mixdog 1.2.2 → 1.2.4

package/src/runtime/agent/orchestrator/session/store/paths-heartbeat.mjs

@@ -1,246 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync } from 'node:fs';
-import * as fsp from 'node:fs/promises';
-import { join } from 'node:path';
-import { getPluginData } from '../../config.mjs';
-
-// Session file paths are rebuilt on every load/save/sidecar probe. Memoize the
-// joined strings per data dir: a changed data dir (MIXDOG_DATA_DIR switch)
-// drops the whole memo, and the per-extension maps are bounded.
-const SESSION_PATH_MEMO_LIMIT = 4096;
-let _memoDataDir = null;
-let _memoStoreDir = null;
-const _memoFilePaths = new Map(); // extension → Map<id, path>
-
-function _storeDirPath() {
-  const dataDir = getPluginData();
-  if (dataDir !== _memoDataDir) {
-    _memoDataDir = dataDir;
-    _memoStoreDir = join(dataDir, 'sessions');
-    _memoFilePaths.clear();
-  }
-  return _memoStoreDir;
-}
-
-function _memoFilePath(dir, id, extension) {
-  let byId = _memoFilePaths.get(extension);
-  if (!byId) {
-    byId = new Map();
-    _memoFilePaths.set(extension, byId);
-  }
-  let path = byId.get(id);
-  if (path === undefined) {
-    path = join(dir, _sessionFileName(id, extension));
-    if (byId.size >= SESSION_PATH_MEMO_LIMIT) byId.clear();
-    byId.set(id, path);
-  }
-  return path;
-}
-export function getStoreDir() {
-  const dir = _storeDirPath();
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  return dir;
-}
-function _sessionFileName(id, extension) {
-  return `${id}${extension}`;
-}
-// Enforce minted session-id shape before using it in a path to prevent
-// `../` traversal. session IDs are generated by createSession as
-// `sess_<timestamp>_<hex>` — reject anything that doesn't match.
-function _assertSessionId(id) {
-  if (!id || typeof id !== 'string' || !/^[A-Za-z0-9_-]+$/.test(id)) {
-    throw new Error(`[session-store] invalid session id: ${JSON.stringify(id)}`);
-  }
-}
-function _sessionFilePath(id, extension) {
-  _assertSessionId(id);
-  return _memoFilePath(getStoreDir(), id, extension);
-}
-export function sessionPath(id) {
-  return _sessionFilePath(id, '.json');
-}
-
-// ── Sidecar owner-pid helpers ─────────────────────────────
-// Liveness sidecars record the publishing process id on their SECOND line so
-// a reader can tell a genuinely live owner from a force-killed one whose
-// timestamp still looks fresh. Legacy (pid-less) sidecars read back as 0.
-export function isProcessAlive(pid) {
-  const target = Number(pid) || 0;
-  if (target <= 0) return false;
-  try {
-    process.kill(target, 0);
-    return true;
-  } catch (error) {
-    // ESRCH: no such process. EPERM means the pid exists (alive).
-    return error?.code !== 'ESRCH';
-  }
-}
-
-function _readSidecarOwnerPid(path) {
-  try {
-    return Number(String(readFileSync(path, 'utf8')).split('\n')[1]) || 0;
-  } catch {
-    return 0;
-  }
-}
-
-// ── Heartbeat publish ─────────────────────────────────────
-// Lightweight per-session timestamp file (`<id>.hb`) consumed by the
-// status aggregator for fresh-session detection. Decoupled from the
-// full session JSON save so it can fire at a tight cadence (≤5s)
-// without serialising the whole payload. The .hb file holds
-// `<msTimestamp>\n<pid>\n` — readers that only need liveness use the file
-// mtime, while the attach-on-resume guard verifies the recorded pid.
-// Aggregator scans the same sessions/ directory and matches `<id>.hb` to
-// `<id>.json`.
-const _HEARTBEAT_THROTTLE_MS = 5_000;
-const _hbLastAt = new Map();
-const _hbOperations = new Map();
-
-function _queueHeartbeatOperation(id, operation) {
-  const prior = _hbOperations.get(id) || Promise.resolve();
-  const next = prior.then(operation, operation).catch(() => {});
-  _hbOperations.set(id, next);
-  void next.then(() => {
-    if (_hbOperations.get(id) === next) _hbOperations.delete(id);
-  });
-  return next;
-}
-
-function _heartbeatPath(id) {
-  return _sessionFilePath(id, '.hb');
-}
-
-export function publishHeartbeat(id, ts) {
-  if (!id) return Promise.resolve();
-  const now = ts || Date.now();
-  const last = _hbLastAt.get(id) || 0;
-  if (now - last < _HEARTBEAT_THROTTLE_MS) {
-    return _hbOperations.get(id) || Promise.resolve();
-  }
-  const target = _heartbeatPath(id);
-  _hbLastAt.set(id, now);
-  return _queueHeartbeatOperation(id, () => fsp.writeFile(target, `${now}\n${process.pid}\n`, 'utf8'));
-}
-
-export function deleteHeartbeat(id) {
-  if (!id) return Promise.resolve();
-  // Deleting needs no directory: skip getStoreDir's synchronous probe.
