teapot-coding-agent 0.26.0 → 0.26.2

package/dist/agent/agent.js

@@ -1190,6 +1190,8 @@ export class Agent {
         if (this.status === "running" && !pendingStop)
             return;
         this.stopRequested = false;
+        // claim the status against any stop write still queued behind us (#86)
+        this.stopSeq++;
         this.awaitingUser = false; // a fresh start answers/resumes past any ask_user
         void this.enqueue(async () => {
             await this.ensureReady(); // lazy restore before the loop touches history
@@ -1206,11 +1208,32 @@ export class Agent {
         this.abort?.abort();
         this.toolAbort.abort();
         this.wake?.();
+        // #86: the status write is DEFERRED onto the run chain, so it can land
+        // AFTER a start() that followed it. Observed: `idle -> stopped -> running ->
+        // running -> idle`. The agent did resume — but it flashed "stopped" on the
+        // way, and finished idle rather than running, so from the UI the operator's
+        // ▶ start looked like it had done nothing.
+        //
+        // `start()` clears stopRequested synchronously, which is what makes this
+        // detectable: by the time this task runs, a start has already claimed the
+        // agent and the stop no longer owns the status.
+        //
+        // So record WHEN the stop was requested, and let a start that came after it
+        // win. A stop issued while the agent is genuinely still running behaves
+        // exactly as before.
+        const stopSeq = ++this.stopSeq;
         void this.enqueue(() => {
+            // Only a start() that arrived AFTER this stop may claim the status. The
+            // seq check alone does that — no status test, because a genuinely running
+            // agent must still be reported "stopped" (#86).
+            if (this.stopSeq !== stopSeq)
+                return Promise.resolve();
             this.setStatus("stopped", reason);
             return Promise.resolve();
         });
     }
+    /** monotonic counter: a start() bumps it, so a pending stop status write loses */
+    stopSeq = 0;
     setStatus(s, reason = "") {
         // Update the field FIRST. log.append fires onEvent synchronously, and the
         // master's child-event hook wakes parked wait_children callers — those
@@ -1585,8 +1608,15 @@ export class Agent {
                 return finished;
             }
             for (const call of m.tool_calls) {
-                if (this.stopRequested)
+                if (this.stopRequested) {
+                    // #54: this returned straight out of the turn, SKIPPING the
+                    // answerUnansweredToolCalls backstop below — so every remaining
+                    // tool_call in this assistant message stayed logged with NO
+                    // tool_result anywhere, and its row rendered as "waiting for
+                    // output…" for the rest of the session.
+                    await this.answerUnansweredToolCalls(m);
                     return finished;
+                }
                 if (call.function.name === "finish") {
                     this.pendingSubReport = ""; // the real summary supersedes it
                     await this.handleFinish(call.function.arguments);
@@ -1665,6 +1695,13 @@ export class Agent {
                     this.awaitingUser = true;
                     this.setStatus("waiting", question.slice(0, 80));
                     // control flow: park the loop; the operator's next prompt resumes it
+                    //
+                    // #54: answer the rest of this assistant batch BEFORE parking. The
+                    // throw leaves the whole tool loop, so any EARLIER call in the same
+                    // message that was logged but not yet run kept no tool_result — the
+                    // comment on the backstop below says as much, and it is exactly the
+                    // path that bites in practice because ask_user is common.
+                    await this.answerUnansweredToolCalls(m);
                     throw Object.assign(new Error("waiting for user"), { name: "WaitForUser" });
                 }
                 if (call.function.name === "get_todo") {
@@ -1796,8 +1833,23 @@ export class Agent {
                 });
                 const t0 = Date.now();
                 // first filesystem touch creates a missing workspace (never at boot)
-                await this.ensureWorkspace();
-                const result = await executeTool(call.function.name, call.function.arguments, this.toolCtx);
+                // #54: this is awaited BETWEEN the tool_call append above and the
+                // tool_result append below, and `fs.mkdir` has no catch — so a failure
+                // propagated out of the whole loop, leaving the call logged with no
+                // result ANYWHERE, and its row read "waiting for output…" for good.
