spexcode 0.7.0-next.3 → 0.7.0-next.4

package/node_modules/@spexcode/session-application/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-application",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "Adopter-owned composition of session protocol and topology transactions.",
@@ -16,10 +16,10 @@
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/session-events": "0.7.0-next.3",
-    "@spexcode/session-protocol": "0.7.0-next.3",
-    "@spexcode/session-runtime": "0.7.0-next.3",
-    "@spexcode/session-topology": "0.7.0-next.3"
+    "@spexcode/session-events": "0.7.0-next.4",
+    "@spexcode/session-protocol": "0.7.0-next.4",
+    "@spexcode/session-runtime": "0.7.0-next.4",
+    "@spexcode/session-topology": "0.7.0-next.4"
   },
   "devDependencies": {
     "@types/node": "^20.16.0",

package/node_modules/@spexcode/session-events/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-events",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "Append-only session facts and deterministic ordered replay inputs.",
@@ -15,7 +15,7 @@
     "prepublishOnly": "node ../../scripts/release-publish.mjs --from-package-publish",
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
-  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.3" },
+  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.4" },
   "devDependencies": {
     "@types/node": "^20.16.0",
     "tsx": "^4.19.2",

package/node_modules/@spexcode/session-protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-protocol",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "type": "module",
   "description": "A durable SQLite session message protocol.",
   "files": [

package/node_modules/@spexcode/session-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-runtime",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "Adopter-owned bindings between protocol addresses and native runtime identities.",
@@ -15,7 +15,7 @@
     "prepublishOnly": "node ../../scripts/release-publish.mjs --from-package-publish",
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
-  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.3" },
+  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.4" },
   "devDependencies": {
     "@types/node": "^20.16.0",
     "tsx": "^4.19.2",

package/node_modules/@spexcode/session-selflaunch/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-selflaunch",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "A fail-closed self-launch adopter for the SpexCode session protocol.",
@@ -24,8 +24,8 @@
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/session-protocol": "0.7.0-next.3",
-    "@spexcode/session-runtime": "0.7.0-next.3"
+    "@spexcode/session-protocol": "0.7.0-next.4",
+    "@spexcode/session-runtime": "0.7.0-next.4"
   },
   "devDependencies": {
     "@types/node": "^20.16.0",

package/node_modules/@spexcode/session-topology/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/session-topology",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "publishConfig": { "access": "public" },
   "type": "module",
   "description": "A neutral SQLite relation model for session addresses.",
@@ -15,7 +15,7 @@
     "prepublishOnly": "node ../../scripts/release-publish.mjs --from-package-publish",
     "test": "npm run build && tsx --import ../../scripts/test-home.mjs --test src/*.test.ts"
   },
-  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.3" },
+  "dependencies": { "@spexcode/session-protocol": "0.7.0-next.4" },
   "devDependencies": {
     "@types/node": "^20.16.0",
     "tsx": "^4.19.2",

package/node_modules/@spexcode/spec-cli/dist/graphSnapshot.js

@@ -3,7 +3,7 @@ import { readFileSync } from 'node:fs';
 import { loadSpecs, requireGitWorkspace, headSha } from '@spexcode/spec-core';
 import { resolveLayout } from '@spexcode/spec-core';
 import { listSessions } from './sessions.js';
-import { driftIndex, historyIndex, repoRoot } from '@spexcode/spec-core';
+import { driftIndex, historyIndex, pruneHistoryCaches, repoRoot } from '@spexcode/spec-core';
 import { residentForgeRevision, residentForgeState } from '@spexcode/spec-forge/resident';
 import { resolveForgeHost } from '@spexcode/spec-forge/drivers';
 import { boardThreads } from './issues.js';
@@ -56,6 +56,9 @@ export async function boardSnapshot() {
     const root = repoRoot();
     requireGitWorkspace(root);
     const [specs, sessions] = await Promise.all([loadSpecs(), listSessions()]);
+    // Session worktrees are the live-root census for immutable history caches. Reconcile before the snapshot
+    // returns so closing a session releases its full index immediately rather than waiting for an LRU slot.
+    pruneHistoryCaches([root, ...sessions.map((session) => session.path)]);
     const layout = await resolveLayout({ activeSessionIds: sessions.map((session) => session.id) });
     const nodeIds = [...new Set([
             ...specs.map((node) => node.id),

