mixdog 0.9.84 → 0.9.86

package/src/runtime/agent/orchestrator/session/manager/ask-session.mjs

@@ -3,10 +3,10 @@
 // mutex-guarded turn loop (askSession) plus the abort-aware call wrapper
 // (_api_call_with_interrupt). Behavior-preserving move — every runtime
 // helper it used in manager.mjs is now imported from its split module.
-import { createHash } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { getProvider } from '../../providers/registry.mjs';
 import { normalizeCompactType, DEFAULT_COMPACT_TYPE } from '../compact.mjs';
-import { loadSession, saveSessionAsync, saveSessionAsyncDeferred, readSessionLifecycleFromDisk } from '../store.mjs';
+import { loadSession, saveSession, saveSessionAsync, saveSessionAsyncDeferred, readSessionLifecycleFromDisk } from '../store.mjs';
 import { createAbortController } from '../../../../shared/abort-controller.mjs';
 import { logLlmCall } from '../../../../shared/llm/usage-log.mjs';
 import { appendAgentTrace } from '../../agent-trace.mjs';
@@ -56,6 +56,12 @@ import {
     persistCompactedOutgoingAfterAskFailure,
 } from './message-sanitize.mjs';
 import { createTurnInterruptionTracker } from './turn-interruption.mjs';
+import {
+    clearTurnCheckpoint,
+    recoverTurnCheckpoint,
+    turnMessagesForCheckpoint,
+    writeTurnCheckpoint,
+} from './turn-checkpoint.mjs';
 import { _getAgentLoop } from './runtime-loaders.mjs';
 import { getAgentRuntimeSync } from './agent-runtime-singleton.mjs';
 import { recordProviderContextBaseline } from '../loop/compact-policy.mjs';
@@ -208,6 +214,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
     // Hoisted so the outer finally (which runs once after the whole turn loop)
     // can compare against the last turn's generation.
     let askGeneration = 0;
+    let _crashRecoveryChecked = false;
     try {
       // Turn loop (pendingMessages pattern): run the current prompt, then drain
       // any `agent type=send` messages that were queued while this turn was in
@@ -262,6 +269,17 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         if (preSession.closed === true) {
             throw new SessionClosedError(sessionId, 'session already closed');
         }
+        if (!_crashRecoveryChecked) {
+            _crashRecoveryChecked = true;
+            const recovery = recoverTurnCheckpoint(preSession);
+            if (recovery.changed) {
+                saveSession(preSession, {
+                    sync: true,
+                    expectedGeneration: preSession.generation,
+                });
+                if (recovery.turnToken) clearTurnCheckpoint(sessionId, recovery.turnToken);
+            }
+        }
         // A prior crash/partial-save during compaction may have pinned
         // compaction.lastStage='compacting'. This ask is starting fresh, so
         // recover the stale transient stage before the loop's pre-send compact
@@ -306,7 +324,93 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         let cancelledUserTurnContent = '';
         let _turnOutgoing = null;
         const _turnInterruption = createTurnInterruptionTracker();
+        const _turnCheckpointToken = randomUUID();
+        const _turnCheckpointStartedAt = Date.now();
+        const _TURN_CHECKPOINT_THROTTLE_MS = 150;
+        let _turnCheckpointTimer = null;
+        let _turnCheckpointStopped = false;
+        let _turnCheckpointLastAt = 0;
+        let _turnCheckpointWarned = false;
+        const _flushTurnCheckpoint = () => {
+            if (_turnCheckpointStopped || !_turnOutgoing || !cancelledUserTurnContent) return false;
+            try {
+                const written = writeTurnCheckpoint({
+                    sessionId,
+                    generation: askGeneration,
+                    turnToken: _turnCheckpointToken,
+                    startedAt: _turnCheckpointStartedAt,
+                    currentUserContent: cancelledUserTurnContent,
+                    turnMessages: turnMessagesForCheckpoint(_turnOutgoing, cancelledUserTurnContent),
+                    interruption: _turnInterruption.snapshot(),
+                });
+                if (written) _turnCheckpointLastAt = Date.now();