+                //
+                // The loop's own backstop could not save it: it sits at the bottom of
+                // the same loop, which a throw skips. So the tool_result is written in a
+                // `finally` — the call is answered whatever happens.
+                // the type is inferred from executeTool, so this cannot drift from it
+                let result;
+                try {
+                    await this.ensureWorkspace();
+                    result = await executeTool(call.function.name, call.function.arguments, this.toolCtx);
+                }
+                catch (err) {
+                    result = { ok: false, result: `tool could not run: ${err.message}` };
+                }
                 this.stats.toolCalls++;
                 await this.log.append("tool_result", this.currentSession, this.currentBranch, {
                     callId: call.id,
@@ -2029,6 +2081,40 @@ export class Agent {
         }
         return sys;
     }
+    /**
+     * The last few conversation turns, for a parent's `final` report.
+     *
+     * Captured BEFORE the final marker is written so the parent gets real
+     * substance (findings, file paths, numbers), not just whatever the model
+     * typed into the finish() summary argument.
+     *
+     * Extracted as its own method because a REJECTED completion audit also needs
+     * it (#89) — the retry prompt should carry the same context an approved one
+     * would — while emitting no `final: true`.
+     */
+    async captureRecentTurns() {
+        const recent = [];
+        for (let i = this.messages.length - 1; i >= 0 && recent.length < 6; i--) {
+            const m = this.messages[i];
+            if (m.role === "user")
+                continue; // prompts/noise — keep agent output only
+            if (m.role === "assistant" && !(m.content ?? "").trim())
+                continue;
+            const who = m.role === "tool" ? "tool" : m.role;
+            let line = `[${who}] ${(m.content ?? "").trim()}`;
+            if (m.role === "tool") {
+                // tool results are prefixed "(failed)" by the logger when they fail —
+                // the raw content is what matters here, and cap hard: these can be huge
+                line = `[${who}] ${(m.content ?? "").trim().slice(0, 1200)}`;
+            }
+            // A generous cap, but not unbounded: one runaway turn must not blow up
+            // the parent's context. The old 1500 char clip cut findings in half —
+            // a review's conclusions routinely live past that mark (#42) — and this
+            // text is bounded by 6 turns, so the worst case is ~120k chars.
+            recent.unshift(line.slice(0, 20_000));
+        }
+        return recent;
+    }
     async handleFinish(argsJson) {
         const args = safeParse(argsJson);
         if (args.goalComplete === true && this.goal.status !== "done") {
@@ -2053,8 +2139,39 @@ export class Agent {
                         { role: "user", content: auditPrompt },
                     ], []);
                     const text = String(res.message.content ?? "");
-                    const approved = /^APPROVED\b/i.test(text.trim());
-                    const feedback = text.replace(/^(APPROVED|CHANGES-REQUIRED)\s*[:—-]?\s*/i, "").trim();
+                    // #90: a reply that is NOT a verdict must not be read as a rejection.
+                    //
+                    // `/^APPROVED\b/i.test("")` is false, so an auditor that returned
+                    // nothing — truncated, refused, or leaked provider tool-call markup —
+                    // was scored `changes-required` with no reason. Seven times in one
+                    // session: the worker was told to "address these gaps" while being
+                    // given none, and the fallback text was the contract it had already
+                    // read. A reason-less rejection carries no information and only
+                    // teaches everyone that the audit is noise.
+                    //
+                    // So an unusable reply is treated as NO VERDICT, exactly like an
+                    // auditor that threw — the `catch` below already fails open with the
+                    // reasoning "a flaky provider can't trap work in an unauditable
+                    // loop". The same situation reached by another route gets the same
+                    // answer.
