teapot-coding-agent 0.25.1 → 0.26.0

package/dist/agent/agent.js

@@ -345,6 +345,46 @@ export class Agent {
     get compactBudgetIsManual() {
         return this.manualCompactBudget;
     }
+    /**
+     * A context size we are willing to act on.
+     *
+     * #73: `lastUsage.input` is the provider's own count, so it is normally the
+     * most accurate number available — but a provider that under-reports (a proxy
+     * that omits the field's real value, a broken gateway, a model served through
+     * a shim) makes BOTH safety gates believe the context is nearly empty:
+     *
+     *     maybePrune()    est < budget * 0.6   -> 0 prunes, forever
+     *     maybeCompact()  before < budget       -> 0 compactions, forever
+     *
+     * Reproduced: ~40k characters of real conversation, provider reporting
+     * `prompt_tokens: 10` — zero prunes, zero compactions, and a gauge reading 10,
+     * so nothing looks wrong. The context then overflows for real, with the
+     * defence that exists to stop exactly that switched off.
+     *
+     * So the reported number is used, but never as the ONLY number: it is floored
+     * against the local estimate. The estimate is a heuristic; the point is that
+     * `??` was the wrong way to combine a measurement with a floor — it only falls
+     * back when the value is ABSENT, so a confidently wrong value was trusted more
+     * than the guess.
+     *
+     * The floor is a HALF of the local estimate. A quarter was tried first and
+     * was too weak to clear the 0.6-of-budget threshold for a realistic session
+     * (estimate 5108 → floored 1277 against a 3600 bar), so the guard still would
+     * not have fired. Half keeps the intent — catch "reported 10 when the real
+     * prompt is large" — without arguing with a provider whose tokenizer
+     * legitimately differs from ours, since a provider within 2x of the estimate
+     * is not the failure mode being defended against.
+     */
+    contextSizeForBudgeting() {
+        const estimated = this.estimateTokens();
+        const reported = this.lastUsage?.input;
+        if (reported === undefined)
+            return estimated;
+        // a provider reporting nothing at all is a different bug; treat it as unknown
+        if (!Number.isFinite(reported) || reported <= 0)
+            return estimated;
+        return Math.max(reported, Math.floor(estimated / 2));
+    }
     /**
      * Is this agent doing work that `stop()` would actually stop?
      *
@@ -722,10 +762,19 @@ export class Agent {
             droppedEvents: dropped.length,
             tailMode: tail,
         });
-        // Seed the new branch's parent link to the fork event just written, so its
-        // first event chains across instead of starting a disconnected parent:null
-        // history (#38).
-        this.log.seedBranch(newBranch, this.log.lastEventId(this.currentBranch));
+        // Seed the new branch's parent link so its first event chains across
+        // instead of starting a disconnected parent:null history (#38).
+        //
+        // #69: seed from the CUT POINT, not from this branch's tip. The fork event
+        // records where the edit was made (`fromEvent` = the last KEPT event), but
+        // `lastEventId(currentBranch)` is the newest event on the branch — which is
+        // one of the events this edit just DISCARDED. Seeding from the tip chained
+        // the new branch to the discarded tail, so lineageOf() walked straight back
+        // through it and a restart resurrected every dropped turn.
+        //
+        // The cut point is the right parent: it is the last event that survives.
+        const cutPoint = kept.at(-1)?.id ?? null;
+        this.log.seedBranch(newBranch, cutPoint);
         this.currentBranch = newBranch;
         this.messages = msgs;
         await this.log.append("prompt", this.currentSession, this.currentBranch, { source: "user", text });
@@ -940,6 +989,17 @@ export class Agent {
                 ...(this.compactPhase ? { compacting: this.compactPhase } : {}),
             },
             pendingPrompts: this.pendingPrompts.length,
+            // #78: the IDS as well as the count. The web UI reconciles its local echo
+            // list against the live queue, and it was doing that by POSITION
+            // (slice(0, queued)) because only a count was published — so whenever the
+            // count dipped below the true queue length (a mid-queue cancellation, or a
+            // momentary gap), the NEWEST still-queued echoes were dropped and their
+            // undelivered log rows reappeared as settled "sent" rows. Identity needs
+            // the ids to travel; the count alone cannot express "these two".
