overlord-cli 0.2606081442.0 → 0.2606091312.0

package/bin/_cli/device-identity.d.mts

@@ -0,0 +1,12 @@
+export const CANONICAL_DEVICE_FILE: string;
+
+export function getLegacyDesktopDeviceFilePath(userDataPath: string): string;
+
+export function readOrCreateCanonicalDeviceFingerprintSync(input?: {
+  explicitFingerprint?: string | null | undefined;
+  legacyDesktopUserDataPath?: string | null | undefined;
+}): string;
+
+export function readOrCreateCanonicalDeviceFingerprint(input?: {
+  legacyDesktopUserDataPath?: string | null | undefined;
+}): Promise<string>;

package/bin/_cli/device-identity.mjs

@@ -0,0 +1,92 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+export const CANONICAL_DEVICE_FILE = path.join(os.homedir(), '.ovld', 'device.json');
+
+export function getLegacyDesktopDeviceFilePath(userDataPath) {
+  return path.join(userDataPath, 'overlord-device.json');
+}
+
+function parseDeviceFingerprint(raw) {
+  const parsed = JSON.parse(raw);
+  return typeof parsed.deviceFingerprint === 'string' ? parsed.deviceFingerprint.trim() : '';
+}
+
+function serializeDeviceFingerprint(deviceFingerprint) {
+  return `${JSON.stringify({ deviceFingerprint }, null, 2)}\n`;
+}
+
+function readDeviceFingerprintSync(filePath) {
+  try {
+    const fingerprint = parseDeviceFingerprint(fs.readFileSync(filePath, 'utf8'));
+    return fingerprint || null;
+  } catch {
+    return null;
+  }
+}
+
+async function readDeviceFingerprint(filePath) {
+  try {
+    const fingerprint = parseDeviceFingerprint(await fsp.readFile(filePath, 'utf8'));
+    return fingerprint || null;
+  } catch {
+    return null;
+  }
+}
+
+function writeCanonicalDeviceFingerprintSync(deviceFingerprint) {
+  fs.mkdirSync(path.dirname(CANONICAL_DEVICE_FILE), { recursive: true });
+  fs.writeFileSync(CANONICAL_DEVICE_FILE, serializeDeviceFingerprint(deviceFingerprint), 'utf8');
+}
+
+async function writeCanonicalDeviceFingerprint(deviceFingerprint) {
+  await fsp.mkdir(path.dirname(CANONICAL_DEVICE_FILE), { recursive: true });
+  await fsp.writeFile(CANONICAL_DEVICE_FILE, serializeDeviceFingerprint(deviceFingerprint), 'utf8');
+}
+
+export function readOrCreateCanonicalDeviceFingerprintSync({
+  explicitFingerprint,
+  legacyDesktopUserDataPath
+} = {}) {
+  const explicit = typeof explicitFingerprint === 'string' ? explicitFingerprint.trim() : '';
+  if (explicit) return explicit;
+
+  const canonical = readDeviceFingerprintSync(CANONICAL_DEVICE_FILE);
+  if (canonical) return canonical;
+
+  if (legacyDesktopUserDataPath) {
+    const legacy = readDeviceFingerprintSync(getLegacyDesktopDeviceFilePath(legacyDesktopUserDataPath));
+    if (legacy) {
+      writeCanonicalDeviceFingerprintSync(legacy);
+      return legacy;
+    }
+  }
+
+  const deviceFingerprint = randomUUID();
+  writeCanonicalDeviceFingerprintSync(deviceFingerprint);
+  return deviceFingerprint;
+}
+
+export async function readOrCreateCanonicalDeviceFingerprint({
+  legacyDesktopUserDataPath
+} = {}) {
+  const canonical = await readDeviceFingerprint(CANONICAL_DEVICE_FILE);
+  if (canonical) return canonical;
+
+  if (legacyDesktopUserDataPath) {
+    const legacy = await readDeviceFingerprint(
+      getLegacyDesktopDeviceFilePath(legacyDesktopUserDataPath)
+    );
+    if (legacy) {
+      await writeCanonicalDeviceFingerprint(legacy);
+      return legacy;
+    }
+  }
+
+  const deviceFingerprint = randomUUID();
+  await writeCanonicalDeviceFingerprint(deviceFingerprint);
+  return deviceFingerprint;
+}

