weir-harness 1.1.6 → 1.2.0

package/src/blackboard/storage.js

@@ -213,8 +213,64 @@ export function createBlackboardStorage({ home, hook = async (_op, _path) => {},
       return result.publish()
     } finally { await release() }
   }
+  // One-time fork seeding: a forked Session is its own board root, but its
+  // board starts as a snapshot of the fork source's durable root board. Both
+  // directories stay under the writer lock in deterministic path order, and
+  // the fork is only ever seeded while it has no sidecar of its own — a
+  // re-seed can never overwrite or merge an initialized board.
+  async function seedFork(id, parentId, cwd) {
+    sessionId(id)
+    let hopId = sessionId(parentId)
+    // The source's durable root is resolved on disk: a delegated source has
+    // no sidecar of its own, so ascend its parent chain to the root board it
+    // actually used.
+    const seen = new Set()
+    let source
+    for (let hop = 0; hop < 64; hop++) {
+      if (seen.has(hopId)) throw new Error('blackboard: cyclic Session parent chain')
+      seen.add(hopId)
+      const located = await locateSession(home, hopId)
+      const depth = located.header.delegationDepth ?? 0
+      if (!Number.isSafeInteger(depth) || depth < 0) throw new Error('blackboard: invalid Session delegation depth')
+      if (depth === 0) { source = located; break }
+      hopId = sessionId(located.header.parentSession)
+    }
+    if (!source) throw new Error('blackboard: Session ancestry exceeds safety limit')
+    const child = await locateSession(home, id, cwd)
+    // Two directories need two writer locks; taking them in deterministic
+    // path-string order means single-lock users (transact) can never
+    // deadlock with this pair. Distinct Session ids never share a directory.
+    const [first, second] = source.dir < child.dir ? [source.dir, child.dir] : [child.dir, source.dir]
+    const releaseFirst = await lock(first)
+    let releaseSecond
+    try { releaseSecond = await lock(second) } catch (error) { await releaseFirst(); throw error }
+    try {
+      const records = []
+      for (const name of (await fs.readdir(source.dir)).filter(name => SIDE.test(name))) {
+        records.push(decodeRecord(await safeRead(join(source.dir, name)), source.id))
+      }
+      if (!records.length) return false
+      if (records.some(record => JSON.stringify(record) !== JSON.stringify(records[0]))) throw new Error('blackboard: conflicting sidecars; originals preserved')
+      // Idempotence: any existing fork sidecar means the board is already
+      // initialized — never overwrite or merge.
+      if ((await fs.readdir(child.dir)).some(name => SIDE.test(name))) return false
+      // Volatile state (tokens/subscriptions/timers) is never persisted, so
+      // the snapshot carries durable entry fields only; the fork starts at
+      // revision 0 under its own root identity.
+      const seeded = { schemaVersion: 1, rootSessionId: id, revision: 0, entries: structuredClone(records[0].entries) }
+      const encoded = JSON.stringify(decodeRecord(JSON.stringify(seeded), id)) + '\n'
+      await publish(child.file, encoded)
+      return true
+    } finally {
+      let failure
+      try { await releaseSecond() } catch (error) { failure ??= error }
+      try { await releaseFirst() } catch (error) { failure ??= error }
+      if (failure) throw failure
+    }
+  }
   return {
     locate: (id, cwd) => locateSession(home, id, cwd),
+    seedFork,
     async releaseWriter(id, cwd) {
       let where
       try { where = await locateSession(home, id, cwd) } catch { return }

