triflux 10.28.0 → 10.29.0

package/hub/team/synapse-registry.mjs

@@ -5,12 +5,59 @@ const DEFAULT_LOCAL_HEARTBEAT_INTERVAL_MS = 5_000;
 const DEFAULT_LOCAL_TIMEOUT_MS = 30_000;
 const DEFAULT_REMOTE_HEARTBEAT_INTERVAL_MS = 15_000;
 const DEFAULT_REMOTE_TIMEOUT_MS = 90_000;
+// Interactive (Claude/Codex) sessions idle for long stretches; a 30s local
+// timeout produces stale false-positives. 5-minute TTL + an `idle` state
+// distinguishes "alive but inactive" from "presumed dead".
+const DEFAULT_INTERACTIVE_HEARTBEAT_INTERVAL_MS = 60_000;
+const DEFAULT_INTERACTIVE_TIMEOUT_MS = 300_000;
+
+const VALID_SESSION_KINDS = new Set(["interactive", "headless"]);
 
 function normalizeSessionId(sessionId) {
   if (sessionId == null) return "";
   return String(sessionId).trim();
 }
 
+function normalizeSessionKind(raw) {
+  return VALID_SESSION_KINDS.has(raw) ? raw : "headless";
+}
+
+// A session is "live" while active OR idle. Idle is an interactive session that
+// missed its heartbeat interval but is still under the TTL — alive but inactive,
+// not presumed dead. getActive() and querySessions() share this single predicate
+// so the liveness contract can't drift: getActive() feeds git-preflight's
+// dirty-file conflict guard, so dropping idle there would hide a still-live
+// interactive session's claimed paths from that safety check.
+function isLiveStatus(status) {
+  return status === "active" || status === "idle";
+}
+
+// Non-secret co-location fingerprint: a short, stable, non-reversible hash of a
+// path so peers can correlate co-located sessions without leaking the raw
+// filesystem path (cf. AccountBroker redaction). This is NOT a security boundary
+// — the boundary is `cwdLabel` (basename only). Treat the hash as an opaque
+// correlation token, not as a secret.
+function shortHash(value) {
+  const str = String(value ?? "");
+  let h = 5381;
+  for (let i = 0; i < str.length; i++) {
+    h = (h * 33) ^ str.charCodeAt(i);
+  }
+  return (h >>> 0).toString(36);
+}
+
+// Last path segment of a directory, used as a human-readable label in redacted
+// peer projections. Separator-agnostic on purpose: `node:path`.basename() is
+// platform-dependent, so on POSIX a Windows path like `C:\Users\Alice\secret`
+// would NOT be split and the full path would leak as the label. Splitting on
+// either separator redacts both path styles regardless of host platform.
+function pathLabel(value) {
+  const str = String(value ?? "").replace(/[/\\]+$/, "");
+  if (!str) return "";
+  const segments = str.split(/[/\\]+/);
+  return segments[segments.length - 1] || "";
+}
+
 function cloneSession(session) {
   return {
     ...session,
@@ -24,6 +71,13 @@ function sanitizeSession(raw, fallbackSessionId = "") {
   const sessionId = normalizeSessionId(raw?.sessionId ?? fallbackSessionId);
   if (!sessionId) return null;
 