+                    const verdictLine = text.trim();
+                    // provider fallbacks for a message with no usable text; treating one
+                    // of these as a "reason" is worse than treating it as nothing
+                    const PLACEHOLDER = /^\((tool call|no content|no output)\)$/i;
+                    const usable = verdictLine.length > 0 && !PLACEHOLDER.test(verdictLine);
+                    const decided = usable && /^(APPROVED|CHANGES-REQUIRED)\b/i.test(verdictLine);
+                    if (!decided) {
+                        await this.log.append("system_note", this.currentSession, this.currentBranch, {
+                            event: "audit-failed",
+                            detail: usable
+                                ? `auditor reply had no verdict: ${verdictLine.slice(0, 200)}`
+                                : "auditor returned no verdict",
+                        });
+                        await this.setGoalStatus("done");
+                        return;
+                    }
+                    const approved = /^APPROVED\b/i.test(verdictLine);
+                    const feedback = verdictLine.replace(/^(APPROVED|CHANGES-REQUIRED)\s*[:—-]?\s*/i, "").trim();
                     // #51: storing the literal "(no detail)" made the UI draw a card
                     // whose whole content was the absence of a reason, and that same
                     // string landed in goal.md for the right panel. An empty string is
@@ -2087,6 +2204,19 @@ export class Agent {
                             source: "harness",
                             text: `[harness] The completion audit REJECTED this finish. Address these gaps, then finish again with goalComplete=true:\n\n${gaps}`,
                         });
+                        // #89: RETURN before the final message is written.
+                        //
+                        // Falling through emitted `final: true` while the goal was still
+                        // active — and that is the event onChildEvent forwards to the
+                        // parent. So a REJECTED completion told the parent the work was
+                        // DONE, and the child then sat retrying against a parent that had
+                        // already moved on and stopped listening.
+                        //
+                        // The goal stays active and the retry prompt is queued above, so
+                        // the loop simply continues; the parent's notification is deferred
+                        // until a finish that actually survives the audit.
+                        await this.captureRecentTurns();
+                        return;
                     }
                 }
                 catch (err) {
@@ -2103,29 +2233,7 @@ export class Agent {
                 await this.setGoalStatus("done");
             }
         }
-        // Capture the last few conversation turns BEFORE the final marker so the
-        // parent gets real substance (findings, file paths, numbers), not just
-        // whatever the model typed into the finish() summary argument.
-        const recent = [];
-        for (let i = this.messages.length - 1; i >= 0 && recent.length < 6; i--) {
-            const m = this.messages[i];
-            if (m.role === "user")
-                continue; // prompts/noise — keep agent output only
-            if (m.role === "assistant" && !(m.content ?? "").trim())
-                continue;
-            const who = m.role === "tool" ? "tool" : m.role;
-            let line = `[${who}] ${(m.content ?? "").trim()}`;
-            if (m.role === "tool") {
-                // tool results are prefixed "(failed)" by the logger when they fail —
-                // the raw content is what matters here, and cap hard: these can be huge
-                line = `[${who}] ${(m.content ?? "").trim().slice(0, 1200)}`;
-            }
-            // A generous cap, but not unbounded: one runaway turn must not blow up
-            // the parent's context. The old 1500 char clip cut findings in half —
-            // a review's conclusions routinely live past that mark (#42) — and this
-            // text is bounded by 6 turns, so the worst case is ~120k chars.
-            recent.unshift(line.slice(0, 20_000));
-        }
+        const recent = await this.captureRecentTurns();
         await this.log.append("message", this.currentSession, this.currentBranch, {
             role: "assistant",
             final: true,

package/dist/agent/tools.js

@@ -16,6 +16,45 @@ function clip(s, max) {
 async function readText(p) {
     return fs.readFile(p, "utf8");
 }
+/**
+ * The file's dominant line ending, or null when it is mixed or empty.
+ *
+ * `null` means "do not normalise" — see the note above.
+ */
+export function detectEol(text) {
+    if (!text)
+        return null;
+    const crlf = (text.match(/\r\n/g) ?? []).length;
+    // a bare CR is a CR not followed by LF
+    const cr = (text.match(/\r(?!\n)/g) ?? []).length;
+    const lf = (text.match(/(?<!\r)\n/g) ?? []).length;
+    const kinds = [crlf, cr, lf].filter((n) => n > 0).length;
+    // one kind only -> unambiguous. Mixed -> null.