package/node_modules/@spexcode/spec-cli/dist/harness.js

@@ -2784,7 +2784,9 @@ const socketListenerLiveness = (_rec, tmuxAlive, _runtimeDir, _pane, socketLive)
 const socketListenerOrPidAliveLiveness = (_rec, tmuxAlive, _runtimeDir, pane, socketLive) => (tmuxAlive && (!!socketLive || pane?.pidAlive === true) ? 'online' : 'offline');
 const panePidLiveness = (_rec, tmuxAlive, _runtimeDir, pane) => (tmuxAlive && pane?.pidAlive === true ? 'online' : 'offline');
 const recordOnline = (rec) => rec.stopped ? 'offline' : 'online';
-const sessionHomeLiveness = (_rec, tmuxAlive) => tmuxAlive ? 'online' : 'offline';
+// Leaf-backed headless sessions are the controller process, not the tmux pane that hosts it. The pane can
+// survive a SIGKILL as a bare shell, so tmux presence without the launch-registered PID is never online.
+const sessionHomeLiveness = (_rec, tmuxAlive, _runtimeDir, pane) => (tmuxAlive && pane?.pidAlive === true ? 'online' : 'offline');
 // @@@ unlinkSocks - remove ONLY the transport this teardown PROVED dead. `cleanupRuntime` unlinks *their*
 // socket, and the honest test of "theirs" is that the agent it just killed is GONE. It used to unlink on
 // faith, which is unsound because a socket path is derived from the session id ALONE: it is the one
@@ -2889,6 +2891,7 @@ export const claudeHeadlessHarness = {
     paneTitleIsSelfSummary: false,
     launchCmd: (id, runtimeDir, cmd) => claudeHeadlessLaunchCommand(id, runtimeDir ?? runtimeRoot(), claudeBaseCmd(cmd)),
     launchEnv: noLaunchEnv,
+    // The controller's registered PID is the liveness witness; the tmux home is only the address boundary.
     liveness: sessionHomeLiveness,
     deliveryTransport: unprovenDeliveryTransport,
     deliver: deliverViaClaudeHeadless,
@@ -3400,6 +3403,7 @@ export const piHeadlessHarness = {
     runtimeOwnership: 'leaf',
     paneTitleIsSelfSummary: false,
     launchCmd: (id, runtimeDir, cmd) => piHeadlessLaunchCommand(id, runtimeDir ?? runtimeRoot(), piBaseCmd(cmd)),
+    // The controller's registered PID is the liveness witness; the tmux home is only the address boundary.
     liveness: sessionHomeLiveness,
     deliver: deliverViaPiHeadless,
     // the controller aborts its own turn child natively and confirms only once that child is gone
@@ -3513,6 +3517,7 @@ export const opencodeHeadlessHarness = {
     runtimeOwnership: 'leaf',
     deliveryTransport: unprovenDeliveryTransport,
     launchCmd: (_id, _runtimeDir, cmd) => opencodeHeadlessLaunchCommand(opencodeBaseCmd(cmd)),
+    // The controller's registered PID is the liveness witness; the tmux home is only the address boundary.
     liveness: sessionHomeLiveness,
     coldRuntime: async (rec) => {
         const result = await opencodeHeadlessColdRuntime(rec);