+            //
+            // Bounded like the rest of the snapshot, and ids are opaque, so this
+            // cannot carry prompt text.
+            pendingPromptIds: this.pendingPrompts.map((p) => p.id).filter((x) => !!x).slice(0, 64),
             todo: this.todo.slice(0, 32_000), // match set_todo's cap — no silent truncation
             parent: this.opts.parent,
             awaiting: this.awaitingUser,
@@ -1114,7 +1174,20 @@ export class Agent {
     }
     /** Start (or resume) autonomous operation toward the goal. */
     start(reason = "start") {
-        if (this.status === "running")
+        // #76: a stop() immediately followed by start() USED TO BE SILENTLY LOST.
+        //
+        // `stop()` only flips the status via an ENQUEUED task, so between the two
+        // calls the status is still "running" and the guard below returned early —
+        // before `stopRequested = false` could run. The stop then landed, the loop
+        // exited, and the agent ended "stopped" with the restart discarded. The same
+        // window made a stop+restart abort the new round's first tool.
+        //
+        // So a pending stop is not a reason to refuse a start. The loop's own
+        // guards (`stopRequested` re-checked after every await) keep the old turn
+        // from running on, and enqueue() serialises the two tasks, so the restart
+        // is ordered after the stop rather than racing it.
+        const pendingStop = this.stopRequested;
+        if (this.status === "running" && !pendingStop)
             return;
         this.stopRequested = false;
         this.awaitingUser = false; // a fresh start answers/resumes past any ask_user
@@ -1318,6 +1391,13 @@ export class Agent {
                 const name = err.name;
                 if (name === "StopRequested" || name === "AbortError" || this.stopRequested)
                     throw err;
+                // #76: a context-overflow error is the caller's to handle, not ours to
+                // retry. Retrying the SAME oversized request four times with 5s/5s/30s
+                // waits cannot succeed, and it delays the compact-and-retry that would
+                // — so the overflow path never even ran. This is the same
+                // "present, correct, and inert" shape as #54.
+                if (isContextOverflow(err))
+                    throw err;
                 if (attempt >= maxAttempts)
                     throw err;
                 const waitMs = waits[Math.min(attempt - 1, waits.length - 1)];
@@ -1743,6 +1823,20 @@ export class Agent {
                         `(last: ${call.function.name})`);
                 }
             }
+            // #76: every tool_call an assistant message issued must have a matching
+            // tool result, or the provider REJECTS the next request — which is the
+            // "`200 with no choices`" shape #50 traced to a malformed history.
+            //
+            // Two exits could leave some unanswered: `stopRequested` returns early
+            // mid-batch, and a handler that throws (ask_user parking the loop is the
+            // one that bites in practice) propagates out of the whole loop. Restore
+            // has a hole-filler for exactly this; the LIVE array did not, so a session
+            // that hit it produced an invalid next request and then failed with
+            // something that looked like a provider fault.
+            //
+            // So the invariant is enforced here rather than at each exit: whatever
+            // happened, answer what is still outstanding before moving on.
+            await this.answerUnansweredToolCalls(m);
             if (finished)
                 return true;
         }
@@ -1750,6 +1844,37 @@ export class Agent {
         // nudges the model; this round simply ends (no hard error)
         return finished;
     }
+    /**
+     * Append a tool result for every tool_call in `m` that has not been answered.
+     *
+     * Scans the tail of `messages` for `tool_call_id`s, so it is correct whichever
+     * path left the batch unfinished — a stop, a throw, or a normal completion
+     * where a handler returned early. Answered calls are left alone.
+     */
+    async answerUnansweredToolCalls(m) {
+        const calls = m.tool_calls ?? [];
+        if (!calls.length)
+            return;
+        const answered = new Set();
+        for (const existing of this.messages) {
+            if (existing.role === "tool" && existing.tool_call_id)
+                answered.add(existing.tool_call_id);
+        }
+        for (const call of calls) {
+            if (answered.has(call.id))
+                continue;
+            const content = "(not completed — the tool did not run)";
+            this.messages.push({ role: "tool", tool_call_id: call.id, content });
+            await this.log.append("tool_result", this.currentSession, this.currentBranch, {
+                callId: call.id,
+                name: call.function.name,
+                ok: false,
+                durationMs: 0,
+                result: content,
+                synthesized: true,
+            });
+        }
+    }
     buildMessages() {
         // deliberately static: [system] + append-only history keeps prefix caches hot.
