shadok-ai 0.17.38 → 0.17.39

package/README.md

@@ -368,8 +368,14 @@ Enter to skip; you can add it later from the web UI).
   a profile edit that bumped no version still does. A `↻` lights up on the agent
   (hover for the reasons) and the **version menu** shows *Reload N agents to
   apply changes*; a reload respawns each one in place, keeping its history.
-  Agents started before a given update stay on the old context until reloaded —
-  this is how you spot the ones still running it.
+  **You don't have to click it**: the cockpit applies it by itself as soon as the
+  agent has nothing to lose — no turn running, no question waiting, nothing in
+  its input box, no background shell or monitor, no child notification queued —
+  and has been quiet for two minutes (the ↻ tooltip then says so).
+  One agent at a time, no nudge afterwards, and at most once per 30 minutes per
+  agent so a change that does not stick cannot loop. A message you send while
+  the respawn runs waits a few seconds for it instead of being refused. Clicking
+  still reloads at once; `SHADOK_AUTO_RELOAD=0` turns the automatic part off.
 - **Phone layout** — the cockpit is a fixed chassis that never pans sideways,
   sized on the *visual* viewport so the composer stays clear of the browser's
   own bar and, when the keyboard opens, sits right above it (the instrument bar
@@ -995,6 +1001,8 @@ machine, which silently shifts every daily prompt on a server running in UTC.
 | `SHADOK_ALLOWED_HOSTS` | host names the cockpit answers besides its own (DNS-rebinding guard); with a password, setting it makes the check strict. `*` disables it |
 | `SHADOK_TMUX=0` | force the node-pty transport instead of tmux |
 | `SHADOK_IDLE_MIN` | minutes with no client before a session is reclaimed (60) |
+| `SHADOK_AUTO_RELOAD=0` | don't apply a pending "reload to apply" by itself — leave it to the ↻ click |
+| `SHADOK_AUTO_RELOAD_IDLE_SEC` | how long an agent must be quiet before that automatic reload (120) |
 | `SHADOK_PERMISSION_MODE` | mode new agents start in (default `acceptEdits`) |
 | `SHADOK_AUTOUPDATE` | fallback only — the GUI setting wins once used |
 | `SHADOK_PILOT_PROMPT=0` | don't inject the cockpit system prompt |

package/dist/auto-reload.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Auto-reload: apply a pending "reload to apply" by itself, at a moment that
+ * cuts nothing.
+ *
+ * The cockpit already KNOWS when a running agent is behind what a fresh spawn
+ * would give it (`stalenessReasons`: prompt/guardrails/skills/secrets changed,
+ * auth cookie past its week, Claude Code binary updated — plus a profile change
+ * stored "at next reload"). Until now it only painted a ↻ badge and waited for a
+ * human to click it, so a profile edit or a shadok update sat unapplied on every
+ * agent nobody happened to look at.
+ *
+ * A reload is a `--resume`: the conversation survives, but the PROCESS does not.
+ * Everything that lives only in that process dies with it — a turn in flight, a
+ * question on screen, text typed in the TUI's input box, a background shell or
+ * monitor, a parent notification waiting to be delivered. So the rule is not
+ * "reload when idle" but "reload when there is provably nothing to lose", and
+ * every condition below names one of those losses.
+ *
+ * The quiet window is the soft half: an agent that JUST finished is the one a
+ * human is most likely about to answer. Waiting a couple of minutes past the
+ * last activity keeps the reload out of a live exchange. (A prompt that arrives
+ * anyway while the respawn runs is held until it is ready — see the prompt
+ * handler — so the worst case is a few seconds of delay, never a lost message.)
+ *
+ * The backoff is the safety net: if the reasons survive a reload (a fingerprint
+ * that is not deterministic, a version probe that flaps), reloading again every
+ * two minutes would be a respawn loop. One automatic attempt per window, then
+ * the badge stays for a human to look at.
+ */
+export interface AutoReloadInput {
+    /** Is the feature on for this instance? */
+    enabled: boolean;
+    /** How many reasons the agent is behind (staleness + a stored profile gap). */
+    pendingReasons: number;
+    /** A turn is running, or the server is driving one (`busy`). */
+    busy: boolean;
+    /** The pane itself shows work (spinner) — covers a turn nobody started from here. */
+    working: boolean;
+    /** A prompt is being typed into the TUI right now. */
+    submitting: boolean;
+    /** A restart is already swapping this agent's process. */
+    restarting: boolean;
+    /** The pilot's process has exited (nothing to reload; the resume path owns it). */
+    exited: boolean;
+    /** A question/permission dialog is on screen, waiting for an answer. */
+    dialogOpen: boolean;
+    /** What the TUI input box holds — text a respawn would discard. */
+    inputBox: string;
+    /** Background shells / monitors the pane reports running. */
+    shells: number;
+    monitors: number;
+    /** Child-agent notifications queued for this agent as a parent. */
+    inboxPending: number;
+    /** An auto-retry of a failed turn is scheduled. */
+    retryPending: boolean;
+    /** Milliseconds since the last thing that happened on this agent. */
+    idleMs: number;
+    /** How long it must have been quiet. */
+    quietMs: number;
+    /** Milliseconds since the last AUTOMATIC reload of this agent (Infinity if never). */
+    sinceLastAutoMs: number;
+    /** Minimum gap between two automatic reloads of the same agent. */
+    backoffMs: number;
+}
+export type AutoReloadVerdict = {
+    reload: true;
+} | {
+    reload: false;
+    why: string;
+};
+/** Pure: may this agent be reloaded right now without cutting anything? */
+export declare function autoReloadVerdict(i: AutoReloadInput): AutoReloadVerdict;
+/** `SHADOK_AUTO_RELOAD=0` turns it off; anything else (or unset) leaves it on. */
+export declare function autoReloadEnabled(env: string | undefined): boolean;