package/node_modules/@spexcode/spec-cli/dist/host-resources.js

@@ -216,6 +216,29 @@ const unresolvedHarnessOwners = (recs, budgets, have) => {
     }
     return out;
 };
+// A leaf-backed headless controller is the session's runtime. Keep its durable row visible when the controller
+// disappears before the next resources sweep can attribute a process, and name the status/liveness contradiction
+// explicitly so a supervisor cannot mistake the missing process for a cleanly idle session.
+const missingHeadlessControllerOwners = (recs, procs, budgets, have) => {
+    const out = [];
+    for (const rec of recs) {
+        const harness = harnessByIdOrNull(rec.harness || defaultHarness.id);
+        if (!rec.governed || rec.stopped || rec.archived || rec.status !== 'active' && rec.status !== 'idle'
+            || harness?.runtimeOwnership !== 'leaf' || have(rec.session_id))
+            continue;
+        const pid = runtimePid(join(runtimeRoot(), 'sessions', rec.session_id, 'agent.pid'));
+        if (pid && procs.has(pid))
+            continue;
+        out.push({
+            kind: 'session', id: rec.session_id, label: `session ${rec.session_id.slice(0, 8)}`, status: rec.status, liveness: 'offline',
+            processes: [], rssMiB: 0, pssMiB: null, cpuPercent: 0,
+            budget: { rssMiB: budgets.sessionRssMiB, idleCpuPercent: budgets.idleCpuPercent },
+            findings: [`headless-liveness-contradiction:${rec.status}/offline`],
+            reclaim: { eligible: false, reason: 'headless controller is absent; lifecycle repair must be explicit' },
+        });
+    }
+    return out;
+};
 const sharedDescriptors = (recs, retainRegistry = false) => {
     const out = new Map();
     for (const harness of HARNESSES)
@@ -722,6 +745,7 @@ export async function collectResourceReport(opts = {}) {
                 budget: { rssMiB: budgets.sessionRssMiB, idleCpuPercent: budgets.idleCpuPercent },
                 findings: [`session-record-corrupt:${entry.error}`], reclaim: { eligible: false, reason: 'session record is corrupt; ownership and lifecycle are unknown' },
             });
+    owners.push(...missingHeadlessControllerOwners(inv.recs, inv.procs, budgets, (sessionId) => owners.some((owner) => owner.kind === 'session' && owner.id === sessionId)));
     owners.push(...unresolvedHarnessOwners(inv.recs, budgets, (sessionId) => owners.some((owner) => owner.kind === 'session' && owner.id === sessionId)));
     // A referenced shared runtime with no readable process is still operationally important: keep its live or
     // unknown refcount visible instead of silently omitting it from a process-derived report.

package/node_modules/@spexcode/spec-cli/dist/sessions.js

@@ -2538,12 +2538,19 @@ async function establishBackendConnection(target) {
             socket.destroy();
             fn();
         };
-        const timer = setTimeout(() => finish(() => {
-            const error = new Error(`backend connection was not accepted at ${target.url} within 1500ms`);
-            error.name = 'BackendError';
-            Object.assign(error, { code: 'backend_availability_indeterminate' });
-            reject(error);
-        }), 1500);
+        const timer = setTimeout(() => {
+            // The event loop may have been blocked past the wall after the kernel completed the handshake. In that
+            // case Node has not emitted `connect` yet, but `connecting` is already false; acceptance still proves
+            // presence and must not be relabelled as an unavailable backend.
+            if (!socket.connecting || socket.readyState === 'open')
+                return finish(() => resolve(false));
+            finish(() => {
+                const error = new Error(`backend connection was not accepted at ${target.url} within 1500ms`);
+                error.name = 'BackendError';
+                Object.assign(error, { code: 'backend_availability_indeterminate' });
+                reject(error);
+            });
+        }, 1500);
         timer.unref?.();
         socket.once('connect', () => finish(() => resolve(false)));
         socket.once('error', (error) => finish(() => {

package/node_modules/@spexcode/spec-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/spec-cli",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "type": "module",
   "description": "SpexCode CLI + server. The root spexcode package delegates to this compiled package; dashboard assets live in @spexcode/spec-dashboard.",
   "bin": {
@@ -35,12 +35,12 @@
     "test": "tsx --import ../scripts/test-home.mjs --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/session-application": "0.7.0-next.3",
-    "@spexcode/session-selflaunch": "0.7.0-next.3",
-    "@spexcode/spec-core": "0.7.0-next.3",
-    "@spexcode/spec-eval": "0.7.0-next.3",
-    "@spexcode/spec-forge": "0.7.0-next.3",
-    "@spexcode/transcript": "0.7.0-next.3",
+    "@spexcode/session-application": "0.7.0-next.4",
+    "@spexcode/session-selflaunch": "0.7.0-next.4",
+    "@spexcode/spec-core": "0.7.0-next.4",
+    "@spexcode/spec-eval": "0.7.0-next.4",
+    "@spexcode/spec-forge": "0.7.0-next.4",
+    "@spexcode/transcript": "0.7.0-next.4",
     "smol-toml": "^1.8.0"
   },
   "devDependencies": {

