thinkpool-pair 0.7.357 → 0.7.359

package/codex-session.mjs

@@ -1153,7 +1153,11 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
       // synchronously after sendTurn(), so this is the edge that makes Thinking,
       // Stop, and the tab spinner appear at dispatch time rather than at the
       // first provider event many seconds later.
-      if (!turnActive) {
+      // Native compaction already owns that public busy edge. A human turn
+      // accepted during it stays queued without flipping the ordinary-turn
+      // latch; otherwise compactContext's post-bootstrap recheck mistakes the
+      // queued turn for an active one and abandons a compaction it already owns.
+      if (!turnActive && !compactActive) {
         aborted = false
         armTurnLiveness()
       }
@@ -1229,13 +1233,20 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
     },
     async compactContext() {
       if (turnActive || compactActive) return false
-      const readyAppServer = await ensureAppServer()
-      // ensureAppServer may need to boot the transport. Re-check after that
-      // await so a normal turn that began meanwhile owns the lane exclusively.
-      if (!readyAppServer || turnActive || compactActive) return false
+      // A Stop latch belongs to the turn it cancelled. sendTurn clears it when
+      // accepting new work, but /compact enters through this direct control path.
+      // Leaving it set makes appServerNotification discard the real
+      // turn/started event, then the five-second waiter falsely declares failure
+      // while Codex continues compacting the old thread in the background.
+      aborted = false
       compactActive = true
       let startTimer = null
+      let compactAccepted = false
       try {
+        const readyAppServer = await ensureAppServer()
+        // compactActive claims the lane before bootstrap, so sendTurn queues
+        // behind us. An independently active ordinary turn still wins safely.
+        if (!readyAppServer || turnActive) return false
         const compactTurn = new Promise((resolve, reject) => {
           startTimer = setTimeout(() => {
             compactStartWaiter = null
@@ -1244,6 +1255,7 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
           compactStartWaiter = { resolve, reject }
         })
         await appServer.compact({ threadId: sessionId })
+        compactAccepted = true
         const turnId = await compactTurn
         if (startTimer) clearTimeout(startTimer)
         const completed = await appServer.waitForTurn(turnId)
@@ -1252,6 +1264,14 @@ export function startCodexSession({ cwd, model, effort: initialEffort = 'high',
         if (status === 'completed') return true
         throw new Error(completed?.turn?.error?.message || `compaction ${status || 'failed'}`)
       } catch (error) {
+        // Once thread/compact/start was accepted, replaying via a bounded-recap
+        // reset is unsafe: the native compaction may still complete (the exact
+        // production failure this guard closes). Preserve the existing thread
+        // and report uncertainty instead of executing a second compaction path.
+        if (compactAccepted || !['rejected', 'not_sent'].includes(error?.delivery)) {
+          note(`Native Codex compaction status is uncertain; existing context was preserved: ${error?.message || error}`)
+          return null
+        }
         note(`Native Codex compaction unavailable; using bounded recap fallback: ${error?.message || error}`)
         return false
       } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.357",
+  "version": "0.7.359",
   "description": "Connect Claude Code, Codex, or Hermes on your computer to a Thinkpool Code room.",
   "type": "module",
   "bin": {
@@ -63,6 +63,8 @@
     "evidence-citations.mjs",
     "error-recovery.mjs",
     "pair-control-authority.mjs",
+    "scheduled-runs.mjs",
+    "scheduled-run-admission.mjs",
     "event-id.mjs",
     "event-bounds.mjs",
     "replay-transport.mjs",

package/scheduled-run-admission.mjs

@@ -0,0 +1,364 @@
+// Host-wide scheduled-run admission for account-served room bridge children.
+//
+// Every room bridge is a separate process, so a process-local count/window cannot
+// enforce the laptop safety boundary. This ledger serializes admissions under
+// TP_PAIR_ROOT. It stores only hashes and millisecond timestamps: never room codes,
+// prompts, provider/model names, credentials, endpoints, or host paths.