+                return written;
+            } catch (error) {
+                if (!_turnCheckpointWarned) {
+                    _turnCheckpointWarned = true;
+                    try { process.stderr.write(`[turn-checkpoint] write failed session=${sessionId}: ${error?.message || error}\n`); } catch {}
+                }
+                return false;
+            }
+        };
+        const _scheduleTurnCheckpoint = (immediate = false) => {
+            if (_turnCheckpointStopped || !_turnOutgoing) return;
+            if (immediate || Date.now() - _turnCheckpointLastAt >= _TURN_CHECKPOINT_THROTTLE_MS) {
+                if (_turnCheckpointTimer) clearTimeout(_turnCheckpointTimer);
+                _turnCheckpointTimer = null;
+                _flushTurnCheckpoint();
+                return;
+            }
+            if (_turnCheckpointTimer) return;
+            const waitMs = Math.max(1, _TURN_CHECKPOINT_THROTTLE_MS - (Date.now() - _turnCheckpointLastAt));
+            _turnCheckpointTimer = setTimeout(() => {
+                _turnCheckpointTimer = null;
+                _flushTurnCheckpoint();
+            }, waitMs);
+            _turnCheckpointTimer.unref?.();
+        };
+        const _stopTurnCheckpoint = () => {
+            _turnCheckpointStopped = true;
+            if (_turnCheckpointTimer) clearTimeout(_turnCheckpointTimer);
+            _turnCheckpointTimer = null;
+        };
         const _sessionStartMetaInjectedBeforeTurn = preSession.sessionStartMetaInjected === true;
+        let _interruptionSnapshot = null;
+        const _prepareCloseSnapshot = (abortReason) => {
+            if (_interruptionSnapshot) return _interruptionSnapshot;
+            if (!activeSession) return null;
+            _stopTurnCheckpoint();
+            activeSession.liveTurnMessages = null;
+            _turnInterruption.restoreTombstonedText();
+            const finalized = _turnInterruption.finalize({
+                turnOutgoing: _turnOutgoing || activeSession.messages,
+                currentUserContent: cancelledUserTurnContent,
+                abortReason,
+            });
+            activeSession.messages = finalized.messages;
+            delete activeSession.activeTurnCheckpoint;
+            if (!finalized.responsePreserved) {
+                if (finalized.userTurnPreserved) {
+                    // A non-user detach keeps the provisional prompt but makes
+                    // the opaque provider continuation unsafe to reuse.
+                    activeSession.providerState = undefined;
+                } else {
+                    activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
+                }
+            } else {
+                activeSession.providerState = undefined;
+            }
+            activeSession.updatedAt = Date.now();
+            activeSession.lastUsedAt = Date.now();
+            runtime.session = activeSession;
+            _interruptionSnapshot = finalized;
+            return finalized;
+        };
+        // closeSession is synchronous and generation-first by design. Expose a
+        // turn-local hook so it can canonicalize the in-flight transcript
+        // before bumpSessionGeneration()/markSessionClosed() writes the disk
+        // snapshot and invalidates the ordinary cancellation cleanup save.
+        runtime.prepareCloseSnapshot = _prepareCloseSnapshot;
         try {
             const session = activeSession;
             const provider = getProvider(session.provider);
@@ -421,6 +525,15 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // user turn is introduced.
             session.messages = filterModelVisibleSessionMessages(outgoing);
             session.liveTurnMessages = outgoing;
+            session.activeTurnCheckpoint = {
+                version: 1,
+                turnToken: _turnCheckpointToken,
+                startedAt: _turnCheckpointStartedAt,
+            };
+            // The sidecar lands synchronously before provider execution. Even
+            // if the async canonical-session preflight save has not reached its
+            // worker when the process is killed, recovery still has the prompt.