package/src/edit-lock/binding-guidance.js

@@ -2,6 +2,7 @@
  * @param {number | undefined} pid @param {string} attestation */
 export function bindingRefusalReason(pid, attestation) {
   const holder = attestation === 'serving' ? 'serving'
+    : attestation === 'serving-idle' ? 'serving-idle'
     : pid === process.pid ? 'same-process-unattestable'
       : pid !== undefined ? 'cross-process-pid' : 'unknown'
   return `session already bound: holder=${holder}${pid !== undefined ? `; pid=${pid}` : ''}`
@@ -10,12 +11,20 @@ export function bindingRefusalReason(pid, attestation) {
 /** Render only publisher-classified facts. Unrecognized/legacy reasons are unknown.
  * @param {string} sessionId @param {string} reason */
 export function bindingGuidance(sessionId, reason) {
-  const facts = /^session already bound: holder=(serving|same-process-unattestable|cross-process-pid|unknown)(?:; pid=([1-9]\d*))?$/.exec(reason)
+  const facts = /^session already bound: holder=(serving-idle|serving|same-process-unattestable|cross-process-pid|unknown)(?:; pid=([1-9]\d*))?$/.exec(reason)
   const classification = facts?.[1]
   const pid = facts?.[2]
   let holder
-  if (classification === 'serving') {
-    holder = `session ${sessionId} is already active in the DeepSeek Harness window that publishes this project. Use the session in that window, close it there, or quit that Harness process.`
+  if (classification === 'serving-idle') {
+    // Transferable (change edit-lock-binding-transfer): an idle same-process
+    // holder is taken over by the next driving ingress — calm copy, no pid,
+    // no window hunt, and NEVER the publisher-reservation warning.
+    holder = `session ${sessionId} is held by an inactive attachment of this same session. Editing attaches here automatically when you next send a message; /edit-lock retry also takes it over now. Retry does not Continue editing.`
+  } else if (classification === 'serving') {
+    // The holder is provably live and not transferable (mid-turn or a live
+    // channel proxy): name what is happening and when to retry. No window
+    // hunt (single-instance hosts exist) and no process management.
+    holder = `session ${sessionId} is being edited in another attachment right now. Wait for that turn to finish, then use /edit-lock retry in this session; retry does not Continue editing.`
   } else if (classification === 'same-process-unattestable' && pid !== undefined) {
     holder = `session ${sessionId} has a binding in this same process (pid ${pid}) that cannot be safely reclaimed. A stale runtime incarnation may still hold its channel. Wait for the original holder to disconnect or for confirmed process shutdown.`
   } else if (classification === 'cross-process-pid' && pid !== undefined) {
@@ -23,6 +32,7 @@ export function bindingGuidance(sessionId, reason) {
   } else {
     holder = `session ${sessionId} has a binding whose holder cannot be attested. Wait for the original holder to disconnect or for confirmed process shutdown.`
   }
+  if (classification === 'serving-idle' || classification === 'serving') return holder
   return `${holder} Then use /edit-lock retry in the original session when available; retry does not Continue editing. Do NOT remove the publisher reservation (.weir/.edit-lock.publisher-reservation) while its process is alive — removing it would split the edit authority.`
 }
 
@@ -32,7 +42,8 @@ export function bindingGuidance(sessionId, reason) {
 export function bindingFailure(pid, attestation, revocationFailed = false) {
   return { code: 'binding-duplicate', retryable: true,
     holderKind: revocationFailed ? 'revocation-failed' : attestation === 'serving' ? 'serving'
-      : pid !== undefined && pid !== process.pid ? 'cross-process' : 'unknown',
+      : attestation === 'serving-idle' ? 'transferable'
+        : pid !== undefined && pid !== process.pid ? 'cross-process' : 'unknown',
     holderPid: pid ?? null }
 }
 /** @param {number | undefined} pid @param {string} attestation @param {boolean} [revocationFailed] */

package/src/edit-lock/domain.js

@@ -15,6 +15,14 @@ export function localDomain(lifecycle, endpoint) {
       lifecycle.assertStartable(agent)
       return endpoint?.startLocal ? endpoint.startLocal(agent, true) : lifecycle.start(agent)
     },
+    /** Trusted binding transfer (change edit-lock-binding-transfer): the
+     * explicit driving-ingress counterpart of retryStart — the holder-side
+     * admission (local, registry-named, provably idle holder) is re-adjudicated
+     * at execution and refuses exactly like start() otherwise. @param {object} agent */
+    transferStart: async agent => {
+      lifecycle.assertStartable(agent)
+      return endpoint?.startLocal ? endpoint.startLocal(agent, true, true) : lifecycle.transferStart(agent)
+    },
     /** Synchronous admission fence for an aborted turn. @param {object} agent */
     latch: agent => { lifecycle.stop(agent).catch(() => {}) },
     /** @param {object} agent */
@@ -86,6 +94,10 @@ export function remoteDomain(remote) {
     start: async agent => (await remote.channelFor(agent)).state,
     /** @param {object} agent */
     retryStart: async agent => (await remote.channelFor(agent, true)).state,
+    /** The wire retry flag carries the transfer admission to the publisher
+     * (its lifecycle re-adjudicates holder idleness); the client adds nothing. */
+    /** @param {object} agent */
+    transferStart: async agent => (await remote.channelFor(agent, true)).state,
     /** @param {object} agent */
     forget: async agent => { try { await remote.call(agent, 'stop') } finally { remote.drop(agent) } },
     /** Closing the channel makes the publisher revoke on EOF. @param {object} agent */

package/src/edit-lock/domains.js

@@ -97,6 +97,73 @@ export function createDomainRegistry(open, resolveRoot = managementRootFor) {
   })
 }
 
