loki-mode 9.17.2 → 9.18.2

package/autonomy/run.sh

@@ -1519,6 +1519,22 @@ PYREG
 # if any other project is still running (KEEP) it is left up. NEVER uses a
 # blanket pkill and NEVER touches another folder's pids. Best-effort and
 # failure-swallowed: teardown bookkeeping must never block a clean exit.
+# Is this pid plausibly OUR dashboard, or a recycled number now naming something
+# else? Fails OPEN (returns 0) whenever ps cannot tell us, so the only behavior
+# change is refusing to kill a process that is positively identified as NOT a
+# dashboard. See the call site for the measured stale-file evidence.
+_loki_pid_looks_like_dashboard() {
+    local _p="$1" _cmd
+    case "$_p" in ''|*[!0-9]*) return 1 ;; esac
+    [ "$_p" -gt 1 ] 2>/dev/null || return 1     # never signal pid 0/1
+    _cmd="$(ps -o command= -p "$_p" 2>/dev/null)"
+    [ -n "$_cmd" ] || return 0                   # ps unavailable: behave as before
+    case "$_cmd" in
+        *dashboard*|*uvicorn*|*loki*) return 0 ;;
+    esac
+    return 1
+}
+
 loki_mark_project_stopped_and_maybe_kill_shared_dashboard() {
     local _skill="${LOKI_SKILL_DIR:-${PROJECT_DIR:-$SCRIPT_DIR/..}}"
     local _shared_pidfile="${HOME}/.loki/dashboard/dashboard.pid"
@@ -1566,7 +1582,19 @@ PYCHECK
         if [ -f "$_shared_pidfile" ]; then
             local _shared_pid
             _shared_pid=$(cat "$_shared_pidfile" 2>/dev/null)
-            if [ -n "$_shared_pid" ]; then
+            # Identity check before signalling. dashboard.pid is removed only on
+            # the explicit stop paths (:16608, :16658, :17399) -- nothing covers
+            # a crash, so the file outlives its dashboard. Measured in this very
+            # checkout: .loki/dashboard/dashboard.pid held a DEAD 87992 with an
+            # 8-day-old mtime. PIDs recycle, so a stale number eventually names
+            # an unrelated LIVE process and this `kill -9` hits it.
+            #
+            # kill -0 is NOT sufficient: a recycled pid is alive by definition,
+            # which is exactly the insufficiency the loki.pgid self-check had.
+            # Mirrors _app_runner_pid_is_ours (app-runner.sh:242) and fails OPEN
+            # the same way -- if `ps` says nothing we signal as before, so a
+            # legitimate dashboard is never left running by this check.
+            if [ -n "$_shared_pid" ] && _loki_pid_looks_like_dashboard "$_shared_pid"; then
                 kill "$_shared_pid" 2>/dev/null || true
                 sleep 0.5
                 kill -9 "$_shared_pid" 2>/dev/null || true
@@ -11467,15 +11495,61 @@ sys.stdout.write(t.strip())
                                 "${TARGET_DIR:-.}"/apps/*/package.json \
                                 "${TARGET_DIR:-.}"/services/*/package.json; do
                     [ -f "$pkg_json" ] || continue
-                    if grep -q '"vitest"' "$pkg_json" 2>/dev/null; then
-                        workspace_runner="vitest"
-                        break
-                    elif grep -q '"jest"' "$pkg_json" 2>/dev/null; then
-                        workspace_runner="jest"
-                        break
-                    fi
+                    # Read the workspace's DECLARED test script, same rule as the
+                    # single-package path above. A bare grep for '"jest"' matches
+                    # a devDependency, so a workspace that merely depends on jest
+                    # got labelled monorepo-jest.
+                    #
+                    # LOWER SEVERITY than the single-package case, and worth being
+                    # precise about why: all three branches below dispatch the
+                    # project's own script (turbo test / pnpm test --recursive /
+                    # npm test), so the grep only ever picked the LABEL, never
+                    # what ran. This corrects the evidence, not the execution.
+                    local _ws_script
+                    _ws_script=$(_LOKI_PKG="$pkg_json" python3 -c "
+import json, os, sys
+try:
+    with open(os.environ['_LOKI_PKG']) as f:
+        d = json.load(f)
+except Exception:
+    sys.exit(0)
+if not isinstance(d, dict):
+    sys.exit(0)
+t = (d.get('scripts') or {}).get('test') or ''
+if 'no test specified' in t.lower():
+    sys.exit(0)
+sys.stdout.write(t.strip())
+" 2>/dev/null || echo "")
+                    case "$_ws_script" in
+                        *vitest*) workspace_runner="vitest"; break ;;
+                        *jest*)   workspace_runner="jest"; break ;;
+                        *mocha*)  workspace_runner="mocha"; break ;;
+                        "")       : ;;
+                        *)        workspace_runner="npm-test"; break ;;
+                    esac
                 done
 
