mixdog 0.9.87 → 0.9.89

package/src/runtime/agent/orchestrator/session/store/serialize.mjs

@@ -2,6 +2,7 @@ import { readFileSync } from 'fs';
 import { join } from 'path';
 import { renameWithRetrySync } from '../../../../shared/atomic-file.mjs';
 import { sanitizeContentForStoredHistory } from '../../providers/media-normalization.mjs';
+import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../lifecycle-scan.mjs';
 
 // The live in-memory session (and every model request)
 // retains attached image bytes across turns so multi-turn recognition works.
@@ -9,6 +10,21 @@ import { sanitizeContentForStoredHistory } from '../../providers/media-normaliza
 // text placeholder at serialization time — keeping session files small without
 // starving the model of the image mid-conversation. Returns the same object
 // reference when nothing changed (no-image sessions pay only a shallow scan).
+// Per-message disk projection shared by _sessionForDisk and the save-worker
+// delta path (tail-only projection). Returns the SAME array reference when no
+// message changed. Idempotent: already-sanitized content passes through
+// unchanged, so projecting a projected message is a no-op.
+export function _messagesForDisk(messages) {
+    let changed = false;
+    const out = messages.map((m) => {
+        if (!m || typeof m !== 'object') return m;
+        const content = sanitizeContentForStoredHistory(m.content);
+        if (content !== m.content) { changed = true; return { ...m, content }; }
+        return m;
+    });
+    return changed ? out : messages;
+}
+
 export function _sessionForDisk(session) {
     // Strip transient in-flight aliases askSession sets for the turn duration:
     //  - liveTurnMessages: live working transcript (so contextStatus() can
@@ -26,14 +42,8 @@ export function _sessionForDisk(session) {
         const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session;
         return rest;
     }
-    let changed = false;
-    const out = messages.map((m) => {
-        if (!m || typeof m !== 'object') return m;
-        const content = sanitizeContentForStoredHistory(m.content);
-        if (content !== m.content) { changed = true; return { ...m, content }; }
-        return m;
-    });
-    if (!changed) {
+    const out = _messagesForDisk(messages);
+    if (out === messages) {
         if (!hasTransient) return session;
         const { liveTurnMessages: _dropLTM, toolApprovalHook: _dropTAH, ...rest } = session;
         return rest;
@@ -58,13 +68,36 @@ export function _ensureLifecycleFields(session) {
     return session;
 }
 
+/**
+ * Sentinel for "the file is THERE and could not be read" (EIO/EACCES/EBUSY…),
+ * as opposed to `null` = "read fine, but the record is corrupt/foreign".
+ * Callers that own retention (summary scan) must never treat the former as an
+ * empty/invalid row.
+ */
+export const STORED_SESSION_UNREADABLE = Symbol('stored-session-unreadable');
+
 export function _storedSessionFromFile(dir, filename, ensureLifecycle = true) {
     if (!filename.endsWith('.json')) return null;
     const storageId = filename.slice(0, -5);
     if (!storageId || !/^[A-Za-z0-9_-]+$/.test(storageId)) return null;
+    let text;
+    try {
+        text = readFileSync(join(dir, filename), 'utf-8');
+    } catch (err) {
+        const code = err?.code || 'EUNKNOWN';
+        // Only ENOENT/ENOTDIR is absence; everything else is present-but-
+        // unreadable and must fail closed for retention decisions.
+        return (code === 'ENOENT' || code === 'ENOTDIR') ? null : STORED_SESSION_UNREADABLE;
+    }
     try {
-        const session = JSON.parse(readFileSync(join(dir, filename), 'utf-8'));
-        if (session?.id !== storageId) return null;
+        // One strict authority for identity: a plain JSON.parse resolves a
+        // duplicate top-level `id` LAST-WINS, so `{"id":"other",…,"id":"me"}`
+        // would be listed (and later acted on) as this file's own session.
+        // Ambiguous/malformed records are treated exactly like corrupt ones:
+        // the caller keeps owning the identity but gets no session object.
+        const record = readTopLevelLifecycleRecord(text);
+        if (isLifecycleUnreadable(record) || record.id !== storageId) return null;
+        const session = record.doc;
         return ensureLifecycle ? _ensureLifecycleFields(session) : session;
     } catch {
         return null;

package/src/runtime/agent/orchestrator/session/store/summary-cache.mjs

@@ -1,8 +1,9 @@
-import { readdirSync, statSync, existsSync } from 'fs';
+import { readdirSync } from 'fs';
 import { join } from 'path';
 import { getPluginData } from '../../config.mjs';
 import { getStoreDir } from './paths-heartbeat.mjs';
-import { _storedSessionFromFile } from './serialize.mjs';
+import { probePath, PROBE_PRESENT, PROBE_ABSENT } from './fs-probe.mjs';
+import { STORED_SESSION_UNREADABLE, _storedSessionFromFile } from './serialize.mjs';
 import { _sessionSummary, _normalizeSummaryIndex, _upsertSessionSummaryRow, _removeSessionSummary, _pruneSummaryIndexIds } from '../store-summary-index.mjs';
 
