zcode-acp-server 0.47.9 → 0.48.0

package/dist/handlers/session.js

@@ -24,13 +24,14 @@ import { buildProviderRegistry } from "../config/provider-registry.js";
 import { pushAccountProviderConfig } from "../config/account-provider.js";
 import { initialSessionMode } from "../config/settings.js";
 import { applyModelSwitch, buildResumeRuntimeModel } from "../config/runtime-model.js";
+import { filterWorkflowCommands, rememberGate, workflowGateNow } from "../config/workflow-gate.js";
 import { messages } from "../i18n.js";
 import { lookupLazySession, lookupModelChoiceByZcodeSid, recordMaterializedSession, rememberLazySession, } from "../lazy-sessions.js";
 import { refreshTerminalTabTitle } from "../terminal-title.js";
 import { buildDiffContent, EventTranslator, extractLocations, formatTurnError, isBackendLostError, isTransientTurnError, ProjectionDiffer, } from "../translators/index.js";
 import { clientConnectionRoot, log, warn } from "../utils.js";
 import { dispatchEvent } from "./dispatch.js";
-import { emitSessionTurnState, sendSessionUpdate, sendTextChunk, withReplayBatch } from "./io.js";
+import { emitSessionTurnState, sendAvailableCommandsDeferred, sendSessionUpdate, sendTextChunk, withReplayBatch, } from "./io.js";
 import { EDIT_DIFF_READ_LIMIT, fetchMessages, fetchMessagesSinceAnchor, fullSlice, readTailLimit, REPLY_READ_LIMIT, replayMessages, sliceTail, TURN_READ, } from "./replay.js";
 import { extractPermDeniedPath, extractSandboxDenial, GENERIC_HINT_KEY, handleSandboxDenial, READ_ONLY_TOOLS, } from "./sandbox-allow.js";
 import { handleServerRequests } from "./server-requests.js";
@@ -39,6 +40,60 @@ function workspaceFor(cwd) {
     const p = cwd || process.cwd();
     return { workspacePath: p, workspaceKey: p };
 }
+/**
+ * Dynamic-workflow session flag (desktop-host parity, server.backendWorkflowGate):
+ * `{dynamicWorkflowEnabled:true}` rides every session/create·resume when the
+ * gate resolved enabled; otherwise NOTHING is written — the backend's zod
+ * schemas are strict, and the flag-absent default is exactly fail-closed.
+ * Awaiting the gate on the hot path is free (the verdict resolved at backend
+ * spawn); the cold-path bound is the gate fetch's 6s timeout, well under a
+ * backend boot. Fork and sub-agent sessions copy the flag inside the backend
+ * — no bridge-side injection point for those.
+ */
+async function workflowFlag(server) {
+    const promise = server.backendWorkflowGate;
+    if (!promise)
+        return {};
+    const gate = await promise;
+    // Belt-and-braces vs captureGate (ensureBackend): an awaited verdict becomes
+    // synchronously readable immediately, so the send-time menu filter that runs
+    // right after create/resume sees it on its FIRST call.
+    rememberGate(promise, gate);
+    return gate.enabled ? { dynamicWorkflowEnabled: true } : {};
+}
+/**
+ * Cold-bridge menu catch-up: the `/` menu snapshot sent at session/new is
+ * filtered against the workflow gate, and on a COLD bridge (lazy session/new,
+ * no backend yet) that snapshot was taken while the gate was still
+ * pending/absent — the two workflow commands get dropped for that whole
+ * session. By the time a lazy session MATERIALIZES the gate has necessarily
+ * settled (create/resume params awaited it), so re-send the menu here.
+ * Overwrite semantics + the deferred helper's timer cancellation make this
+ * idempotent and correctly ordered (a late settle supersedes the stale send).
+ */
+export function resendMenuAfterGateSettled(server, acpSid) {
+    if (!server.allCommands || !workflowGateNow(server)?.enabled)
+        return;
+    for (const sid of server.sessionAliases(acpSid)) {
+        sendAvailableCommandsDeferred(server.clients, sid, filterWorkflowCommands(server, server.allCommands));
+    }
+}
+/**
+ * Shared `session/resume` params builder: {sessionId, workspace} + optional
+ * session-lifetime mcpServers + the conditional dynamic-workflow flag. Every
+ * resume construction site (session/resume, /resume adoption, session/load,
+ * eviction/respawn reload) goes through here so the param shape cannot drift.
+ */
+async function resumeParams(server, zcodeSid, cwd, mcpServers) {
+    const params = {
+        sessionId: zcodeSid,
+        workspace: workspaceFor(cwd),
+        ...(await workflowFlag(server)),
+    };
+    if (mcpServers)
+        params.mcpServers = mcpServers;
+    return params;
+}
 /**
  * A client-supplied cwd is only ever trusted for `session/new` — creating a
  * session is the editor declaring its worktree. "/" is never a project root:
@@ -252,7 +307,10 @@ export async function newSession(server, params, client) {
         // Same banner handshake as boot-resume: the TUI's auto-submitted trigger
         // (DSH_TUI_AUTOPROMPT) drops martty's welcome banner so the window shows
         // the shared conversation instead of waiting for local input.
