mixdog 1.2.3 → 1.2.4

package/src/runtime/agent/orchestrator/session/store/liveness-veto.mjs

@@ -1,53 +1,62 @@
 /**
- * Runtime-liveness evidence for the destructive paths (close, detach,
- * delete): the freshness of a session's `.hb` sidecar, the veto rules derived
- * from it and the caller-supplied `isSessionLive` probe.
+ * Runtime-liveness veto for the destructive paths (close, delete): the
+ * caller-supplied `isSessionLive` probe over the daemon's in-memory runtime
+ * state, plus — for the sweep (`legacyOwnerVeto`) — the legacy `.hb` / `.own`
+ * markers an OLDER Mixdog process still running beside this one (mid-upgrade)
+ * keeps publishing. No current build writes those markers; they are only ever
+ * READ here, never refreshed.
  *
  * Separate from the write pipeline on purpose — a veto is a pure READ taken
  * before any commit lock is held, and markSessionClosed / deleteSession must
- * apply exactly the same rules.
+ * apply exactly the same rule.
  */
-import { existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { getStoreDir, deleteHeartbeat } from './paths-heartbeat.mjs';
+import { getStoreDir } from './session-paths.mjs';
+import { probePath, readTextFile, PROBE_PRESENT } from './fs-probe.mjs';
 
-function _heartbeatMtime(id) {
+export const LEGACY_MARKER_SUFFIXES = ['.hb', '.own'];
+// An older live owner rewrote `.hb` every ≤5s mid-turn and `.own` every ~20s
+// while holding the session open; one untouched this long holds nothing.
+export const LEGACY_MARKER_FRESH_MS = 2 * 60 * 1000;
+
+function processAlive(pid) {
   try {
-    const path = join(getStoreDir(), `${id}.hb`);
-    return existsSync(path) ? statSync(path).mtimeMs || 0 : 0;
-  } catch {
-    return 0;
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // ESRCH: no such process. EPERM means the pid exists.
+    return error?.code === 'EPERM';
   }
 }
 
-/**
- * Freshness of a session's `.hb` heartbeat sidecar (0 when absent). Used by
- * the fork-on-resume guard: a fresh heartbeat published by another process
- * means the session is actively being driven there RIGHT NOW.
- */
-export function readSessionHeartbeatMtime(id) {
-  if (!id) return 0;
-  return _heartbeatMtime(id);
-}
-
-export function _runtimeLivenessVeto(id, options = {}) {
-  return typeof options.isSessionLive === 'function' && options.isSessionLive(id);
+/** A legacy marker's evidence, or null when it is not there to judge. The
+ *  marker holds `<msTimestamp>\n<pid>\n`; a pid-less (pre-pid) marker names
+ *  no owner, so it is neither live nor dead. */
+export function readLegacyMarker(path, now = Date.now()) {
+  const probe = probePath(path);
+  if (probe.state !== PROBE_PRESENT) return null;
+  const read = readTextFile(path);
+  const pid = read.state === PROBE_PRESENT ? Number(read.text.split('\n')[1]) || 0 : 0;
+  const alive = pid > 0 && processAlive(pid);
+  return {
+    fresh: now - (probe.mtimeMs || 0) <= LEGACY_MARKER_FRESH_MS,
+    ownerAlive: alive,
+    ownerDead: pid > 0 && !alive,
+  };
 }
 
-export function _heartbeatLivenessVeto(id, options = {}) {
-  const heartbeatMtime = _heartbeatMtime(id);
-  if (!(heartbeatMtime > 0)) return false;
-  const hasHeartbeatSnapshot = Object.hasOwn(options, 'heartbeatSnapshotMtime');
-  const snapshotMtime = Number(options.heartbeatSnapshotMtime) || 0;
-  if (hasHeartbeatSnapshot && heartbeatMtime > snapshotMtime) return true;
-  const freshMs = Number(options.heartbeatFreshMs);
-  return Number.isFinite(freshMs) && freshMs > 0 && Date.now() - heartbeatMtime <= freshMs;
+/** Whether a legacy marker of the session names a live owner pid with a
+ *  fresh heartbeat: that session is driven by another live process. */
+export function _legacyOwnerLivenessVeto(id, now = Date.now()) {
+  if (typeof id !== 'string' || !/^[A-Za-z0-9_-]+$/.test(id)) return false;
+  const dir = getStoreDir();
+  return LEGACY_MARKER_SUFFIXES.some((suffix) => {
+    const marker = readLegacyMarker(join(dir, `${id}${suffix}`), now);
+    return Boolean(marker?.fresh && marker.ownerAlive);
+  });
 }
 