package/node_modules/@spexcode/spec-core/dist/git.d.ts

@@ -122,6 +122,7 @@ export declare function historyCacheStats(): {
     historyRoots: number;
     driftRoots: number;
 };
+export declare function pruneHistoryCaches(activeRoots: Iterable<string>): void;
 export declare function resetHistoryCachesForTests(): void;
 export declare function historyEventCachePathForTests(root: string): string;
 export declare function ancestorsOf(idx: Reachability, sha: string): Uint8Array | undefined;

package/node_modules/@spexcode/spec-core/dist/git.js

@@ -2270,6 +2270,31 @@ export function sourceIndexes(root, tip = 'HEAD') {
 export function historyCacheStats() {
     return { historyHeads: indexCache.size, driftHeads: driftIdxCache.size, historyRoots: indexRoots.size, driftRoots: driftRoots.size };
 }
+// A backend snapshot is the authority for which checkout roots are live. Release cache ownership for roots
+// that disappeared from that snapshot so closed session worktrees do not keep immutable history warm until
+// the generic slot bound happens to evict them. Shared entries survive while another live root still names
+// the same immutable key; an in-flight promise remains usable by its current caller even after its cache key
+// is released.
+export function pruneHistoryCaches(activeRoots) {
+    const active = new Set([...activeRoots].map(rootKey));
+    for (const [root] of indexRoots)
+        if (!active.has(root))
+            indexRoots.delete(root);
+    for (const [root] of driftRoots)
+        if (!active.has(root))
+            driftRoots.delete(root);
+    const referencedHistory = new Set(indexRoots.values());
+    const referencedDrift = new Set(driftRoots.values());
+    for (const key of indexCache.keys())
+        if (!referencedHistory.has(key))
+            indexCache.delete(key);
+    for (const key of driftIdxCache.keys())
+        if (!referencedDrift.has(key))
+            driftIdxCache.delete(key);
+    for (const root of eventPathMemo.keys())
+        if (!active.has(root))
+            eventPathMemo.delete(root);
+}
 // Tests deliberately clear process-local promises and path identity to exercise both cold and read-back paths.
 // Production callers retain the bounded index caches; this is not a correctness escape hatch.
 export function resetHistoryCachesForTests() {

package/node_modules/@spexcode/spec-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/spec-core",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "type": "module",
   "description": "SpexCode's dependency-minimal spec graph core.",
   "files": [

package/node_modules/@spexcode/spec-eval/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/spec-eval",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "type": "module",
   "exports": {
     ".": "./dist/index.js",
@@ -26,7 +26,7 @@
     "test": "tsx --import ../scripts/test-home.mjs --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/spec-core": "0.7.0-next.3"
+    "@spexcode/spec-core": "0.7.0-next.4"
   },
   "devDependencies": {
     "@types/node": "^20.16.0",

package/node_modules/@spexcode/spec-forge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/spec-forge",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "type": "module",
   "exports": {
     ".": "./dist/index.js",
@@ -22,7 +22,7 @@
     "test": "tsx --test src/*.test.ts"
   },
   "dependencies": {
-    "@spexcode/spec-core": "0.7.0-next.3"
+    "@spexcode/spec-core": "0.7.0-next.4"
   },
   "devDependencies": {
     "@types/node": "^20.16.0",

