mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/session/manager/pending-messages.mjs

@@ -1,7 +1,6 @@
 // Steering / pending-message queue with sync buffering and atomic persistence.
-import { mkdirSync, readFileSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { loadSession } from '../store.mjs';
-import { ForeignPendingMessageController } from './foreign-pending-messages.mjs';
 import {
   currentPendingLifecycleToken,
   lifecycleTokenStale,
@@ -29,7 +28,7 @@ import {
   pendingIdSet,
   pruneEmptyPendingIdSet,
 } from './pending-claim-ledger.mjs';
-import { legacyPendingMessagesPath, pendingShardDir } from './pending-spool-path.mjs';
+import { legacyPendingMessagesPath } from './pending-spool-path.mjs';
 import { pruneCleanupConfirmedLedger } from './pending-delivered-ledger.mjs';
 // The durable delivered-id ledger on the session record lives in
 // pending-delivered-ledger.mjs; re-exported so prior importers stay unchanged.
@@ -83,16 +82,6 @@ const _sessionPendingMessages = new Map();
 const _hydratedPendingMessages = new Map();
 const _pendingHydrations = new Map();
 
-// Exposed for live-share owners: they fs.watch this session's shard file for
-// instant pickup of cross-surface submits (the 3s drain tick remains the
-// safety net). Without a valid session id there is nothing to watch.
-export function pendingMessagesSpoolPath(sessionId) {
-  if (!isValidPendingSessionId(sessionId)) return '';
-  // fs.watch needs the directory to exist before the first shard is written.
-  mkdirSync(pendingShardDir(), { recursive: true });
-  return pendingMessagesPath(sessionId);
-}
-
 function pendingIdStillQueued(sessionId, id) {
   for (const map of [_sessionPendingMessages, _pendingPersistBuffers, _hydratedPendingMessages]) {
     const q = map.get(sessionId);
@@ -196,11 +185,10 @@ function acknowledgePendingMessages(sessionId, deliveredEntries, options = {}) {
         return false;
       }
       // Keep the acked ids when the spool cleanup FAILED: the durable entry
-      // still exists, and forgetting that it was already delivered let the
-      // foreign-injection drain re-take it as a "new" cross-surface submit
-      // (user saw the same message duplicated in the transcript). Retained
-      // ids also keep suppressing the hydrate path; they are dropped only
-      // once a later ack round actually lands.
+      // still exists, and forgetting that it was already delivered would let
+      // the hydrate path re-take it as a new message (the same message
+      // duplicated in the transcript). They are dropped only once a later ack
+      // round actually lands.
       if (!ok) return false;
       forgetAckedIds();
       return true;
@@ -462,99 +450,6 @@ export function enqueuePendingMessage(sessionId, message) {
   return Math.max(q.length, bufferedDepth || 0);
 }
 