+                # FAIL-SAFE. If no workspace DECLARES a test script but one has a
+                # runner installed, still run the monorepo suite -- labelled
+                # "installed" so the evidence does not claim a declaration that
+                # does not exist.
+                #
+                # Without this the change would trade a wrong label for a SKIPPED
+                # GATE, which is the dangerous direction: the old grep at least
+                # dispatched `npm test`. Reporting a runner inaccurately is a
+                # documentation bug; silently not testing a monorepo is not.
+                if [ -z "$workspace_runner" ]; then
+                    for pkg_json in "${TARGET_DIR:-.}"/packages/*/package.json \
+                                    "${TARGET_DIR:-.}"/apps/*/package.json \
+                                    "${TARGET_DIR:-.}"/services/*/package.json; do
+                        [ -f "$pkg_json" ] || continue
+                        if grep -qE '"(vitest|jest|mocha)"' "$pkg_json" 2>/dev/null; then
+                            workspace_runner="installed"
+                            break
+                        fi
+                    done
+                fi
+
                 if [ -n "$workspace_runner" ]; then
                     test_runner="monorepo-$workspace_runner"
                     local output
@@ -24622,6 +24696,58 @@ kill_provider_child() {
 # ~run.sh:15034); in interactive foreground we share the user's shell group,
 # leave the pgid absent, and skip this reap entirely -- so Ctrl+C semantics
 # and the user's shell are untouched.
+# --- pgid stamp helpers (P0: stale-pgid session killer) ---------------------
+# The pgid file is written as `pgid=<n> boot=<id> started=<epoch>` so a reader
+# can tell a live record from a week-old orphan. See reap_own_process_group.
+
+# Extract one field from a stamp. A bare number (legacy file) yields the pgid
+# and nothing else, so the reader's fail-closed branch rejects it.
+_loki_pgid_field() {
+    local _s="$1" _k="$2"
+    case "$_s" in
+        *=*) ;;
+        *) [ "$_k" = "pgid" ] && printf '%s' "$(printf '%s' "$_s" | tr -d ' ')"; return 0 ;;
+    esac
+    # Prefix/suffix trimming, not `for _tok in $_s`. Two reasons:
+    #   - `while read` in a pipeline runs in a SUBSHELL and drops a final field
+    #     with no trailing newline, silently returning an empty `started`.
+    #   - unquoted `$_s` in a `for` relies on word splitting, which bash does
+    #     and ZSH DOES NOT. run.sh is bash, but this file gets sourced and
+    #     probed from other shells, and a helper whose correctness depends on
+    #     the caller's shell is a trap. This form needs no word splitting.
+    local _rest="$_s" _tok
+    while [ -n "$_rest" ]; do
+        _tok="${_rest%% *}"                    # first space-delimited token
+        case "$_tok" in
+            "$_k"=*) printf '%s' "${_tok#*=}"; return 0 ;;
+        esac
+        case "$_rest" in
+            *" "*) _rest="${_rest#* }" ;;      # advance past this token
+            *) _rest="" ;;                     # last token: stop
+        esac
+    done
+}
+
+# A value that changes on every reboot, so a pgid recorded before a reboot can
+# never validate afterwards. Empty when unavailable -- callers fail closed.
+_loki_boot_id() {
+    if [ -r /proc/stat ]; then
+        awk '/^btime /{print $2; exit}' /proc/stat 2>/dev/null && return 0
+    fi
+    # macOS: `kern.boottime` prints `{ sec = 1234567890, usec = 0 } ...`
+    sysctl -n kern.boottime 2>/dev/null | sed -n 's/.*sec *= *\([0-9][0-9]*\).*/\1/p'
+}
+
+# Start time of a pid as a unix epoch, or empty when it cannot be determined.
+_loki_proc_start_epoch() {
+    local _p="${1:-$$}" _lstart
+    _lstart="$(ps -o lstart= -p "$_p" 2>/dev/null)"
+    [ -n "$_lstart" ] || return 0
+    date -j -f '%a %b %e %T %Y' "$_lstart" '+%s' 2>/dev/null \
+        || date -d "$_lstart" '+%s' 2>/dev/null \
+        || true
+}
+
 reap_own_process_group() {
     local loki_dir="${TARGET_DIR:-.}/.loki"
     # Resolve the pgid file the same way main() recorded it (global or per-session).
@@ -24632,8 +24758,13 @@ reap_own_process_group() {
     _reap_pgid_file="${_reap_pgid_file%.pid}.pgid"
     [ -f "$_reap_pgid_file" ] || return 0   # interactive / no own session: skip
 
