mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/session/manager/foreign-pending-messages.mjs

@@ -1,346 +0,0 @@
-import { stat } from 'node:fs/promises';
-import { isProcessAlive } from '../store/paths-heartbeat.mjs';
-import {
-  isCompletionNotificationEntry,
-  isStaleUserInjection,
-  lateDeliveryText,
-  normalizePendingMessageEntry,
-  pendingMessageId,
-  pendingMessageText,
-} from './pending-message-entry.mjs';
-import { isInternalRuntimeNotificationText } from './prompt-utils.mjs';
-import { lifecycleTokenClosed } from './pending-lifecycle-epoch.mjs';
-
-const HANDOFF_RETRY_MS = 1000;
-const HANDOFF_RELEASE_SLACK_MS = 50;
-
-/**
- * One session's spool queue, split into what this process takes and what stays
- * on disk. A foreign user message is taken (and parked with a handoff stamp
- * until the consumer owns a copy); an entry already handed off stays until its
- * release window expires or its owner is gone; everything else is kept.
- *
- * Appends to `request.taken` / `request.released`, tightens
- * `request.rescanDueAt` to the earliest live handoff deadline, and returns the
- * entries the queue keeps.
- */
-function takeForeignMessagesFromQueue(queue, request, handoffReleaseMs) {
-  const now = Date.now();
-  const kept = [];
-  for (const entry of queue) {
-    const id = pendingMessageId(entry);
-    const handoffAt = Number(entry?.handoffAt) || 0;
-    const handoffPid = Number(entry?.handoffPid) || 0;
-    if (handoffAt > 0) {
-      const dueAt = handoffAt + handoffReleaseMs;
-      const expired = now >= dueAt;
-      if (!expired) {
-        request.rescanDueAt = request.rescanDueAt === 0 ? dueAt : Math.min(request.rescanDueAt, dueAt);
-      }
-      if (handoffPid === process.pid) {
-        if (expired) {
-          if (id) request.released.push(id);
-          continue;
-        }
-        kept.push(entry);
-        continue;
-      }
-      if (!expired || isProcessAlive(handoffPid)) {
-        kept.push(entry);
-        continue;
-      }
-    }
-    const text = pendingMessageText(entry);
-    const foreignUser =
-      id &&
-      !request.localIds.has(id) &&
-      !isCompletionNotificationEntry(entry) &&
-      text &&
-      !isInternalRuntimeNotificationText(text);
-    if (!foreignUser) {
-      kept.push(entry);
-      continue;
-    }
-    const normalized = normalizePendingMessageEntry(entry);
-    const structured = Array.isArray(normalized?.content) || Boolean(normalized?.options);
-    let takenText = text;
-    let content = normalized?.content ?? text;
-    if (isStaleUserInjection(entry)) {
-      takenText = lateDeliveryText(text, entry);
-      content = Array.isArray(normalized?.content)
-        ? [{ type: 'text', text: takenText.slice(0, takenText.length - text.length) }, ...normalized.content]
-        : takenText;
-    }
-    request.taken.push({
-      ...(structured ? { content } : {}),
-      text: takenText,
-      id,
-      ...(normalized?.options ? { options: normalized.options } : {}),
-    });
-    // Park rather than delete until the consumer owns a copy.
-    kept.push({ ...entry, handoffAt: now, handoffPid: process.pid });
-  }
-  return kept;
-}
-
-/**
- * Owns cross-process pending-message polling and the durable two-phase handoff.
- * Queue storage and lifecycle authority stay in the parent pending-message
- * service and are supplied as narrow callbacks.