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { createHash, randomUUID } from 'node:crypto'
+import { SPAWN } from './cross-terminal.mjs'
+
+const VERSION = 1
+const LEDGER_NAME = 'scheduled-run-admission.json'
+const LOCK_NAME = '.scheduled-run-admission.lock'
+const MAX_LEDGER_BYTES = 128 * 1024
+const DEFAULT_LOCK_WAIT_MS = 1_000
+const DEFAULT_STALE_LOCK_MS = 30_000
+const DEFAULT_RETRY_MS = 12
+const DEFAULT_MAX_LEASE_MS = 31 * 60 * 1_000
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,255}$/
+
+const rootPath = (root) => path.resolve(root || process.env.TP_PAIR_ROOT || path.join(os.homedir(), '.thinkpool-pair'))
+const pathsFor = (root) => {
+  const dir = rootPath(root)
+  return {
+    dir,
+    ledger: path.join(dir, LEDGER_NAME),
+    lock: path.join(dir, LOCK_NAME),
+  }
+}
+const digest = (value) => createHash('sha256').update(String(value)).digest('hex')
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+const finiteInt = (value) => Number.isSafeInteger(value) && value >= 0
+const exactKeys = (value, expected) =>
+  value && typeof value === 'object' &&
+  Object.keys(value).sort().join('\0') === [...expected].sort().join('\0')
+
+function normalizeLimits (limits = {}) {
+  const machineMax = Number.isSafeInteger(limits.machineMax) && limits.machineMax > 0 ? limits.machineMax : SPAWN.machineMax
+  const perWindowCap = Number.isSafeInteger(limits.perWindowCap) && limits.perWindowCap > 0 ? limits.perWindowCap : SPAWN.perWindowCap
+  const windowMs = Number.isSafeInteger(limits.windowMs) && limits.windowMs > 0 ? limits.windowMs : SPAWN.windowMs
+  const maxLeaseMs = Number.isSafeInteger(limits.maxLeaseMs) && limits.maxLeaseMs > 0 ? limits.maxLeaseMs : DEFAULT_MAX_LEASE_MS
+  return Object.freeze({ machineMax, perWindowCap, windowMs, maxLeaseMs })
+}
+
+function emptyLedger () {
+  return { version: VERSION, leases: [], spawnTimes: [] }
+}
+
+function validLease (lease) {
+  return Boolean(exactKeys(lease, ['runKey', 'terminalKey', 'tokenHash', 'acquiredAt', 'expiresAt']) &&
+    /^[a-f0-9]{64}$/.test(lease.runKey) &&
+    /^[a-f0-9]{64}$/.test(lease.terminalKey) &&
+    /^[a-f0-9]{64}$/.test(lease.tokenHash) &&
+    finiteInt(lease.acquiredAt) &&
+    finiteInt(lease.expiresAt) &&
+    lease.expiresAt > lease.acquiredAt)
+}
+
+function readLedger (file, limits) {
+  let fd = null
+  let raw
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0))
+    const stat = fs.fstatSync(fd)
+    if (!stat.isFile() || stat.size > MAX_LEDGER_BYTES) throw new Error('invalid_admission_ledger')
+    raw = fs.readFileSync(fd, 'utf8')
+  } catch (error) {
+    if (error?.code === 'ENOENT') return emptyLedger()
+    throw error
+  } finally {
+    if (fd != null) fs.closeSync(fd)
+  }
+  const parsed = JSON.parse(raw)
+  if (!exactKeys(parsed, ['version', 'leases', 'spawnTimes']) || parsed.version !== VERSION || !Array.isArray(parsed.leases) || !Array.isArray(parsed.spawnTimes)) throw new Error('invalid_admission_ledger')
+  // Generous parse bounds let a future lower configured cap prune an older
+  // snapshot, while still refusing attacker-sized or corrupted structures.
+  if (parsed.leases.length > Math.max(64, limits.machineMax * 4) || parsed.spawnTimes.length > Math.max(128, limits.perWindowCap * 8)) throw new Error('unbounded_admission_ledger')
+  if (!parsed.leases.every(validLease) || !parsed.spawnTimes.every(finiteInt)) throw new Error('invalid_admission_ledger')
+  if (new Set(parsed.leases.map((lease) => lease.runKey)).size !== parsed.leases.length ||
+      new Set(parsed.leases.map((lease) => lease.terminalKey)).size !== parsed.leases.length) throw new Error('duplicate_admission_ledger')
+  return parsed
+}
+
+function pruneLedger (ledger, now, limits) {
+  // Never truncate still-active leases merely because a later process starts
+  // with a lower cap. Every active lease continues to consume capacity until
+  // exact release or expiry.