+/** @type {WeakMap<object, Map<string, {registry: any, settled: WeakMap<object, any>, recoveryNotices: Map<string, string>, mounts: number}>>} */
+const sharedRegistriesByHost = new WeakMap()
+
+/** Process-shared domain registry container (change
+ * edit-lock-shared-domain-mounts, design D1): several preset mounts of this
+ * bundle coexist for the whole process, and every mount of one management
+ * root must resolve the SAME domain — one runtime, one publisher reservation,
+ * one lifecycle and one endpoint — instead of the second mount degrading to a
+ * same-process remote client of the first.
+ *
+ * The container is keyed by host (`ctx.root ?? ctx`, the same key expression
+ * the write-scope store uses — proven to be shared across preset mounts) plus
+ * a caller-supplied configuration discriminator: mounts whose effective
+ * domain configuration differs (a fixed root/authority row) NEVER share; they
+ * keep today's independent-registry semantics exactly.
+ *
+ * Reference-counted by mount: each apply takes one count, each disposer
+ * releases exactly one (idempotently); a factory that throws enters no count.
+ * Only the LAST release closes every domain through the established drain
+ * discipline (`registry.all() → domain.close()`), revoking sessions and
+ * releasing reservations; the entry is then dropped, so a later generation
+ * reopens fresh. The per-entry `settled` store and the per-root
+ * automatic-recovery notice queue share the entry's lifetime: they outlive
+ * any single mount (a preset switch lets a sibling mount's listeners read
+ * the binding the first mount settled, and the mount that hears the first
+ * post-recovery turn drains the summary), and they die with the last
+ * release so a closed domain is never mistaken for a live binding.
+ *
+ * @template T
+ * @param {object} host
+ * @param {string} discriminator
+ * @param {() => ReturnType<typeof createDomainRegistry<T>>} makeRegistry
+ * @returns {{registry: ReturnType<typeof createDomainRegistry<T>>, settled: WeakMap<object, T>, recoveryNotices: Map<string, string>, release: () => Promise<void>}} */
+export function sharedDomainRegistryFor(host, discriminator, makeRegistry) {
+  let entries = sharedRegistriesByHost.get(host)
+  if (!entries?.has(discriminator)) {
+    // A throwing factory mutates nothing and enters no count.
+    const created = makeRegistry()
+    if (!entries) {
+      entries = new Map()
+      sharedRegistriesByHost.set(host, entries)
+    }
+    entries.set(discriminator, { registry: created, settled: new WeakMap(), recoveryNotices: new Map(), mounts: 0 })
+  }
+  const entry = /** @type {{registry: any, settled: WeakMap<object, any>, recoveryNotices: Map<string, string>, mounts: number}} */ (entries.get(discriminator))
+  entry.mounts += 1
+  let released = false
+  return Object.freeze({
+    registry: entry.registry,
+    settled: entry.settled,
+    /** One queued automatic-recovery summary per root, shared so the mount
+     * that hears the first post-recovery turn drains it (design D3). */
+    recoveryNotices: entry.recoveryNotices,
+    /** Idempotent: only the first call counts; only the last call closes. */
+    async release() {
+      if (released) return
+      released = true
+      entry.mounts -= 1
+      if (entry.mounts > 0 || entries.get(discriminator) !== entry) return
+      entries.delete(discriminator)
+      const results = await Promise.allSettled(entry.registry.all().map(async domain => (await domain).close()))
+      const failure = results.find(result => result.status === 'rejected')
+      if (failure?.status === 'rejected') throw failure.reason
+    },
+  })
+}
+
 /** @param {string} path */
 export function isDirectory(path) {
   try { return lstatSync(path).isDirectory() } catch { return false }