+  const status =
+    raw?.status === "stale" ||
+    raw?.status === "expired" ||
+    raw?.status === "idle"
+      ? raw.status
+      : "active";
+
   return {
     sessionId,
     host: typeof raw?.host === "string" ? raw.host : "local",
@@ -33,11 +87,39 @@ function sanitizeSession(raw, fallbackSessionId = "") {
     taskSummary: typeof raw?.taskSummary === "string" ? raw.taskSummary : "",
     lastHeartbeat:
       typeof raw?.lastHeartbeat === "number" ? raw.lastHeartbeat : Date.now(),
-    status:
-      raw?.status === "stale" || raw?.status === "expired"
-        ? raw.status
-        : "active",
+    status,
     isRemote: Boolean(raw?.isRemote),
+    // Additive fields (peer-discovery). Defaults keep pre-existing persist rows
+    // (no cwd/pid/sessionKind) loading cleanly — no persist version bump needed.
+    cwd: typeof raw?.cwd === "string" ? raw.cwd : "",
+    pid: typeof raw?.pid === "number" ? raw.pid : null,
+    sessionKind: normalizeSessionKind(raw?.sessionKind),
+  };
+}
+
+// Pure redacted projection of a session for the peer-discovery route. Raw
+// `cwd`/`pid` and `dirtyFiles` are NEVER exposed; only label/hash + booleans
+// computed against the caller's query args (cf. AccountBroker.publicSnapshot).
+export function projectPeer(session, query = {}) {
+  const cwd = typeof session?.cwd === "string" ? session.cwd : "";
+  const worktreePath =
+    typeof session?.worktreePath === "string" ? session.worktreePath : "";
+  const queryCwd = typeof query?.cwd === "string" ? query.cwd : "";
+  const queryWorktree =
+    typeof query?.worktree === "string" ? query.worktree : "";
+
+  return {
+    sessionId: typeof session?.sessionId === "string" ? session.sessionId : "",
+    branch: typeof session?.branch === "string" ? session.branch : "",
+    sessionKind: normalizeSessionKind(session?.sessionKind),
+    status: typeof session?.status === "string" ? session.status : "active",
+    host: typeof session?.host === "string" ? session.host : "local",
+    isRemote: Boolean(session?.isRemote),
+    sameCwd: Boolean(queryCwd) && cwd === queryCwd,
+    sameWorktree: Boolean(queryWorktree) && worktreePath === queryWorktree,
+    cwdLabel: pathLabel(cwd),
+    cwdHash: cwd ? shortHash(cwd) : "",
+    worktreeLabel: pathLabel(worktreePath),
   };
 }
 
@@ -49,11 +131,14 @@ export function createSynapseRegistry(opts = {}) {
     localTimeoutMs = DEFAULT_LOCAL_TIMEOUT_MS,
     remoteHeartbeatIntervalMs = DEFAULT_REMOTE_HEARTBEAT_INTERVAL_MS,
     remoteTimeoutMs = DEFAULT_REMOTE_TIMEOUT_MS,
+    interactiveHeartbeatIntervalMs = DEFAULT_INTERACTIVE_HEARTBEAT_INTERVAL_MS,
+    interactiveTimeoutMs = DEFAULT_INTERACTIVE_TIMEOUT_MS,
   } = opts;
 
   const sessions = new Map();
   const monitors = new Map();
   const staleCallbacks = new Set();
+  const idleCallbacks = new Set();
   const removedCallbacks = new Set();
 
   function now() {
@@ -61,12 +146,16 @@ export function createSynapseRegistry(opts = {}) {
   }
 
   function intervalFor(session) {
+    if (session.sessionKind === "interactive") {
+      return interactiveHeartbeatIntervalMs;
+    }
     return session.isRemote
       ? remoteHeartbeatIntervalMs
       : localHeartbeatIntervalMs;
   }
 
   function timeoutFor(session) {
+    if (session.sessionKind === "interactive") return interactiveTimeoutMs;
     return session.isRemote ? remoteTimeoutMs : localTimeoutMs;
   }
 
@@ -130,6 +219,21 @@ export function createSynapseRegistry(opts = {}) {
     }
   }
 
+  function notifyIdle(session) {
+    const clone = cloneSession(session);
+    emitter?.emit("synapse.session.idle", {
+      sessionId: session.sessionId,
+      session: clone,
+    });
+    for (const callback of idleCallbacks) {
+      try {
+        callback(clone);
+      } catch {
+        /* no-op */
+      }
+    }
+  }
+
   function notifyRemoved(session) {
     const clone = cloneSession(session);
     emitter?.emit("synapse.session.removed", {
@@ -156,12 +260,30 @@ export function createSynapseRegistry(opts = {}) {
       if (!current) return;
 