+  const leases = ledger.leases.filter((lease) => lease.expiresAt > now)
+  const spawnTimes = ledger.spawnTimes
+    .filter((at) => at > now - limits.windowMs && at <= now)
+    .sort((a, b) => a - b)
+  return {
+    ledger: { version: VERSION, leases, spawnTimes },
+    changed: leases.length !== ledger.leases.length || spawnTimes.length !== ledger.spawnTimes.length,
+  }
+}
+
+let tempSerial = 0
+function atomicWriteLedger (file, ledger) {
+  const serialized = `${JSON.stringify(ledger)}\n`
+  if (Buffer.byteLength(serialized) > MAX_LEDGER_BYTES) throw new Error('unbounded_admission_ledger')
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.tmp.${process.pid}.${Date.now()}.${tempSerial++}`)
+  let fd = null
+  try {
+    fd = fs.openSync(tmp, 'wx', 0o600)
+    const bytes = Buffer.from(serialized)
+    for (let offset = 0; offset < bytes.length;) {
+      const written = fs.writeSync(fd, bytes, offset, bytes.length - offset)
+      if (written <= 0) throw new Error('short_admission_write')
+      offset += written
+    }
+    fs.fsyncSync(fd)
+    fs.closeSync(fd)
+    fd = null
+    fs.renameSync(tmp, file)
+    fs.chmodSync(file, 0o600)
+    // Persist the directory entry where the host filesystem supports it.
+    let dirFd = null
+    try {
+      dirFd = fs.openSync(path.dirname(file), 'r')
+      fs.fsyncSync(dirFd)
+    } catch {
+      // Windows and some network filesystems reject directory fsync. The
+      // replacement file itself was still fsynced before the atomic rename.
+    } finally {
+      if (dirFd != null) fs.closeSync(dirFd)
+    }
+  } catch (error) {
+    try { if (fd != null) fs.closeSync(fd) } catch { /* best effort */ }
+    try { fs.rmSync(tmp, { force: true }) } catch { /* best effort */ }
+    throw error
+  }
+}
+
+function ensureRoot (dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+  const stat = fs.lstatSync(dir)
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('invalid_pair_root')
+}
+
+function readLockOwner (lock) {
+  const file = path.join(lock, 'owner')
+  const stat = fs.lstatSync(file)
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1_024) return null
+  const owner = JSON.parse(fs.readFileSync(file, 'utf8'))
+  if (!exactKeys(owner, ['pid', 'token', 'createdAt']) ||
+      !Number.isSafeInteger(owner.pid) || owner.pid < 1 ||
+      typeof owner.token !== 'string' || !/^[a-f0-9-]{36}$/.test(owner.token) ||
+      !finiteInt(owner.createdAt)) return null
+  return owner
+}
+
+function ownerProcessState (pid) {
+  try {
+    process.kill(pid, 0)
+    return 'live'
+  } catch (error) {
+    if (error?.code === 'ESRCH') return 'dead'
+    // EPERM and every unknown platform error fail closed.
+    return 'unknown'
+  }
+}
+
+function recoverStaleLock (lock, staleLockMs, now) {
+  const stat = fs.lstatSync(lock)
+  if (!stat.isDirectory() || stat.isSymbolicLink() || now - stat.mtimeMs <= staleLockMs) return false
+  let owner = null
+  try { owner = readLockOwner(lock) } catch { return false }
+  if (!owner || ownerProcessState(owner.pid) !== 'dead') return false
+  // Rename is the recovery claim. Only the process that atomically moves this
+  // exact stale directory may remove it; contenders see ENOENT and retry. A
+  // live, permission-unknown, or malformed owner is never stolen.