+            _scheduleTurnCheckpoint(true);
             saveSessionAsync(session, { expectedGeneration: askGeneration }).catch((err) => {
                 try { process.stderr.write(`[session] preflight user-turn save failed: ${err?.message || err}\n`); } catch {}
             });
@@ -454,6 +567,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             const agentLoop = await _getAgentLoop();
             const _trackTextDelta = (chunk) => {
                 _turnInterruption.recordTextDelta(chunk);
+                _scheduleTurnCheckpoint();
                 if (typeof askOpts?.onTextDelta === 'function') askOpts.onTextDelta(chunk);
             };
             const _trackTextReset = async (detail) => {
@@ -470,23 +584,28 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 }
                 if (!acknowledged) return false;
                 _turnInterruption.tombstoneText(detail?.chars);
+                _scheduleTurnCheckpoint(true);
                 return true;
             };
             const _trackReasoningDelta = (chunk) => {
                 _turnInterruption.recordReasoningDelta(chunk);
+                _scheduleTurnCheckpoint();
                 if (typeof askOpts?.onReasoningDelta === 'function') askOpts.onReasoningDelta(chunk);
             };
             const _trackAssistantText = (text) => {
                 _turnInterruption.recordAssistantText(text);
+                _scheduleTurnCheckpoint(true);
                 if (typeof askOpts?.onAssistantText === 'function') askOpts.onAssistantText(text);
             };
             const _trackedOnToolCall = async (iteration, calls) => {
                 _turnInterruption.recordToolCalls(calls);
+                _scheduleTurnCheckpoint(true);
                 if (typeof onToolCall === 'function') return await onToolCall(iteration, calls);
                 return undefined;
             };
             const _trackToolResult = (message) => {
                 _turnInterruption.recordToolResult(message);
+                _scheduleTurnCheckpoint(true);
                 if (typeof askOpts?.onToolResult === 'function') askOpts.onToolResult(message);
             };
             const priorToolApprovalHook = session.toolApprovalHook;
@@ -505,10 +624,22 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     onReasoningDelta: _trackReasoningDelta,
                     onAssistantText: _trackAssistantText,
                     takeAssistantTranscriptMetadata: _takeAssistantTranscriptMetadata,
-                    onAssistantMessageCommitted: () => _turnInterruption.markAssistantMessageCommitted(),
-                    onAssistantToolCallObserved: (call, detail) => _turnInterruption.recordToolCalls([call], detail),
-                    onProviderSendStarted: () => _turnInterruption.markProviderSendStarted(),
-                    onToolPhaseStarted: () => _turnInterruption.markToolPhaseStarted(),
+                    onAssistantMessageCommitted: () => {
+                        _turnInterruption.markAssistantMessageCommitted();
+                        _scheduleTurnCheckpoint(true);
+                    },
+                    onAssistantToolCallObserved: (call, detail) => {
+                        _turnInterruption.recordToolCalls([call], detail);
+                        _scheduleTurnCheckpoint(true);
+                    },
+                    onProviderSendStarted: () => {
+                        _turnInterruption.markProviderSendStarted();
+                        _scheduleTurnCheckpoint(true);
+                    },
+                    onToolPhaseStarted: () => {
+                        _turnInterruption.markToolPhaseStarted();
+                        _scheduleTurnCheckpoint(true);
+                    },
                     onUsageDelta: (d) => {
                         persistIterationMetrics(d).catch(() => {});
                         // provider_send usage arrives before agentLoop appends
@@ -531,7 +662,10 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     },
                     onToolResult: _trackToolResult,
                     onToolApproval: typeof askOpts?.onToolApproval === 'function' ? askOpts.onToolApproval : undefined,
-                    onCompactEvent: typeof askOpts?.onCompactEvent === 'function' ? askOpts.onCompactEvent : undefined,
+                    onCompactEvent: (event) => {
+                        _scheduleTurnCheckpoint(true);
+                        try { askOpts?.onCompactEvent?.(event); } catch {}
+                    },
                     // Claude Code parity: mid-chain queued prompt/notification
                     // drain is owned by agentLoop at provider-continuation
                     // boundaries (after a tool batch, before the next send).