-export function _deleteHeartbeatUnlessNewer(id, options = {}) {
-  const hasHeartbeatSnapshot = Object.hasOwn(options, 'heartbeatSnapshotMtime');
-  const snapshotMtime = Number(options.heartbeatSnapshotMtime) || 0;
-  if (!hasHeartbeatSnapshot || _heartbeatMtime(id) <= snapshotMtime) {
-    deleteHeartbeat(id);
-  }
+export function _runtimeLivenessVeto(id, options = {}) {
+  if (typeof options.isSessionLive === 'function' && options.isSessionLive(id)) return true;
+  return options.legacyOwnerVeto === true && _legacyOwnerLivenessVeto(id);
 }

package/src/runtime/agent/orchestrator/session/store/load-cache.mjs

@@ -8,7 +8,7 @@ import {
   readCanonicalSessionRecord,
   acceptStrictSessionRecords,
 } from './canonical-reader.mjs';
-import { sessionPath } from './paths-heartbeat.mjs';
+import { sessionPath } from './session-paths.mjs';
 import { noteMemoryRelease } from '../../../../shared/idle-gc.mjs';
 
 // Recent full-session reads are much hotter than writes while a user hops

package/src/runtime/agent/orchestrator/session/store/load-session.mjs

@@ -4,7 +4,7 @@
  * snapshot, or the evidence-backed failed-save snapshot. Nothing here writes;
  * the precedence rules are the whole responsibility.
  */
-import { sessionPath } from './paths-heartbeat.mjs';
+import { sessionPath } from './session-paths.mjs';
 import { _savePending } from './pending-saves.mjs';
 import { _liveSessions, _droppedSaveIds, getFailedSaveSnapshot } from './live-state.mjs';
 import { _readStoredSessionCached } from './load-cache.mjs';

package/src/runtime/agent/orchestrator/session/store/session-delete.mjs

@@ -9,7 +9,7 @@ import { isAgentOwner } from '../../agent-owner.mjs';
 import { listStoredAgentWorkerLinks } from '../store-agent-worker-rows.mjs';
 import { listStoredSessionSummaries } from './listing.mjs';
 import { STORED_SESSION_UNREADABLE, _storedSessionFromFile } from './serialize.mjs';
-import { getStoreDir, sessionPath, deleteSessionPresence } from './paths-heartbeat.mjs';
+import { getStoreDir, sessionPath } from './session-paths.mjs';
 import {
   readCanonicalSessionRecord as _readCanonicalRecord,
   CANONICAL_RECORD_UNREADABLE as LIFECYCLE_AMBIGUOUS,
@@ -32,7 +32,7 @@ import {
 import { purgeSessionSaveBookkeeping as _purgeSessionSaveBookkeeping } from './save-worker.mjs';
 import { _uncacheSessionSummary, _queueSessionSummaryRemoval, _cachedSummaryRows } from './summary-cache.mjs';
 import { _savePending, _clearDebounce, _releasePendingSlot } from './pending-saves.mjs';
-import { _runtimeLivenessVeto, _heartbeatLivenessVeto, _deleteHeartbeatUnlessNewer } from './liveness-veto.mjs';
+import { _runtimeLivenessVeto } from './liveness-veto.mjs';
 import { _runSessionPurgeHooks } from './session-observers.mjs';
 import { deleteCompactionArchive } from '../compaction-archive.mjs';
 