-/**
- * Remote-attach injection enqueue: persist a user message into the shared
- * cross-process spool WITHOUT touching this process's in-memory queues. Used
- * by a viewer surface attached to a session another live process owns — the
- * owner's injection poller (drainForeignUserInjections) picks it up there.
- * Skipping the local queues is deliberate: if this process later takes real
- * ownership of the session, a lingering local copy would double-inject.
- */
-export function enqueueRemotePendingMessage(sessionId, message) {
-  if (!isValidPendingSessionId(sessionId)) return 0;
-  // Same durable-lifecycle authority as the local enqueue: a cross-surface
-  // submit that lands after the session was closed is refused before any
-  // spool mutation.
-  const token = currentPendingLifecycleToken(sessionId);
-  if (pendingLifecycleInvalidated(sessionId)) return 0;
-  const normalized = pendingMessageQueueEntry(message);
-  if (!normalized) return 0;
-  // The token rides into the async spool commit, which revalidates under the
-  // spool lock (see persistPendingMessages).
-  if (pendingLifecycleInvalidated(sessionId, token)) return 0;
-  // Preserve the viewer's submission id end-to-end. Minting a fresh id here
-  // made pipe-delivered + spool-fallback twins look like two messages
-  // (owner accepted the pipe copy, then re-took the spool copy).
-  const preservedId = pendingMessageId(normalized) || pendingMessageId(message);
-  const remoteEntry = stampLifecycleToken(
-    {
-      ...normalized,
-      id: typeof preservedId === 'string' && preservedId.trim() ? preservedId.trim() : newPendingMessageId(),
-    },
-    token
-  );
-  return persistPendingMessages(sessionId, [remoteEntry]);
-}
-
-function _foreignLocalIds(sessionId) {
-  const localIds = new Set();
-  for (const map of [_sessionPendingMessages, _pendingPersistBuffers, _hydratedPendingMessages]) {
-    for (const entry of map.get(sessionId) || []) {
-      const id = pendingMessageId(entry);
-      if (id) localIds.add(id);
-    }
-  }
-  for (const set of [_inDeliveryPendingIds.get(sessionId), _ackedPendingIds.get(sessionId)]) {
-    for (const id of set || []) localIds.add(id);
-  }
-  // The durable delivered-ledger mirrors the hydrate path's suppression: an
-  // entry whose id was recorded as delivered (but whose spool cleanup has
-  // not landed yet — crash, lock contention, another process) is NOT a
-  // foreign submit and must never re-inject.
-  try {
-    for (const id of loadSession(sessionId)?.deliveredPendingMessageIds || []) {
-      if (typeof id === 'string' && id) localIds.add(id);
-    }
-  } catch {
-    /* ledger unavailable — in-memory sets still guard */
-  }
-  return localIds;
-}
-
-function addForeignInDeliveryIds(sessionId, ids) {
-  const inDelivery = pendingIdSet(_inDeliveryPendingIds, sessionId);
-  for (const id of ids) inDelivery.add(id);
-}
-
-function removeForeignInDeliveryIds(sessionId, ids) {
-  const inDelivery = _inDeliveryPendingIds.get(sessionId);
-  for (const id of ids) inDelivery?.delete(id);
-  pruneEmptyPendingIdSet(_inDeliveryPendingIds, sessionId);
-}
-
-const foreignPendingMessages = new ForeignPendingMessageController({
-  addInDeliveryIds: addForeignInDeliveryIds,
-  chainSpoolTail,
-  currentLifecycleToken: currentPendingLifecycleToken,
-  getSpoolTail: (sessionId) => _pendingPersistTails.get(sessionId),
-  isValidSessionId: isValidPendingSessionId,
-  lifecycleEpochMoved: pendingLifecycleEpochMoved,
-  lifecycleInvalidated: pendingLifecycleInvalidated,
-  localIds: _foreignLocalIds,
-  normalizeStore: normalizePendingStore,
-  removeInDeliveryIds: removeForeignInDeliveryIds,
-  setSpoolQueue,
-  spoolPath: pendingMessagesPath,
-  updateSpool,
-  warn: pendingWarn,
-});
-
-// The controller parks rows before delivery so an owner crash can redeliver
-// accepted input instead of losing it.
-export async function drainForeignUserInjections(sessionId) {
-  return foreignPendingMessages.drainUserInjections(sessionId);
-}
-
 // Drain order: enqueue time, then source (hydrated < buffered < memory), then
 // position within the source.
 function byEnqueueOrder(a, b) {
@@ -710,15 +605,6 @@ export function _dropPendingMessageState(id, { clearPersisted = true } = {}) {
   } catch {
     /* ignore */
   }
-  // A tombstoned close removes the whole durable queue anyway; a DETACH keeps
-  // its scheduled release so this process still cleans up rows it parked.
-  if (clearPersisted) {
-    try {
-      foreignPendingMessages.cancelHandoffRelease(id);
-    } catch {
-      /* ignore */
-    }
-  }
   _inDeliveryPendingIds.delete(id);
   _ackedPendingIds.delete(id);
   _pendingHydrations.delete(id);