package/dist/auto-reload.js

@@ -0,0 +1,65 @@
+/**
+ * Auto-reload: apply a pending "reload to apply" by itself, at a moment that
+ * cuts nothing.
+ *
+ * The cockpit already KNOWS when a running agent is behind what a fresh spawn
+ * would give it (`stalenessReasons`: prompt/guardrails/skills/secrets changed,
+ * auth cookie past its week, Claude Code binary updated — plus a profile change
+ * stored "at next reload"). Until now it only painted a ↻ badge and waited for a
+ * human to click it, so a profile edit or a shadok update sat unapplied on every
+ * agent nobody happened to look at.
+ *
+ * A reload is a `--resume`: the conversation survives, but the PROCESS does not.
+ * Everything that lives only in that process dies with it — a turn in flight, a
+ * question on screen, text typed in the TUI's input box, a background shell or
+ * monitor, a parent notification waiting to be delivered. So the rule is not
+ * "reload when idle" but "reload when there is provably nothing to lose", and
+ * every condition below names one of those losses.
+ *
+ * The quiet window is the soft half: an agent that JUST finished is the one a
+ * human is most likely about to answer. Waiting a couple of minutes past the
+ * last activity keeps the reload out of a live exchange. (A prompt that arrives
+ * anyway while the respawn runs is held until it is ready — see the prompt
+ * handler — so the worst case is a few seconds of delay, never a lost message.)
+ *
+ * The backoff is the safety net: if the reasons survive a reload (a fingerprint
+ * that is not deterministic, a version probe that flaps), reloading again every
+ * two minutes would be a respawn loop. One automatic attempt per window, then
+ * the badge stays for a human to look at.
+ */
+/** Pure: may this agent be reloaded right now without cutting anything? */
+export function autoReloadVerdict(i) {
+    const no = (why) => ({ reload: false, why });
+    if (!i.enabled)
+        return no("disabled");
+    if (i.pendingReasons <= 0)
+        return no("up to date");
+    if (i.exited)
+        return no("process exited");
+    if (i.restarting)
+        return no("already restarting");
+    if (i.busy || i.working)
+        return no("working");
+    if (i.submitting)
+        return no("a prompt is being typed");
+    if (i.dialogOpen)
+        return no("waiting on a question");
+    if (i.inputBox.trim())
+        return no("text in the input box");
+    if (i.shells > 0 || i.monitors > 0)
+        return no("background task running");
+    if (i.inboxPending > 0)
+        return no("notifications queued");
+    if (i.retryPending)
+        return no("auto-retry scheduled");
+    if (i.idleMs < i.quietMs)
+        return no("recently active");
+    if (i.sinceLastAutoMs < i.backoffMs)
+        return no("auto-reloaded recently");
+    return { reload: true };
+}
+/** `SHADOK_AUTO_RELOAD=0` turns it off; anything else (or unset) leaves it on. */
+export function autoReloadEnabled(env) {
+    return env === undefined || !/^(0|false|off|no)$/i.test(env.trim());
+}
+//# sourceMappingURL=auto-reload.js.map

package/dist/auto-reload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-reload.js","sourceRoot":"","sources":["../src/auto-reload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAwCH,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,CAAkB;IAClD,MAAM,EAAE,GAAG,CAAC,GAAW,EAAqB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,cAAc,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,YAAY,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACzE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,GAAuB;IACvD,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/server.js

