zcode-acp-server 0.44.2 → 0.44.4

package/dist/handlers/session.js

@@ -31,7 +31,7 @@ import { buildDiffContent, EventTranslator, extractLocations, formatTurnError, i
 import { clientConnectionRoot, log, warn } from "../utils.js";
 import { dispatchEvent } from "./dispatch.js";
 import { sendSessionUpdate, sendTextChunk, withReplayBatch } from "./io.js";
-import { fetchMessages, fullSlice, readTailLimit, replayMessages, sliceTail } from "./replay.js";
+import { fetchMessages, fullSlice, readTailLimit, replayMessages, sliceTail, TURN_READ, } from "./replay.js";
 import { extractPermDeniedPath, extractSandboxDenial, GENERIC_HINT_KEY, handleSandboxDenial, READ_ONLY_TOOLS, } from "./sandbox-allow.js";
 import { handleServerRequests } from "./server-requests.js";
 /** Workspace descriptor used in session create/resume calls. */
@@ -883,7 +883,7 @@ export async function resumeIntoSession(server, cx, acpSid, zcodeTarget) {
         if (current) {
             let existing;
             try {
-                existing = await fetchMessages(server, current);
+                existing = await fetchMessages(server, current, TURN_READ);
             }
             catch {
                 // Cannot prove the thread empty — refuse rather than orphan history.
@@ -1328,7 +1328,8 @@ export async function runOneTurn(server, opts) {
             // settling before the send — see drainBackendAfterCancel. EXEMPT while a
             // detached auto-compact runs: it legitimately holds the prompt lock, and
             // the gate's close escalation would tear down the resident runtime and
-            // kill the compaction — the busy-retry below waits it out instead.
+            // kill the compaction — the busy-reject below rejects the send outright
+            // instead of waiting it out.
             const cancelledRecently = server.lastCancelledAt.get(zcodeSid) !== undefined &&
                 Date.now() - server.lastCancelledAt.get(zcodeSid) < DRAIN_WINDOW_MS &&
                 !server.autoCompactInFlight.has(zcodeSid);
@@ -1363,10 +1364,6 @@ export async function runOneTurn(server, opts) {
                 : { sessionId: zcodeSid, content: sendText };
             const sendT0 = Date.now();
             let sendAttempt = 0;
-            // One-shot "waiting for compaction" notice — a minutes-long busy window
-            // with no explanation reads as a hang (the very thing that made users
-            // ESC out of the old blocking auto-compact).
-            let compactWaitNotified = false;
             while (true) {
                 if (turn.cancelled) {
                     stopBackendTurn(server, zcodeSid, turn);
@@ -1424,20 +1421,29 @@ export async function runOneTurn(server, opts) {
                 const NOTIFY_TURN_STALE_MS = 600_000;
                 const notifySince = server.notifyTurnActiveSince.get(zcodeSid);
                 const notifyActive = notifySince !== undefined && Date.now() - notifySince < NOTIFY_TURN_STALE_MS;
-                // A detached auto-compact is the same shape: a real model turn holding
-                // the lock for minutes. Extend the budget past its full worst case
-                // (settle cap 300s + startup + probe gaps) and tell the user once.
-                // Both flags can be true at once (a background notify turn AND a
-                // compaction queued behind it) — take the LARGER budget, never the
-                // smaller: the smaller fails the user's prompt mid-wait.
-                const COMPACT_BUSY_TIMEOUT_MS = 360_000;
-                const compacting = server.autoCompactInFlight.has(zcodeSid);
-                const busyBudget = Math.max(notifyActive ? NOTIFY_TURN_BUSY_TIMEOUT_MS : 0, compacting ? COMPACT_BUSY_TIMEOUT_MS : 0, SEND_RETRY_TIMEOUT_MS);
-                const budget = isBusy ? busyBudget : WARMUP_RETRY_TIMEOUT_MS;
-                if (isBusy && compacting && !compactWaitNotified) {
-                    compactWaitNotified = true;
-                    await sendTextChunk(cx, acpSid, messages().autoCompactWaiting, randomUUID());
+                // A detached auto-compact is the opposite case: REJECT instead of
+                // waiting. This turn's listener is already subscribed, so the
+                // compaction's internal AI turn is streaming its residue into our
+                // queue right now; queueing behind the lock until it releases would
+                // dispatch that residue as THIS prompt's output (its turn.completed
+                // ends the turn before the real reply even starts). Reject at once:
+                // the notice asks the user to resend, the queued residue dies with
+                // this turn's listener unregister in the finally, and
+                // turn.compactRejected lets the goal-loop driver (no user to resend)
+                // wait the compaction out and retry the round.
+                if (isBusy && server.autoCompactInFlight.has(zcodeSid)) {
+                    // Goal rounds get no user-directed notice: the driver retries them
+                    // automatically — a "resend" instruction would point at an internal
+                    // dispatch prompt the user never typed (the driver announces its
+                    // own wait note instead).