package/src/runtime/agent/orchestrator/session/manager/pending-persist-queue.mjs

@@ -93,7 +93,7 @@ export function persistPendingMessages(sessionId, messages) {
       // schedule the retry HERE. Waiting for "the next scheduled flush or
       // session takeover" meant a FINAL submit (nothing else ever
       // enqueues afterwards) stayed process-local forever, while
-      // enqueue/enqueueRemotePendingMessage had already reported success.
+      // enqueuePendingMessage had already reported success.
       try {
         // Closed/detached since this write started: its buffer and its
         // retry timer were torn down on purpose — do not rebuild them.

package/src/runtime/agent/orchestrator/session/manager/prompt-utils.mjs

@@ -5,6 +5,7 @@ import { formatLocalAndUtcTimestamp } from '../../../../shared/time-format.mjs';
 import { SUMMARY_PREFIX } from '../compact.mjs';
 import { isProtectedContextUserMessage } from '../compact/messages.mjs';
 import { attachmentTextForPart, isAttachmentReference } from '../../../../attachments/store.mjs';
+import { samePath } from '../../../../shared/worktrees/paths.mjs';
 
 export function promptContentText(content) {
   if (typeof content === 'string') return content;
@@ -144,7 +145,11 @@ function replaceSystemMessageContent(session, target, content) {
   return true;
 }
 
-export function refreshSessionBp3Environment(session, cwd) {
+export function refreshSessionBp3Environment(session, requestedCwd) {
+  // A staged workspace change (see stageWorkspaceReroot) keeps the system
+  // prompt rooted where it was until the next re-root: the `# Session` Cwd
+  // stays the rooted one, the change reaches the model as a tail notice.
+  const cwd = session?.workspaceReroot?.rootCwd || requestedCwd;
   // Split layout (bp3EnvSplit): the volatile environment lives in its own
   // UNMARKED cacheTier:'env' system block; the tier3 core block is never
   // rewritten, so the refresh cannot invalidate the BP3 cache write.
@@ -224,7 +229,7 @@ export function replaceWorkspaceCoreSlices(core, { coreMemoryContext, instructio
     if (memory) parts.push(`${CORE_MEMORY_HEADING}${memory}`);
   }
   if (instructionFilesContext !== undefined) instructionFiles = trimmedSlice(instructionFilesContext);
-  return [...parts, instructionFiles].filter((part) => part && part.trim()).join(BP3_PART_SEPARATOR);
+  return [...parts, instructionFiles].filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
 }
 
 /**
@@ -238,24 +243,16 @@ export function replaceWorkspaceEnvironment(environmentTail, environmentContext)
   const facts = trimmedSlice(environmentContext);
   if (parts[0]?.startsWith('- ')) parts[0] = facts;
   else parts.unshift(facts);
-  return parts.filter((part) => part && part.trim()).join(BP3_PART_SEPARATOR);
+  return parts.filter((part) => part?.trim()).join(BP3_PART_SEPARATOR);
 }
 
 /**
- * Re-root an existing session's prompt at a new workspace without touching
- * the conversation: environment facts, project memory and instruction files
- * are replaced in place (never appended), then the `# Session` block is
- * rebuilt for `cwd`. Messages are replaced, not mutated, so delta saves write
- * a full snapshot.
- * @param {object} session
- * @param {{ cwd: string, environmentContext?: string, coreMemoryContext?: string, instructionFilesContext?: string }} context
- * @returns {boolean}
+ * Re-root a session's prompt at a workspace in place: environment facts,
+ * project memory and instruction files are replaced (never appended), then
+ * the `# Session` block is rebuilt for `cwd`. Messages are replaced, not
+ * mutated, so delta saves write a full snapshot.
  */
-export function refreshSessionWorkspaceContext(
-  session,
-  { cwd, environmentContext, coreMemoryContext, instructionFilesContext } = {}
-) {
-  if (!session) return false;
+function rerootSessionWorkspace(session, { cwd, environmentContext, coreMemoryContext, instructionFilesContext }) {
   if (typeof session.bp3EnvironmentContext === 'string') {
     session.bp3EnvironmentContext = replaceWorkspaceEnvironment(session.bp3EnvironmentContext, environmentContext);
   }
@@ -275,7 +272,225 @@ export function refreshSessionWorkspaceContext(
   return refreshSessionBp3Environment(session, cwd);
 }
 