         // The workspace context block (AGENTS.md + ls snapshot) is appended to the
@@ -2139,7 +2264,7 @@ export class Agent {
      * protected so current work never loses its footing.
      */
     maybePrune() {
-        const est = this.lastUsage?.input ?? this.estimateTokens();
+        const est = this.contextSizeForBudgeting(); // floored — see #73
         const budget = this.opts.contextTokenBudget;
         if (!budget || est < budget * 0.6)
             return 0; // prune only when it matters
@@ -2199,7 +2324,7 @@ export class Agent {
         // for providers that omit usage
         // stage 1: clip oversized old tool outputs before considering a summarize
         this.maybePrune();
-        const before = this.lastUsage?.input ?? this.estimateTokens();
+        const before = this.contextSizeForBudgeting(); // floored — see #73
         if (!force && before < this.opts.contextTokenBudget)
             return;
         if (!force && this.opts.autoCompact === false)
@@ -2492,12 +2617,24 @@ export class Agent {
     async fork(fromEventId) {
         const newBranch = `br${this.branchCount()}${Date.now().toString(36).slice(-4)}`;
         const parentBranch = this.currentBranch;
-        await this.log.append("fork", this.currentSession, newBranch, {
+        // Where the fork leaves the source branch. Recorded on the event AND used
+        // to seed the new branch, so the two can never disagree.
+        const fromEvent = fromEventId ?? this.log.lastEventId(parentBranch);
+        // #69: the fork event must be appended under the SOURCE branch. Appending it
+        // under the new one gave it parent:null (nothing had been written to that
+        // branch yet), so lineageOf() walked an empty chain and a restart rebuilt
+        // the fork with NO history at all — the same class of bug editPromptAt had,
+        // fixed on one path only. editPromptAt already appends under the old
+        // branch for exactly this reason.
+        await this.log.append("fork", this.currentSession, parentBranch, {
             fromSession: this.currentSession,
             fromBranch: parentBranch,
-            fromEvent: fromEventId ?? this.log.lastEventId(parentBranch),
+            fromEvent,
             newBranch,
         });
+        // Seed the new branch's parent to the point it leaves the source, so its
+        // first event chains across instead of starting at parent:null.
+        this.log.seedBranch(newBranch, fromEvent);
         this.currentBranch = newBranch;
         this.messages = [...this.messages]; // independent history copy
         return { session: this.currentSession, branch: newBranch };

package/dist/agent/tools.js

@@ -3,7 +3,7 @@
  * Tool specs are plain JSON-schema function definitions — provider-agnostic.
  */
 import { spawn } from "node:child_process";
-import { existsSync, promises as fs, realpathSync } from "node:fs";
+import { existsSync, promises as fs, readlinkSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { discoverSkills, isValidSkillName, readSkillFile, saveSkill, SKILL_FILE, } from "./skills.js";
 const str = (v, fallback = "") => (typeof v === "string" ? v : fallback);
@@ -60,14 +60,64 @@ export function safeJoin(cwd, p) {
     if (rel.startsWith("..") || path.isAbsolute(rel)) {
         throw new Error(`path escapes workspace: ${p}`);
     }
-    // symlinks inside the workspace can point anywhere — resolve the real
-    // target and confine THAT too (path.resolve alone doesn't follow links)
+    // symlinks inside the workspace can point anywhere — resolve the real target
+    // and confine THAT too (path.resolve alone doesn't follow links)
+    //
+    // #74: the old code resolved `abs` and swallowed a throw, treating failure as
+    // "fine". That is exactly backwards, and the failure is the NORMAL case:
+    // `realpathSync` throws ENOENT for a file that does not exist yet, which is
+    // every write_file creating something new. So `real` stayed as the LEXICAL
+    // path — which is inside the workspace — and the symlink guard never ran.
+    //
+    // Demonstrated: with `esc -> /outside` (a real directory), safeJoin allowed
+    // `esc/pwned.txt` and write_file wrote straight through it, landing outside
+    // the workspace. The dangling case happened to fail later with ENOTDIR, which
+    // is luck, not a control.