+                    if (!turn.goalLoop) {
+                        await sendTextChunk(cx, acpSid, messages().autoCompactBusy, randomUUID());
+                    }
+                    turn.compactRejected = true;
+                    return { stopReason: "max_turn_requests" };
                 }
+                const busyBudget = Math.max(notifyActive ? NOTIFY_TURN_BUSY_TIMEOUT_MS : 0, SEND_RETRY_TIMEOUT_MS);
+                const budget = isBusy ? busyBudget : WARMUP_RETRY_TIMEOUT_MS;
                 if (Date.now() - sendT0 > budget) {
                     throw new Error(`zcode send failed: ${isBusy ? "backend still busy" : "send keeps being rejected"} after ${Math.round(budget / 1000)}s (${sendResp.error.message ?? ""})`);
                 }
@@ -1577,7 +1583,7 @@ export async function runOneTurn(server, opts) {
         // Start the armed auto-compact ONLY now, after deregistration and the
         // running:false turnState: from here on a cancel or follow-up prompt finds
         // no turn to preempt (the compaction is untouchable housekeeping), and a
-        // prompt racing it waits on the busy-retry instead of killing it.
+        // prompt racing it is rejected outright instead of killing it.
         if (autoCompactDue) {
             try {
                 const { runAutoCompactDetached } = await import("../config/auto-compact.js");
@@ -1671,17 +1677,43 @@ async function runPrompt(server, params, cx, requestId, continuationRound = fals
     // same lock). Slash commands /auto pause|resume|stop|status were
     // intercepted above, so anything reaching here is conversational input.
     let parked;
+    // Set when the compaction gate below rejected this prompt.
+    let compactBusy = false;
+    // A sandbox continuation has no user watching to resend it: wait the
+    // compaction out instead of hitting the rejection gate. The wait happens
+    // BEFORE any subscribe, so it is residue-free by construction.
+    if (continuationRound && server.autoCompactInFlight.has(zcodeSid)) {
+        const { waitForAutoCompactIdle } = await import("../config/auto-compact.js");
+        await waitForAutoCompactIdle(server, zcodeSid);
+    }
     await withPreemptLock(server, zcodeSid, async () => {
         const goalLoop = server.goalLoops?.get(zcodeSid);
         if (goalLoop) {
             parked = goalLoop.parkPrompt(sendText);
             return;
         }
+        // Compaction gate: a detached auto-compact holds the backend prompt lock
+        // for minutes. NEVER queue behind it — this prompt's listener subscribes
+        // before the send, so waiting out the compaction would accumulate its
+        // whole internal-turn stream in our queue and dispatch it as THIS
+        // prompt's output once the lock releases (its turn.completed even ends
+        // the turn before the real reply starts). Reject with a resend notice;
+        // runOneTurn's busy-reject fallback covers the arm race between this
+        // check and the send.
+        if (server.autoCompactInFlight.has(zcodeSid)) {
+            compactBusy = true;
+            return;
+        }
         server.pendingTurns.set(requestId, turn);
         preempted = preemptInFlightTurn(server, zcodeSid, requestId);
     });
     if (parked)
         return parked;
+    if (compactBusy) {
+        await sendTextChunk(cx, params.sessionId, messages().autoCompactBusy, randomUUID());
+        log("session/prompt: rejected — a detached auto-compact is in flight");
+        return { stopReason: "max_turn_requests" };
+    }
     // Discovery: the session is live the moment its turn STARTS — mark it active
     // here instead of only at turn end, so a freshly created conversation shows
     // up in remote lists within one heartbeat even while its first (possibly
@@ -2427,18 +2459,23 @@ const RESUME_SETTLE_STABLE_READS = 2;
  * reads re-settle (fetchMessagesForReplay); a stable exit clears it.
  *
  * Re-settles (a marker left by a capped settle) fast-path on the WATERMARK:
- * one non-growing read that reaches the largest length any settle has ever
- * observed counts as caught-up. Demanding the full two-read plateau again
+ * one non-growing read that itself reaches the largest length any settle has
+ * ever observed counts as caught-up. Demanding the full two-read plateau again
  * meant slow-reading sessions NEVER cleared the marker — every load re-paid
  * a capped settle (observed 2026-09-20: 22–56s loads on a 7413-message
- * session). Watermarks reset on backend respawn (ensureBackend).
+ * session). The confirming READ (not this flight's running max) must reach
+ * the live watermark, so a read that dips below what any settle has seen
+ * falls back to the plateau rule; watermark writes are monotonic, so a
+ * concurrent settle's higher observation is never traded down. Residual,
+ * accepted: a hydration stalling at/above the watermark across one read+gap
+ * still exits early with a prefix — bounded, and the next plain read
+ * self-heals. Watermarks reset on backend respawn (ensureBackend).