- */
-export class ForeignPendingMessageController {
-  constructor(dependencies) {
-    this._dependencies = dependencies;
-    this._scanLimit = Math.max(128, Number(process.env.MIXDOG_FOREIGN_SPOOL_SCAN_LIMIT) || 512);
-    this._handoffReleaseMs = Math.max(1000, Number(process.env.MIXDOG_FOREIGN_HANDOFF_RELEASE_MS) || 10000);
-    this._releaseTimers = new Map();
-    this._drainRequests = new Map();
-    this._scanMemo = new Map();
-    this._drainScheduled = false;
-    this._drainRunning = false;
-  }
-
-  cancelHandoffRelease(sessionId) {
-    const existing = this._releaseTimers.get(sessionId);
-    if (existing) {
-      try {
-        clearTimeout(existing.timer);
-      } catch {
-        /* best-effort */
-      }
-    }
-    this._releaseTimers.delete(sessionId);
-  }
-
-  async drainUserInjections(sessionId) {
-    const { currentLifecycleToken, isValidSessionId } = this._dependencies;
-    if (!isValidSessionId(sessionId)) return [];
-    // One durable read decides both the epoch and the tombstone refusal.
-    const epochToken = currentLifecycleToken(sessionId);
-    if (lifecycleTokenClosed(epochToken)) return [];
-    return new Promise((resolve) => {
-      const existing = this._drainRequests.get(sessionId);
-      if (existing && existing.epochToken === epochToken) {
-        existing.waiters.push(resolve);
-      } else {
-        if (existing) this._settleDrain(existing, []);
-        this._drainRequests.set(sessionId, {
-          sessionId,
-          epochToken,
-          waiters: [resolve],
-          localIds: null,
-          taken: [],
-          released: [],
-          rescanDueAt: 0,
-          lifecycleDecided: false,
-        });
-      }
-      this._scheduleDrainBatch();
-    });
-  }
-
-  _scheduleHandoffRelease(sessionId, delayMs = this._handoffReleaseMs) {
-    const { isValidSessionId } = this._dependencies;
-    if (!isValidSessionId(sessionId)) return;
-    const delay = Math.max(1, Number(delayMs) || 0);
-    const dueAt = Date.now() + delay;
-    const existing = this._releaseTimers.get(sessionId);
-    if (existing) {
-      if (existing.dueAt <= dueAt) return;
-      try {
-        clearTimeout(existing.timer);
-      } catch {
-        /* best-effort */
-      }
-    }
-    const timer = setTimeout(() => {
-      this._releaseTimers.delete(sessionId);
-      void this._releaseExpiredHandoffs(sessionId);
-    }, delay);
-    // The row is durable; cleanup must not keep a shutting-down process open.
-    try {
-      timer.unref?.();
-    } catch {
-      /* ignore */
-    }
-    this._releaseTimers.set(sessionId, { timer, dueAt });
-  }
-
-  _releaseExpiredHandoffs(sessionId) {
-    const {
-      chainSpoolTail,
-      currentLifecycleToken,
-      getSpoolTail,
-      isValidSessionId,
-      lifecycleEpochMoved,
-      normalizeStore,
-      removeInDeliveryIds,
-      setSpoolQueue,
-      updateSpool,
-      warn,
-    } = this._dependencies;
-    if (!isValidSessionId(sessionId)) return Promise.resolve(0);
-    const epochToken = currentLifecycleToken(sessionId);
-    const released = [];
-    let nextDueIn = 0;
-    const preceding = getSpoolTail(sessionId) || Promise.resolve();
-    const operation = preceding
-      .catch(() => {})
-      .then(() =>
-        updateSpool(sessionId, (raw) => {
-          released.length = 0;
-          nextDueIn = 0;
-          // A generation move transfers ownership; never clean the new queue.