+const SESSION_BLOCK_CWD_RE = /(?:^|\n)# Session\nCwd: ([^\n]+)/;
+const WORKER_ENV_CWD_RE = /(?:^|\n)- Cwd: ([^\n]+?) — the active Project root/;
+
+function textOf(message) {
+  return typeof message?.content === 'string' ? message.content : '';
+}
+
+/**
+ * The workspace the session's system prompt currently presents: its Cwd and
+ * the environment facts, project memory and instruction-files slices, read
+ * back from the blocks refreshSessionBp3Environment/composeSystemPrompt wrote.
+ */
+function presentedWorkspace(session) {
+  const core = session.bp3EnvSplit === true ? textOf(bp3SystemMessage(session)) : String(session.bp3CoreContext || '');
+  const instructionAt = bp3SliceAt(core, INSTRUCTION_FILES_HEADING);
+  const head = instructionAt ? core.slice(0, instructionAt.cut) : core;
+  const memory = (head ? head.split(BP3_PART_SEPARATOR) : []).find((part) => part.startsWith(CORE_MEMORY_HEADING));
+  const tail = typeof session.bp3EnvironmentContext === 'string' ? session.bp3EnvironmentContext : '';
+  const facts = tail.split(BP3_PART_SEPARATOR)[0] || '';
+  const promptText = [textOf(bpEnvSystemMessage(session)), textOf(bp3SystemMessage(session))].join('\n');
+  const cwd = promptText.match(SESSION_BLOCK_CWD_RE)?.[1] || facts.match(WORKER_ENV_CWD_RE)?.[1] || null;
+  return {
+    cwd: cwd ? cwd.trim() : null,
+    environmentContext: facts.startsWith('- ') ? facts.trim() : '',
+    coreMemoryContext: memory ? memory.slice(CORE_MEMORY_HEADING.length).trim() : '',
+    instructionFilesContext: instructionAt ? core.slice(instructionAt.start).trim() : '',
+  };
+}
+
+const WORKSPACE_SLICES = ['environmentContext', 'coreMemoryContext', 'instructionFilesContext'];
+
+/**
+ * A workspace change of a session that already has a conversation: the
+ * system prompt stays byte-identical (provider prompt cache intact) and the
+ * change is staged on `session.workspaceReroot`:
+ *   rootCwd — the Cwd the system prompt stays rooted at;
+ *   seen    — what the model has been told (the prompt, then acknowledged notices);
+ *   target  — the current workspace, applied to the prompt at the next re-root
+ *             (compaction, a route change, a cleared conversation).
+ * `undefined` slices keep what is there. The state object is replaced, never
+ * mutated, so a transaction snapshot of the field restores it exactly.
+ */
+function stageWorkspaceReroot(session, context) {
+  const prior = session.workspaceReroot;
+  const seen = prior ? prior.seen : presentedWorkspace(session);
+  const target = { ...(prior ? prior.target : {}), cwd: String(context.cwd || '').trim() };
+  for (const slice of WORKSPACE_SLICES) {
+    if (context[slice] !== undefined) target[slice] = trimmedSlice(context[slice]);
+  }
+  // The move into a worktree belongs to this change only; a later one drops it.
+  delete target.move;
+  const from = String(context.move?.from || '').trim();
+  if (from) target.move = { from, changes: context.move.changes ?? null };
+  session.workspaceReroot = {
+    version: 1,
+    revision: (Number(prior?.revision) || 0) + 1,
+    rootCwd: prior ? prior.rootCwd : seen.cwd,
+    seen,
+    target,
+  };
+  return true;
+}
+
+/**
+ * Re-root an existing session's prompt at a new workspace. A session without
+ * a conversation is re-rooted in place (no cache to keep); one with a
+ * conversation keeps its system messages untouched and stages the change
+ * (stageWorkspaceReroot): the model learns it from the tail notice of its
+ * next user turn (snapshotPendingWorkspaceNotice), and the next re-root