@@ -552,7 +686,10 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                         // post-loop _pendingTail drain below.
                         return out;
                     },
-                    onSteerMessage: typeof askOpts?.onSteerMessage === 'function' ? askOpts.onSteerMessage : undefined,
+                    onSteerMessage: (text, detail) => {
+                        _scheduleTurnCheckpoint(true);
+                        try { askOpts?.onSteerMessage?.(text, detail); } catch {}
+                    },
                     notifyFn: typeof askOpts?.notifyFn === 'function' ? askOpts.notifyFn : undefined,
                     promptCacheKey: session.promptCacheKey || sessionId,
                     // Provider-scoped cache key (mixdog-codex, mixdog-claude…).
@@ -605,6 +742,8 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             // Turn committed into session.messages; drop the live-turn alias so
             // contextStatus() reverts to the authoritative committed transcript.
             session.liveTurnMessages = null;
+            _stopTurnCheckpoint();
+            delete session.activeTurnCheckpoint;
             const _assistantTranscriptMeta = persistedAssistantTranscriptMetadata(_rawTranscriptMeta);
             if (result.content || result.reasoningContent) {
                 // Max-output recovery returns the complete concatenated text to
@@ -672,6 +811,12 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     process.stderr.write(`[session] empty-final persisted sessionId=${sessionId} stopReason=${_emptyStop ?? 'unknown'} iterations=${result?.iterations ?? 0} toolCallsTotal=${result?.toolCallsTotal ?? 0} outTokens=${_emptyUsage?.outputTokens ?? 0} hasThinking=${_thinkingStr} blockTypes=${_blockTypesStr}\n`);
                 } catch {}
             }
+            // The terminal assistant message is now canonical. A close racing
+            // any later await should persist this committed session as-is,
+            // never re-finalize the pre-terminal outgoing array.
+            if (runtime.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                runtime.prepareCloseSnapshot = null;
+            }
             session.updatedAt = Date.now();
             session.lastUsedAt = Date.now();
             applyAskTerminalUsageTotals(session, result, {
@@ -806,6 +951,10 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 ? saveSessionAsyncDeferred
                 : saveSessionAsync;
             const terminalSave = saveTerminalSession(session, { expectedGeneration: askGeneration });
+            terminalSave.then(
+                () => clearTurnCheckpoint(sessionId, _turnCheckpointToken),
+                () => {},
+            );
             finalizePendingMessageDelivery(
                 session,
                 _turnPendingEntries,
@@ -827,10 +976,14 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             markSessionDone(sessionId, { empty: isEmptyFinal });
             _result = terminalResultPreview;
         } catch (err) {
+            _stopTurnCheckpoint();
             // Cancellation/error paths bypass the commit point above; drop the
             // live-turn alias so contextStatus() stops estimating from the
             // stale in-flight array once the turn unwinds.
-            if (activeSession) activeSession.liveTurnMessages = null;
+            if (activeSession) {
+                activeSession.liveTurnMessages = null;
+                delete activeSession.activeTurnCheckpoint;
+            }
             // Restore before ANY finalization path. In particular, cancellation
             // can race the acknowledged non-streaming restart and surface as a
             // SessionClosedError; its interruption snapshot must include the
@@ -840,34 +993,15 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 const currentRuntime = _getRuntimeEntry(sessionId);
                 if (!currentRuntime?.closed) {
                     if (activeSession) {
-                        const finalized = _turnInterruption.finalize({
-                            turnOutgoing: _turnOutgoing || activeSession.messages,
-                            currentUserContent: cancelledUserTurnContent,
-                            abortReason: err.reason,
-                        });
-                        activeSession.messages = finalized.messages;
+                        const finalized = _prepareCloseSnapshot(err.reason);
+                        if (currentRuntime?.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                            currentRuntime.prepareCloseSnapshot = null;
+                        }
                         if (!finalized.responsePreserved) {
                             releasePendingMessages(sessionId, _turnPendingEntries);
-                            if (finalized.userTurnPreserved) {
-                                // Non-user abort (app quit / engine dispose /
-                                // watchdog): the just-sent user turn stays in
-                                // history, so the session-start meta it carries
-                                // remains consumed, and the opaque provider
-                                // continuation no longer matches — force full
-                                // transcript replay on the next send.