 // Listing is much hotter than writing, especially while the desktop session
@@ -108,6 +109,17 @@ export function _rollbackCachedSessionSummary(id, version) {
 export function _queueSessionSummaryUpsert(session, version = null) {
     const latest = version === null ? null : _summaryCacheLatestRows.get(session?.id);
     const row = latest?.version === version ? latest.row : _sessionSummary(session);
+    return _queueSessionSummaryUpsertRow(row, version);
+}
+
+/**
+ * Publish an ALREADY-CAPTURED row. Async writers snapshot the row at the
+ * moment their payload is built and publish THAT snapshot when the write
+ * lands, so an older completion can never republish metadata read from the
+ * (since-mutated) live session — the row always describes the bytes that
+ * actually reached disk.
+ */
+export function _queueSessionSummaryUpsertRow(row, version = null) {
     if (!row) return;
     _setCachedBaseSummary(row);
     if (version === null || (_summaryCacheVersions.get(row.id) || 0) === version) {
@@ -141,11 +153,22 @@ const _summaryScanCache = new Map(); // filename → { mtimeMs, size, row|null }
 
 export function _scanStoredSessionSummaryRows() {
     const dir = getStoreDir();
-    if (!existsSync(dir)) {
+    const dirProbe = probePath(dir);
+    if (dirProbe.state === PROBE_ABSENT) {
         const changed = _summaryScanCache.size > 0;
         _summaryScanCache.clear();
         return { rows: [], invalidStorageIds: new Set(), changed };
     }
+    if (dirProbe.state !== PROBE_PRESENT) {
+        // The store dir exists as far as we know and simply cannot be probed
+        // (EACCES/EIO). Reporting "no sessions" here would let the caller
+        // rewrite the sidecar index from an empty scan — i.e. delete every
+        // row because of a transient stat error. Fail loudly instead; the
+        // refresh caller treats a throw as "storage not enumerable".
+        const err = new Error(`[session-store] session dir not readable (${dirProbe.code})`);
+        err.code = dirProbe.code;
+        throw err;
+    }
     const files = readdirSync(dir).filter(f => f.endsWith('.json'));
     const present = new Set(files);
     let changed = false;
@@ -162,21 +185,43 @@ export function _scanStoredSessionSummaryRows() {
         if (/^[A-Za-z0-9_-]+$/.test(storageId)) invalidStorageIds.add(storageId);
     };
     for (const f of files) {
-        let fileStat = null;
-        try { fileStat = statSync(join(dir, f)); } catch { /* deleted mid-scan */ }
-        if (!fileStat) {
+        const fileProbe = probePath(join(dir, f));
+        // Proven absence only: the file was deleted mid-scan, so its cached
+        // row legitimately retires.
+        if (fileProbe.state === PROBE_ABSENT) {
             if (_summaryScanCache.delete(f)) changed = true;
             continue;
         }
+        if (fileProbe.state !== PROBE_PRESENT) {
+            // Unreadable probe (EACCES/EIO/EBUSY): NOT a deletion. Keep the
+            // cache entry exactly as it is — `changed` stays untouched so no
+            // sidecar rewrite can drop this row — and keep serving the last
+            // known row. With no cached row the id is marked invalid instead,
+            // so no pending/live overlay may stand in for the unreadable file.
+            const stale = _summaryScanCache.get(f);
+            if (stale?.row) rows.push(stale.row);
+            else markInvalid(f);
+            continue;
+        }
         const cached = _summaryScanCache.get(f);
-        if (cached && cached.mtimeMs === fileStat.mtimeMs && cached.size === fileStat.size) {
+        if (cached && cached.mtimeMs === fileProbe.mtimeMs && cached.size === fileProbe.size) {
             if (cached.row) rows.push(cached.row);
             else markInvalid(f);
             continue;
         }
         const session = _storedSessionFromFile(dir, f);
+        if (session === STORED_SESSION_UNREADABLE) {
+            // Stat said PRESENT, the READ failed: identical contract to an
+            // unreadable probe. Retain the last known row, leave `changed`
+            // untouched (no sidecar rewrite may drop it) and never cache a
+            // null row for a file we could not read.
+            const stale = _summaryScanCache.get(f);
+            if (stale?.row) rows.push(stale.row);
+            else markInvalid(f);
+            continue;
+        }
         const row = session ? _sessionSummary(session) : null;
-        _summaryScanCache.set(f, { mtimeMs: fileStat.mtimeMs, size: fileStat.size, row });
+        _summaryScanCache.set(f, { mtimeMs: fileProbe.mtimeMs, size: fileProbe.size, row });
         changed = true;
         if (row) rows.push(row);
         else markInvalid(f);