+  const stale = `${lock}.stale.${process.pid}.${randomUUID()}`
+  fs.renameSync(lock, stale)
+  fs.rmSync(stale, { recursive: true, force: true })
+  return true
+}
+
+async function acquireLock ({ dir, lock }, { lockWaitMs = DEFAULT_LOCK_WAIT_MS, staleLockMs = DEFAULT_STALE_LOCK_MS, retryMs = DEFAULT_RETRY_MS } = {}) {
+  ensureRoot(dir)
+  const startedAt = Date.now()
+  while (Date.now() - startedAt <= lockWaitMs) {
+    const owner = Object.freeze({ pid: process.pid, token: randomUUID(), createdAt: Date.now() })
+    try {
+      fs.mkdirSync(lock, { mode: 0o700 })
+      fs.writeFileSync(path.join(lock, 'owner'), JSON.stringify(owner), { flag: 'wx', mode: 0o600 })
+      return owner
+    } catch (error) {
+      if (error?.code !== 'EEXIST') {
+        // If mkdir succeeded but writing the ownership marker failed, remove
+        // only the markerless lock we just created.
+        try {
+          if (fs.existsSync(lock) && !fs.existsSync(path.join(lock, 'owner'))) fs.rmdirSync(lock)
+        } catch { /* a contender/stale recovery may own the path now */ }
+        throw error
+      }
+      try {
+        if (recoverStaleLock(lock, staleLockMs, Date.now())) continue
+      } catch (recoveryError) {
+        if (!['ENOENT', 'EEXIST'].includes(recoveryError?.code)) throw recoveryError
+      }
+      await sleep(Math.max(1, retryMs))
+    }
+  }
+  throw new Error('admission_lock_timeout')
+}
+
+async function withLedgerLock (options, operation) {
+  const paths = pathsFor(options?.root)
+  let lockOwner = null
+  try {
+    lockOwner = await acquireLock(paths, options)
+    return await operation(paths)
+  } finally {
+    if (lockOwner) {
+      try {
+        // A paused process may resume after its stale lock was recovered. Never
+        // let that old holder remove the new holder's lock.
+        const ownerFile = path.join(paths.lock, 'owner')
+        const currentOwner = readLockOwner(paths.lock)
+        if (currentOwner?.pid === lockOwner.pid && currentOwner?.token === lockOwner.token) {
+          fs.rmSync(ownerFile, { force: true })
+          fs.rmdirSync(paths.lock)
+        }
+      } catch { /* stale recovery/host cleanup owns it */ }
+    }
+  }
+}
+
+function invalidIdentity (runId, terminalId) {
+  return typeof runId !== 'string' || !SAFE_ID.test(runId) || typeof terminalId !== 'string' || !SAFE_ID.test(terminalId)
+}
+
+// Acquire before the database claim and local spawn. `runId` may be the
+// deterministic occurrence key (schedule-id + next-run-at) because the database
+// UUID does not exist until claim_due_code_schedule succeeds.
+export async function acquireScheduledRunAdmission ({
+  runId,
+  terminalId,
+  deadlineAt,
+  now = Date.now(),
+  root,
+  limits,
+  lockWaitMs,
+  staleLockMs,
+  retryMs,
+} = {}) {
+  const policy = normalizeLimits(limits)
+  if (invalidIdentity(runId, terminalId) || !finiteInt(now) || !finiteInt(deadlineAt) || deadlineAt <= now || deadlineAt - now > policy.maxLeaseMs) {
+    return Object.freeze({ ok: false, code: 'invalid_admission_request' })
+  }
+  const token = randomUUID()
+  const runKey = digest(runId)
+  const terminalKey = digest(terminalId)
+  try {
+    return await withLedgerLock({ root, lockWaitMs, staleLockMs, retryMs }, ({ ledger: file }) => {
+      const loaded = readLedger(file, policy)
+      const { ledger, changed } = pruneLedger(loaded, now, policy)
+      const sameRun = ledger.leases.find((lease) => lease.runKey === runKey)
+      const sameTerminal = ledger.leases.find((lease) => lease.terminalKey === terminalKey)
+      if (sameRun || sameTerminal) {
+        if (changed) atomicWriteLedger(file, ledger)
+        return Object.freeze({
+          ok: false,
+          code: sameRun && sameTerminal && sameRun === sameTerminal
+            ? 'duplicate_lease'
+            : sameRun ? 'duplicate_run' : 'duplicate_terminal',
+        })
+      }
+      if (ledger.leases.length >= policy.machineMax) {
+        if (changed) atomicWriteLedger(file, ledger)
+        return Object.freeze({ ok: false, code: 'machine_cap' })
+      }
+      if (ledger.spawnTimes.length >= policy.perWindowCap) {
+        if (changed) atomicWriteLedger(file, ledger)
+        return Object.freeze({ ok: false, code: 'burst_cap', retryAt: ledger.spawnTimes[0] + policy.windowMs })
+      }
+      ledger.leases.push({ runKey, terminalKey, tokenHash: digest(token), acquiredAt: now, expiresAt: deadlineAt })
+      ledger.spawnTimes.push(now)
+      atomicWriteLedger(file, ledger)
+      return Object.freeze({
+        ok: true,
+        code: 'admitted',
+        lease: Object.freeze({ runId, terminalId, token, expiresAt: deadlineAt }),
+      })
+    })
+  } catch {
+    return Object.freeze({ ok: false, code: 'admission_unavailable' })
+  }
+}
+
+// Exact-pair + one-time token release makes outcome/close cleanup idempotent
+// without allowing one room child to free another child's active lease.