-                                activeSession.providerState = undefined;
-                            } else {
-                                activeSession.sessionStartMetaInjected = _sessionStartMetaInjectedBeforeTurn;
-                            }
                         } else {
                             recordPendingMessageDelivery(activeSession, _turnPendingEntries);
-                            // The opaque provider continuation now points at a
-                            // request that ended mid-turn. Force full transcript
-                            // replay on the next send instead of reusing it.
-                            activeSession.providerState = undefined;
                         }
-                        activeSession.updatedAt = Date.now();
-                        activeSession.lastUsedAt = Date.now();
                         try {
                             const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
                             if (finalized.responsePreserved) {
@@ -878,6 +1012,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                             } else {
                                 await durableSave;
                             }
+                            clearTurnCheckpoint(sessionId, _turnCheckpointToken);
                         } catch { /* cancellation cleanup is best-effort */ }
                         if (currentRuntime) currentRuntime.session = activeSession;
                     } else releasePendingMessages(sessionId, _turnPendingEntries);
@@ -887,6 +1022,9 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                 // can render it as "cancelled" rather than a red failure.
                 throw err;
             }
+            if (runtime.prepareCloseSnapshot === _prepareCloseSnapshot) {
+                runtime.prepareCloseSnapshot = null;
+            }
             // A reset acknowledgement removes the live partial before the
             // non-streaming request starts. If that restart fails, restore the
             // tombstone and persist the one exposed partial as interruption
@@ -894,18 +1032,11 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
             const preserveProviderPartial = restoredResetText
                 || err?.liveTextEmitted === true
                 || err?.unsafeToRetry === true;
+            let _errorStateDurable = false;
             if (preserveProviderPartial && activeSession && _turnInterruption.hasResponseStarted()) {
-                const finalized = _turnInterruption.finalize({
-                    turnOutgoing: _turnOutgoing || activeSession.messages,
-                    currentUserContent: cancelledUserTurnContent,
-                    abortReason: 'provider-error',
-                });
-                activeSession.messages = finalized.messages;
+                const finalized = _prepareCloseSnapshot('provider-error');
                 if (finalized.responsePreserved) recordPendingMessageDelivery(activeSession, _turnPendingEntries);
                 else releasePendingMessages(sessionId, _turnPendingEntries);
-                activeSession.providerState = undefined;
-                activeSession.updatedAt = Date.now();
-                activeSession.lastUsedAt = Date.now();
                 try {
                     const durableSave = saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
                     if (finalized.responsePreserved) {
@@ -916,6 +1047,7 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                     } else {
                         await durableSave;
                     }
+                    _errorStateDurable = true;
                 } catch { /* provider-failure history persistence is best-effort */ }
                 const currentRuntime = _getRuntimeEntry(sessionId);
                 if (currentRuntime) currentRuntime.session = activeSession;
@@ -935,11 +1067,19 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
                             activeSession, _turnPendingEntries, durableSave,
                             () => saveSessionAsync(activeSession, { expectedGeneration: askGeneration }),
                         );
+                        _errorStateDurable = true;
                     } catch {}
                 } else {
                     releasePendingMessages(sessionId, _turnPendingEntries);
                 }
             }
+            if (!_errorStateDurable && activeSession) {
+                try {
+                    await saveSessionAsync(activeSession, { expectedGeneration: askGeneration });
+                    _errorStateDurable = true;
+                } catch { /* retain checkpoint when canonical persistence fails */ }
+            }
+            if (_errorStateDurable) clearTurnCheckpoint(sessionId, _turnCheckpointToken);
             markSessionError(sessionId, err && err.message ? err.message : String(err));
             throw err;
         }
@@ -984,6 +1124,8 @@ export async function askSession(sessionId, prompt, context, onToolCall, cwdOver
         return _result;
       }
     } finally {
+        // A thrown setup/provider path must never leave a delayed checkpoint
+        // writer alive after the turn lock is released.