-  _assertSessionId(id);
-  const target = _memoFilePath(_storeDirPath(), id, '.hb');
-  // One ordered async delete behind any pending write for this id. It starts
-  // on the next microtask when nothing is pending, so the marker still drops
-  // at once, without a synchronous unlink on the turn-settle path. Queuing it
-  // (rather than deleting beside the write) keeps a write started just before
-  // turn completion from landing after the delete and resurrecting the
-  // session's working badge for the full freshness window.
-  _hbLastAt.delete(id);
-  return _queueHeartbeatOperation(id, () => fsp.unlink(target).catch(() => {}));
-}
-
-// Batch reader for session catalogs. Scanning only the handful of `.hb`
-// sidecars avoids one failed stat per historical session while still exposing
-// cross-process turn activity to desktop/TUI resume lists.
-export function listSessionHeartbeatMtimes() {
-  const result = new Map();
-  try {
-    const dir = getStoreDir();
-    for (const filename of readdirSync(dir)) {
-      if (!filename.endsWith('.hb')) continue;
-      const id = filename.slice(0, -3);
-      if (!/^[A-Za-z0-9_-]+$/.test(id)) continue;
-      try {
-        const mtime = statSync(join(dir, filename)).mtimeMs || 0;
-        if (mtime > 0) result.set(id, mtime);
-      } catch {
-        /* sidecar disappeared after readdir */
-      }
-    }
-  } catch {
-    /* catalog activity is best-effort */
-  }
-  return result;
-}
-
-// Owner pid recorded in the `<id>.hb` sidecar (0 when absent or written by a
-// pre-pid build).
-export function readSessionHeartbeatOwnerPid(id) {
-  if (!id) return 0;
-  try {
-    return _readSidecarOwnerPid(_heartbeatPath(id));
-  } catch {
-    return 0;
-  }
-}
-
-// A killed owner never deletes its `.hb` sidecar, so bare mtime freshness
-// would keep the session "actively driven" for the whole freshness window and
-// every cross-open would attach as a viewer whose submits spool to nobody.
-// The recorded pid is authoritative proof; pid-less legacy sidecars return
-// false (unknown, not dead).
-export function isSessionHeartbeatOwnerDead(id) {
-  const pid = readSessionHeartbeatOwnerPid(id);
-  if (!pid) return false;
-  return !isProcessAlive(pid);
-}
-
-// ── Interactive presence publish ──────────────────────────
-// `<id>.own` marks a live interactive surface (TUI/desktop engine) HOLDING
-// the session open — including idle time between turns. Kept separate from
-// `.hb` (turn-activity signal consumed by the status aggregator and deleted
-// at turn end) so idle presence never fakes a "running" badge. Consumed by
-// the attach-on-resume guard (_isActivelyOwnedElsewhere): fresh presence
-// means a cross-open must attach as a viewer instead of claiming a second
-// writer on the same session file (dual-writer last-save-wins clobbering).
-// Refreshed by the engine share tick (~3s call, throttled here) and cleared
-// on session switch/dispose; staleness covers crashes.
-const _PRESENCE_THROTTLE_MS = 20_000;
-const _presenceLastAt = new Map();
-
-function _presencePath(id) {
-  return _sessionFilePath(id, '.own');
-}
-
-export function publishSessionPresence(id, ts) {
-  if (!id) return;
-  const now = ts || Date.now();
-  const last = _presenceLastAt.get(id) || 0;
-  if (now - last < _PRESENCE_THROTTLE_MS) return;
-  const target = _presencePath(id);
-  _presenceLastAt.set(id, now);
-  void fsp.writeFile(target, `${now}\n${process.pid}\n`, 'utf8').catch(() => {});
-}
-
-export function deleteSessionPresence(id) {
-  if (!id) return;
-  try {
-    unlinkSync(_presencePath(id));
-  } catch {
-    /* ignore */
-  }
-  _presenceLastAt.delete(id);
-}
-
-export function readSessionPresenceMtime(id) {
-  if (!id) return 0;
-  try {
-    return statSync(_presencePath(id)).mtimeMs || 0;
-  } catch {
-    return 0;
-  }
-}
-
-// A force-killed owner never clears its presence sidecar, so bare mtime
-// freshness would lock every resume inside the window into viewer mode with
-// nobody draining the shared spool. The `.own` payload records the holder's
-// pid; a recorded-but-dead pid is authoritative proof the owner is gone.