  */
 export async function fetchMessagesSettled(server, zcodeSid) {
     let messages = await fetchMessages(server, zcodeSid);
     // The catch-up anchor: what a previous settle already saw of this store.
     const entryWatermark = server.hydrationWatermark.get(zcodeSid) ?? 0;
-    if (messages.length > entryWatermark)
-        server.hydrationWatermark.set(zcodeSid, messages.length);
+    raiseWatermark(server, zcodeSid, messages.length);
     let stable = 0;
     const deadline = Date.now() + RESUME_SETTLE_CAP_MS;
     for (;;) {
@@ -2449,21 +2486,21 @@ export async function fetchMessagesSettled(server, zcodeSid) {
             // A failed read comes back EMPTY (fetchMessages swallows errors) — never
             // let it vouch for stability while hydration may still be running.
             const errored = next.length === 0 && messages.length > 0;
-            // Watermark fast-path: the store reached everything any settle has ever
-            // seen AND this read confirms it is not growing — caught up.
-            const reachedWatermark = entryWatermark > 0 && messages.length >= entryWatermark;
+            // Watermark fast-path: the confirming read itself reached everything
+            // any settle has ever seen (live value — a concurrent settle may have
+            // raised it past our entry snapshot) AND the store is not growing.
+            const liveWatermark = server.hydrationWatermark.get(zcodeSid) ?? 0;
+            const reachedWatermark = entryWatermark > 0 && next.length >= liveWatermark;
             if (!errored && (reachedWatermark || ++stable >= RESUME_SETTLE_STABLE_READS)) {
                 server.hydrationUnsettled.delete(zcodeSid);
-                server.hydrationWatermark.set(zcodeSid, Math.max(messages.length, entryWatermark));
+                raiseWatermark(server, zcodeSid, Math.max(messages.length, entryWatermark));
                 return messages;
             }
         }
         else {
             stable = 0;
             messages = next;
-            if (messages.length > (server.hydrationWatermark.get(zcodeSid) ?? 0)) {
-                server.hydrationWatermark.set(zcodeSid, messages.length);
-            }
+            raiseWatermark(server, zcodeSid, messages.length);
         }
         if (Date.now() >= deadline) {
             server.hydrationUnsettled.add(zcodeSid);
@@ -2474,6 +2511,12 @@ export async function fetchMessagesSettled(server, zcodeSid) {
         }
     }
 }
+/** Monotonic watermark write — a concurrent settle's higher observation wins. */
+function raiseWatermark(server, zcodeSid, length) {
+    if (length > (server.hydrationWatermark.get(zcodeSid) ?? 0)) {
+        server.hydrationWatermark.set(zcodeSid, length);
+    }
+}
 /**
  * History read for replay paths: plain unless the last settle for this
  * session capped out mid-hydration — then re-settle first (the marker is
@@ -3111,7 +3154,7 @@ export async function runEventTurn(server, listener, monitor, differ, cx, acpSid
             // compaction, before the user's next send) would leave its entire output
             // invisible in the UI. `fetchLastReply` above only covers the last
             // assistant message, not the whole missing span.
-            const snapshot = await buildSnapshot(server, turn.zcodeSid);
+            const snapshot = await buildSnapshot(server, turn.zcodeSid, TURN_READ);
             const completionEvents = differ.diff(snapshot);
             for (const iev of completionEvents) {
                 // Per-kind dedup (see deliveredReasoningMessageIds): text and reasoning
@@ -3173,7 +3216,7 @@ function registerFetchedReply(translator, reply) {
  */
 async function fetchLastReply(server, zcodeSid, differ) {
     for (let attempt = 0; attempt < 4; attempt++) {
-        const messages = await fetchMessages(server, zcodeSid);
+        const messages = await fetchMessages(server, zcodeSid, TURN_READ);
         for (let i = messages.length - 1; i >= 0; i--) {
             const m = messages[i];
             if (!m)
@@ -3216,10 +3259,10 @@ export function flattenTodos(todos, todoGroups) {
     return flat;
 }
 /** Build a {projection, messages, todos} snapshot from session/messages + session/read. */
-async function buildSnapshot(server, zcodeSid) {
+async function buildSnapshot(server, zcodeSid, opts = {}) {
     const backend = server.ensureBackend();
     const [msgs, readResp] = await Promise.all([
-        fetchMessages(server, zcodeSid),
+        fetchMessages(server, zcodeSid, opts),
         backend.request(server.nextId(), "session/read", { sessionId: zcodeSid }, 8000),
     ]);
     const read = (readResp.result ?? {});
@@ -3263,7 +3306,7 @@ export async function emitModeIfChanged(server, cx, acpSid, zcodeSid) {
  * the tool seen in the differ so turn-completion diff won't re-emit it.
  */
 async function dispatchEditDiff(server, cx, acpSid, zcodeSid, callId, differ, chunkMsgId) {
-    const messages = await fetchMessages(server, zcodeSid);
+    const messages = await fetchMessages(server, zcodeSid, TURN_READ);
     for (const m of messages) {
         for (const p of m.parts ?? []) {
             if (!p || typeof p !== "object")