       const elapsedMs = now() - current.lastHeartbeat;
-      if (elapsedMs > timeoutFor(current) && current.status !== "stale") {
-        const staled = { ...current, status: "stale" };
-        sessions.set(sessionId, staled);
+      if (elapsedMs > timeoutFor(current)) {
+        if (current.status !== "stale") {
+          const staled = { ...current, status: "stale" };
+          sessions.set(sessionId, staled);
+          schedulePersist();
+          setImmediate(() => {
+            if (!destroyed) notifyStale(staled);
+          });
+        }
+        return;
+      }
+
+      // Interactive sessions that miss the heartbeat interval but are still
+      // under the TTL are "alive but inactive" (idle), not "presumed dead".
+      if (
+        current.sessionKind === "interactive" &&
+        current.status === "active" &&
+        elapsedMs > intervalFor(current)
+      ) {
+        const idled = { ...current, status: "idle" };
+        sessions.set(sessionId, idled);
         schedulePersist();
         setImmediate(() => {
-          if (!destroyed) notifyStale(staled);
+          if (!destroyed) notifyIdle(idled);
         });
       }
     }, intervalFor(session));
@@ -185,7 +307,14 @@ export function createSynapseRegistry(opts = {}) {
       return { ok: false, sessionId, reason: "invalid_id" };
     }
 
-    if (sessions.has(sessionId)) {
+    // A live row (active/idle) means a concurrent session already holds this id
+    // — reject (LOCKED #5). A stale/expired row is a dead remnant of the SAME
+    // session resuming: Claude Code re-fires SessionStart with the same
+    // session_id on resume/clear/compact, so fall through and re-register
+    // (revive) it. Otherwise the resumed-but-live session stays stale forever
+    // and vanishes from peer-discovery AND git-preflight's dirty-file guard.
+    const existing = sessions.get(sessionId);
+    if (existing && isLiveStatus(existing.status)) {
       console.warn(
         "[synapse-registry] duplicate registration rejected:",
         sessionId,
@@ -252,6 +381,9 @@ export function createSynapseRegistry(opts = {}) {
       if (typeof partialMeta.isRemote === "boolean") {
         updated.isRemote = partialMeta.isRemote;
       }
+      if (typeof partialMeta.cwd === "string") updated.cwd = partialMeta.cwd;
+      if (typeof partialMeta.pid === "number") updated.pid = partialMeta.pid;
+      // sessionKind is set at register time and immutable on heartbeat.
     }
 
     sessions.set(normalized, updated);
@@ -270,8 +402,11 @@ export function createSynapseRegistry(opts = {}) {
   }
 
   function getActive() {
+    // Live = active or idle. git-preflight uses this to detect other live
+    // sessions whose dirty files would conflict; an idle interactive session is
+    // still live (process alive, dirty files on disk) and must stay visible.
     return [...sessions.values()]
-      .filter((session) => session.status === "active")
+      .filter((session) => isLiveStatus(session.status))
       .map((session) => cloneSession(session));
   }
 
@@ -286,11 +421,51 @@ export function createSynapseRegistry(opts = {}) {
     return session ? cloneSession(session) : null;
   }
 
+  // Peer-discovery primitive: returns sessions sharing the caller's cwd OR
+  // worktree, excluding the caller's own session. Only live peers (active/idle)
+  // are returned — stale/expired rows are presumed dead and omitted.
+  //
+  // SECURITY: at least one non-empty locator (cwd or worktree) is REQUIRED. An
+  // empty filter would otherwise return every active/idle session, turning the
+  // redacted peer surface into a full-registry enumeration (session ids/branches/
+  // labels/hashes). With no usable locator we return [] rather than leak.
+  //
+  // Matching is disjunctive (cwd OR worktreePath): a peer in the same worktree
+  // but a different subdirectory shares the worktree locator even though its cwd
+  // differs, and a conjunctive (AND) match would wrongly drop it.
+  function querySessions(filter = {}) {
+    const wantCwd = typeof filter?.cwd === "string" ? filter.cwd : "";
+    const wantWorktree =
+      typeof filter?.worktree === "string" ? filter.worktree : "";
+    const excludeId = normalizeSessionId(filter?.excludeSessionId);
+
+    // Require at least one non-empty locator — never enumerate the whole registry.
+    if (!wantCwd && !wantWorktree) return [];
+
+    return [...sessions.values()]
+      .filter((session) => {
+        if (!isLiveStatus(session.status)) {
+          return false;
+        }
+        if (excludeId && session.sessionId === excludeId) return false;
+        const cwdMatch = Boolean(wantCwd) && session.cwd === wantCwd;
+        const worktreeMatch =
+          Boolean(wantWorktree) && session.worktreePath === wantWorktree;
+        return cwdMatch || worktreeMatch;
+      })
+      .map((session) => cloneSession(session));
+  }
+
   function onStale(callback) {
     if (typeof callback !== "function") return;
     staleCallbacks.add(callback);
   }
 