+    if (kinds !== 1)
+        return null;
+    if (crlf > 0)
+        return "\r\n";
+    if (cr > 0)
+        return "\r";
+    return "\n";
+}
+/** Split on ANY of the three line endings, dropping the terminators. */
+export function splitEolLines(text) {
+    return text.split(/\r\n|\r|\n/);
+}
+/**
+ * Re-apply `eol` to content the model supplied.
+ *
+ * Models emit `\n` essentially always, so a CRLF or CR file rewritten with LF
+ * content would otherwise be silently converted. Untouched terminators already
+ * in the right form are left alone, so this is safe to run on merged content.
+ */
+export function applyEol(content, eol) {
+    if (!eol || eol === "\n")
+        return content;
+    // normalise to \n first, then re-apply — avoids double-CR on "\r\n"
+    return content.replace(/\r\n|\r|\n/g, eol);
+}
 /**
  * Optimistic-concurrency guard (#5). The model reads a file, thinks, then
  * writes — and in between, a sub-agent, a background job or the operator may
@@ -970,7 +1009,11 @@ export const TOOLS = [
                 };
             }
             ctx.onFileRead?.(str(args.path));
-            const lines = text.split("\n");
+            // #84: split on ALL THREE line endings. A CR-only (old-Mac) file used to
+            // come back as a single line, so the model could not address lines 2..n at
+            // all — and a CRLF file left a trailing "\r" on every line, which then
+            // had to be stripped again by every consumer.
+            const lines = splitEolLines(text);
             // #7/#4: opt-in hashline output. Default stays the historical `N| ` so
             // nothing that depends on it changes until the mode is chosen.
             const idMode = lineIdMode(args);
@@ -1056,8 +1099,25 @@ export const TOOLS = [
             if (stale)
                 return stale;
             await fs.mkdir(path.dirname(p), { recursive: true });
-            await fs.writeFile(p, args.content, "utf8");
-            return { ok: true, result: `wrote ${p} (${args.content.length} bytes)` };
+            // #84: a file's line endings belong to the FILE. Writing the model's
+            // content verbatim silently converted a CRLF (or CR) file to LF whenever
+            // the model rewrote it — the model never emits \r — so one logical edit
+            // produced a whole-file diff, and any tool that normalises on EOL (git,
+            // prettier) would rewrite it afterwards.
+            //
+            // So an EXISTING file's dominant EOL is re-applied. detectEol returns null
+            // for a mixed file, which is left untouched on purpose: choosing a winner
+            // there would itself be the silent whole-file rewrite this prevents.
+            const before = await currentOrNull(p);
+            const eol = before === null ? null : detectEol(before);
+            const out = applyEol(args.content, eol);
+            await fs.writeFile(p, out, "utf8");
+            const converted = eol !== null && eol !== "\n" && out !== args.content;
+            return {
+                ok: true,
+                result: `wrote ${p} (${out.length} bytes)` +
+                    (converted ? ` (kept ${eol === "\r\n" ? "CRLF" : "CR"} line endings)` : ""),
+            };
         },
     },
     {
@@ -1136,12 +1196,15 @@ export const TOOLS = [
                 const patLines = oldText.replace(/\r\n/g, "\n").split("\n");
                 const hits = trailingWsMatches(srcLines, patLines);
                 if (hits.length === 1 && patLines.length > 0) {
-                    const eol = text.includes("\r\n") ? "\r\n" : "\n";
+                    // #84: same detection as the hashline path — CR-only files are detected
+                    // too, and a MIXED file yields null and is left as-is rather than
+                    // homogenised. The old `includes("\r\n")` test called a CR-only file
+                    // "\n", so an edit to one silently converted its line endings.
                     const rebuilt = [
                         ...srcLines.slice(0, hits[0]),
-                        ...newText.replace(/\r\n/g, "\n").split("\n"),
+                        ...splitEolLines(newText),
                         ...srcLines.slice(hits[0] + patLines.length),
-                    ].join(eol);
+                    ].join(detectEol(text) ?? "\n");
                     await fs.writeFile(p, rebuilt, "utf8");
                     return {
                         ok: true,
@@ -1197,12 +1260,10 @@ export const TOOLS = [
             // emit \r).
