osborn 0.9.50 → 0.9.52

package/dist/index.js

@@ -165,6 +165,30 @@ const livekitState = {
     lastAttemptAt: null,
     attemptCount: 0,
 };
+// ── Room-presence lifecycle (2026-06-09) ──────────────────────────────────────
+// The agent used to eager-connect to LiveKit on boot and hold the room for the
+// machine's entire life. With 1 participant (the agent itself), LiveKit never
+// considers the room empty, so it never closes — a single forgotten session
+// burned 25h of connection-minutes (room osborn-jzs94j) before we caught it.
+//
+// Fix: the agent now LEAVES the LiveKit room when no user is present, and only
+// rejoins when a user actually connects. Two triggers, both feeding room.disconnect():
+//   1. Agent-side "alone" timer — armed in ParticipantDisconnected once a real
+//      session has ended; if no user rejoins within ALONE_GRACE_MS, the agent
+//      leaves on its own. This is tab-close-proof (does not depend on the
+//      frontend's JS still running — the exact gap that let the 25h room linger).
+//   2. POST /leave-room — the frontend's explicit "leave" button leaves instantly.
+// Rejoin happens via POST /connect-room (frontend connect flow) which re-runs the
+// connect-with-retry loop.
+//
+// `intentionalLeave` distinguishes a voluntary leave from an involuntary LiveKit
+// eviction. The ghost-agent fix in RoomEvent.Disconnected auto-rejoins on drop;
+// that must NOT fire after a voluntary leave (it would recreate the burn we just
+// stopped). The hooks below are populated by main() (which owns `room` and the
+// connect-with-retry loop) so the module-level HTTP server can drive them.
+let intentionalLeave = false;
+let connectRoomHook = null;
+let leaveRoomHook = null;
 function startApiServer(workingDir, port) {
     const server = createServer(async (req, res) => {
         // CORS headers for cloud frontend
@@ -282,6 +306,32 @@ function startApiServer(workingDir, port) {
             res.end(JSON.stringify({ roomCode: currentRoomCode }));
             return;
         }
+        // POST /connect-room — the frontend connect flow calls this so the agent
+        // joins LiveKit for an incoming user. Idempotent: if already connected it's
+        // a no-op. Must complete (agent in room) BEFORE the user joins, because the
+        // voice session is created from the ParticipantConnected event, which only
+        // fires for participants who join AFTER the agent. The frontend polls
+        // /health for livekit.status==='connected' before minting its token.
+        if (req.method === 'POST' && url.pathname === '/connect-room') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true, status: livekitState.status }));
+            if (connectRoomHook) {
+                connectRoomHook().catch((e) => console.error('❌ /connect-room hook failed:', e));
+            }
+            return;
+        }
+        // POST /leave-room — the frontend's explicit "leave"/disconnect leaves the
+        // LiveKit room immediately so connection-minute burn stops the instant the
+        // user is done (no waiting for the agent-side alone timer). Sets
+        // intentionalLeave so the Disconnected handler does NOT auto-rejoin.
+        if (req.method === 'POST' && url.pathname === '/leave-room') {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: true }));
+            if (leaveRoomHook) {
+                leaveRoomHook('frontend_leave').catch((e) => console.error('❌ /leave-room hook failed:', e));
+            }
+            return;
+        }
         // POST /restart — graceful process restart (process manager will restart)
         if (req.method === 'POST' && url.pathname === '/restart') {
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1069,6 +1119,35 @@ async function main() {
     let currentSession = null;
     let currentAgent = null; // For updateChatCtx() context injection
     let currentLLM = null;
+    // Agent-side "alone in room" leave timer (see Room-presence lifecycle note up
+    // top). Armed in ParticipantDisconnected once a user has left; if no one
+    // rejoins within the grace window the agent leaves LiveKit on its own.
+    // Cancelled in ParticipantConnected. 3 min: long enough to ride out a brief
+    // reconnect (page refresh, network blip), short enough that a forgotten
+    // session costs ~3 min of connection-minutes instead of hours.
+    let aloneTimer = null;
+    const ALONE_GRACE_MS = 3 * 60 * 1000;
+    // Arm (or re-arm) the alone timer: if no remote participant is present, leave
+    // the LiveKit room after the grace window. Called on Connected (covers a
+    // machine woken but then abandoned before the user joined) and on
+    // ParticipantDisconnected (covers a finished session). Cancelled the moment a
+    // user joins. Net invariant: the agent never holds an empty room beyond
+    // ALONE_GRACE_MS, in any scenario — the root cause of the 25h burn.
+    const armAloneTimer = () => {
+        if (aloneTimer)
+            clearTimeout(aloneTimer);
+        aloneTimer = null;
+        if (room.remoteParticipants.size > 0)
+            return;
+        aloneTimer = setTimeout(() => {
+            aloneTimer = null;
+            if (room.remoteParticipants.size === 0 && livekitState.status === 'connected') {
+                console.log(`🕊️ Alone in room ${ALONE_GRACE_MS / 1000}s — leaving LiveKit to stop connection-minute burn`);
+                intentionalLeave = true;
+                room.disconnect().catch((e) => console.error('alone-leave room.disconnect failed:', e));
+            }
+        }, ALONE_GRACE_MS);
+    };
     /**
      * Hard-kill the in-flight Claude SDK query AND the persistent subprocess.