-          if (lifecycleEpochMoved(sessionId, epochToken)) return undefined;
-          const next = normalizeStore(raw);
-          const queue = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
-          if (queue.length === 0) return undefined;
-          const now = Date.now();
-          const kept = [];
-          for (const entry of queue) {
-            const handoffAt = Number(entry?.handoffAt) || 0;
-            const handoffPid = Number(entry?.handoffPid) || 0;
-            if (handoffAt > 0 && handoffPid === process.pid) {
-              const remaining = this._handoffReleaseMs - (now - handoffAt);
-              if (remaining <= 0) {
-                const id = pendingMessageId(entry);
-                if (id) released.push(id);
-                continue;
-              }
-              nextDueIn = nextDueIn === 0 ? remaining : Math.min(nextDueIn, remaining);
-            }
-            kept.push(entry);
-          }
-          if (released.length === 0) return undefined;
-          setSpoolQueue(next, sessionId, kept);
-          next.updatedAt = now;
-          return next;
-        })
-      )
-      .then(() => {
-        if (released.length > 0) removeInDeliveryIds(sessionId, released);
-        if (nextDueIn > 0) {
-          this._scheduleHandoffRelease(sessionId, nextDueIn + HANDOFF_RELEASE_SLACK_MS);
-        }
-        return released.length;
-      })
-      .catch((err) => {
-        warn(`[session] foreign-injection handoff release failed sessionId=${sessionId}: ${err?.message || err}\n`);
-        // The rows remain durable, so contention and I/O failures retry.
-        this._scheduleHandoffRelease(sessionId, HANDOFF_RETRY_MS);
-        return 0;
-      });
-    return chainSpoolTail(sessionId, operation);
-  }
-
-  _rememberScan(sessionId, mtime, rescanDueAt) {
-    this._scanMemo.delete(sessionId);
-    this._scanMemo.set(sessionId, { mtime, rescanDueAt: Number(rescanDueAt) || 0 });
-    while (this._scanMemo.size > this._scanLimit) {
-      const oldest = this._scanMemo.keys().next().value;
-      if (oldest === undefined) break;
-      this._scanMemo.delete(oldest);
-    }
-  }
-
-  _scanNeeded(sessionId, mtime, now) {
-    const memo = this._scanMemo.get(sessionId);
-    if (!memo || memo.mtime !== mtime) return true;
-    return memo.rescanDueAt > 0 && now >= memo.rescanDueAt;
-  }
-
-  _settleDrain(request, value) {
-    for (const resolve of request.waiters) {
-      try {
-        resolve(value);
-      } catch {
-        /* a consumer cannot break the batch */
-      }
-    }
-  }
-
-  _scheduleDrainBatch() {
-    if (this._drainScheduled || this._drainRunning || this._drainRequests.size === 0) return;
-    this._drainScheduled = true;
-    setImmediate(() => {
-      this._drainScheduled = false;
-      void this._flushDrainBatch();
-    });
-  }
-
-  async _flushDrainBatch() {
-    if (this._drainRunning) return;
-    this._drainRunning = true;
-    const batch = [...this._drainRequests.values()];
-    this._drainRequests.clear();
-    try {
-      // Each session drains against its own shard and lock, so one busy
-      // session never delays (or fails) another's intake.