-        if (isMarttyClient(server)) {
+        // Per-connection martty identity, NOT the sticky process flag: the phone
+        // claims this same bind below, and a sticky-gated arm re-pointed the
+        // handshake at the phone — the TUI's trigger then reached the model.
+        if (server.marttyConnectionRoots.has(bindRoot)) {
             server.bootResumeTriggerConnection = bindRoot;
         }
         const modes = await buildModes(server, null);
@@ -286,9 +344,12 @@ export async function newSession(server, params, client) {
             // into its transcript. The chunks sit BEHIND martty's welcome banner
             // until text is submitted — the DSH_TUI_AUTOPROMPT handshake armed
             // below drops the banner for the user.
-            if (isMarttyClient(server)) {
+            if (server.marttyConnectionRoots.has(clientConnectionRoot(client))) {
                 // Scope the handshake to THIS connection: a phone app attached to the
                 // same bridge may prompt during the boot window and must not disarm it.
+                // Per-connection martty identity, NOT the sticky process flag — an
+                // attaching phone's session/new can win the race for the env; it must
+                // neither arm for itself nor leave a wrong arm for the TUI's trigger.
                 server.bootResumeTriggerConnection = clientConnectionRoot(client);
                 // Targeted replay — the booting TUI's own connection, never broadcast
                 // (see the loadSession comment above).
@@ -504,6 +565,9 @@ export async function ensureRealSession(server, acpSid, opts = {}) {
             if (opts.ensureResident !== false) {
                 await ensureBackendResident(server, acpSid, record.zcodeSid);
             }
+            // Materialization (resume flight) settled the gate — refresh a menu
+            // snapshot that may predate the verdict (see resendMenuAfterGateSettled).
+            resendMenuAfterGateSettled(server, acpSid);
             return record.zcodeSid;
         }
         if (record) {
@@ -544,6 +608,9 @@ export async function ensureRealSession(server, acpSid, opts = {}) {
             // ZCODE_ACP_MODE; the default stays "yolo" (unrestricted), which is
             // what the bridge always used.
             mode: initialSessionMode(),
+            // Dynamic-workflow enable rides create only when the gate says so —
+            // workflowFlag writes nothing otherwise (strict zod).
+            ...(await workflowFlag(server)),
         };
         if (pending.mcpServers && pending.mcpServers.length > 0) {
             createParams.mcpServers = pending.mcpServers;
@@ -592,6 +659,9 @@ export async function ensureRealSession(server, acpSid, opts = {}) {
         recordMaterializedSession(acpSid, sid, pending.cwd);
         log(`session/new ${acpSid} → created ${sid} (lazy, on first use)`);
         await server.ensureBackgroundListener(sid);
+        // Cold-bridge catch-up: the session/new menu snapshot was filtered on a
+        // pending gate; the create above settled it — re-send for this session.
+        resendMenuAfterGateSettled(server, acpSid);
         // Sync to the App's tasks-index.sqlite so the App UI shows this session.
         // Best-effort; failures are logged inside upsertSessionTask and swallowed.
         const { upsertSessionTask } = await import("../tasks-index.js");
@@ -806,18 +876,12 @@ export async function resumeSession(server, params, cx) {
         // the faithful resume fails outright). The params deliberately carry NO
         // apiKey either (the backend's schema rejects it; it resolves auth from
         // its own config/OAuth store).
-        const zcParams = {
-            sessionId: zcodeSid,
-            workspace: workspaceFor(cwd),
-        };
         // ACP session/resume may also carry mcpServers; the backend's resume
         // schema accepts the same array shape (verified: an unknown key would be
         // rejected before the session lookup). Remembered as session-lifetime
         // state so later reloads keep re-sending them (#193).
         rememberSessionMcpServers(server, acpSid, params.mcpServers);
-        const storedMcp = server.sessionMcpServers.get(acpSid);
-        if (storedMcp)
-            zcParams.mcpServers = storedMcp;
+        const zcParams = await resumeParams(server, zcodeSid, cwd, server.sessionMcpServers.get(acpSid));
         // Push the provider registry BEFORE resume: a resumed session may carry a
         // third-party model in its history, and the backend needs the provider
         // registered to even process the resume turn.
@@ -949,14 +1013,9 @@ export async function resumeIntoSession(server, cx, acpSid, zcodeTarget) {
     let settledHistory;
     try {
         await syncProviderRegistry(server, cwd);
-        const outcome = await resumePreservingModel(server, {
-            sessionId: zcodeTarget,
-            workspace: workspaceFor(cwd),
-            // Session-lifetime MCP set keeps riding every resume (#193).