      *
@@ -1092,6 +1171,21 @@ async function main() {
             return;
         try {
             const llm = currentLLM;
+            // Heap-OOM fix (2026-06-02): stop the PipelineDirectLLM summary-index
+            // watcher BEFORE we abort + drop the reference. The watcher is a 10s
+            // setInterval whose closure retains the entire PipelineDirectLLM →
+            // ClaudeLLM object graph. killCurrentLLM is the single chokepoint all
+            // three cleanup sites (Disconnected, previous-session-cleanup,
+            // ParticipantDisconnected) call, but it previously only aborted the
+            // SDK subprocess — leaving the interval (and the whole graph) alive and
+            // uncollectable on every disconnect/reconnect. A reconnect-heavy session
+            // (e.g. 15 reconnects from a frontend redeploy) leaked 15 timers + 15
+            // retained graphs, each re-reading JSONL every 10s, until the node heap
+            // OOM'd (~980MB) and the process crashed. Stopping the watcher here lets
+            // the abandoned graph be GC'd. Duck-typed: only PipelineDirectLLM has it.
+            if (typeof llm.stopIndexWatcher === 'function') {
+                llm.stopIndexWatcher();
+            }
             if (typeof llm.abortQuery === 'function') {
                 llm.abortQuery();
             }
@@ -2490,6 +2584,10 @@ async function main() {
     room.on(RoomEvent.Connected, () => {
         console.log('✅ Connected to room:', roomName);
         localParticipant = room.localParticipant;
+        // Arm the alone timer: if we connected but no user joins within the grace
+        // window (e.g. machine woken then abandoned mid-handshake), leave the room
+        // rather than hold it indefinitely. Cancelled in ParticipantConnected.
+        armAloneTimer();
     });
     // NOTE: previously this section also had a RoomEvent.ActiveSpeakersChanged
     // handler that interrupted TTS on any sustained audio activity (~50ms after
@@ -2544,6 +2642,20 @@ async function main() {
         //
         // Note: we mark status='retrying' immediately so /health reflects the real
         // state — closing the lie window between Disconnected and the next attempt.
+        // ── Voluntary-leave guard (2026-06-09) ──
+        // If we left the room ON PURPOSE (user clicked leave → /leave-room, or the
+        // agent-side alone timer fired), do NOT auto-rejoin — rejoining would
+        // recreate the connection-minute burn we just stopped. Mark the connection
+        // 'idle' (machine stays warm, /health still 200) and wait for the next
+        // /connect-room. Reset the flag so a later involuntary drop still rejoins.
+        if (intentionalLeave) {
+            intentionalLeave = false;
+            livekitState.status = 'idle';
+            livekitState.error = null;
+            livekitState.errorCode = null;
+            console.log('🕊️ Left LiveKit room intentionally — idle, awaiting /connect-room (no auto-rejoin)');
+            return;
+        }
         livekitState.status = 'retrying';
         livekitState.error = 'LiveKit room disconnected; attempting to rejoin';
         livekitState.errorCode = 'disconnected';
@@ -2554,6 +2666,11 @@ async function main() {
     });
     room.on(RoomEvent.ParticipantConnected, async (participant) => {
         console.log(`\n👤 User joined: ${participant.identity}`);
+        // A user is present — cancel any pending agent-side "alone" leave.
+        if (aloneTimer) {
+            clearTimeout(aloneTimer);
+            aloneTimer = null;
+        }
         // Wait for previous session's byte stream handler to fully deregister.
         // Quick reconnects (< ~6s) crash with "byte stream handler already set" without this.
         if (pendingSessionClose) {
@@ -3276,6 +3393,10 @@ async function main() {
                 activeMeetingBotId = null;
             }
         }
+        // Arm the agent-side "alone" leave timer (tab-close-proof — runs on the
+        // agent, not the frontend, so it fires even if the user closed the tab
+        // without clicking leave).
+        armAloneTimer();
         console.log('⏳ Waiting for new user...\n');
     });
     room.on(RoomEvent.DataReceived, async (payload, participant, kind, topic) => {
@@ -4077,6 +4198,36 @@ async function main() {
             }
         }
     };
+    // Wire the module-level HTTP control hooks now that `room` and the
+    // connect-with-retry loop exist (see Room-presence lifecycle note up top).
+    // The /connect-room and /leave-room endpoints in startApiServer call these.
+    connectRoomHook = async () => {
+        intentionalLeave = false;
+        if (aloneTimer) {
+            clearTimeout(aloneTimer);
+            aloneTimer = null;
+        }
+        if (livekitState.status === 'connected')
+            return; // already in the room — no-op
+        console.log('🔌 /connect-room — joining LiveKit for incoming user');
+        await connectWithRetry();
+    };
+    leaveRoomHook = async (reason) => {
+        if (aloneTimer) {
+            clearTimeout(aloneTimer);
+            aloneTimer = null;
+        }
+        if (livekitState.status !== 'connected')
+            return; // already out — no-op
+        intentionalLeave = true;
+        console.log(`🚪 Leaving LiveKit room (${reason}) — stops connection-minute burn`);
+        try {
+            await room.disconnect();
+        }
+        catch (e) {
+            console.error('leave-room room.disconnect failed:', e);
+        }
+    };
     // Fire and forget; the retry loop keeps the process alive on its own (so
     // we don't need the explicit `new Promise(() => {})` keepalive anymore).
     // Errors that escape the retry loop should never happen, but if they do,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.50",
+  "version": "0.9.52",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {