passalong 0.19.0 → 0.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passalong",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Hand tasks, bugs and finished work to AI coding agents, and get back a write-up with evidence.",
   "mcpName": "io.github.codellyson/passalong",
   "keywords": [

package/src/api.js

@@ -120,6 +120,19 @@ export function loggedIn() {
   return Boolean(token());
 }
 
+/**
+ * Every login this machine holds, as `{ token, api }` for a call's `as`: each kept account and the
+ * one in use, once each. For work that belongs to all of them, like `tidy`, rather than to one.
+ */
+export function logins() {
+  const all = Object.values(readAccounts())
+    .filter((a) => a.token)
+    .map((a) => ({ token: a.token, api: a.api || readConfig().api || DEFAULT_API }));
+  if (token()) all.push({ token: token(), api: baseUrl() });
+  const seen = new Set();
+  return all.filter((a) => !seen.has(`${a.token} ${a.api}`) && seen.add(`${a.token} ${a.api}`));
+}
+
 /** The team this account works in. It belongs to the account, not the machine. */
 export function currentTeam() {
   const p = picked();
@@ -149,12 +162,12 @@ export { nameFor };
 
 async function call(
   path,
-  { method = "GET", body, auth = true, raw = false, uploadName = "" } = {},
+  { method = "GET", body, auth = true, raw = false, uploadName = "", as = null } = {},
 ) {
   const headers = { ...CLIENT };
   if (auth) {
-    if (needsChoice()) throw new ApiError(409, choiceMessage());
-    const t = token();
+    if (!as && needsChoice()) throw new ApiError(409, choiceMessage());
+    const t = as ? as.token : token();
     if (!t) throw new ApiError(401, "not logged in — run `passalong login` to enable sync");
     headers.authorization = `Bearer ${t}`;
   }
@@ -166,9 +179,10 @@ async function call(
         : "application/json";
   }
   if (uploadName) headers["x-file-name"] = uploadName.replace(/[^\x20-\x7e]/g, "").slice(0, 120);
+  const base = as ? as.api.replace(/\/$/, "") : baseUrl();
   let res;
   try {
-    res = await fetch(`${baseUrl()}${path}`, {
+    res = await fetch(`${base}${path}`, {
       method,
       headers,
       body:
@@ -179,7 +193,7 @@ async function call(
             : JSON.stringify(body),
     });
   } catch (err) {
-    throw new ApiError(0, `could not reach ${baseUrl()} (${err.message})`);
+    throw new ApiError(0, `could not reach ${base} (${err.message})`);
   }
   if (!res.ok) {
     const text = await res.text();
@@ -379,10 +393,10 @@ export const inbox = () => call("/v1/inbox");
 export const createReport = (body) => call("/v1/reports", { method: "POST", body });
 /** One report and the issues filed under it, grouped by product area. */
 export const report = (id) => call(`/v1/reports/${encodeURIComponent(id)}`);
-export const get = (id, { peek = false } = {}) =>
-  call(`/v1/guides/${id}${q({ peek: peek ? "1" : "" })}`, { raw: true });
+export const get = (id, { peek = false, as = null } = {}) =>
+  call(`/v1/guides/${id}${q({ peek: peek ? "1" : "" })}`, { raw: true, as });
 /** One page of every guide this account can read, for `export`. Records no pull. */
-export const exportPage = (after = "") => call(`/v1/export${q({ after })}`);
+export const exportPage = (after = "", as = null) => call(`/v1/export${q({ after })}`, { as });
 /**
  * A guide's follow-ups, one level down. `markdown` adds each one's content, oldest first and
  * capped server-side; neither form counts as opening them.
@@ -485,7 +499,7 @@ export async function uploadFile(bytes, type, name = "") {
   try {
     res = await fetch(`${baseUrl()}/v1/attachments`, { method: "POST", headers, body: bytes });
   } catch (err) {
-    throw new ApiError(0, `could not reach ${baseUrl()} (${err.message})`);
+    throw new ApiError(0, `could not reach ${base} (${err.message})`);
   }
   if (!res.ok) {
     const body = await res.text();
@@ -509,7 +523,7 @@ export async function uploadShot(bytes, type, name = "") {
   try {
     res = await fetch(`${baseUrl()}/v1/shots`, { method: "POST", headers, body: bytes });
   } catch (err) {
-    throw new ApiError(0, `could not reach ${baseUrl()} (${err.message})`);
+    throw new ApiError(0, `could not reach ${base} (${err.message})`);
   }
   if (!res.ok) {
     const body = await res.text();

package/src/hooks.js

@@ -21,28 +21,47 @@ const plural = (n, one, many) => `${n} ${n === 1 ? one : many}`;
 /**
  * What this worktree's agent holds and what is waiting, as a few lines for an agent to read.
  * Empty when there is nothing to say, so a session in an unrelated repo is not told anything.
+ *
+ * `held` is a list: an agent may hold several things, and several sessions in one worktree are one
+ * agent to the queue. So a session is told what the worktree holds, and to carry on only with what
+ * was its own before a restart — never to resume another session's work.
  */
-export function nowText({ held, waiting = {} }) {
-  if (held) {
+export function nowText({ held = [], waiting = {} }) {
+  if (held.length === 1) {
+    const [h] = held;
     const lines = [
       // `kind` is required on what /v1/working sends. The `|| "task"` that used to be here was
       // both dead and wrong — absent has meant transfer since kinds existed, never task.
-      `Passalong: You hold ${held.id} (${held.kind}): ${held.title || held.id}.`,
+      `Passalong: This worktree holds ${h.id} (${h.kind}): ${h.title || h.id}.`,
     ];
-    if (held.note) lines.push(`Last note: "${held.note}".`);
+    if (h.note) lines.push(`Last note: "${h.note}".`);
     // The one thing here that is new information rather than a reminder: the person has written, and
     // nothing else in the session will say so until the agent next checks in.
-    if (held.replies)
+    if (h.replies)
       lines.push(
-        `${plural(held.replies, "message", "messages")} from the person ${held.replies === 1 ? "is" : "are"} ` +
-          `waiting for you: call take ${held.id} to read ${held.replies === 1 ? "it" : "them"} before anything else.`,
+        `${plural(h.replies, "message", "messages")} from the person ${h.replies === 1 ? "is" : "are"} ` +
+          `waiting: call take ${h.id} to read ${h.replies === 1 ? "it" : "them"} before anything else.`,
       );
-    if (held.state === "stalled")
+    if (h.state === "stalled")
       lines.push("It is marked stalled: nobody has heard from its agent in 30 minutes.");
     lines.push(
-      `To carry on, call take ${held.id} (it resumes what you hold), then progress at each ` +
-        "milestone. When it is done, hand_in with evidence — what you ran and what came back — " +
-        "so keep it as you go; if it is not yours or you are stuck, pass with the reason.",
+      `If it was yours before this session restarted, call take ${h.id} to carry on, then ` +
+        "progress at each milestone. When it is done, hand_in with evidence — what you ran and " +
+        "what came back — so keep it as you go; if it is not yours or you are stuck, pass with " +
+        "the reason. If another session here is on it, leave it to that session.",
+    );
+    return lines.join("\n");
+  }
+  if (held.length > 1) {
+    const lines = [`Passalong: This worktree holds ${held.length} things:`];
+    for (const h of held)
+      lines.push(
+        `- ${h.id} (${h.kind}): ${h.title || h.id}${h.state === "stalled" ? " — stalled" : ""}` +
+          `${h.replies ? ` — ${plural(h.replies, "message", "messages")} waiting` : ""}`,
+      );
+    lines.push(
+      "Several sessions may be working here. Carry on only with what was yours before this " +
+        "session restarted (take <id> resumes it) and leave the rest to the sessions on them.",
     );
     return lines.join("\n");
   }
@@ -59,19 +78,22 @@ export function nowText({ held, waiting = {} }) {
  * Whether a session may stop. `input` is what Claude Code sends the Stop hook on stdin. Null lets
  * it stop; an object is the hook's answer, blocking once with what to call. `stop_hook_active`
  * means this stop is already the session continuing because of this hook, and blocking again
- * would leave it no way to end.
+ * would leave it no way to end. The hook cannot tell which session took what, so it names
+ * everything still open here and lets the session settle its own.
  */
-export function stopVerdict({ held, input = {} }) {
+export function stopVerdict({ held = [], input = {} }) {
   // An agent that asked a question was told to stop and wait, so it must be let: blocking it would
   // make the instruction and the hook contradict each other, and the agent would pick one.
-  if (!held || held.asking || input.stop_hook_active) return null;
+  const open = held.filter((h) => !h.asking);
+  if (!open.length || input.stop_hook_active) return null;
+  const ids = open.map((h) => h.id).join(", ");
   return {
     decision: "block",
     reason:
-      `You still hold ${held.id}: ${held.title || held.id}. Before ending, do one of: ` +
-      `hand_in ${held.id} with your evidence if it is done; pass ${held.id} with the reason if ` +
-      `it is not yours or you are stuck; or, if the user is stopping mid-way, progress ${held.id} ` +
-      "with a note saying what is left — then end.",
+      `This worktree still holds ${ids}. For anything there you worked on in this session, do ` +
+      "one of before ending: hand_in it with your evidence if it is done; pass it with the reason " +
+      "if it is not yours or you are stuck; or, if the user is stopping mid-way, progress it with " +
+      "a note saying what is left. Leave what other sessions are on — then end.",
   };
 }
 
@@ -112,15 +134,19 @@ const clip = (s, n) => (s.length > n ? `${s.slice(0, n - 1)}…` : s);
  * `needs` counts everything waiting on the person: work handed in for review, agents stuck on
  * them, and guides handed to them.
  */
-export function statusText({ held, needs = 0, ready = 0 }) {
+export function statusText({ held = [], needs = 0, ready = 0 }) {
   const parts = [];
-  if (held) {
-    const said = held.note ? ` "${clip(held.note, 32)}"` : "";
-    parts.push(`▸ ${held.id}${held.state === "stalled" ? " (stalled)" : ""}${said}`);
+  if (held.length === 1) {
+    const [h] = held;
+    const said = h.note ? ` "${clip(h.note, 32)}"` : "";
+    parts.push(`▸ ${h.id}${h.state === "stalled" ? " (stalled)" : ""}${said}`);
+  } else if (held.length > 1) {
+    const stalled = held.filter((h) => h.state === "stalled").length;
+    parts.push(`▸ ${held.length} held${stalled ? ` (${stalled} stalled)` : ""}`);
   } else parts.push("passalong");
   if (needs) parts.push(`${needs} need${needs === 1 ? "s" : ""} you`);
   if (ready) parts.push(`${ready} ready`);
-  if (parts.length === 1 && !held) parts.push("clear");
+  if (parts.length === 1 && !held.length) parts.push("clear");
   return parts.join(" · ");
 }
 

package/src/mcp.js

@@ -334,8 +334,8 @@ export function buildServer() {
         "session into a guide (guide_template kind transfer shows the shape) and call " +
         "publish_guide, with `to` as team, team/@handle for one teammate, or team/#group for the " +
         "people who do a thing. " +
-        "BEFORE PUBLISHING ANYTHING, CHECK WHAT IS ALREADY OPEN: call take with no id, or read the " +
-        "inbox, and see what you hold. If this session's work answers something you hold, hand_in " +
+        "BEFORE PUBLISHING ANYTHING, CHECK WHAT IS ALREADY OPEN: call board (it lists what this " +
+        "worktree holds) or read the inbox. If this session's work answers something you hold, hand_in " +
         "that — never publish a second guide about it. A transfer guide is for work that has to " +
         "cross a boundary: another repo, another machine, a teammate without your branch. Work you " +
         "committed and pushed where the team can already see it has crossed no boundary, and a " +
@@ -944,12 +944,17 @@ export function buildServer() {
         "The state of this user's transfers as queues: waiting on you (handed to you, not " +
         "pulled), not working (someone gave it a failing verdict — the most urgent), in flight " +
         "(handed over, nobody has taken it — `stale` means it has sat over a week), and landed " +
-        "(someone else has it). Use it to answer 'what is outstanding?'.",
+        "(someone else has it), and `held`: what this worktree's agents hold now. Use it to answer " +
+        "'what is outstanding?' and to see what you hold, without taking anything.",
       inputSchema: {},
     },
     async () => {
       try {
-        return json(await passalong.board());
+        const [board, now] = await Promise.all([
+          passalong.board(),
+          passalong.now().catch(() => ({ held: [] })),
+        ]);
+        return json({ ...board, held: now.held });
       } catch (err) {
         return fail(err);
       }
@@ -1100,9 +1105,9 @@ export function buildServer() {
       annotations: ADDS,
       description:
         "Say you are doing it, and get it. With `id`, that guide — any kind: a task, a bug, a " +
-        "handoff. With no id, the next thing waiting for this worktree's agent. While you hold it " +
-        "no other agent can take it here, and its sender sees you are on it. One thing at a time: " +
-        "if you already hold something, finish or pass that first. If somebody else has it, the " +
+        "handoff. With no id, the next thing waiting — always something new, never what you hold. " +
+        "While you hold it no other agent can take it here, and its sender sees you are on it. You " +
+        "may hold several at once; the person watches them on the board. If somebody else has it, the " +
         "answer says who — tell the user rather than doing the work twice. Every answer ends with " +
         "what to call next.",
       inputSchema: {
@@ -1525,8 +1530,8 @@ export function buildServer() {
       title: "Publish guide",
       annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false },
       description:
-        "Publish a guide from markdown (frontmatter + sections). Check what you hold first (take " +
-        "with no id): if this session answers something you hold, hand_in that instead, and if the " +
+        "Publish a guide from markdown (frontmatter + sections). Check what you hold first " +
+        "(board): if this session answers something you hold, hand_in that instead, and if the " +
         "work never left a branch the team can see, publish what is still open as a bug or a task " +
         "rather than a write-up of the fix. A transfer guide by default, or " +
         "a single bug with `kind: bug`; use file_bugs for more than one; or a task for work nobody " +

package/src/passalong.js

@@ -264,7 +264,7 @@ export async function tasks() {
 }
 
 /**
- * Take the next task for this worktree's repo, or get back the one this worktree already holds.
+ * Take the next task for this worktree's repo — always a new one, since an agent may hold several.
  * `null` when there is nothing to do. Written to `.passalong/<id>.md` only when `save` asks.
  */
 export async function nextTask({ cwd = process.cwd(), any = false, save = false } = {}) {
@@ -542,7 +542,7 @@ export async function ask(id, question, { cwd = process.cwd() } = {}) {
 
 /**
  * What this worktree's agent holds right now, and what is waiting for it: what the session-start
- * and stop hooks read (src/hooks.js). `held` is null when it holds nothing. Counts are best effort
+ * and stop hooks read (src/hooks.js). `held` lists everything it holds, empty when nothing. Counts are best effort
  * — a hook must never fail a session over a count.
  */
 export async function now({ cwd = process.cwd() } = {}) {
@@ -557,8 +557,7 @@ export async function now({ cwd = process.cwd() } = {}) {
     api.handedIn(),
   ]);
   if (w.status === "rejected") throw w.reason;
-  const held =
-    (who.agent && w.value.working.find((x) => x.agent === who.agent && x.by?.you)) || null;
+  const held = who.agent ? w.value.working.filter((x) => x.agent === who.agent && x.by?.you) : [];
   const tasks = t.status === "fulfilled" ? t.value.tasks : [];
   const waiting = {
     ready: tasks.filter((x) => x.state === "ready" && x.target === who.repo).length,
@@ -1099,9 +1098,8 @@ export function workPrompt(t) {
  * hand_in land on the claim this took. `agent` is a command the prompt is appended to;
  * `claude -p` by default, or whatever PASSALONG_AGENT says.
  *
- * An agent that exits without finishing stops the loop. Asking for the next task would hand the
- * same one back, since a worktree holds one task at a time, and the loop would run the agent on it
- * forever. The task stays claimed here, for the next run to resume or a person to release.
+ * An agent that exits without finishing stops the loop, rather than piling up half-done work. The
+ * task stays claimed here, for a person to see on the board and resume (take it) or release.
  */
 export async function work({
   cwd = process.cwd(),
@@ -1122,8 +1120,9 @@ export async function work({
       stdio: "inherit",
       env: { ...process.env, PASSALONG_TASK: t.id },
     });
+    // Finishing is final, so a finished task is Done; "review" is a server from before that.
     const state = (await tasks()).find((x) => x.id === t.id)?.state;
-    if (state !== "review")
+    if (state !== "done" && state !== "review")
       return {
         finished,
         stopped: "unfinished",
@@ -1182,26 +1181,70 @@ export async function exportAll(dir) {
   });
 }
 
+// The host this product answered on before passalong.dev. It serves the same data, so a copy
+// whose url names it belongs to the default API.
+const OLD_HOST = "passalong.kreativekorna.com";
+const hostOf = (url) => {
+  try {
+    const { host, hostname } = new URL(url);
+    if (["localhost", "127.0.0.1", "[::1]"].includes(hostname)) return "";
+    return host === OLD_HOST ? new URL(api.DEFAULT_API).host : host;
+  } catch {
+    return "";
+  }
+};
+// Raised whenever tidy learns to remove something it used to keep, so machines that tidied run it once more.
+const TIDIED = 2;
+
 /**
  * Once per machine, signed in: drop the local copies the server says it holds. They were written
- * by every share, pull and take before `keep()`, and nothing ever removed one. What the server
- * does not return — shared while signed out, or from another account — is left where it is.
+ * by every share, pull and take before `keep()`, and nothing ever removed one. Every login on the
+ * machine is asked, since a copy may be any of theirs. A copy whose `url:` is on a login's own host
+ * and that the server answers 404 for is a guide since deleted, and goes too. Anything else — no
+ * url, localhost, another host, or an answer that was neither 200 nor 404 — is left where it is,
+ * and an export that failed leaves the flag unset so the next start tries again.
  */
 export async function tidy() {
-  if (!api.loggedIn() || store.readConfig().tidied) return 0;
-  const local = new Set(store.list().map((g) => g.meta.id));
+  const logins = api.logins();
+  if (!logins.length || store.readConfig().tidied === TIDIED) return 0;
+  const local = new Map(store.list().map((g) => [g.meta.id, hostOf(g.meta.url)]));
   let removed = 0;
-  let after = "";
-  while (local.size) {
-    const page = await api.exportPage(after);
-    for (const g of page.guides)
-      if (local.delete(g.id)) {
-        store.remove(g.id);
-        removed++;
-      }
-    after = page.next;
-    if (!after) break;
+  let sure = true;
+  const drop = (id) => {
+    if (!local.delete(id)) return;
+    store.remove(id);
+    removed++;
+  };
+  for (const as of logins) {
+    try {
+      let after = "";
+      do {
+        const page = await api.exportPage(after, as);
+        for (const g of page.guides) drop(g.id);
+        after = page.next;
+      } while (after && local.size);
+    } catch {
+      sure = false;
+    }
+  }
+  const said = new Map();
+  for (const as of logins) {
+    const host = hostOf(as.api);
+    const ids = [...local].filter(([, h]) => h && h === host).map(([id]) => id);
+    // Eight at a time: a few hundred copies is a few seconds, not a few hundred open requests.
+    for (let i = 0; i < ids.length; i += 8)
+      await Promise.all(
+        ids.slice(i, i + 8).map(async (id) => {
+          const status = await api.get(id, { peek: true, as }).then(
+            () => 200,
+            (err) => err.status ?? 0,
+          );
+          said.set(id, [...(said.get(id) ?? []), status]);
+        }),
+      );
   }
-  store.writeConfig({ tidied: true });
+  for (const [id, statuses] of said)
+    if (statuses.includes(200) || statuses.every((s) => s === 404)) drop(id);
+  if (sure) store.writeConfig({ tidied: TIDIED });
   return removed;
 }

package/src/update.js

@@ -15,7 +15,31 @@
 // feature would have shipped dead while looking fine in review. So the line is read from a file and
 // the file is refreshed by a process nobody waits for. What a person sees is a day old at worst,
 // which is the right age for "there is a new version".
-import { readConfig, writeConfig } from "./store.js";
+//
+// The answer is kept in its own file, never in config.json. The refresh runs beside whatever
+// command started it, and config.json is read, patched and written whole: a refresh that read it
+// just before `logout` or `use` wrote it, and wrote it back after, put the old accounts and the old
+// default back. This file has one writer, so there is nothing to lose.
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { HOME } from "./store.js";
+
+const FILE = join(HOME, "update.json");
+
+function readUpdate() {
+  try {
+    return JSON.parse(readFileSync(FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function writeUpdate(held) {
+  if (!existsSync(HOME)) mkdirSync(HOME, { recursive: true, mode: 0o700 });
+  const tmp = `${FILE}.${process.pid}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(held)}\n`, { mode: 0o600 });
+  renameSync(tmp, FILE);
+}
 
 /** How long a cached answer lasts before a refresh is worth starting. */
 export const CHECK_EVERY_MS = 24 * 60 * 60 * 1000;
@@ -70,7 +94,7 @@ export function cachedNotice({
   current,
   now = Date.now(),
   env = process.env,
-  config = readConfig,
+  config = readUpdate,
 }) {
   if (env.PASSALONG_NO_UPDATE_CHECK === "1") return { notice: "", stale: false };
   const held = config();
@@ -90,7 +114,7 @@ export function cachedNotice({
  * trying again — `cachedNotice` reads an empty `update_latest` as a failure and uses the shorter
  * gap.
  */
-export async function refresh({ now = Date.now(), fetchImpl = fetch, save = writeConfig } = {}) {
+export async function refresh({ now = Date.now(), fetchImpl = fetch, save = writeUpdate } = {}) {
   let latest = "";
   try {
     const res = await fetchImpl(REGISTRY, {