             const eol = text.includes("\r\n") ? "\r\n" : "\n";
             const out = hashSpan
-                ? text
-                    .split("\n")
+                ? splitEolLines(text)
                     .slice(0, hashSpan.start)
-                    .concat(newText.replace(/\r\n/g, "\n").split("\n"), text.split("\n").slice(hashSpan.end))
-                    .join("\n")
-                    .replace(/(?<!\r)\n/g, eol)
+                    .concat(splitEolLines(newText), splitEolLines(text).slice(hashSpan.end))
+                    .join(eol ?? "\n")
                 : replaceAll
                     ? text.split(oldText).join(newText)
                     : text.replace(oldText, newText);

package/dist/master.js

@@ -1277,9 +1277,30 @@ When this task is done (or truly blocked), call finish() with a summary for @${p
             // remove from map so a re-spawn after restart doesn't carry state
             this.agents.delete(id);
         });
-        const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error("agent stop timeout")), timeoutMs));
-        await Promise.race([Promise.all(stopPromises), timeout]);
-        console.log("[teapot] all agents stopped");
+        // #79: two problems with racing a timeout against the real work.
+        //
+        // 1. The timer was never cleared, so it kept the event loop alive for the
+        //    FULL timeout after a fast, successful stop — a 30s handle on a stop
+        //    that took milliseconds.
+        // 2. On timeout, the promises that HAD completed had already deleted their
+        //    agents from `this.agents`, while their peers were still mid-dispose.
+        //    `restartServer` then threw BEFORE spawning its replacement, so the
+        //    process was left serving with a half-empty agent map and no successor.
+        //
+        // Fixed by clearing the timer, and by reporting which agents did NOT stop
+        // so the caller can decide rather than being left half-dead.
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error("agent stop timeout")), timeoutMs);
+        });
+        try {
+            await Promise.race([Promise.all(stopPromises), timeout]);
+            console.log("[teapot] all agents stopped");
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
     }
     /** Restart the server process (spawns a new master, keeps this one alive until ready). */
     async restartServer() {

package/dist/server/api.js

@@ -91,21 +91,58 @@ function mimeFor(rel, kind) {
 }
 export function buildApp(master) {
     const app = new Hono();
+    /**
+     * Cap on concurrent `/api/ws` event-stream clients (#79).
+     *
+     * Each one holds a listener on the global bus and receives every agent's
+     * events, so this bounds real fan-out. 64 is far above any plausible number of
+     * open tabs on a LAN and low enough that a runaway client cannot exhaust memory.
+     */
+    const MAX_WS_CLIENTS = 64;
     // Optional bearer auth for LAN exposure — TEAPOT_API_TOKEN env wins, else
     // the config's `password` field. Static files stay public; only /api/* is
-    // gated. WebSocket handshakes can't send headers → they accept ?token=.
+    // gated.
     const apiToken = process.env.TEAPOT_API_TOKEN || master.config.password || "";
+    /**
+     * Routes where `?token=` is accepted (#79).
+     *
+     * A browser WebSocket handshake cannot send an Authorization header, so the
+     * query parameter is the ONLY way for the UI to authenticate those two
+     * sockets. It used to be accepted on EVERY `/api/*` route, which put the
+     * secret into proxy access logs, `Referer` headers and browser history for
+     * requests that never needed it — `DELETE /api/agents/:id`, `PUT
+     * /api/config`, `POST /api/update/restart`.
+     *
+     * So this narrows where the secret can LEAK rather than changing who is
+     * authenticated: every route still accepts the header, and only these two
+     * also accept the query form.