+    //
+    // So on ENOENT/ENOTDIR, resolve the nearest EXISTING ancestor instead of
+    // giving up. That still catches the escape — the ancestor IS the symlink —
+    // while allowing genuinely new files inside the workspace.
     let real = abs;
     try {
         real = realpathSync(abs);
     }
-    catch {
-        /* target may not exist yet (write_file) — lexical check above still holds */
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT" || code === "ENOTDIR") {
+            // Walk up one component at a time. A component that is itself a SYMLINK
+            // must be resolved even when its target does not exist — realpathSync
+            // throws ENOENT for the dangling link itself, so naively walking to the
+            // first existing ancestor steps OVER the symlink and loses it. So read
+            // the link and check its target directly.
+            let probe = path.dirname(abs);
+            for (;;) {
+                try {
+                    real = realpathSync(probe);
+                    break;
+                }
+                catch (inner) {
+                    if (inner.code !== "ENOENT")
+                        break;
+                    // this component is a dangling symlink: resolve where it POINTS
+                    try {
+                        const target = readlinkSync(probe);
+                        real = path.isAbsolute(target) ? target : path.resolve(path.dirname(probe), target);
+                        break;
+                    }
+                    catch {
+                        /* not a symlink after all — keep walking */
+                    }
+                    const next = path.dirname(probe);
+                    if (next === probe)
+                        break; // reached the filesystem root
+                    probe = next;
+                }
+            }
+            // keep the un-resolved tail so the comparison below sees the full path
+            const tail = path.relative(probe, abs);
+            if (tail && !tail.startsWith(".."))
+                real = path.join(real, tail);
+        }
     }
     const relReal = path.relative(cwd, real);
     if (relReal.startsWith("..") || path.isAbsolute(relReal)) {

package/dist/master.js

@@ -229,6 +229,22 @@ function printAgentEvent(e) {
     if (line)
         console.log(`${dim(ts)} ${who} ${line}`);
 }
+/**
+ * Reduce an agent id to a safe single path segment.
+ *
+ * Agent ids become directory names, so anything path-like in one is an escape
+ * from the sessions root (#72). Kept in step with the per-call-site
+ * `.replace(/[^\w.-]/g, "-")` calls, and applied in `addAgent` too so the
+ * guarantee holds for every caller.
+ */
+export function sanitizeAgentId(id) {
+    const cleaned = String(id ?? "")
+        .replace(/[^\w.-]/g, "-")
+        // a leading dot would create a hidden dir; ".." would climb out
+        .replace(/^\.+/, "")
+        .slice(0, 60);
+    return cleaned || "agent";
+}
 export class Master {
     agents = new Map();
     /**
@@ -402,6 +418,21 @@ export class Master {
      * an older one's history.
      */
     async addAgent(ac, opts = {}) {
+        // #72: an agent id becomes a DIRECTORY name (sessions/<id>-<hash>), so it
+        // must be a safe path segment. Every caller sanitised its own id — the HTTP
+        // route, spawnChildFor's child name — except the ACP adapter, which passed
+        // the raw client string through, so `session/load {"sessionId":"../../x"}`
+        // created an agent logged outside <dataDir>/sessions/.
+        //
+        // Sanitised HERE as well as at the call sites: this is the one place that
+        // guarantees the property, so a future caller cannot reintroduce the escape
+        // by forgetting. A caller that already sanitised is unaffected — the
+        // transform is idempotent on a safe id.
+        const safeId = sanitizeAgentId(ac.id);
+        if (safeId !== ac.id) {
+            console.warn(`[teapot] agent id ${JSON.stringify(ac.id)} contained unsafe characters; using ${JSON.stringify(safeId)}`);
+        }
+        ac = { ...ac, id: safeId };
         if (this.agents.has(ac.id))
             throw new Error(`agent id already exists: ${ac.id}`);
         // provider resolution: inline overrides > named provider > legacy llm block

package/dist/server/api.js

@@ -106,6 +106,16 @@ export function buildApp(master) {
         });
     // per-agent terminal spawn guard
     const termCounts = new Map();
+    /**
+     * Agent ids reserved by an in-flight create (#71).