-    local _pgid
-    _pgid=$(cat "$_reap_pgid_file" 2>/dev/null | tr -d ' ')
+    # Parse the stamped format `pgid=<n> boot=<id> started=<epoch>`, falling back
+    # to a bare number for a file written by an older version.
+    local _stamp _pgid _boot _started
+    _stamp=$(cat "$_reap_pgid_file" 2>/dev/null | tr -d '\n')
+    _pgid=$(_loki_pgid_field "$_stamp" pgid)
+    _boot=$(_loki_pgid_field "$_stamp" boot)
+    _started=$(_loki_pgid_field "$_stamp" started)
     case "$_pgid" in ''|*[!0-9]*) return 0 ;; esac
     [ "$_pgid" -gt 1 ] 2>/dev/null || return 0    # never touch pgid 0/1
 
@@ -24644,6 +24775,40 @@ reap_own_process_group() {
     _my_pgid=$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ')
     [ -n "$_my_pgid" ] && [ "$_pgid" = "$_my_pgid" ] || return 0
 
+    # BOOT + AGE GUARD (the fix for the session-killer).
+    #
+    # The self-check above is NOT sufficient on its own. loki.pgid was removed
+    # only on the normal exit path, so a Ctrl+C'd or crashed run left the file
+    # behind indefinitely -- measured on a real machine: two orphans aged 155h
+    # and 202h. PIDs recycle (macOS wraps near 99999; max observed 99762), so a
+    # week-old pgid eventually matches a LIVE, unrelated shell group. The
+    # self-check then passes and every sibling in the user's terminal -- their
+    # editor, another agent session -- is TERM'd then KILL'd.
+    #
+    # A recycled pgid cannot forge both of these:
+    #   - boot id: a file from a previous boot can never match this boot.
+    #   - started: the recording run must not predate THIS process.
+    #
+    # Fails CLOSED. A missing or malformed stamp means we do nothing: an
+    # orphaned agent (the v7.41.x problem this reap was added for) is strictly
+    # less harmful than killing a user's editor.
+    local _now_boot
+    _now_boot="$(_loki_boot_id)"
+    if [ -z "$_boot" ] || [ -z "$_started" ]; then
+        return 0    # unstamped legacy file: never trust it
+    fi
+    if [ -z "$_now_boot" ] || [ "$_boot" != "$_now_boot" ]; then
+        return 0    # different boot (or boot id unavailable): refuse
+    fi
+    case "$_started" in ''|*[!0-9]*) return 0 ;; esac
+    local _self_started
+    _self_started="$(_loki_proc_start_epoch $$)"
+    # The stamp must not predate this process by more than a small clock skew.
+    # A stale file is always OLDER than the process now reading it.
+    if [ -n "$_self_started" ] && [ "$_started" -lt "$(( _self_started - 5 ))" ]; then
+        return 0
+    fi
+
     # Collect protected pids (dashboard, app-runner, registered children) so the
     # reap never takes down the shared dashboard if it happens to share our
     # group. Mirrors the `loki stop` / dashboard reaper protection set.
@@ -25045,6 +25210,20 @@ _loki_remove_temp_self_copy() {
     fi
 }
 