         // Clear the controller only if it's still ours (closeSession may have
         // swapped it). Leave the rest of the runtime entry intact so agent type=list
         // can still surface the final stage (done/error/cancelling).

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -569,18 +569,30 @@ export function hydratePendingMessages(sessionId, options = {}) {
 
 function clearPersistedPendingMessages(sessionId) {
     if (!isValidPendingSessionId(sessionId)) return;
-    try {
-        updateJsonAtomicSync(pendingMessagesPath(), (raw) => {
-            const next = normalizePendingStore(raw);
-            if (!Object.prototype.hasOwnProperty.call(next.sessions, sessionId)) return undefined;
-            delete next.sessions[sessionId];
-            if (next.sessionTouchedAt) delete next.sessionTouchedAt[sessionId];
-            next.updatedAt = Date.now();
-            return next;
-        }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false });
-    } catch (err) {
-        try { process.stderr.write(`[session] pending-message clear failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
-    }
+    // ASYNC, chained behind this session's persist tail. The previous SYNC
+    // variant self-deadlocked: closeSession ran it on the event loop while an
+    // in-flight async spool op (persist/ack/hydrate) in the SAME process held
+    // the lock — the sync wait starved the holder's continuations, so every
+    // such race burned the full 8s lock timeout (observed as an 8s shard-child
+    // stall after each one-shot session close). In-memory queues are already
+    // dropped synchronously by _dropPendingMessageState; only the durable
+    // spool row lags behind, exactly like the ack path.
+    const preceding = _pendingPersistTails.get(sessionId) || Promise.resolve();
+    const operation = preceding.catch(() => {}).then(() => updateJsonAtomic(pendingMessagesPath(), (raw) => {
+        const next = normalizePendingStore(raw);
+        if (!Object.prototype.hasOwnProperty.call(next.sessions, sessionId)) return undefined;
+        delete next.sessions[sessionId];
+        if (next.sessionTouchedAt) delete next.sessionTouchedAt[sessionId];
+        next.updatedAt = Date.now();
+        return next;
+    }, { compact: true, lock: true, mode: PENDING_MESSAGES_MODE, fsync: false }))
+        .catch((err) => {
+            try { process.stderr.write(`[session] pending-message clear failed sessionId=${sessionId}: ${err?.message || err}\n`); } catch {}
+        });
+    _pendingPersistTails.set(sessionId, operation);
+    operation.finally(() => {
+        if (_pendingPersistTails.get(sessionId) === operation) _pendingPersistTails.delete(sessionId);
+    }).catch(() => {});
 }
 
 function shouldEvictPendingSession(sessionId, ttlMs, entryTouchedAt, now = Date.now()) {
@@ -913,5 +925,12 @@ export function _dropPendingMessageState(id, { clearPersisted = true } = {}) {
 }
 
 setImmediate(() => {
+    // Spool hygiene belongs to the lead/daemon process. Worker-mode children
+    // (channels worker, agent shard) share the same spool file; a boot-time
+    // SYNC sweep in every child contends on the cross-process lock against
+    // the lead's writes (observed in the first live shard run: "atomic lock
+    // timeout after 8000ms: session-pending-messages.json.lock") for zero
+    // benefit — the lead already sweeps.