-            ...(server.sessionMcpServers.get(acpSid)
-                ? { mcpServers: server.sessionMcpServers.get(acpSid) }
-                : {}),
-        });
+        const outcome = await resumePreservingModel(server, 
+        // Session-lifetime MCP set keeps riding every resume (#193).
+        await resumeParams(server, zcodeTarget, cwd, server.sessionMcpServers.get(acpSid)));
         settledHistory = outcome.history;
         server.markBackendLoaded(acpSid);
         await repairUnavailableModel(server, zcodeTarget);
@@ -1026,16 +1085,10 @@ export async function loadSession(server, params, cx, opts = {}) {
     // snapshot is the mid-hydration-prefix guard; undefined = alreadyLive).
     let settledHistory;
     if (!alreadyLive) {
-        const zcParams = {
-            sessionId: zcodeSid,
-            workspace: workspaceFor(cwd),
-        };
         // Same mcpServers contract as resume: the client may re-declare them on
         // load; a stored set keeps riding along when it doesn't (#193).
         rememberSessionMcpServers(server, acpSid, params.mcpServers);
-        const storedMcp = server.sessionMcpServers.get(acpSid);
-        if (storedMcp)
-            zcParams.mcpServers = storedMcp;
+        const zcParams = await resumeParams(server, zcodeSid, cwd, server.sessionMcpServers.get(acpSid));
         // Push the provider registry BEFORE resume: a loaded session may carry a
         // third-party model in its history, and the backend needs the provider
         // registered to process it.
@@ -1695,16 +1748,39 @@ async function runPrompt(server, params, cx, requestId, continuationRound = fals
     // connection submitting anything else first means the auto-submit was
     // lost — disarm so the trigger text typed manually later stays a normal
     // prompt.
+    const promptRoot = clientConnectionRoot(client);
+    const ackBootResumeTrigger = async () => {
+        await sendTextChunk(cx, params.sessionId, messages().bootResumeAck, randomUUID());
+        log("session/prompt: boot-resume banner handshake acknowledged");
+        await emitSessionTurnState(server, params.sessionId, false, cx);
+        return { stopReason: "end_turn" };
+    };
     if (server.bootResumeTriggerConnection !== null &&
-        clientConnectionRoot(client) === server.bootResumeTriggerConnection) {
+        promptRoot === server.bootResumeTriggerConnection) {
         server.bootResumeTriggerConnection = null;
         if (text === BOOT_RESUME_TRIGGER) {
-            await sendTextChunk(cx, params.sessionId, messages().bootResumeAck, randomUUID());
-            log("session/prompt: boot-resume banner handshake acknowledged");
-            await emitSessionTurnState(server, params.sessionId, false, cx);
-            return { stopReason: "end_turn" };
-        }
-    }
+            return await ackBootResumeTrigger();
+        }
+    }
+    else if (
+    // Unarmed fallback: the boot-resume env was consumed by a NON-martty
+    // first session/new (an attaching phone can win the race against the
+    // TUI's boot), so no arm exists for the TUI — its auto-submitted trigger
+    // still needs the ack or it reaches the model (observed from the mobile
+    // app, 2026-09-23). A MARTTY connection's first prompt matching the
+    // trigger verbatim is that handshake; a phone typing the same words is
+    // real input (marttyConnectionRoots does not contain it) and goes to the
+    // model as typed.
+    server.bootResumeTriggerConnection === null &&
+        text === BOOT_RESUME_TRIGGER &&
+        server.marttyConnectionRoots.has(promptRoot) &&
+        !server.connectionPromptSeen.has(promptRoot)) {
+        return await ackBootResumeTrigger();
+    }
+    // First-prompt bookkeeping for the unarmed fallback above: only a martty
+    // connection's FIRST prompt is a handshake candidate.
+    if (promptRoot !== undefined)
+        server.connectionPromptSeen.add(promptRoot);
     // Materialize a lazy session/new placeholder on first use. Placed after the
     // empty-prompt check so an invalid request doesn't create a backend session.
     const zcodeSid = await ensureRealSession(server, params.sessionId);
@@ -2429,17 +2505,13 @@ async function resumeBackendSession(server, zcParams) {
  */
 export async function reloadBackendSession(server, acpSid, zcodeSid) {
     const cwd = server.sessionCwds.get(acpSid) ?? process.cwd();
-    const zcParams = {
-        sessionId: zcodeSid,
-        workspace: workspaceFor(cwd),
-    };
     // Eviction/respawn reload: the backend lost the per-load mcpServers runtime
     // config with its resident session — re-send or the tools vanish (#193).
     const reloadMcp = server.sessionMcpServers.get(acpSid);
     if (reloadMcp) {
-        zcParams.mcpServers = reloadMcp;
         log(`session/resume (reload) carrying ${reloadMcp.length} client MCP server(s)`);
     }
+    const zcParams = await resumeParams(server, zcodeSid, cwd, reloadMcp);
     // Same pre-resume steps as the ACP resume/load handlers: register the
     // provider registry (a resumed session's history references a model the
     // fresh backend can't process until its provider is registered — sends