package/bin/_cli/protocol.mjs

@@ -703,6 +703,19 @@ function resolveGitRepoRoot(workspacePath) {
   }
 }
 
+// The server caps snapshot.diffStat at 20,000 chars (snapshotContextSchema in
+// lib/overlord/validation.ts). A `git diff --stat` over a large change set can
+// blow past that and make the update POST fail validation. diffstat is purely
+// informational provenance, so truncate it to a safe size before sending.
+const MAX_DIFFSTAT_CHARS = 16_000;
+
+function clampDiffStat(diffStat) {
+  if (typeof diffStat !== 'string' || diffStat.length <= MAX_DIFFSTAT_CHARS) {
+    return diffStat || null;
+  }
+  return `${diffStat.slice(0, MAX_DIFFSTAT_CHARS)}\n… (diffstat truncated; ${diffStat.length} chars total)`;
+}
+
 /**
  * Snapshot the working tree to a hidden ref refs/overlord/checkpoints/<objectiveId>.
  * Captures tracked + untracked + staged + unstaged in one commit-tree object.
@@ -727,9 +740,11 @@ function createLocalCheckpoint({ flags, kind = 'objective', objectiveId, snapsho
       const gitCommitId = runLocalCommand('git', ['-C', repoRoot, 'rev-parse', 'HEAD'], {
         cwd: repoRoot
       }).trim();
-      const diffStat = runLocalCommand('git', ['-C', repoRoot, 'diff', '--stat', 'HEAD'], {
-        cwd: repoRoot
-      }).trim();
+      const diffStat = clampDiffStat(
+        runLocalCommand('git', ['-C', repoRoot, 'diff', '--stat', 'HEAD'], {
+          cwd: repoRoot
+        }).trim()
+      );
       return {
         checkpoint: { diffStat: diffStat || null, kind },
         snapshot: {
@@ -761,9 +776,11 @@ function createLocalCheckpoint({ flags, kind = 'objective', objectiveId, snapsho
   if (existingSha) {
     let diffStat = '';
     try {
-      diffStat = runLocalCommand('git', ['-C', repoRoot, 'diff', '--stat', `${existingSha}^!`], {
-        cwd: repoRoot
-      }).trim();
+      diffStat = clampDiffStat(
+        runLocalCommand('git', ['-C', repoRoot, 'diff', '--stat', `${existingSha}^!`], {
+          cwd: repoRoot
+        }).trim()
+      );
     } catch {
       /* ignore */
     }
@@ -812,9 +829,11 @@ function createLocalCheckpoint({ flags, kind = 'objective', objectiveId, snapsho
     });
     let diffStat = '';
     try {
-      diffStat = runLocalCommand('git', ['-C', repoRoot, 'diff', '--stat', `${commit}^!`], {
-        cwd: repoRoot
-      }).trim();
+      diffStat = clampDiffStat(
+        runLocalCommand('git', ['-C', repoRoot, 'diff', '--stat', `${commit}^!`], {
+          cwd: repoRoot
+        }).trim()
+      );
     } catch {
       /* ignore */
     }
@@ -947,22 +966,31 @@ async function createAndRecordPendingCheckpoints({
       continue;
     }
 