+    if (process.env.MIXDOG_WORKER_MODE === '1') return;
     try { sweepOrphanedPendingMessages(); } catch { /* ignore */ }
 });

package/src/runtime/agent/orchestrator/session/manager/session-close.mjs

@@ -11,6 +11,7 @@ import { SessionClosedError } from './session-errors.mjs';
 import { _dropPendingMessageState } from './pending-messages.mjs';
 import { _stopToolActivityHeartbeat, _getRuntimeEntry, _clearSessionRuntime } from './runtime-liveness.mjs';
 import { _closeBashSessionLazy } from './runtime-loaders.mjs';
+import { clearTurnCheckpoint } from './turn-checkpoint.mjs';
 
 /**
  * Close a session. Plants a `closed=true` tombstone on disk with a bumped
@@ -37,10 +38,17 @@ export function closeSession(id, reason = 'manual', opts = {}) {
     // resuming. Only truly-empty scratch sessions should still tombstone.
     const tombstone = opts.tombstone !== false;
     if (!id) return false;
+    const entry = _getRuntimeEntry(id);
+    // askSession owns the interruption tracker that can merge committed
+    // iterations, the current partial response, and observed tool results into
+    // one canonical transcript. Finalize that in-memory snapshot synchronously
+    // BEFORE the lifecycle generation changes; once generation is bumped, the
+    // normal cancellation cleanup save is intentionally rejected as stale.
+    try { entry?.prepareCloseSnapshot?.(reason); } catch { /* best-effort */ }
     _stopToolActivityHeartbeat(id);
     // Prefer in-memory runtime session — allBashSessionIds may not be persisted
     // yet for shells opened in the current turn (BL-bash-disk-sync).
-    const inMemory = _getRuntimeEntry(id)?.session;
+    const inMemory = entry?.session;
     const persisted = inMemory || loadSession(id);
     const bashSessionId = persisted?.implicitBashSessionId || null;
     // Collect all persistent bash shells created during this session.
@@ -62,8 +70,10 @@ export function closeSession(id, reason = 'manual', opts = {}) {
     //    write could silently overwrite the session after the user resumes
     //    it back (BL: burned-session late-save clobber).
     const newGen = tombstone ? markSessionClosed(id, reason) : bumpSessionGeneration(id, reason);
+    // prepareCloseSnapshot was folded into the synchronous generation write
+    // above. Only now is it safe to remove the crash fallback.
+    if (typeof newGen === 'number') clearTurnCheckpoint(id);
     // 2. Mark runtime as closed so post-await validation in askSession fires.
-    const entry = _getRuntimeEntry(id);
     if (entry) {
         entry.closed = true;
         entry.closedReason = reason;

package/src/runtime/agent/orchestrator/session/manager/session-lifecycle.mjs

@@ -34,6 +34,7 @@ import {
 import { getAgentRuntimeSync, warnAgentRuntimeResolveFailureOnce } from './agent-runtime-singleton.mjs';
 import { mintSessionId } from './session-id.mjs';
 import { providerCacheKey } from './provider-cache-key.mjs';
+import { clearTurnCheckpoint, recoverTurnCheckpoint } from './turn-checkpoint.mjs';
 
 function buildSessionProviderCacheOpts(providerName, sessionId, agent = null) {
     // Keep this in sync with createSession's provider-cache policy: only
@@ -657,6 +658,19 @@ export async function resumeSession(sessionId, preset, options = {}) {
         }
         return attached;
     }
+    const crashRecovery = recoverTurnCheckpoint(session);
+    if (crashRecovery.changed) {
+        // Resume must not expose a recovered frame that exists only in memory.
+        // Persist synchronously, then remove the sidecar; a second crash at
+        // either boundary therefore leaves at least one complete copy.
+        saveSession(session, {
+            sync: true,
+            expectedGeneration: session.generation,
+        });
+        if (crashRecovery.turnToken) {
+            clearTurnCheckpoint(sessionId, crashRecovery.turnToken);
+        }
+    }
     const oldTools = session.tools || [];
     const cached = _preparedResumes.get(sessionId);
     _preparedResumes.delete(sessionId);