+  function onIdle(callback) {
+    if (typeof callback !== "function") return;
+    idleCallbacks.add(callback);
+  }
+
   function onRemoved(callback) {
     if (typeof callback !== "function") return;
     removedCallbacks.add(callback);
@@ -321,7 +496,9 @@ export function createSynapseRegistry(opts = {}) {
     getActive,
     getAll,
     getSession,
+    querySessions,
     onStale,
+    onIdle,
     onRemoved,
     snapshot,
     destroy,

package/hub/team/uds-orchestrator.mjs

@@ -1,7 +1,12 @@
+import { spawn } from "node:child_process";
 import crypto from "node:crypto";
+import { mkdtemp, rm, stat } from "node:fs/promises";
 import net from "node:net";
+import { tmpdir } from "node:os";
+import { join as pathJoin } from "node:path";
 
 import { execute as defaultExecuteCodex } from "../codex-adapter.mjs";
+import { JsonRpcWsUdsClient } from "../workers/lib/jsonrpc-ws-uds.mjs";
 import {
   buildClaudePromptDispatchPayload,
   deriveClaudeDaemonPaths,
@@ -10,6 +15,8 @@ import {
 } from "./claude-daemon-control.mjs";
 
 const DEFAULT_TIMEOUT_MS = 90_000;
+const DEFAULT_CODEX_APP_SERVER_UDS_TIMEOUT_MS = 120_000;
+const DEFAULT_CODEX_APP_SERVER_UDS_BOOTSTRAP_MS = 12_000;
 