-    await apiPost(
-      platformUrl,
-      bearerToken,
-      localSecret,
-      organizationId,
-      '/api/protocol/update',
-      {
-        sessionKey,
-        ticketId,
-        summary: `Created local git checkpoint for objective ${objectiveId}.`,
-        phase: 'execute',
-        snapshot: checkpointResult.snapshot
-      },
-      timeoutMs
-    );
-    recorded.push(objectiveId);
+    try {
+      await apiPost(
+        platformUrl,
+        bearerToken,
+        localSecret,
+        organizationId,
+        '/api/protocol/update',
+        {
+          sessionKey,
+          ticketId,
+          summary: `Created local git checkpoint for objective ${objectiveId}.`,
+          phase: 'execute',
+          snapshot: checkpointResult.snapshot
+        },
+        timeoutMs
+      );
+      recorded.push(objectiveId);
+    } catch (error) {
+      // A failed checkpoint update must not block the remaining objectives or
+      // the attach itself. The session key is already persisted by the caller.
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(
+        `[protocol] Failed to record checkpoint for objective ${objectiveId}: ${message}\n`
+      );
+    }
   }
   return recorded;
 }
@@ -1275,25 +1303,45 @@ async function protocolAttach(args) {
     timeoutMs
   );
 
-  const recordedCheckpointObjectiveIds = await createAndRecordPendingCheckpoints({
-    attachData: data,
-    bearerToken,
-    flags,
-    localSecret,
-    organizationId,
-    platformUrl,
-    ticketId,
-    timeoutMs
-  });
+  // Persist the new session key BEFORE any best-effort follow-up work. The
+  // checkpoint step below posts a separate /update call whose payload can be
+  // rejected by the server (e.g. a large diffstat exceeding the size cap). If
+  // that throws, we must not lose the freshly minted session key — otherwise a
+  // stale key from a previous ticket lingers in the persisted session file and
+  // every later `ovld protocol` call in this directory resolves the wrong
+  // session. Persisting first guarantees the new key survives a checkpoint
+  // failure. See ticket 1:1430.
+  const sessionKey = data.session?.sessionKey;
+  if (sessionKey) {
+    persistSession(sessionKey, ticketId);
+  }
+
+  // Best-effort: record local git checkpoints for any pending objectives. This
+  // must never abort the attach or prevent the session key from being persisted
+  // and emitted, so swallow any failure (size limits, network, no git repo).
+  let recordedCheckpointObjectiveIds = [];
+  try {
+    recordedCheckpointObjectiveIds = await createAndRecordPendingCheckpoints({
+      attachData: data,
+      bearerToken,
+      flags,
+      localSecret,
+      organizationId,
+      platformUrl,
+      ticketId,
+      timeoutMs
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`[protocol] Checkpoint recording skipped (attach still succeeded): ${message}\n`);
+  }
   if (recordedCheckpointObjectiveIds.length > 0) {
     data.recordedCheckpointObjectiveIds = recordedCheckpointObjectiveIds;
   }
 
-  const sessionKey = data.session?.sessionKey;
   console.log(JSON.stringify(data, null, 2));
 
   if (sessionKey) {
-    persistSession(sessionKey, ticketId);
     // Emit a machine-readable line for easy shell capture:
     // SESSION_KEY=$(ovld protocol attach --ticket-id ... | grep ^SESSION_KEY= | cut -d= -f2)
     process.stderr.write(`\nSESSION_KEY=${sessionKey}\n`);

package/bin/_cli/runner.mjs

@@ -3,7 +3,7 @@
 import { execFileSync, spawn } from 'node:child_process';
 import os from 'node:os';
 
-import { readOrCreateCanonicalDeviceFingerprintSync } from '../../../../lib/overlord/device-identity.mjs';
+import { readOrCreateCanonicalDeviceFingerprintSync } from './device-identity.mjs';
 
 const OVLD_ENTRY = process.argv[1];
 const DEFAULT_TMUX_COMMAND = 'tmux new-session bash {script}';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord-cli",
-  "version": "0.2606081442.0",
+  "version": "0.2606091312.0",
   "description": "Overlord CLI — launch AI agents on tickets from anywhere",
   "homepage": "https://www.ovld.ai/docs/",
   "type": "module",