shadok-ai 0.17.4 → 0.17.6

package/dist/live-handover.d.ts

@@ -0,0 +1,47 @@
+import type { WebSocket } from "ws";
+/**
+ * The subset of a `Live` that a handover reads and mutates. Kept structural so
+ * the server's full `Live` satisfies it with no cast, and a test can build a
+ * fake. It DELIBERATELY omits `pilot`, `cwd`, `id` and `transcriptHome`: the
+ * handover must never be able to kill the agent or clear the shared tail
+ * position, and leaving those fields out of the type makes that a compile-time
+ * guarantee rather than a comment someone can regress past.
+ */
+export interface HandoverLive {
+    clients: Set<WebSocket>;
+    rawClients?: Set<WebSocket>;
+    screenTimer: ReturnType<typeof setInterval> | null;
+    idleTimer: ReturnType<typeof setTimeout> | null;
+    retryTimer: ReturnType<typeof setTimeout> | null;
+    stopTail: (() => void) | null;
+    rawOff?: (() => void) | null;
+}
+/**
+ * Hand a superseded `Live`'s viewers onto the `Live` that replaced it, and quiet
+ * the old one WITHOUT touching the agent. Returns how many viewers moved.
+ *
+ * The bug (shared-ledger [5d8d]): when a session's pilot has exited but the
+ * channel still has web/Telegram viewers attached, a resume takes the
+ * `createSession` path and `sessions.set(id, newLive)` REPLACES the registry
+ * entry — leaving the old `Live`, with its clients, orphaned. Its tail keeps
+ * running on the same transcript, so those clients still see the agent's
+ * ANSWERS, but every `broadcast` now targets the new `Live`: they miss the other
+ * interfaces' prompt echoes (the reported symptom: Telegram messages invisible
+ * on the web until reload), dialogs, and working/turn-done. Two `Live` for one
+ * agent; "server code correct in isolation", the split is the cause.
+ *
+ * The cure is one `Live` per agent: hand the viewers over and tear the old one
+ * down. Teardown here is DELIBERATELY not `destroySession`. The new `Live` may
+ * have adopted the very same tmux pane — a `hasExited` that latched on a single
+ * transient probe (invariants 23/25) leaves the pane alive — so killing the old
+ * pilot would kill the live agent, and clearing the shared tail position would
+ * make the new tail replay the whole transcript from byte 0. So we stop the old
+ * `Live`'s own tail and timers and detach its raw pipe, and nothing else. (The
+ * type can't express `pilot.kill()` or `clearTailPos` anyway — see `HandoverLive`.)
+ *
+ * Raw terminal viewers are NOT re-wired onto the new pilot's pipe: the raw
+ * subscription is per-pilot and is rebuilt when the engine room is next opened.
+ * Moving the chat `clients` set is what the reported bug needs; the old raw pipe
+ * is simply turned off so the retired `Live` goes fully quiet.
+ */
+export declare function supersedeSession(old: HandoverLive, next: HandoverLive): number;

package/dist/live-handover.js

@@ -0,0 +1,58 @@
+/**
+ * Hand a superseded `Live`'s viewers onto the `Live` that replaced it, and quiet
+ * the old one WITHOUT touching the agent. Returns how many viewers moved.
+ *
+ * The bug (shared-ledger [5d8d]): when a session's pilot has exited but the
+ * channel still has web/Telegram viewers attached, a resume takes the
+ * `createSession` path and `sessions.set(id, newLive)` REPLACES the registry
+ * entry — leaving the old `Live`, with its clients, orphaned. Its tail keeps
+ * running on the same transcript, so those clients still see the agent's
+ * ANSWERS, but every `broadcast` now targets the new `Live`: they miss the other
+ * interfaces' prompt echoes (the reported symptom: Telegram messages invisible
+ * on the web until reload), dialogs, and working/turn-done. Two `Live` for one
+ * agent; "server code correct in isolation", the split is the cause.
+ *
+ * The cure is one `Live` per agent: hand the viewers over and tear the old one
+ * down. Teardown here is DELIBERATELY not `destroySession`. The new `Live` may
+ * have adopted the very same tmux pane — a `hasExited` that latched on a single
+ * transient probe (invariants 23/25) leaves the pane alive — so killing the old
+ * pilot would kill the live agent, and clearing the shared tail position would
+ * make the new tail replay the whole transcript from byte 0. So we stop the old
+ * `Live`'s own tail and timers and detach its raw pipe, and nothing else. (The
+ * type can't express `pilot.kill()` or `clearTailPos` anyway — see `HandoverLive`.)
+ *
+ * Raw terminal viewers are NOT re-wired onto the new pilot's pipe: the raw
+ * subscription is per-pilot and is rebuilt when the engine room is next opened.
+ * Moving the chat `clients` set is what the reported bug needs; the old raw pipe
+ * is simply turned off so the retired `Live` goes fully quiet.
+ */
+export function supersedeSession(old, next) {
+    let moved = 0;
+    for (const c of old.clients) {
+        next.clients.add(c);
+        moved++;
+    }
+    old.clients.clear();
+    // Quiet the retired Live: its own tail (so one transcript is not tailed
+    // twice — the "two tails share one pos file" side effect noted in [5d8d]),
+    // its timers, and its raw pipe. Never the pilot, never the tail position.
+    if (old.screenTimer) {
+        clearInterval(old.screenTimer);
+        old.screenTimer = null;
+    }
+    if (old.idleTimer) {
+        clearTimeout(old.idleTimer);
+        old.idleTimer = null;
+    }
+    if (old.retryTimer) {
+        clearTimeout(old.retryTimer);
+        old.retryTimer = null;
+    }
+    old.stopTail?.();
+    old.stopTail = null;
+    old.rawOff?.();
+    old.rawOff = null;
+    old.rawClients?.clear();
+    return moved;
+}
+//# sourceMappingURL=live-handover.js.map

package/dist/live-handover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-handover.js","sourceRoot":"","sources":["../src/live-handover.ts"],"names":[],"mappings":"AAoBA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAiB,EAAE,IAAkB;IACpE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,KAAK,EAAE,CAAC;IACV,CAAC;IACD,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAEpB,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/B,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IACjB,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;IACf,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;IAClB,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;IAExB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/server.js