@@ -20,7 +20,8 @@ import { OFFER_TOOL, filesFileFor, loadOffers, saveOffers, offerVerdict, withOff
 // the browser): one source for reading the in-flight text off the screen.
 import { extractLiveText } from "../public/live-text.js";
 import { findTransientErrors, newTransientErrors, RETRY_DELAYS_MS } from "./retry.js";
-import { backgroundTasks, screenShowsWork, moveToOption } from "./detect.js";
+import { backgroundTasks, screenShowsWork, moveToOption, boxText } from "./detect.js";
+import { autoReloadVerdict, autoReloadEnabled } from "./auto-reload.js";
 import { PtyPilot } from "./session.js";
 import { ensureClaudeHome, ensureProjectTrusted, getDefaultModel, setDefaultModel, parseClaudeVersion, seedPlanForCwds, settingsPlan, } from "./claude-home.js";
 import { authStatus, cancelLogin, invalidateAuthStatus, startLogin, submitLoginCode } from "./claude-auth.js";
@@ -6248,6 +6249,13 @@ function broadcast(s, msg, except) {
  * Shared by the `restart` message and by `set-profile` with `restart: true`.
  */
 async function restartSession(s, by = SYSTEM_SPAWN) {
+    const done = restartSessionNow(s, by).finally(() => {
+        s.lastActivityAt = Date.now();
+    });
+    s.restartDone = done.catch(() => { });
+    return done;
+}
+async function restartSessionNow(s, by) {
     // Fail-closed group check BEFORE any teardown. A restart re-derives the OS
     // user from the channel's stored group; if that group no longer resolves,
     // `resolveSpawnIsolation` would derive a null user and respawn a private agent
@@ -6355,6 +6363,7 @@ async function restartSession(s, by = SYSTEM_SPAWN) {
         sessionId: s.id,
         preprompt: prepromptById.get(s.id) ?? [],
         stale: sessionStaleness(s),
+        staleAuto: AUTO_RELOAD,
         cwd: s.cwd,
         branch: s.worktree?.branch ?? null,
         lastTurnMs: s.lastTurnMs,
@@ -6447,7 +6456,70 @@ function sessionStaleness(s, channels) {
     });
 }
 function staleMessage(s, channels) {
-    return { type: "stale", sessionId: s.id, reasons: sessionStaleness(s, channels) };
+    // `auto`: the cockpit will apply it by itself once the agent is idle, so the
+    // badge reads "applies when idle" rather than asking for a click.
+    return { type: "stale", sessionId: s.id, reasons: sessionStaleness(s, channels), auto: AUTO_RELOAD };
+}
+// ── Auto-reload: apply a pending reload at a moment that cuts nothing ────────
+// See src/auto-reload.ts for why each condition exists. One agent at a time —
+// the same no-herd rule as /restart-all (concurrent `--resume` race the OAuth
+// refresh) — and never a nudge afterwards: the agent was idle, so it stays idle.
+const AUTO_RELOAD = autoReloadEnabled(process.env.SHADOK_AUTO_RELOAD);
+const AUTO_RELOAD_QUIET_MS = Number(process.env.SHADOK_AUTO_RELOAD_IDLE_SEC ?? 120) * 1000;
+const AUTO_RELOAD_BACKOFF_MS = 30 * 60_000;
+let autoReloadRunning = false;
+/** Why `s` is behind, counting a profile stored "at next reload" too. */
+function pendingReloadReasons(s, channels) {
+    const out = sessionStaleness(s, channels).map((r) => r.kind);
+    if ((s.appliedProfile ?? null) !== (s.profile ?? null))
+        out.push("profile");
+    return out;
+}
+async function autoReloadSweep() {
+    if (!AUTO_RELOAD || autoReloadRunning)
+        return;
+    const channels = loadChannels();
+    const now = Date.now();
+    for (const s of sessions.values()) {
+        const reasons = pendingReloadReasons(s, channels);
+        if (!reasons.length)
+            continue;
+        const screen = s.pilot.hasExited ? "" : s.pilot.screen();
+        const verdict = autoReloadVerdict({
+            enabled: AUTO_RELOAD,
+            pendingReasons: reasons.length,
+            busy: s.busy,
+            working: !s.pilot.hasExited && s.pilot.isWorking(),
+            submitting: !!s.submitting,
+            restarting: !!s.restarting,
+            exited: s.pilot.hasExited,
+            dialogOpen: s.lastDialogKey !== null || !!detectDialog(screen),
+            inputBox: boxText(screen),
+            shells: s.shells,
+            monitors: s.monitors,
+            inboxPending: parentInbox.get(s.id)?.length ?? 0,
+            retryPending: s.retryTimer !== null,
+            idleMs: now - Math.max(s.lastActivityAt ?? 0, s.lastContentAt ?? 0),
+            quietMs: AUTO_RELOAD_QUIET_MS,
+            sinceLastAutoMs: s.lastAutoReloadAt ? now - s.lastAutoReloadAt : Infinity,
+            backoffMs: AUTO_RELOAD_BACKOFF_MS,