package/src/runtime/agent/orchestrator/session/store/summary-rebuild-worker.mjs

@@ -0,0 +1,20 @@
+import { parentPort, workerData } from 'worker_threads';
+
+const dataDir = String(workerData?.dataDir || '');
+if (dataDir) process.env.MIXDOG_DATA_DIR = dataDir;
+
+try {
+    const [{ _scanStoredSessionSummaryRows }, { _writeSummaryIndex }] = await Promise.all([
+        import('./summary-cache.mjs'),
+        import('../store-summary-index.mjs'),
+    ]);
+    const { rows } = _scanStoredSessionSummaryRows();
+    const indexedRows = _writeSummaryIndex(rows);
+    parentPort?.postMessage({ ok: true, dataDir, rows: indexedRows });
+} catch (error) {
+    parentPort?.postMessage({
+        ok: false,
+        dataDir,
+        error: error?.message || String(error),
+    });
+}

package/src/runtime/agent/orchestrator/session/store/write-guards.mjs

@@ -1,21 +1,51 @@
-/** Module-level map tracking per-session cancellation generations and commit locks. */
+/**
+ * Module-level map tracking per-session cancellation generations, commit locks
+ * and the highest save epoch that actually LANDED for the id. All three live
+ * in one SharedArrayBuffer per id, so the save worker (which receives the
+ * buffer inside the write guard) observes the same state as the parent.
+ */
 const _writeControls = new Map();
 
+// Layout of the per-id SharedArrayBuffer:
+//   int32  [0] cancellation generation (equality-compared, wrap-safe)
+//   int32  [1] commit lock
+//   int64  @8 highest LANDED save epoch — 64-bit and 8-byte aligned so the
+//             fence can never wrap or read back negative, unlike an int32
+//             slot which a long-lived process could in principle overflow.
+const CONTROL_I32_LENGTH = 2;
+const LANDED_EPOCH_BYTE_OFFSET = 8;
+const CONTROL_BYTES = LANDED_EPOCH_BYTE_OFFSET + BigInt64Array.BYTES_PER_ELEMENT;
+
 function writeControl(id) {
     let control = _writeControls.get(id);
     if (!control) {
-        // [0] cancellation generation, [1] commit lock
-        control = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT * 2));
+        control = new Int32Array(new SharedArrayBuffer(CONTROL_BYTES), 0, CONTROL_I32_LENGTH);
         _writeControls.set(id, control);
     }
     return control;
 }
 
-export function guardedSaveOptions(id, opts) {
+// Both realms build this view over the SAME SharedArrayBuffer they received in
+// the guard, so parent and save worker observe one landed-epoch value.
+function landedEpochView(buffer) {
+    return new BigInt64Array(buffer, LANDED_EPOCH_BYTE_OFFSET, 1);
+}
+
+export function guardedSaveOptions(id, opts, epoch = null) {
     const control = writeControl(id);
+    // Only exact integers may fence a commit; anything else is treated as
+    // "no identity" rather than silently truncated.
+    const issued = Number.isSafeInteger(epoch) ? epoch : null;
     return {
         ...(opts || {}),
-        _sessionWriteGuard: { buffer: control.buffer, version: Atomics.load(control, 0) },
+        _sessionWriteGuard: {
+            buffer: control.buffer,
+            version: Atomics.load(control, 0),
+            // Identity of the snapshot this write carries. Absent for the
+            // lifecycle barriers (tombstone/detach/delete), which are
+            // authoritative by construction and never epoch-fenced.
+            ...(issued === null ? {} : { epoch: issued }),
+        },
     };
 }
 