@@ -40,8 +40,8 @@ import { deleteCompactionArchive } from '../compaction-archive.mjs';
  * metadata only (the summary rows and the agent-worker links — no folder
  * scan); each candidate's own file is then read strictly and must still be an
  * agent-owned record linked to this parent, so a stale/foreign metadata row
- * can never name a deletion target. Used only by explicit parent deletion;
- * ordinary close/context switches keep the relationship intact. */
+ * can never name a deletion target. Parent deletion no longer removes these
+ * children; they outlive the parent as independent sessions. */
 export function listOwnedAgentSessionIds(ownerSessionId) {
   const ownerId = String(ownerSessionId || '').trim();
   if (!/^[A-Za-z0-9_-]+$/.test(ownerId)) return [];
@@ -78,14 +78,11 @@ function knownSessionCwds(id) {
 export function deleteSession(id, options = {}) {
   // Keep caller probes and all vetoes ahead of the non-reentrant lock and
   // ahead of pending-save disruption, matching markSessionClosed().
-  if (_runtimeLivenessVeto(id, options) || _heartbeatLivenessVeto(id, options)) return false;
+  if (_runtimeLivenessVeto(id, options)) return false;
   const deleteGuard = _guardedSaveOptions(id);
   const commitControl = _acquireWriteCommit(deleteGuard);
   if (commitControl === false) return false;
   try {
-    // Cross-process revival after full-TTL silence remains best-effort; the
-    // tombstone resurrection guard is authoritative. Only re-stat .hb here.
-    if (_heartbeatLivenessVeto(id, options)) return false;
     // ── 1. unlink FIRST, still holding the commit lock ─────────────────────
     // A failed unlink is NOT a delete: the canonical bytes are still there, so
     // nothing may be purged, cancelled or closed — every pending write, parked
@@ -141,9 +138,6 @@ export function deleteSession(id, options = {}) {
     _savePending.delete(id);
     _purgeSessionSaveBookkeeping(id);
     _runSessionPurgeHooks(id, { cwds: knownSessionCwds(id) });
-    // Preserve a sidecar published strictly after the sweep's scan snapshot.
-    _deleteHeartbeatUnlessNewer(id, options);
-    deleteSessionPresence(id);
     // The display-only compaction archive has no meaning without its session.
     deleteCompactionArchive(getStoreDir(), id);
     _clearLiveSession(id);

package/src/runtime/agent/orchestrator/session/store/session-paths.mjs

@@ -0,0 +1,59 @@
+import { existsSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { getPluginData } from '../../config.mjs';
+
+// Session file paths are rebuilt on every load/save/sidecar probe. Memoize the
+// joined strings per data dir: a changed data dir (MIXDOG_DATA_DIR switch)
+// drops the whole memo, and the per-extension maps are bounded.
+const SESSION_PATH_MEMO_LIMIT = 4096;
+let _memoDataDir = null;
+let _memoStoreDir = null;
+const _memoFilePaths = new Map(); // extension → Map<id, path>
+
+function _storeDirPath() {
+  const dataDir = getPluginData();
+  if (dataDir !== _memoDataDir) {
+    _memoDataDir = dataDir;
+    _memoStoreDir = join(dataDir, 'sessions');
+    _memoFilePaths.clear();
+  }
+  return _memoStoreDir;
+}
+
+function _memoFilePath(dir, id, extension) {
+  let byId = _memoFilePaths.get(extension);
+  if (!byId) {
+    byId = new Map();
+    _memoFilePaths.set(extension, byId);
+  }
+  let path = byId.get(id);
+  if (path === undefined) {
+    path = join(dir, _sessionFileName(id, extension));
+    if (byId.size >= SESSION_PATH_MEMO_LIMIT) byId.clear();
+    byId.set(id, path);
+  }
+  return path;
+}
+export function getStoreDir() {
+  const dir = _storeDirPath();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  return dir;
+}
+function _sessionFileName(id, extension) {
+  return `${id}${extension}`;
+}
+// Enforce minted session-id shape before using it in a path to prevent
+// `../` traversal. session IDs are generated by createSession as
+// `sess_<timestamp>_<hex>` — reject anything that doesn't match.
+function _assertSessionId(id) {
+  if (!id || typeof id !== 'string' || !/^[A-Za-z0-9_-]+$/.test(id)) {
+    throw new Error(`[session-store] invalid session id: ${JSON.stringify(id)}`);
+  }
+}
+function _sessionFilePath(id, extension) {
+  _assertSessionId(id);
+  return _memoFilePath(getStoreDir(), id, extension);
+}
+export function sessionPath(id) {
+  return _sessionFilePath(id, '.json');
+}