-export function isSessionPresenceOwnerDead(id) {
-  if (!id) return false;
-  let pid = 0;
-  try {
-    pid = _readSidecarOwnerPid(_presencePath(id));
-  } catch {
-    return false;
-  }
-  if (!pid) return false;
-  return !isProcessAlive(pid);
-}

package/src/session-runtime/services/agent-tool/terminal-reaper/reap-timers.mjs

@@ -1,142 +0,0 @@
-// Delayed reap timers: arm a terminal row's deadline, fire the reap when it
-// elapses, and rebuild the timers after a process restart.
-import { clean, clearAgentStatuslineRoute } from '../helpers.mjs';
-import { workerRowTime } from '../worker-rows.mjs';
-import { resolveAgentTerminalReapMs } from '../../../../runtime/agent/orchestrator/runtime-core/config-helpers.mjs';
-import { isTerminalRow } from './row-helpers.mjs';
-
-export function createReapTimers({ cfgMod, mgr, index, getLiveSession, tagForSession, tombstoneTerminalSession }) {
-  const { readWorkerRows, writeWorkerRows, flushWorkerIndexMutations } = index;
-  const reapTimers = new Map();
-  // sessionId -> the reapAt a live timer was armed for. Lets a repeated session
-  // scan recognise an already-armed deadline instead of re-arming (and thus
-  // re-stamping) the same terminal lease on every list read.
-  const scheduledReapAt = new Map();
-
-  function isArmedFor(sessionId, reapAt) {
-    return reapTimers.has(sessionId) && scheduledReapAt.get(sessionId) === reapAt;
-  }
-
-  /** closeAll() drops every timer wholesale; the armed-deadline bookkeeping
-   * must go with them or a later scan would trust a timer that no longer runs. */
-  function clearScheduledReaps() {
-    scheduledReapAt.clear();
-  }
-
-  function cancelReap(sessionId) {
-    const handle = reapTimers.get(sessionId);
-    scheduledReapAt.delete(sessionId);
-    if (!handle) return false;
-    clearTimeout(handle);
-    reapTimers.delete(sessionId);
-    return true;
-  }
-
-  function reapTerminalRow(row) {
-    const sessionId = clean(row?.sessionId);
-    const reapAt = clean(row?.reapAt);
-    const tag = clean(row?.tag) || tagForSession(sessionId);
-    if (!sessionId || !reapAt || !tag) return false;
-    const session = getLiveSession(sessionId);
-    if (!tombstoneTerminalSession(tag, sessionId, session, reapAt)) return false;
-    try {
-      mgr.hideSessionFromList?.(sessionId);
-    } catch {}
-    clearAgentStatuslineRoute(sessionId);
-    // Reaping expires only the reusable tag/runtime lease. The transcript is
-    // user-visible from the parent task's agent tab, so terminal cleanup must
-    // never tombstone it ahead of that parent.
-    try {
-      mgr.unloadSessionRuntime?.(sessionId, 'terminal-reap');
-    } catch {}
-    return true;
-  }
-
-  function schedulePersistedReap(row) {
-    const sessionId = clean(row?.sessionId);
-    const reapAt = clean(row?.reapAt);
-    const deadline = Date.parse(reapAt) || 0;
-    if (!sessionId || !deadline) return false;
-    cancelReap(sessionId);
-    const handle = setTimeout(
-      () => {
-        reapTimers.delete(sessionId);
-        scheduledReapAt.delete(sessionId);
-        reapTerminalRow(row);
-      },
-      Math.max(0, deadline - Date.now())
-    );
-    handle.unref?.();
-    reapTimers.set(sessionId, handle);
-    scheduledReapAt.set(sessionId, reapAt);
-    return true;
-  }
-
-  function scheduleReap(sessionId, provider = null) {
-    const id = clean(sessionId);
-    if (!id) return false;
-    cancelReap(id);
-    // The terminal upsert is deferred to batch parallel fanout writes. Flush it
-    // before stamping the deadline so reapAt and the terminal state land in one
-    // durable lifecycle order.
