this.stopWatching();
+                return;
             }
+            this.watchdog();
         }, POLL_MS);
     }
+    /**
+     * Reconcile stuck `working` state. Two failure modes:
+     *  1. opencode finished the turn but we never saw the `message.updated` with
+     *     `time.completed` (SSE event dropped, or the network blip between
+     *     driver and serve). → re-list messages and flush what we missed.
+     *  2. The daemon's `Store.patch` threw (the pre-fix race) and the status
+     *     never propagated even though `emitStatus` ran. The driver-local
+     *     `this.status` is already correct in that case, but if for any reason
+     *     the daemon-side meta didn't move, forcing `awaiting_input` here at
+     *     least unblocks the user.
+     */
+    watchdog() {
+        if (this.status !== 'working' || this.workingSince === null)
+            return;
+        const startedAt = this.workingSince;
+        const elapsed = Date.now() - startedAt;
+        if (elapsed < WORKING_GRACE_MS)
+            return;
+        // Best-effort reconcile: ask opencode for the message list and flush any
+        // completed-but-unhandled assistant turn. Cheap (~1 HTTP call), and the
+        // SSE stream may have missed the completion event entirely.
+        void this.reconcile().then((flushed) => {
+            if (flushed)
+                return;
+            // Nothing to flush and we've been silent for too long — give up and let
+            // the user send the next message rather than spin forever.
+            if (this.status === 'working' && Date.now() - startedAt >= WORKING_HARD_TIMEOUT_MS) {
+                console.warn(`[kernelpm] session ${this.sessionId} stuck in working for ${Math.round(elapsed / 1000)}s, forcing awaiting_input`);
+                this.emitStatus('awaiting_input');
+            }
+        });
+    }
+    /**
+     * Re-list opencode messages and emit anything we missed. Returns true if it
+     * flushed a turn (caller uses that to reset the watchdog grace window).
+     */
+    async reconcile() {
+        if (!this.opencodeId)
+            return false;
+        let entries = [];
+        try {
+            entries = await this.listMessages();
+        }
+        catch {
+            return false;
+        }
+        let flushed = false;
+        for (const m of entries) {
+            const info = m.info;
+            if (!info || info.sessionID !== this.opencodeId)
+                continue;
+            this.messageInfo.set(info.id, info);
+            const parts = new Map();
+            for (const p of m.parts ?? []) {
+                parts.set(p.id, p);
+                this.storePart(p);
+            }
+            this.partsByMessage.set(info.id, parts);
+            if (info.role === 'assistant' && info.time?.completed && !this.emittedTurn.has(info.id)) {
+                this.flushMessage(info.id);
+                flushed = true;
+            }
+        }
+        return flushed;
+    }
     stopWatching() {
         if (this.abort) {
             this.abort.abort();
@@ -519,11 +616,30 @@ class ServeOpencodeDriver {
         }
     }
     http(path, init = {}) {
-        return fetch(this.baseUrl + path, init);
+        // opencode 1.18+ validates the request content-type and rejects POSTs
+        // without an explicit `application/json` header with HTTP 415
+        // ("Unsupported content-type: text/plain"). Node's fetch defaults the
+        // header to text/plain when given a string body, so any JSON POST must
+        // set it explicitly. GETs (no body) are left untouched. SSE streaming
+        // calls pass `Accept: text/event-stream` directly and bypass this path.
+        const headers = { ...init.headers };
+        if (init.body && !headers['Content-Type'] && !headers['content-type']) {
+            headers['Content-Type'] = 'application/json';
+        }
+        return fetch(this.baseUrl + path, { ...init, headers });
     }
     async probeServe(port) {
         try {
-            const r = await fetch(`http://127.0.0.1:${port}/global/health`);
+            // opencode's serve has a brief window where it has bound the port but
+            // hasn't wired up its HTTP handlers yet — a plain `fetch` to /global/health
+            // in that window connects, sends the request, and then *hangs forever*
+            // (Node's fetch has no default timeout). That single stuck probe blocks
+            // `waitForHealth`'s loop indefinitely and the daemon never reports
+            // `created` back to the broker. The explicit timeout turns the hang into
+            // a normal "not ready yet, retry in 250ms" and the loop converges.
+            const r = await fetch(`http://127.0.0.1:${port}/global/health`, {
+                signal: AbortSignal.timeout(2000),
+            });
             if (!r.ok)
                 return false;
             const j = (await r.json());
@@ -570,6 +686,7 @@ class ServeOpencodeDriver {
         if (status === this.status)
             return;
         this.status = status;
+        this.workingSince = status === 'working' ? Date.now() : null;
         this.cb.onStatus(status);
     }
 }

package/dist/store.js

@@ -55,6 +55,15 @@ class Store {
     statePath = path.join(this.home, 'sessions.json');
     meta = new Map();
     appendChains = new Map();
+    /**
+     * Single global chain for `sessions.json` writes. Without this, two
+     * concurrent `persistMeta()` calls race on the fixed `.tmp` filename
+     * (`A.writeFile → B.writeFile → A.rename → B.rename = ENOENT`), which is
+     * the intermittent `sendMessage/createSession → error in ~40ms` seen in
+     * the broker log. `serializeAppend` only covers per-session `.jsonl`
+     * appends; this covers the shared meta file.
+     */
+    metaChain = Promise.resolve();
     async init() {
         await fs.promises.mkdir(this.sessionsDir, { recursive: true });
         try {
@@ -136,10 +145,29 @@ class Store {
         return next;
     }
     async persistMeta() {
+        return this.serializeMeta(() => this.writeMetaFile());
+    }
+    /** The actual disk write — must run inside `serializeMeta`. */
+    async writeMetaFile() {
         const state = { version: 1, sessions: Object.fromEntries(this.meta) };
-        const tmp = this.statePath + '.tmp';
+        // Unique tmp name per call: extra defense so a future code path that
+        // bypasses `metaChain` (or a concurrent Store instance during tests) can't
+        // trip on the same ENOENT rename race the fixed name caused.
+        const tmp = `${this.statePath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
         await fs.promises.writeFile(tmp, JSON.stringify(state, null, 2), 'utf8');
         await fs.promises.rename(tmp, this.statePath);
     }
+    /**
+     * Serialize all writes to `sessions.json`. Callers already hold the in-memory
+     * `meta` map mutation (synchronous), but the actual disk write must be
+     * queued so the tmp+rename pair runs atomically per write. Without this,
+     * concurrent calls step on each other's tmp file and one rename fails with
+     * ENOENT — surfaced to the app as a generic `error`.
+     */
+    serializeMeta(fn) {
+        const next = this.metaChain.then(fn, fn);
+        this.metaChain = next.catch(() => undefined);
+        return next.then(() => undefined);
+    }
 }
 exports.Store = Store;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kernelpm",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "kernelpm daemon — keeps opencode sessions alive on a server (via `opencode serve`) and exposes them over a local control socket.",
   "license": "MIT",
   "bin": {