package/src/runtime/agent/orchestrator/session/store/summary-cache.mjs

@@ -1,7 +1,7 @@
 import { readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getPluginData } from '../../config.mjs';
-import { getStoreDir } from './paths-heartbeat.mjs';
+import { getStoreDir } from './session-paths.mjs';
 import { probePath, PROBE_PRESENT, PROBE_ABSENT } from './fs-probe.mjs';
 import { STORED_SESSION_UNREADABLE, _storedSessionFromFile } from './serialize.mjs';
 import {

package/src/runtime/agent/orchestrator/session/store/sweep/stale-sweep.mjs

@@ -4,7 +4,7 @@
 // sidecars. The generator yields between records so cooperative hosts never
 // hold the event loop for a whole directory scan; the synchronous wrapper
 // drains it in one go.
-import { getStoreDir } from '../paths-heartbeat.mjs';
+import { getStoreDir } from '../session-paths.mjs';
 import { probePath, PROBE_PRESENT } from '../fs-probe.mjs';
 import { persistSweepRecordCache, pruneSweepRecordCache } from './sweep-record.mjs';
 import { collectSweepRows, createSweepTally, resolveSweepPlan } from './sweep-plan.mjs';

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-finish.mjs

@@ -1,17 +1,13 @@
 // sweep/sweep-finish.mjs
 // What runs after every row has its verdict: the resumable-open retention
-// cap, the orphan sidecar reap, and the one batched summary-index prune.
+// cap, the legacy/orphan sidecar reap, and the one batched summary-index prune.
 import { readdirSync, unlinkSync } from 'node:fs';
 import { join } from 'node:path';
 import { probePath, PROBE_PRESENT, PROBE_ABSENT } from '../fs-probe.mjs';
 import { _queueSummaryIndexPrune } from '../summary-cache.mjs';
 import { deleteSession } from '../session-delete.mjs';
 import { COMPACTION_ARCHIVE_SUFFIX } from '../../compaction-archive.mjs';
-import { isSidecarOwnerDead } from '../paths-heartbeat.mjs';
-
-// A live presence owner rewrites `.own` every ~20s; one untouched for the
-// attach guard's whole freshness window holds nothing open.
-const PRESENCE_ORPHAN_AGE_MS = 2 * 60 * 1000;
+import { LEGACY_MARKER_SUFFIXES, readLegacyMarker } from '../liveness-veto.mjs';
 
 /** Retention cap: prune resumable open (non-tombstone) sessions newest-first
  *  — keep the most recent openMaxCount, prune anything older than openMaxAgeMs
@@ -37,8 +33,7 @@ export function pruneOpenCandidates({ plan, now, tally }) {
         deleteSession(c.id, {
           deferSummaryUpdate: true,
           isSessionLive: plan.isSessionLive,
-          heartbeatSnapshotMtime: c.heartbeatSnapshotMtime,
-          heartbeatFreshMs: c.heartbeatFreshMs,
+          legacyOwnerVeto: true,
         })
       ) {
         tally.openPruned++;
@@ -53,40 +48,40 @@ export function pruneOpenCandidates({ plan, now, tally }) {
   }
 }
 