+ * (applyPendingWorkspaceReroot) rewrites the prompt.
+ * `move` ({ from, changes: 'carried'|'left'|null }: the session left the
+ * project folder `from` for a worktree) adds to the notice what happened to
+ * the uncommitted changes and that paths under `from` now resolve under `cwd`.
+ * @param {object} session
+ * @param {{ cwd: string, environmentContext?: string, coreMemoryContext?: string, instructionFilesContext?: string, move?: { from: string, changes?: 'carried'|'left'|null } }} context
+ * @returns {boolean}
+ */
+export function refreshSessionWorkspaceContext(session, context = {}) {
+  if (!session) return false;
+  if (hasUserConversationMessage(session.messages)) return stageWorkspaceReroot(session, context);
+  applyPendingWorkspaceReroot(session);
+  return rerootSessionWorkspace(session, context);
+}
+
+/**
+ * Give `stored` (the canonical transcript) the system prefix of `messages`
+ * (a running turn's working array built on it), message objects included.
+ */
+export function syncSystemPrefix(stored, messages) {
+  const systemCount = (list) => {
+    let count = 0;
+    while (count < list.length && list[count]?.role === 'system') count += 1;
+    return count;
+  };
+  stored.splice(0, systemCount(stored), ...messages.slice(0, systemCount(messages)));
+}
+
+/**
+ * Apply a staged workspace change to the system prompt (the session's own
+ * messages, plus `messages` when a running turn works on another array whose
+ * system prefix is the session's) and drop the staged state: the prompt now
+ * presents the current workspace, so no notice is due any more.
+ * @returns {boolean} whether a staged change was applied
+ */
+export function applyPendingWorkspaceReroot(session, messages = session?.messages) {
+  const pending = session?.workspaceReroot;
+  if (!pending) return false;
+  delete session.workspaceReroot;
+  const stored = session.messages;
+  const other = Array.isArray(messages) && messages !== stored;
+  if (other) session.messages = messages;
+  try {
+    rerootSessionWorkspace(session, pending.target);
+  } finally {
+    if (other) session.messages = stored;
+  }
+  if (other && Array.isArray(stored)) syncSystemPrefix(stored, messages);
+  return true;
+}
+
+function sameWorkspacePath(left, right) {
+  return !!left && !!right && samePath(left, right);
+}
+
+/** The lines a move from the project folder into a worktree adds to the notice. */
+function workspaceMoveLines(move, cwd) {
+  if (!move?.from || sameWorkspacePath(move.from, cwd)) return [];
+  let changes = '';
+  if (move.changes === 'carried') {
+    changes =
+      'Uncommitted changes were moved into the worktree; ignored files (dependencies, build output, env files) were not.';
+  } else if (move.changes === 'left') {
+    changes = `Uncommitted changes were left in ${move.from}; they are not present here.`;
+  }
+  return [
+    changes,
+    `For continued work, substitute ${cwd} for the project root ${move.from} in paths mentioned earlier; absolute paths are not remapped automatically. Re-read affected files before editing them.`,
+  ].filter(Boolean);
+}
+
+function workspaceNoticeContent({ seen, target }) {
+  if (!target?.cwd || sameWorkspacePath(seen?.cwd, target.cwd)) return '';
+  const changed = (slice) => target[slice] !== undefined && target[slice] !== (seen?.[slice] || '');
+  const sections = [
+    [
+      '# Working Folder Changed',
+      `The working folder is now ${target.cwd}. This replaces the Cwd and environment facts given earlier in this conversation; relative paths and shell commands resolve here.`,