+# P0 (stale-pgid session killer): the pgid file must never outlive its run.
+# Recorded by the writer (see _LOKI_PGID_FILE below) rather than re-derived, so
+# the removal hits the exact path written -- global OR per-session -- and can
+# never delete a concurrent run's file.
+_loki_remove_pgid_file() {
+    [ -n "${_LOKI_PGID_FILE:-}" ] || return 0
+    # A `trap ... EXIT` fires in SUBSHELLS too, and a subshell exiting must not
+    # delete a LIVE parent's file (repo scar: a bare trap deleted a parent's
+    # lock). $$ does NOT change in a subshell -- BASHPID does, so it is the only
+    # real discriminator here.
+    [ "${BASHPID:-$$}" = "${_LOKI_PGID_OWNER:-$$}" ] || return 0
+    rm -f "$_LOKI_PGID_FILE" 2>/dev/null || true
+}
+
 _loki_session_exit_cleanup() {
     local exit_code=$?
     _loki_terminal_record 2>/dev/null || true
@@ -25052,6 +25231,12 @@ _loki_session_exit_cleanup() {
        && type safe_release_lock >/dev/null 2>&1; then
         safe_release_lock "$_LOKI_SESSION_LOCK_FILE" 2>/dev/null || true
     fi
+    # Covers EXIT plus INT/TERM: every cleanup() path that actually terminates
+    # does so via `exit`, which fires this trap. Deliberately NOT called from
+    # cleanup() itself -- its perpetual/pause branches RETURN and the run
+    # continues, so removing the file there would silently disable the
+    # completion-path reap for the rest of the run.
+    _loki_remove_pgid_file
     _loki_remove_temp_self_copy
     return "$exit_code"
 }
@@ -25720,6 +25905,10 @@ main() {
         fi
     else
         # Lock helper not loaded (lib/lock.sh missing). PID-only fallback.
+        # This branch still falls through to the pgid writer below, so it needs
+        # the same EXIT cleanup or the pgid file leaks on every interrupt here.
+        # An empty lock file is safe: the release is [ -n ]-guarded.
+        _loki_arm_session_exit_cleanup ""
         if [ -f "$pid_file" ]; then
             local existing_pid
             existing_pid=$(cat "$pid_file" 2>/dev/null)
@@ -25750,7 +25939,22 @@ main() {
     if [ "${LOKI_OWN_SESSION:-}" = "1" ]; then
         _loki_pgid="$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ')"
         if [ -n "$_loki_pgid" ]; then
-            echo "$_loki_pgid" > "${pid_file%.pid}.pgid" 2>/dev/null || true
+            # STAMPED, not a bare number. The reader requires boot id + start
+            # epoch to match before it will signal anything, because this file
+            # outlived its run (measured: 155h and 202h orphans) and PIDs
+            # recycle -- a stale bare pgid eventually matches a live shell group
+            # and the reap killed the user's other terminal sessions.
+            _loki_pgid_started="$(_loki_proc_start_epoch $$)"
+            [ -n "$_loki_pgid_started" ] || _loki_pgid_started="$(date +%s 2>/dev/null)"
+            # Record the EXACT path written (global or per-session) plus the
+            # owning shell, so the EXIT trap removes THIS file and only from
+            # this process. Without removal on the interrupt/crash paths the
+            # file outlived its run -- measured orphans aged 155h and 202h.
+            _LOKI_PGID_FILE="${pid_file%.pid}.pgid"
+            _LOKI_PGID_OWNER="${BASHPID:-$$}"
+            printf 'pgid=%s boot=%s started=%s\n' \
+                "$_loki_pgid" "$(_loki_boot_id)" "$_loki_pgid_started" \
+                > "$_LOKI_PGID_FILE" 2>/dev/null || true
         fi
     fi
     # Store session ID in state for dashboard/status visibility