-/** Orphan .hb/.own/compaction-archive reap: a sidecar whose .json no longer
+/** Legacy `.hb` heartbeat and `.own` presence sidecars are written by no
+ *  current build, but an older Mixdog process still running mid-upgrade keeps
+ *  publishing them. One is reaped only once it holds nothing: its recorded
+ *  owner pid is dead or it went stale; a fresh marker of a live (or
+ *  unrecorded) owner is kept. Orphan compaction-archive reap: an archive whose .json no longer
  *  exists is dead weight once it is also stale (older than maxAge) — the
- *  session JSON was swept/closed but the sidecar lingered (crashed owner or
- *  pre-fix orphan). The staleness gate avoids nuking the sidecar of a session
- *  mid-create whose .json write has not landed yet. Yields between sidecars
- *  like the row loop. */
+ *  session JSON was swept/closed but the archive lingered. The staleness gate
+ *  avoids nuking the archive of a session mid-create whose .json write has not
+ *  landed yet. Yields between sidecars like the row loop. */
 export function* reapOrphanSidecars({ plan, dir, now, tally }) {
-  const recordOf = (sidecar) =>
-    sidecar.endsWith(COMPACTION_ARCHIVE_SUFFIX)
-      ? `${sidecar.slice(0, -COMPACTION_ARCHIVE_SUFFIX.length)}.json`
-      : sidecar.replace(/\.(hb|own)$/, '.json');
+  const recordOf = (sidecar) => `${sidecar.slice(0, -COMPACTION_ARCHIVE_SUFFIX.length)}.json`;
+  const unlinkSidecar = (h) => {
+    try {
+      unlinkSync(join(dir, h));
+      tally.cleaned++;
+    } catch {
+      /* ignore */
+    }
+  };
   try {
     for (const h of readdirSync(dir).filter(
       (f) => f.endsWith('.hb') || f.endsWith('.own') || f.endsWith(COMPACTION_ARCHIVE_SUFFIX)
     )) {
       yield undefined;
-      // Only a PROVEN-absent session file makes its sidecar an orphan.
+      if (LEGACY_MARKER_SUFFIXES.some((suffix) => h.endsWith(suffix))) {
+        const marker = readLegacyMarker(join(dir, h), now);
+        if (marker && (marker.ownerDead || !marker.fresh)) unlinkSidecar(h);
+        continue;
+      }
+      // Only a PROVEN-absent session file makes its archive an orphan.
       if (probePath(join(dir, recordOf(h))).state !== PROBE_ABSENT) continue;
       const sidecarProbe = probePath(join(dir, h));
       if (sidecarProbe.state !== PROBE_PRESENT) continue;
-      // A presence sidecar is only ever published while its record exists,
-      // so one without a record whose recorded owner is dead (or which no
-      // live owner refreshed within the presence window) is a leftover of a
-      // deleted session, not a session mid-create.
-      const orphanPresence =
-        h.endsWith('.own') && (now - sidecarProbe.mtimeMs > PRESENCE_ORPHAN_AGE_MS || isSidecarOwnerDead(join(dir, h)));
-      if (orphanPresence || now - sidecarProbe.mtimeMs > plan.maxAge) {
-        try {
-          unlinkSync(join(dir, h));
-          tally.cleaned++;
-        } catch {
-          /* ignore */
-        }
-      }
+      if (now - sidecarProbe.mtimeMs > plan.maxAge) unlinkSidecar(h);
     }
   } catch {
     /* dir scan failure — non-fatal */

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-plan.mjs

@@ -2,7 +2,6 @@
 // One sweep's resolved options (what to sweep and with which bounds), the
 // candidate rows it visits, and the tally it fills in.
 import { readdirSync } from 'node:fs';
-import { loadConfig } from '../../../config.mjs';
 import { listStoredSessionSummaries } from '../listing.mjs';
 import { DEFAULT_SESSION_TTL_MS, RESUMABLE_OPEN_MAX_AGE_MS, RESUMABLE_OPEN_MAX_COUNT } from './sweep-record.mjs';
 