+     *
+     * The uniqueness loop is a check, not a reservation, and `addAgent` only
+     * publishes the id after awaiting — so concurrent creates all computed the
+     * same "unique" id and all persisted an entry. Reserving before the first
+     * await closes the window. Entries are released as soon as the agent is
+     * published or the create fails, so this never grows.
+     */
+    const idReservations = new Set();
     // keyed by CHILD, not agent: one agent may have up to 10 concurrent
     // terminals, each with its own size and its own foreground program
     const termSizes = new TermSizeTracker();
@@ -169,6 +179,12 @@ export function buildApp(master) {
     app.get("/api/agents/:id/term", upgradeWebSocket((c) => {
         const agentId = c.req.param("id") ?? "";
         let child = null;
+        // #70: whether THIS connection was admitted to the per-agent terminal
+        // budget. Declared per connection (not inside onOpen) because onClose is a
+        // sibling handler: a connection refused at the cap never incremented the
+        // counter, so onClose must not decrement for it — that asymmetry walked
+        // the counter below the live-shell count and disabled the cap entirely.
+        let admitted = false;
         const cleanup = () => {
             if (!child)
                 return;
@@ -198,7 +214,12 @@ export function buildApp(master) {
                     return;
                 }
                 termCounts.set(agentId, cur + 1);
+                admitted = true;
                 if (!agent) {
+                    // the slot was just taken and this connection owns it, so release
+                    // it here rather than leaving onClose to work it out
+                    termCounts.set(agentId, cur);
+                    admitted = false;
                     send({ kind: "exit", error: `no such agent: ${agentId}` });
                     return;
                 }
@@ -250,6 +271,11 @@ export function buildApp(master) {
                 if (dead)
                     termSizes.forget(dead);
                 cleanup();
+                // #70: only an ADMITTED connection owns a slot. A connection refused
+                // at the cap never incremented, so decrementing for it is exactly
+                // what drove the counter negative and disabled the limit.
+                if (!admitted)
+                    return;
                 const n = (termCounts.get(agentId) ?? 1) - 1;
                 if (n <= 0)
                     termCounts.delete(agentId);
@@ -281,10 +307,27 @@ export function buildApp(master) {
         let n = 2;
         // ids must be unique among RUNNING agents AND persisted config entries —
         // a config-only agent (not yet loaded) would otherwise collide on addAgent
-        while (master.agents.has(id) || master.config.agents.some((a) => a.id === id))
+        //
+        // #71: the loop below is a CHECK, not a RESERVATION, and addAgent only
+        // publishes the id after several awaits (mkdirSync, agent.init()). Every
+        // concurrent request therefore passed the check, computed the same "unique"
+        // id, and all persisted an entry — measured: 3 concurrent creates → 3 config
+        // entries, and with 5 concurrent spawns each minting its own session dir,
+        // `resolveSessionDir` binds to the first entry on restart and the rest are
+        // orphaned.
+        //
+        // So the id is RESERVED synchronously, before the first await. The set is
+        // per-process and only guards the window; a real agent arriving through
+        // another path still collides correctly via addAgent's own check.
+        while ((master.agents.has(id) || master.config.agents.some((a) => a.id === id) || idReservations.has(id)))
             id = `${base.slice(0, 38)}-${n++}`;
+        idReservations.add(id);
+        const releaseId = () => idReservations.delete(id);
         try {
+            // the reservation covers the awaits inside addAgent; once the agent is
+            // published the reservation is redundant and must be released
             const agent = await master.addAgent({ id, workspace: ws, provider: body.provider, model: body.model }, { persist: true, fresh: true });
+            releaseId();
             // NOTE: creation no longer auto-starts an LLM loop — the agent sits in
             // "stopped" (a lazy, zero-cost session) until the operator sends the
             // first prompt or presses ▶ start. The web UI relies on this.
@@ -293,6 +336,7 @@ export function buildApp(master) {
             return c.json({ ok: true, agent: agent.snapshot() });
         }
         catch (err) {
+            releaseId(); // never leak a reservation on failure
             return c.json({ error: err.message }, 400);
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teapot-coding-agent",
-  "version": "0.25.1",
+  "version": "0.26.0",
   "description": "A lightweight, always-on multi-agent harness for AI coding agents",
   "type": "module",
   "license": "AGPL-3.0-or-later",