-      await Promise.all(batch.map((request) => this._drainOne(request)));
-    } finally {
-      this._drainRunning = false;
-      this._scheduleDrainBatch();
-    }
-  }
-
-  async _drainOne(request) {
-    const {
-      addInDeliveryIds,
-      lifecycleInvalidated,
-      localIds,
-      normalizeStore,
-      removeInDeliveryIds,
-      setSpoolQueue,
-      spoolPath,
-      updateSpool,
-      warn,
-    } = this._dependencies;
-    const { sessionId, epochToken } = request;
-    try {
-      let mtime = 0;
-      try {
-        mtime = (await stat(spoolPath(sessionId))).mtimeMs || 0;
-      } catch {
-        this._settleDrain(request, []);
-        return;
-      }
-      if (!this._scanNeeded(sessionId, mtime, Date.now()) || lifecycleInvalidated(sessionId, epochToken)) {
-        this._settleDrain(request, []);
-        return;
-      }
-      request.localIds = localIds(sessionId);
-      request.taken = [];
-      request.released = [];
-      request.rescanDueAt = 0;
-      request.lifecycleDecided = false;
-      await updateSpool(
-        sessionId,
-        (raw) => {
-          const next = normalizeStore(raw);
-          if (lifecycleInvalidated(sessionId, epochToken)) return undefined;
-          request.lifecycleDecided = true;
-          const queue = Array.isArray(next.sessions[sessionId]) ? next.sessions[sessionId] : [];
-          if (queue.length === 0) return undefined;
-          const kept = takeForeignMessagesFromQueue(queue, request, this._handoffReleaseMs);
-          if (request.taken.length === 0 && request.released.length === 0) return undefined;
-          setSpoolQueue(next, sessionId, kept);
-          next.updatedAt = Date.now();
-          return next;
-        },
-        { timeoutMs: 0 }
-      );
-      if (request.lifecycleDecided) this._rememberScan(sessionId, mtime, request.rescanDueAt);
-      if (request.taken.length > 0) {
-        addInDeliveryIds(sessionId, request.taken.map((item) => item?.id).filter(Boolean));
-        this._scheduleHandoffRelease(sessionId, this._handoffReleaseMs + HANDOFF_RELEASE_SLACK_MS);
-      }
-      if (request.released.length > 0) removeInDeliveryIds(sessionId, request.released);
-      this._settleDrain(request, request.taken);
-    } catch (err) {
-      if (err?.code !== 'ELOCKCONTENDED') {
-        warn(`[session] foreign-injection drain failed: ${err?.message || err}\n`);
-      }
-      this._settleDrain(request, []);
-    }
-  }
-}

package/src/runtime/agent/orchestrator/session/manager/session-owner-liveness.mjs

@@ -1,117 +0,0 @@
-// manager/session-owner-liveness.mjs
-// Is another live process driving this session right now?
-//
-// Attach-on-resume guard: resuming a session that another live process is
-// ACTIVELY driving right now must not create a second writer on the same
-// file — that split-brain silently freezes one side's transcript (generation
-// ownership drops the loser's saves). Such a resume ATTACHES instead: the
-// caller gets the live transcript flagged remoteAttached, its submits are
-// persisted into the shared pending spool (the owner's injection poller runs
-// them as normal user turns), and its view refreshes from disk. ONE writer,
-// ONE transcript, every surface talking into the same conversation. Idle
-// sessions keep the normal single-identity handoff.
-//
-// The answer comes from three durable signals — the in-process runtime entry,
-// the `.own` presence sidecar and the `.hb` heartbeat — each verified against
-// the pid the sidecar recorded so a force-killed owner can never look live.
-// The session file's own `lastHeartbeatAt`/`clientHostPid` are NOT liveness
-// evidence: the file outlives its writer, and its host pid can name an older
-// process (or a recycled pid), so a restart within the freshness window
-// reopened the session as a viewer whose prompts spooled to nobody.
-import {
-  loadSession,
-  saveSession,
-  readSessionHeartbeatMtime,
-  readSessionPresenceMtime,
-  isSessionPresenceOwnerDead,
-  deleteSessionPresence,
-  isSessionHeartbeatOwnerDead,
-  readSessionHeartbeatOwnerPid,
-  deleteHeartbeat,
-} from '../store.mjs';
-import { _getRuntimeEntry } from './runtime-liveness.mjs';
-import { clearTurnCheckpoint, recoverTurnCheckpoint } from './turn-checkpoint.mjs';
-
-const ACTIVE_OWNER_HB_FRESH_MS = 2 * 60 * 1000; // heartbeat freshness window
-
-export function _isActivelyOwnedElsewhere(_session, sessionId) {
-  // This process already owns the runtime for the id — switching back to
-  // one of our own sessions (desktop tab switch, TUI /resume) never attaches.
-  const entry = _getRuntimeEntry(sessionId);
-  if (entry && entry.closed !== true) return false;
-  // A FORCE-KILLED owner leaves its `.own` sidecar behind looking fresh.