+      'Keep the conversation goals and decisions, but treat earlier file contents, search results and Git observations as historical, not as evidence of this checkout. Check the target project instructions and Git status, and re-read the files needed for the next edit before continuing. A folder change alone does not transfer uncommitted changes.',
+      ...workspaceMoveLines(target.move, target.cwd),
+      changed('environmentContext') ? target.environmentContext : '',
+    ]
+      .filter(Boolean)
+      .join('\n'),
+  ];
+  if (changed('instructionFilesContext')) {
+    sections.push(
+      target.instructionFilesContext
+        ? `The instruction files below replace all previously provided instruction files.\n\n${target.instructionFilesContext}`
+        : 'The new working folder has no instruction files: the previously provided instruction files no longer apply.'
+    );
+  }
+  if (changed('coreMemoryContext')) {
+    sections.push(
+      target.coreMemoryContext
+        ? `The core memory below replaces all previously provided core memory.\n\n${CORE_MEMORY_HEADING}${target.coreMemoryContext}`
+        : 'The new working folder has no core memory: the previously provided core memory no longer applies.'
+    );
+  }
+  return `<system-reminder>\n${sections.join('\n\n')}\n</system-reminder>`;
+}
+
+/**
+ * The workspace notice the next user turn carries, or null: nothing when the
+ * folder did not change from what the model was told, and only the slices
+ * that changed. Lifecycle mirrors deferred-tool-delta.mjs (snapshot → acknowledge
+ * when the provider accepted the turn), so a failed turn re-sends it.
+ * @returns {{ revision: number, content: string } | null}
+ */
+export function snapshotPendingWorkspaceNotice(session) {
+  const pending = session?.workspaceReroot;
+  if (!pending) return null;
+  const content = workspaceNoticeContent(pending);
+  return content ? { revision: pending.revision, content } : null;
+}
+
+/**
+ * The report of a new worktree's preparation (session.pendingSetupNotice, set
+ * by the first turn's workspace gate) for this turn, or null. Acknowledged
+ * when the provider accepted the turn, like the workspace notice.
+ * @returns {{ revision: number, content: string } | null}
+ */
+export function snapshotPendingSetupNotice(session) {
+  const pending = session?.pendingSetupNotice;
+  return typeof pending?.content === 'string' && pending.content
+    ? { revision: pending.revision, content: pending.content }
+    : null;
+}
+
+export function acknowledgePendingSetupNotice(session, revision) {
+  if (session?.pendingSetupNotice?.revision !== revision) return false;
+  delete session.pendingSetupNotice;
+  return true;
+}
+
+/** The notice of `revision` reached the model: what it was told is now the target. */
+export function acknowledgePendingWorkspaceNotice(session, revision) {
+  const pending = session?.workspaceReroot;
+  if (!pending || pending.revision !== Number(revision)) return false;
+  const seen = { ...pending.seen, cwd: pending.target.cwd };
+  for (const slice of WORKSPACE_SLICES) {
+    if (pending.target[slice] !== undefined) seen[slice] = pending.target[slice];
+  }
+  session.workspaceReroot = { ...pending, seen };
+  return true;
+}
+
 export function resetSessionBp3Environment(session) {
+  // A cleared conversation has no cache to keep: the prompt re-roots now.
+  applyPendingWorkspaceReroot(session);
   if (session?.bp3EnvSplit === true) {
     const target = bpEnvSystemMessage(session);
     if (!target || typeof session?.bp3EnvironmentContext !== 'string') return false;