package/node_modules/@spexcode/transcript/dist/parsers.js

@@ -104,6 +104,9 @@ export function claudeEvent(value) {
     }
     return null;
 }
+const blockText = (content) => typeof content === 'string'
+    ? string(content)
+    : items(content).map((block) => string(object(block)?.text)).filter(Boolean).join('\n') || null;
 export function codexEvent(value) {
     const entry = object(value);
     const payload = object(entry?.payload);
@@ -113,16 +116,25 @@ export function codexEvent(value) {
     if (eventAt === null)
         return { at: null, turn: null };
     const type = string(payload.type);
-    if ((entry.type === 'event_msg' && type === 'user_message')
-        || (entry.type === 'response_item' && (type === 'message' || type === 'input_message') && payload.role === 'user')) {
+    // THE PERSON'S MESSAGE is the `user_message` event. Codex also records it as a `response_item` message (the API
+    // form, `input_text` blocks) beside harness injections that no person typed (the AGENTS.md instructions), so
+    // that form is not a turn — the event is, once.
+    if (entry.type === 'event_msg' && type === 'user_message') {
         const text = typeof payload.message === 'string' ? payload.message : compact(payload.message ?? payload.content ?? '');
         return text ? { at: eventAt, turn: { id: idOf(payload) ?? idOf(entry), at: eventAt, role: 'user', text, tools: [] } } : null;
     }
-    // commentary AND the final answer are both what the agent said; only structured reasoning stays private
+    if (entry.type === 'response_item' && (type === 'message' || type === 'input_message') && payload.role === 'user')
+        return { at: eventAt, turn: null };
+    // WHAT THE AGENT SAID is the `agent_message` event — commentary and the final answer alike. Codex 0.146 also
+    // records the same prose as a `response_item` message (`output_text` blocks) beside it, so that form is not read:
+    // reading both would say every sentence twice. An empty event (a final answer that was a tool call) is a clock,
+    // not a turn. Structured reasoning stays private.
     if (entry.type === 'event_msg' && type === 'agent_message') {
         const text = string(payload.message ?? payload.text);
-        return text ? { at: eventAt, turn: { id: idOf(payload) ?? idOf(entry), at: eventAt, role: 'assistant', text, tools: [] } } : null;
+        return text ? { at: eventAt, turn: { id: idOf(payload) ?? idOf(entry), at: eventAt, role: 'assistant', text, tools: [] } } : { at: eventAt, turn: null };
     }
+    if (entry.type === 'response_item' && type === 'message' && payload.role === 'assistant')
+        return { at: eventAt, turn: null };
     if (entry.type === 'response_item' && (type === 'custom_tool_call' || type === 'function_call')) {
         const id = string(payload.call_id ?? payload.id) ?? 'tool';
         return { at: eventAt, turn: { id: idOf(payload) ?? idOf(entry), at: eventAt, role: 'assistant', tools: [{ id, name: string(payload.name ?? payload.tool_name) ?? 'tool', input: payload.input === undefined && payload.arguments === undefined ? undefined : compact(payload.input ?? payload.arguments), outputLines: 0, outputBytes: 0 }] } };
@@ -229,9 +241,6 @@ export function codexAppServerStream() {
         return parsed;
     };
 }
-const blockText = (content) => typeof content === 'string'
-    ? string(content)
-    : items(content).map((block) => string(object(block)?.text)).filter(Boolean).join('\n') || null;
 export function piEvent(value) {
     const entry = object(value);
     const message = object(entry?.message);

package/node_modules/@spexcode/transcript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spexcode/transcript",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "type": "module",
   "description": "Normalized agent transcripts: one parser per harness, a bounded interval reader over a native thread file or an in-memory event stream, and the full/delta frame protocol every transport and renderer share.",
   "files": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spexcode",
-  "version": "0.7.0-next.3",
+  "version": "0.7.0-next.4",
   "type": "module",
   "description": "SpexCode — a spec-driven, self-developing dev tool. The `spex` CLI + spec server reads the .spec tree and its git history, and serves the dashboard.",
   "license": "MIT",
@@ -44,7 +44,7 @@
     "prepack": "node scripts/sync-init-plugins.mjs --check && node scripts/prepack.mjs"
   },
   "dependencies": {
-    "@spexcode/spec-cli": "0.7.0-next.3"
+    "@spexcode/spec-cli": "0.7.0-next.4"
   },
   "publishConfig": {
     "access": "public"