-    flushWorkerIndexMutations();
-    const row = readWorkerRows().find((entry) => clean(entry.sessionId) === id);
-    if (!row || !isTerminalRow(row)) return false;
-    const reapProvider = clean(provider) || clean(row.provider) || clean(getLiveSession(id)?.provider) || null;
-    const reapMs = resolveAgentTerminalReapMs(cfgMod.loadConfig(), reapProvider);
-    const reapAt = reapMs == null ? null : new Date(Date.now() + reapMs).toISOString();
-    let persisted = null;
-    writeWorkerRows((byKey) => {
-      for (const [key, current] of byKey.entries()) {
-        if (clean(current.sessionId) !== id) continue;
-        if (!isTerminalRow(current)) return;
-        persisted = { ...current, reapAt };
-        byKey.set(key, persisted);
-        return;
-      }
-    });
-    return persisted?.reapAt ? schedulePersistedReap(persisted) : false;
-  }
-
-  /** Rebuild child terminal timers after a process restart. Legacy rows have
-   * no reapAt, so derive the original absolute deadline from their frozen
-   * terminal stamp instead of granting a fresh full lease on every boot. */
-  function recoverTerminalReaps() {
-    flushWorkerIndexMutations();
-    const now = Date.now();
-    const recovered = [];
-    writeWorkerRows((byKey) => {
-      for (const [key, row] of byKey.entries()) {
-        if (!isTerminalRow(row)) continue;
-        let reapAt = clean(row.reapAt);
-        if (!(Date.parse(reapAt) > 0)) {
-          const reapMs = resolveAgentTerminalReapMs(cfgMod.loadConfig(), row.provider);
-          if (reapMs == null) continue;
-          const terminalAt = workerRowTime(row);
-          // A timestamp-free legacy row cannot prove that its grace already
-          // elapsed. Give it one normal window from recovery; timestamped rows
-          // keep their original completion-based deadline.
-          reapAt = new Date((terminalAt > 0 ? terminalAt : now) + reapMs).toISOString();
-        }
-        const next = { ...row, reapAt };
-        byKey.set(key, next);
-        recovered.push(next);
-      }
-    });
-    for (const row of recovered) {
-      if ((Date.parse(row.reapAt) || 0) <= now) reapTerminalRow(row);
-      else schedulePersistedReap(row);
-    }
-  }
-
-  return {
-    reapTimers,
-    isArmedFor,
-    clearScheduledReaps,
-    cancelReap,
-    reapTerminalRow,
-    schedulePersistedReap,
-    scheduleReap,
-    recoverTerminalReaps,
-  };
-}

package/src/session-runtime/turn/share-ops.mjs

@@ -1,77 +0,0 @@
-/**
- * src/session-runtime/turn/share-ops.mjs - cross-surface session sharing on
- * the owner side: pending-spool intake, presence beacon, and the viewer's
- * owner-liveness probe.
- */
-export function createShareOps({ getSession, getActiveTurnCount, mgr, isSessionAdmissionOpen }) {
-  // Owner-side injection intake: foreign user messages persisted into the
-  // shared spool by an attached surface. Engine pollers call this while
-  // idle and run each returned text through the normal submit queue.
-  async function takeRemoteInjections() {
-    const session = getSession();
-    if (!session?.id || session.remoteAttached) return [];
-    // Pending-spool intake is an admission route: a fenced/closed owner leaves
-    // the spool untouched.
-    if (isSessionAdmissionOpen && !isSessionAdmissionOpen()) return [];
-    if (getActiveTurnCount() > 0) return [];
-    try {
-      return (await mgr.drainForeignUserInjections?.(session.id)) || [];
-    } catch {
-      return [];
-    }
-  }
-
-  // Absolute path of THIS session's pending spool shard. Live-share owners
-  // fs.watch it for instant cross-surface input pickup; empty string when
-  // there is no session or the store is unavailable (callers fall back to the
-  // poll tick).
-  function pendingSpoolPath() {
-    try {
-      return mgr.pendingMessagesSpoolPath?.(getSession()?.id) || '';
-    } catch {
-      return '';
-    }
-  }
-
-  // Interactive-presence beacon (engine share tick): mark the CURRENT
-  // session as held open by this live surface — idle time included — so a
-  // cross-open from another surface attaches as a viewer instead of
-  // splitting ownership into two writers. No-op while THIS surface is the
-  // viewer. Returns the held id so the caller can clear a previous
-  // session's beacon after a switch.
-  function publishSessionPresence() {
-    const session = getSession();
-    if (!session?.id || session.remoteAttached) return null;
-    try {
-      mgr.publishSessionPresence?.(session.id);
-    } catch {
-      /* best-effort */
-    }
-    return session.id;
-  }
-
-  function clearSessionPresence(id) {
-    const target = id || getSession()?.id;
-    if (!target) return;
-    try {
-      mgr.deleteSessionPresence?.(target);
-    } catch {
-      /* best-effort */
-    }
-  }
-
-  // Live-owner liveness probe for the viewer self-heal tick: true when a
-  // re-resume would no longer attach (owner pid dead or every liveness
-  // signal stale) — i.e. nobody is draining this session's spool anymore.
-  function sessionOwnerGone(id) {
-    const target = id || getSession()?.id;
-    if (!target) return false;
-    try {
-      return mgr.isSessionOwnerGone?.(target) === true;
-    } catch {
-      return false;
-    }
-  }
-
-  return { takeRemoteInjections, pendingSpoolPath, publishSessionPresence, clearSessionPresence, sessionOwnerGone };
-}