+export async function releaseScheduledRunAdmission ({
+  runId,
+  terminalId,
+  token,
+  now = Date.now(),
+  root,
+  limits,
+  lockWaitMs,
+  staleLockMs,
+  retryMs,
+} = {}) {
+  const policy = normalizeLimits(limits)
+  if (invalidIdentity(runId, terminalId) || typeof token !== 'string' || token.length < 16 || token.length > 128 || !finiteInt(now)) {
+    return Object.freeze({ ok: false, code: 'invalid_release_request' })
+  }
+  const runKey = digest(runId)
+  const terminalKey = digest(terminalId)
+  const tokenHash = digest(token)
+  try {
+    return await withLedgerLock({ root, lockWaitMs, staleLockMs, retryMs }, ({ ledger: file }) => {
+      const loaded = readLedger(file, policy)
+      const { ledger, changed } = pruneLedger(loaded, now, policy)
+      const index = ledger.leases.findIndex((lease) => lease.runKey === runKey && lease.terminalKey === terminalKey)
+      if (index < 0) {
+        if (ledger.leases.some((lease) => lease.runKey === runKey || lease.terminalKey === terminalKey)) {
+          return Object.freeze({ ok: false, code: 'lease_mismatch' })
+        }
+        if (changed) atomicWriteLedger(file, ledger)
+        return Object.freeze({ ok: true, code: 'already_released' })
+      }
+      if (ledger.leases[index].tokenHash !== tokenHash) return Object.freeze({ ok: false, code: 'lease_mismatch' })
+      ledger.leases.splice(index, 1)
+      atomicWriteLedger(file, ledger)
+      return Object.freeze({ ok: true, code: 'released' })
+    })
+  } catch {
+    return Object.freeze({ ok: false, code: 'admission_unavailable' })
+  }
+}
+
+// Secret-free diagnostics/tests: counts and expiry only.
+export async function inspectScheduledRunAdmissions ({
+  now = Date.now(),
+  root,
+  limits,
+  lockWaitMs,
+  staleLockMs,
+  retryMs,
+} = {}) {
+  const policy = normalizeLimits(limits)
+  if (!finiteInt(now)) return Object.freeze({ ok: false, code: 'invalid_inspection_request' })
+  try {
+    return await withLedgerLock({ root, lockWaitMs, staleLockMs, retryMs }, ({ ledger: file }) => {
+      const loaded = readLedger(file, policy)
+      const { ledger, changed } = pruneLedger(loaded, now, policy)
+      if (changed) atomicWriteLedger(file, ledger)
+      return Object.freeze({
+        ok: true,
+        code: 'inspected',
+        active: ledger.leases.length,
+        burst: ledger.spawnTimes.length,
+        nextExpiryAt: ledger.leases.length ? Math.min(...ledger.leases.map((lease) => lease.expiresAt)) : null,
+      })
+    })
+  } catch {
+    return Object.freeze({ ok: false, code: 'admission_unavailable' })
+  }
+}