 function requireEndpoint(endpoint, name) {
   if (!endpoint || typeof endpoint.ask !== "function") {
@@ -346,3 +353,255 @@ export function createCodexExecEndpoint({
     },
   };
 }
+
+function extractCodexThreadId(result) {
+  if (!result || typeof result !== "object") return null;
+  if (typeof result.threadId === "string") return result.threadId;
+  if (result.thread && typeof result.thread.id === "string") {
+    return result.thread.id;
+  }
+  return null;
+}
+
+async function waitForSocketFile(sockPath, deadlineMs) {
+  const start = Date.now();
+  while (Date.now() - start < deadlineMs) {
+    try {
+      if ((await stat(sockPath)).isSocket()) return true;
+    } catch {
+      /* not bound yet */
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  return false;
+}
+
+/**
+ * SIGTERM a child, wait up to graceMs for it to actually exit, then SIGKILL if
+ * still alive. Liveness is `exitCode === null && signalCode === null` — NOT
+ * `child.killed`, which only means "a signal was sent" and would suppress the
+ * SIGKILL fallback when the child ignores SIGTERM.
+ * @param {import('node:child_process').ChildProcess} child
+ * @param {number} [graceMs]
+ */
+async function terminateChild(child, graceMs = 1000) {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  const exited = new Promise((resolve) => {
+    child.once("exit", () => resolve("exited"));
+  });
+  try {
+    child.kill("SIGTERM");
+  } catch {}
+  const outcome = await Promise.race([
+    exited,
+    new Promise((resolve) => setTimeout(() => resolve("timeout"), graceMs)),
+  ]);
+  if (
+    outcome !== "exited" &&
+    child.exitCode === null &&
+    child.signalCode === null
+  ) {
+    try {
+      child.kill("SIGKILL");
+    } catch {}
+  }
+}
+
+/**
+ * Experimental Codex endpoint that drives a real `codex app-server` over its
+ * WebSocket-over-Unix-Domain-Socket control plane (the symmetric peer of the
+ * Claude daemon `control.sock` path). Same `ask(prompt) -> {endpoint,text,done}`
+ * contract as `createCodexExecEndpoint`, so it is a drop-in for
+ * `runUdsOrchestration`'s `codex` slot — but it is NOT the default.
+ *
+ * Two modes:
+ *   - spawnServer (default): mkdtemp a private socket, spawn
+ *     `codex app-server --listen unix://PATH`, attach, run one turn, tear down.
+ *   - attach (socketPath + spawnServer=false): connect to an already-running
+ *     daemon socket (e.g. $CODEX_HOME/app-server-control/app-server-control.sock).
+ *
+ * Wire transport proven against codex-cli 0.135.0 — see
+ * experiments/native-bridge-feasibility/codex-app-server-uds-smoke.mjs.
+ *
+ * @param {object} [options]
+ * @param {string|null} [options.socketPath] Existing daemon socket to attach to.
+ * @param {boolean} [options.spawnServer] Spawn a private app-server (default true).
+ * @param {string} [options.codexBin]
+ * @param {string} [options.cwd]
+ * @param {string} [options.model]
+ * @param {number} [options.timeoutMs] Turn timeout.
+ * @param {number} [options.bootstrapTimeoutMs] Connect + handshake timeout.
+ * @param {(opts: object) => JsonRpcWsUdsClient} [options.clientFactory]
+ * @param {(command: string, args: string[], options: object) => import('node:child_process').ChildProcess} [options.spawnFn]
+ */
+export function createCodexAppServerUdsEndpoint({
+  socketPath = null,
+  spawnServer = true,
+  codexBin = process.env.CODEX_BIN || "codex",
+  cwd = process.cwd(),
+  model,
+  timeoutMs = DEFAULT_CODEX_APP_SERVER_UDS_TIMEOUT_MS,
+  bootstrapTimeoutMs = DEFAULT_CODEX_APP_SERVER_UDS_BOOTSTRAP_MS,
+  clientFactory = (opts) => new JsonRpcWsUdsClient(opts),
+  spawnFn = spawn,
+} = {}) {
+  return {
+    name: "codex-app-server-uds",
+    async ask(prompt, _meta = {}) {
+      if (typeof prompt !== "string" || !prompt.trim()) {
+        throw new Error(
+          "codex-app-server-uds endpoint requires a non-empty prompt",
+        );
+      }
+
+      let dir = null;
+      let child = null;
+      let client = null;
+      let resolvedSock = socketPath;
+
+      try {
+        if (spawnServer && !socketPath) {
+          dir = await mkdtemp(pathJoin(tmpdir(), "tfx-codex-appserver-uds-"));
+          resolvedSock = pathJoin(dir, "app-server.sock");
+          child = spawnFn(
+            codexBin,
+            ["app-server", "--listen", `unix://${resolvedSock}`],
+            { stdio: ["ignore", "pipe", "pipe"], cwd, env: process.env },
+          );
+          let stderr = "";
+          child.stderr?.on("data", (chunk) => {
+            stderr += String(chunk);
+            if (stderr.length > 8000) stderr = stderr.slice(-8000);
+          });
+          const earlyExit = new Promise((resolve) => {
+            child.once("error", (err) =>
+              resolve(`spawn error: ${err.message}`),