+     */
+    const tokenInQueryOk = (path) => path === "/api/ws" || /^\/api\/agents\/[^/]+\/term$/.test(path);
     if (apiToken)
         app.use("/api/*", async (c, next) => {
             const h = c.req.header("authorization");
             const provided = h?.startsWith("Bearer ") ? h.slice(7) : undefined;
-            const q = c.req.query("token");
-            if ((provided && provided === apiToken) || (q && q === apiToken))
+            if (provided && provided === apiToken)
                 return next();
+            if (tokenInQueryOk(c.req.path)) {
+                const q = c.req.query("token");
+                if (q && q === apiToken)
+                    return next();
+            }
             return c.json({ error: "unauthorized" }, 401);
         });
     // per-agent terminal spawn guard
     const termCounts = new Map();
+    /**
+     * Live `/api/ws` event-stream connections (#79).
+     *
+     * Every one of these receives EVERY agent's events, so the count is a direct
+     * multiplier on fan-out, and `bus.setMaxListeners(1000)` only silences a
+     * warning — it does not bound anything. Capped so a stuck or hostile client
+     * cannot pin unbounded memory, and paired with a liveness check below so a
+     * client that stops reading is reaped rather than buffered for ever.
+     */
+    let wsClients = 0;
     /**
      * Agent ids reserved by an in-flight create (#71).
      *
@@ -128,8 +165,30 @@ export function buildApp(master) {
     app.get("/api/ws", upgradeWebSocket(() => {
         let onUpdate = null;
         let ka = null;
+        // set by onOpen, cleared by a pong. Declared at the connection's scope
+        // because onMessage is a SIBLING handler and cannot see a local in onOpen.
+        let awaitingPong = false;
+        let counted = false;
         return {
             onOpen(_evt, ws) {
+                // #79: refuse beyond the cap rather than accepting and buffering.
+                // Each connection costs a listener on the global bus and receives
+                // every agent's events, so this bounds real memory, not just a count.
+                if (wsClients >= MAX_WS_CLIENTS) {
+                    try {
+                        ws.send(JSON.stringify({ kind: "error", error: `too many event-stream clients (max ${MAX_WS_CLIENTS})` }));
+                        ws.close(1013, "too many clients");
+                    }
+                    catch {
+                        /* already gone */
+                    }
+                    return;
+                }
+                wsClients++;
+                counted = true;
+                // a client that stops reading makes ws.send buffer without bound; the
+                // app-level ping doubles as a liveness probe — if a ping goes
+                // unanswered the socket is reaped instead of accumulating
                 const send = (data) => {
                     try {
                         ws.send(JSON.stringify(data));
@@ -151,8 +210,23 @@ export function buildApp(master) {
                     send(ev);
                 };
                 bus.on("update", onUpdate);
-                // app-level liveness ping every 30s
-                ka = setInterval(() => send({ kind: "ping" }), 30_000);
+                // app-level liveness ping every 30s, and a reaper for a client that
+                // has stopped answering (#79)
+                ka = setInterval(() => {
+                    if (awaitingPong) {
+                        // the previous ping went unanswered: the client is not reading,
+                        // so its send buffer is growing. Reap it.
+                        try {
+                            ws.close(1011, "unresponsive");
+                        }
+                        catch {
+                            /* already gone */
+                        }
+                        return;
+                    }
+                    awaitingPong = true;
+                    send({ kind: "ping" });
+                }, 30_000);
             },
             onMessage(evt, ws) {
                 // clients may send {"kind":"ping"} — nothing else to do today
@@ -160,6 +234,8 @@ export function buildApp(master) {
                     const m = JSON.parse(String(evt.data));
                     if (m?.kind === "ping")
                         ws.send(JSON.stringify({ kind: "pong" }));
+                    if (m?.kind === "pong")
+                        awaitingPong = false;
                 }
                 catch {
                     /* ignore junk */
@@ -170,6 +246,10 @@ export function buildApp(master) {
                     clearInterval(ka);
                 if (onUpdate)
                     bus.off("update", onUpdate);
+                // only a connection that was actually admitted owns a slot — a
+                // refused one must not decrement one it never took (#70's lesson)
+                if (counted)
+                    wsClients = Math.max(0, wsClients - 1);
             },
         };
     }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "teapot-coding-agent",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "A lightweight, always-on multi-agent harness for AI coding agents",
   "type": "module",
   "license": "AGPL-3.0-or-later",