-  // The recorded pid is authoritative: when it no longer exists, the owner
-  // is gone — clear the stale sidecar and resume with normal ownership
-  // instead of viewer-attaching into a spool nobody drains.
-  if (isSessionPresenceOwnerDead(sessionId)) {
-    deleteSessionPresence(sessionId);
-    return false;
-  }
-  const now = Date.now();
-  // Presence (`.own`, pid-verified just above) covers the idle gaps between
-  // turns: a live interactive surface keeps refreshing it (~20s) for its
-  // CURRENT session, so cross-opening an idle-but-open session still
-  // attaches as a viewer instead of splitting ownership into two writers
-  // that clobber each other's saves.
-  const presenceAt = Number(readSessionPresenceMtime(sessionId)) || 0;
-  if (presenceAt > 0 && now - presenceAt <= ACTIVE_OWNER_HB_FRESH_MS) return true;
-  // Heartbeats publish only while a turn is running (≤5s cadence) and the
-  // sidecar is deleted on detach/close, so freshness here means another
-  // process is mid-conversation on this session right now — PROVIDED that
-  // process still exists. Without the pid check a force-killed owner (app
-  // upgrade restart, crash) kept looking live for the whole freshness
-  // window, so every cross-open attached as a viewer and the user's
-  // messages spooled to a queue nobody drains (silently dropped 30m later).
-  if (isSessionHeartbeatOwnerDead(sessionId)) {
-    void deleteHeartbeat(sessionId);
-    return false;
-  }
-  // Fresh sidecar whose recorded pid is alive: a real owner is driving this
-  // session right now. Anything weaker (no sidecar, a pid-less legacy one)
-  // proves no live owner, whatever the session file remembers.
-  const sidecarAt = Number(readSessionHeartbeatMtime(sessionId)) || 0;
-  return sidecarAt > 0 && now - sidecarAt <= ACTIVE_OWNER_HB_FRESH_MS && readSessionHeartbeatOwnerPid(sessionId) > 0;
-}
-
-// Viewer self-heal probe: true when a re-resume of this session would NO
-// LONGER attach (owner dead or every liveness signal stale). Attached
-// surfaces poll this so a dead owner promotes the viewer instead of leaving
-// it spooling messages to nobody. Single source of truth: the same guard
-// the resume path uses.
-export function isSessionOwnerGone(sessionId) {
-  const session = loadSession(sessionId);
-  if (!session) return false;
-  return !_isActivelyOwnedElsewhere(session, sessionId);
-}
-
-export function _recoverTurnCheckpointDurably(session, sessionId) {
-  const recovery = recoverTurnCheckpoint(session);
-  if (!recovery.changed) return recovery;
-  // Recovery is a durable reconnect boundary, not a renderer-only view.
-  // Persist before removing the checkpoint so a second crash leaves at
-  // least one complete copy of the interrupted turn.
-  saveSession(session, {
-    sync: true,
-    expectedGeneration: session.generation,
-  });
-  if (recovery.turnToken) {
-    clearTurnCheckpoint(sessionId, recovery.turnToken);
-  }
-  // A force-killed owner cannot clear its activity/presence sidecars. Once
-  // its checkpoint is committed as interrupted, neither sidecar may keep a
-  // restored pane busy or make a new prompt queue behind a dead process.
-  deleteSessionPresence(sessionId);
-  void deleteHeartbeat(sessionId);
-  return recovery;
-}
-
-// Reconnect-safe historical read used by desktop pane peeks. Unlike a normal
-// read-only load, it resolves a dead owner's durable turn checkpoint before
-// returning the transcript. A genuinely live foreign owner remains untouched.
-export function recoverSessionAfterProcessRestart(sessionId) {
-  const session = loadSession(sessionId);
-  if (!session || session.closed === true) return session || null;
-  if (_isActivelyOwnedElsewhere(session, sessionId)) return session;
-  _recoverTurnCheckpointDurably(session, sessionId);
-  return session;
-}