+            );
+            child.once("exit", (code, sig) =>
+              resolve(`exited early code=${code} sig=${sig || ""}`),
+            );
+          });
+          const ready = await Promise.race([
+            waitForSocketFile(resolvedSock, bootstrapTimeoutMs).then((ok) =>
+              ok ? "ready" : "no-socket",
+            ),
+            earlyExit,
+          ]);
+          if (ready !== "ready") {
+            throw new Error(
+              `codex app-server did not bind socket: ${ready}${
+                stderr ? ` — ${stderr.slice(-400)}` : ""
+              }`,
+            );
+          }
+        }
+        if (!resolvedSock) {
+          throw new Error(
+            "codex-app-server-uds endpoint needs socketPath or spawnServer=true",
+          );
+        }
+
+        client = clientFactory({
+          socketPath: resolvedSock,
+          connectTimeoutMs: bootstrapTimeoutMs,
+        });
+        await client.connect();
+        await client.request(
+          "initialize",
+          { clientInfo: { name: "triflux-tfx-live", version: "1.0.0" } },
+          bootstrapTimeoutMs,
+        );
+        client.notify("initialized", {});
+
+        const threadParams = {
+          sandbox: "read-only",
+          approvalPolicy: "never",
+          ephemeral: true,
+        };
+        if (typeof model === "string" && model) threadParams.model = model;
+        if (cwd) threadParams.cwd = cwd;
+        const threadStart = await client.request(
+          "thread/start",
+          threadParams,
+          bootstrapTimeoutMs,
+        );
+        const threadId = extractCodexThreadId(threadStart);
+        if (!threadId) {
+          throw new Error(
+            "codex app-server thread/start returned no thread id",
+          );
+        }
+
+        const parts = [];
+        let offDelta = () => {};
+        let offError = () => {};
+        let offDone = () => {};
+        const cleanup = () => {
+          offDelta();
+          offError();
+          offDone();
+        };
+        const completion = new Promise((resolve) => {
+          offDelta = client.onNotification(
+            "item/agentMessage/delta",
+            (params) => {
+              if (typeof params?.delta === "string") parts.push(params.delta);
+            },
+          );
+          offError = client.onNotification("error", (params) => {
+            cleanup();
+            resolve({
+              status: "failed",
+              message: params?.message || "codex app-server error",
+            });
+          });
+          offDone = client.onNotification("turn/completed", (params) => {
+            cleanup();
+            resolve({ status: params?.turn?.status || "unknown" });
+          });
+        });
+
+        await client.request(
+          "turn/start",
+          { threadId, input: [{ type: "text", text: prompt }] },
+          timeoutMs,
+        );
+        let timeoutHandle = null;
+        const timeoutPromise = new Promise((resolve) => {
+          timeoutHandle = setTimeout(() => {
+            cleanup();
+            resolve({ status: "timeout" });
+          }, timeoutMs);
+        });
+        let settled;
+        try {
+          settled = await Promise.race([completion, timeoutPromise]);
+        } finally {
+          // Clear the timer whichever side won, so a completed turn does not
+          // keep the event loop alive until timeoutMs.
+          if (timeoutHandle) clearTimeout(timeoutHandle);
+        }
+
+        return {
+          endpoint: "codex-app-server-uds",
+          text: parts.join("").trim(),
+          done: settled.status === "completed",
+          meta: {
+            threadId,
+            status: settled.status,
+            socketPath: resolvedSock,
+            spawned: Boolean(child),
+            ...(settled.message ? { error: settled.message } : {}),
+          },
+        };
+      } finally {
+        try {
+          client?.close();
+        } catch {}
+        if (child) await terminateChild(child);
+        if (dir)
+          await rm(dir, { recursive: true, force: true }).catch(() => {});
+      }
+    },
+  };
+}

package/hub/workers/codex-app-server-worker.mjs

@@ -160,8 +160,11 @@ export const KIND_MAP = Object.freeze({
   configWarning: "error",
 });
 
+// NOTE: codex 0.135.0 rejects `--skip-git-repo-check` as a global option (exit 2:
+// "unexpected argument"); it lives at `codex exec` subcommand scope, and the
+// `app-server` subcommand does not need it. Empirically verified against
+// codex-cli 0.135.0. Do not re-add it as a global flag here.
 export const DEFAULT_CODEX_APP_SERVER_ARGS = Object.freeze([
-  "--skip-git-repo-check",
   "app-server",
   "--listen",
   "stdio://",