@@ -33,18 +63,80 @@ export function isCancelledWrite(opts) {
     }
 }
 
-export function acquireWriteCommit(opts) {
+/**
+ * Publish the epoch of a write that just renamed onto the canonical path.
+ * Monotonic max, so a late/older commit can never lower the bar.
+ */
+export function publishLandedWriteEpoch(opts, epoch) {
+    const guard = opts?._sessionWriteGuard;
+    if (!guard?.buffer || !Number.isSafeInteger(epoch)) return;
+    try {
+        const view = landedEpochView(guard.buffer);
+        const next = BigInt(epoch);
+        let current = Atomics.load(view, 0);
+        while (next > current) {
+            const previous = Atomics.compareExchange(view, 0, current, next);
+            if (previous === current) return;
+            current = previous;
+        }
+    } catch { /* buffer gone: nothing to fence */ }
+}
+
+/**
+ * True when a STRICTLY NEWER save already landed on disk for this id, i.e.
+ * committing this snapshot would revert durable history. Covers the exit
+ * drain of an outstanding older payload and an older worker write finishing
+ * after a newer sync/async write (the commit lock serialises renames, it does
+ * not order them by content age).
+ */
+export function isStaleWriteEpoch(opts) {
+    const guard = opts?._sessionWriteGuard;
+    if (!guard?.buffer || !Number.isSafeInteger(guard.epoch)) return false;
+    try {
+        return BigInt(guard.epoch) < Atomics.load(landedEpochView(guard.buffer), 0);
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Sentinel returned when `timeoutMs` elapsed before the id's commit lock could
+ * be taken. Distinct from `false` (cancelled): nothing is wrong with the
+ * write, this realm simply may not block any longer (exit drain).
+ */
+export const WRITE_COMMIT_TIMEOUT = Symbol('session-write-commit-timeout');
+
+/**
+ * Sentinel returned when a newer write for the id landed while this one waited
+ * for the lock: the caller must discard its scratch file and commit nothing.
+ */
+export const WRITE_COMMIT_STALE = Symbol('session-write-commit-stale');
+
+export function acquireWriteCommit(opts, options = {}) {
     const guard = opts?._sessionWriteGuard;
     if (!guard?.buffer) return null;
     const control = new Int32Array(guard.buffer);
+    const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs >= 0
+        ? options.timeoutMs
+        : Infinity;
+    const deadline = timeoutMs === Infinity ? Infinity : Date.now() + timeoutMs;
     while (Atomics.compareExchange(control, 1, 0, 1) !== 0) {
-        Atomics.wait(control, 1, 1, 25);
+        if (Date.now() >= deadline) return WRITE_COMMIT_TIMEOUT;
+        const slice = deadline === Infinity ? 25 : Math.min(25, Math.max(1, deadline - Date.now()));
+        Atomics.wait(control, 1, 1, slice);
     }
     if (isCancelledWrite(opts)) {
         Atomics.store(control, 1, 0);
         Atomics.notify(control, 1);
         return false;
     }
+    // Re-checked UNDER the lock: the newer write may have landed while this
+    // one was waiting for it.
+    if (isStaleWriteEpoch(opts)) {
+        Atomics.store(control, 1, 0);
+        Atomics.notify(control, 1);
+        return WRITE_COMMIT_STALE;
+    }
     return control;
 }
 
@@ -54,9 +146,21 @@ export function releaseWriteCommit(control) {
     Atomics.notify(control, 1);
 }
 
-export function waitForWriteCommit(id) {
+/**
+ * Wait until no commit holds this id's rename lock. `timeoutMs` bounds the
+ * wait: the exit drain must never hang behind a worker/thread that is stuck
+ * inside its commit, and a timeout is safe — the caller's own write still
+ * serialises on the same Atomics lock. Returns true when the lock was
+ * observed free, false on timeout.
+ */
+export function waitForWriteCommit(id, opts = {}) {
     const control = writeControl(id);
+    const timeoutMs = Number.isFinite(opts.timeoutMs) && opts.timeoutMs >= 0 ? opts.timeoutMs : Infinity;
+    const deadline = timeoutMs === Infinity ? Infinity : Date.now() + timeoutMs;
     while (Atomics.load(control, 1) !== 0) {
-        Atomics.wait(control, 1, 1, 25);
+        if (Date.now() >= deadline) return false;
+        const slice = deadline === Infinity ? 25 : Math.min(25, Math.max(1, deadline - Date.now()));
+        Atomics.wait(control, 1, 1, slice);
     }
+    return true;
 }

package/src/runtime/agent/orchestrator/session/store-summary-index.mjs

@@ -150,6 +150,7 @@ export function _sessionSummary(session) {
         permission: session.permission || null,
         toolPermission: session.toolPermission || null,
         messageCount: messageProjection.count,
+        title: _cleanPreview(session.title || '', 100),
         preview: messageProjection.preview,
         generation: typeof session.generation === 'number' ? session.generation : 0,
         implicitBashSessionId: session.implicitBashSessionId || null,
@@ -185,6 +186,7 @@ function _normalizeSummaryRow(row) {
         permission: row.permission || null,
         toolPermission: row.toolPermission || null,
         messageCount: Math.max(0, Math.floor(Number(row.messageCount) || 0)),
+        title: _cleanPreview(row.title || '', 100),
         preview: _cleanPreview(row.preview || ''),
         generation: typeof row.generation === 'number' ? row.generation : 0,
         implicitBashSessionId: row.implicitBashSessionId || null,