+        });
+        if (!verdict.reload)
+            continue;
+        autoReloadRunning = true;
+        s.lastAutoReloadAt = now;
+        console.log(`auto-reload: ${s.id.slice(0, 8)} idle — respawning to apply ${reasons.join(", ")}`);
+        try {
+            await restartSession(s, { actor: "auto-reload", via: "system" });
+        }
+        catch {
+            /* logged by restartSession; the backoff keeps it from looping */
+        }
+        finally {
+            autoReloadRunning = false;
+        }
+        return; // one per sweep: the next one waits for the next tick
+    }
 }
 /** Broadcast the staleness reasons, but only when they changed. */
 function broadcastStaleness(s, channels) {
@@ -6650,6 +6722,9 @@ group = null) {
         monitors: 0,
         stopTail: null,
         recentTexts: [],
+        // A new Live (a spawn, an adoption after a server restart) counts as
+        // activity: the auto-reload waits a quiet window before touching it.
+        lastActivityAt: Date.now(),
         lastTurnSilent: false,
         worktree,
         idleTimer: null,
@@ -7092,6 +7167,7 @@ async function finishTurn(s) {
     finally {
         s.busy = false;
         s.interruptedAt = null;
+        s.lastActivityAt = Date.now();
         // Remember how long it took: a dialog suspends the turn and a completion
         // ends it, but both freeze the client's timer, so both are worth keeping.
         if (s.turnStartedAt)
@@ -7430,6 +7506,8 @@ wss.on("connection", (ws, req) => {
                 const current = sessions.get(session.id);
                 if (current && current !== session)
                     session = current;
+                // Someone is interacting: hold the auto-reload's quiet window open.
+                session.lastActivityAt = Date.now();
             }
             // Any user takeover cancels a pending auto-retry and ends the streak.
             // "prompt" is settled inside its own case instead: a prompt refused on
@@ -7663,6 +7741,7 @@ wss.on("connection", (ws, req) => {
                             sessionId: id,
                             preprompt: prepromptById.get(id) ?? [],
                             stale: sessionStaleness(session),
+                            staleAuto: AUTO_RELOAD,
                             cwd: session.cwd,
                             lastTurnMs: session.lastTurnMs,
                         });
@@ -7843,6 +7922,7 @@ wss.on("connection", (ws, req) => {
                         sessionId: id,
                         preprompt: prepromptById.get(id) ?? [],
                         stale: sessionStaleness(session),
+                        staleAuto: AUTO_RELOAD,
                         cwd: effectiveCwd,
                         branch: worktree?.branch ?? null,
                     });
@@ -7961,6 +8041,14 @@ wss.on("connection", (ws, req) => {
                         if (session.busy)
                             return fail("a response is already in progress", "busy");
                     }
+                    // A respawn (an auto-reload, a reload click elsewhere) is swapping the
+                    // process: typing now would land in the one being torn down. Wait for
+                    // the new one — a few seconds — rather than refuse or lose the prompt.
+                    if (session.restarting) {
+                        await session.restartDone;
+                        if (session.busy)
+                            return fail("a response is already in progress", "busy");
+                    }
                     // Getting here means the prompt is really being sent — that is the
                     // takeover. A pending auto-retry (or pace pause) gives way to it.
                     clearRetry(session, true);
@@ -8832,6 +8920,10 @@ server.listen(port, HOST, () => {
                 broadcastStaleness(s, channels);
     }, 60_000);
     staleTimer.unref();
+    // Auto-reload: twice a minute, respawn (at most) one idle agent that is
+    // behind — the "reload to apply" badge applying itself. See autoReloadSweep.
+    const autoReloadTimer = setInterval(() => void autoReloadSweep().catch(() => { }), 30_000);
+    autoReloadTimer.unref();
     // The lead agent, if this instance has none. Deferred a beat so it dials a
     // server that is already accepting, and never awaited: a cockpit that starts
     // without its lead agent is a far smaller problem than a boot that hangs.