@@ -65,6 +65,7 @@ import { getProfile, profileArgs, permissionModeArgs, isPermissionMode, isEffort
 import { BOOTSTRAP_ADMIN, loadAccounts, verifyPassword, sessionSecret, signSession, readSessionFull, sessionAlive, saveAccounts, userWriteVerdict, newInvite, inviteVerdict, hashPassword, promptAuthor, signSessionKey, readSessionKey, signTalkHandle, readTalkHandle, } from "./accounts.js";
 import { admins2fa, authenticationOptions, enrollCodeVerdict, isInternalClient, keepsTwoAdminsVerdict, loginNext, newEnrollCode, publicPasskey, putChallenge, readPending, registrationOptions, resetVerdict, signPending, takeChallenge, twoFactorEnableVerdict, verifyAuthentication, verifyRegistration, PENDING_TTL_MS, } from "./twofactor.js";
 import { ensureSelfRepo } from "./selfrepo.js";
+import { supersedeSession } from "./live-handover.js";
 import { createWorktree, pruneWorktree, ensureWorktreeCheckout, gitDiff, isGitRepo, listPastSessions, } from "./worktree.js";
 import { latestVersion, update } from "./updater.js";
 import { resolveChannel } from "./update-channel.js";
@@ -2234,6 +2235,12 @@ const SKILL_SOURCES = [
     ["reload-skill", "shadok-reload"],
     ["ledger-skill", "shadok-ledger"],
     ["agents-skill", "shadok-ai-agents"],
+    // files-skill is ALSO seeded to the server HOME by seedFilesSkill; it must be
+    // here too, or a privilege-dropped group agent (which reads only the machine-
+    // wide tier, never the server's /root HOME) silently loses it — which is
+    // exactly what bit a migrated instance. test/system-skills.test.ts pins that
+    // every shipped context/*-skill is listed here.
+    ["files-skill", "shadok-files"],
 ];
 /** Claude Code's machine-wide ("Enterprise"/managed) skills directory — read by
  *  EVERY OS user regardless of HOME, with precedence over a personal
@@ -6092,8 +6099,11 @@ wss.on("connection", (ws, req) => {
     // so a server updated underneath it refreshes the page automatically.
     send(versionMessage());
     ws.on("close", () => {
+        // Detach from the CURRENT Live for this id, not the closure's possibly
+        // retired one: a handover ([5d8d]) moved this ws onto the new Live, so
+        // detaching the old object would leak the ws in the live one's client set.
         if (session)
-            detach(ws, session);
+            detach(ws, sessions.get(session.id) ?? session);
         session = null;
     });
     ws.on("message", async (raw) => {
@@ -6105,6 +6115,16 @@ wss.on("connection", (ws, req) => {
             return fail("unreadable message");
         }
         try {
+            // This connection can outlive the Live it attached to: a resume that
+            // supersedes an exited-but-watched session (see `supersedeSession`,
+            // [5d8d]) moved this ws onto the NEW Live, but this closure still points
+            // at the retired one. Re-point it so every handler below — and the
+            // takeover/retry logic — acts on the single real Live for this id.
+            if (session) {
+                const current = sessions.get(session.id);
+                if (current && current !== session)
+                    session = current;
+            }
             // Any user takeover cancels a pending auto-retry and ends the streak.
             // "prompt" is settled inside its own case instead: a prompt refused on
             // pace grounds sends nothing, so it must not count as a takeover — it
@@ -6457,6 +6477,21 @@ wss.on("connection", (ws, req) => {
                     if (mtMsg)
                         return fail(mtMsg);
                     session = await createSession(id, effectiveCwd, args, worktree, profile, model, effort, spawnActor({ account: me?.name, origin: msg.origin, peer: callerPeer, parent: parentAtStart, agent: callerAgent?.name }), dropUser, agentGroupId);
+                    // One Live per agent (shared-ledger [5d8d]). We only reach here when
+                    // there was no live session to attach to — but `existing` may be a
+                    // RETIRED Live whose pilot has exited while viewers are still
+                    // attached (a web tab, a Telegram bridge). `createSession` has just
+                    // replaced it in the registry; without a handover those viewers are
+                    // orphaned on the old object — still fed the agent's answers by its
+                    // lingering tail, but cut off from every broadcast on the new Live
+                    // (the other interfaces' prompt echoes, dialogs, working/turn-done).
+                    // Move them onto the new Live and quiet the old one — without killing
+                    // the agent, which the new Live may now be driving on the same pane.
+                    if (existing && existing !== session) {
+                        const moved = supersedeSession(existing, session);
+                        if (moved)
+                            console.log(`session ${id.slice(0, 8)}: superseded a retired Live, moved ${moved} viewer(s)`);
+                    }
                     session.clients.add(ws);
                     if (resumed) {
                         const turns = historyWithOffers(loadHistory(effectiveCwd, id, session.transcriptHome), id);