@@ -11,12 +10,6 @@ export function resolveSweepPlan(ttlMs, options = {}) {
     options = ttlMs;
     ttlMs = options.ttlMs;
   }
-  let terminalReapConfig = null;
-  try {
-    terminalReapConfig = loadConfig({ secrets: false });
-  } catch {
-    /* built-ins remain available */
-  }
   const sweepIdle = options.sweepIdle !== false;
   const tombstoneMaxAgeMs = Number(options.tombstoneMaxAgeMs);
   const optAge = Number(options.openMaxAgeMs);
@@ -24,7 +17,6 @@ export function resolveSweepPlan(ttlMs, options = {}) {
   return {
     maxAge: ttlMs || DEFAULT_SESSION_TTL_MS,
     sweepIdle,
-    terminalReapConfig,
     tombstoneMaxAgeMs,
     sweepTombstones: Number.isFinite(tombstoneMaxAgeMs) && tombstoneMaxAgeMs > 0,
     // Retention cap for resumable open sessions runs only on the idle sweep

package/src/runtime/agent/orchestrator/session/store/sweep/sweep-record.mjs

@@ -1,18 +1,14 @@
 // sweep/sweep-record.mjs
 // What the stale-session sweep reads per record and the bounds it decides
-// with: the fingerprint-cached lifecycle record, the linked-agent retention
-// rule, and the idle / retention / blank-scratch thresholds.
+// with: the fingerprint-cached lifecycle record and the
+// idle / retention / blank-scratch thresholds.
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { writeJsonAtomicSync } from '../../../../../shared/atomic-file.mjs';
 import { getPluginData } from '../../../config.mjs';
-import { isAgentOwner } from '../../../agent-owner.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../../lifecycle-scan.mjs';
-import { sessionPath } from '../paths-heartbeat.mjs';
-import { probePath, PROBE_ABSENT } from '../fs-probe.mjs';
 
 export const DEFAULT_SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes idle — aligned with Anthropic 5m messages tier and OpenAI in-memory cache window
-export const AGENT_TERMINAL_STATUSES = new Set(['idle', 'done', 'error']);
 // Hard wall-clock ceiling for sessions stuck in status='running'. The
 // stream-watchdog should abort stalled streams within ~120s, but if it misses
 // one (process crash, watchdog not started, provider never returned), this
@@ -52,7 +48,7 @@ export const BLANK_SCRATCH_MAX_AGE_MS = 60 * 60 * 1000; // 1h
 // running is still parsed again.
 const sweepRecordCache = new Map();
 const SWEEP_RECORD_CACHE_FILE = 'session-sweep-records.json';
-const SWEEP_RECORD_CACHE_VERSION = 1;
+const SWEEP_RECORD_CACHE_VERSION = 2;
 let sweepRecordCacheDataDir = null;
 let sweepRecordCacheDirty = false;
 let sweepRecordParses = 0;
@@ -86,11 +82,13 @@ function syncSweepRecordCache() {
 }
 
 // The only document fields sweep-row reads (effectiveFields, the closed
-// check and retainedLinkedAgent). Caching the whole top-level document kept
+// check). Caching the whole top-level document kept
 // every session's tool catalogs, schemas and provider state alive — one
 // entry per session file, measured at ~290MB of a 470MB daemon heap.
 const SWEEP_DOC_FIELDS = [
   'id',
+  'closed',
+  'closedReason',
   'owner',
   'status',
   'provider',
@@ -172,13 +170,3 @@ export function sweepRecordCacheStats() {
   syncSweepRecordCache();
   return { entries: sweepRecordCache.size, parses: sweepRecordParses };
 }
-
-/** Child-agent transcripts share their visible parent's retention boundary.
- * Presence (including a tombstone or unreadable file) preserves the child;
- * only proven parent absence releases it to ordinary cleanup. */
-export function retainedLinkedAgent(session) {
-  if (!session || !isAgentOwner(session)) return false;
-  const parentId = String(session.ownerSessionId || session.parentSessionId || '').trim();
-  if (!/^[A-Za-z0-9_-]+$/.test(parentId) || parentId === session.id) return false;
-  return probePath(sessionPath(parentId)).state !== PROBE_ABSENT;
-}