agentwire-dev 1.59.0__tar.gz → 1.61.0__tar.gz

{agentwire_dev-1.59.0 → agentwire_dev-1.61.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentwire-dev
-Version: 1.59.0
+Version: 1.61.0
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev

{agentwire_dev-1.59.0 → agentwire_dev-1.61.0}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.59.0"
+__version__ = "1.61.0"

{agentwire_dev-1.59.0 → agentwire_dev-1.61.0}/agentwire/core.py

@@ -148,15 +148,25 @@ def _build_tmux_env_flags_shell(env: dict[str, str]) -> str:
     return " ".join(parts) + " "
 
 
-def _set_session_name_env(agent: "AgentCommand", session_name: str) -> None:
-    """Stamp ``AGENTWIRE_SESSION_NAME`` onto an ``AgentCommand.env``.
+def _set_session_name_env(agent: "AgentCommand", session_name: str, created_by: str | None = None) -> None:
+    """Stamp ``AGENTWIRE_SESSION_NAME`` (and, when there's a real parent,
+    ``AGENTWIRE_CREATED_BY``) onto an ``AgentCommand.env``.
 
     Every session created via ``cmd_new`` / ``cmd_spawn`` / ``cmd_recreate``
-    / ``cmd_fork`` / scheduler-spawn paths gets this so downstream tooling
-    (notably the worker damage-control rules in ``safety/_core.py``)
-    can identify which agentwire session the running tool is part of.
+    / ``cmd_fork`` / scheduler-spawn paths gets ``AGENTWIRE_SESSION_NAME`` so
+    downstream tooling (notably the worker damage-control rules in
+    ``safety/_core.py``) can identify which agentwire session the running
+    tool is part of.
+
+    ``created_by`` of ``''`` (root/orchestrator) or ``None`` means no
+    parent — ``AGENTWIRE_CREATED_BY`` is deliberately left UNSET rather than
+    set to an empty string, so the bare pre-agent shell's launch-crash guard
+    (``_guarded_launch_command``) can tell "has a parent to escalate to"
+    apart from "root session, email the owner" with a plain ``-n`` test (#743).
     """
     agent.env["AGENTWIRE_SESSION_NAME"] = session_name
+    if created_by:
+        agent.env["AGENTWIRE_CREATED_BY"] = created_by
 
 
 def inject_session_env(session: str, env: dict[str, str], remote_host: str | None = None) -> None:
@@ -847,6 +857,52 @@ def _run_remote(machine_id: str, command: str) -> subprocess.CompletedProcess:
         )
 
 
+def _guarded_launch_command(path_str: str, agent_cmd: str | None) -> str:
+    """Build the pane's ``cd <path> && <agent_cmd>`` line with a missing-dir guard (#739).
+
+    A crashed worktree create can leave ``path_str`` absent by the time the
+    pane actually runs its ``cd`` (race between ``agentwire new`` reporting
+    success and the async pane launch, or an external actor removing the
+    dir). Without a guard, ``cd`` fails, the shell prints an error and
+    carries on, and ``agent_cmd`` (e.g. ``claude``) then launches from the
+    WRONG cwd and crashes — dropping the pane to a bare shell that the
+    idle-reaper never touches (it only reaps a *running* agent going idle),
+    so it lingers forever.
+
+    On a missing dir this instead alerts and exits the shell, which tears the
+    tmux session down instead of leaving a zombie. ``agent_cmd`` never runs.
+
+    Two alert routes, both shell-runtime-gated on env vars stamped at launch
+    (``_set_session_name_env``), so this function stays a pure string builder
+    with no Python-level knowledge of the session's parent (#743):
+    - A real recorded parent (``$AGENTWIRE_CREATED_BY`` set) gets the crash
+      escalated to its msg inbox — in-band, not just an email the human has
+      to forward.
+    - No parent (root/orchestrator sessions, the genuine scheduler-dispatch
+      case) falls back to the original owner email, still gated on
+      ``$AGENTWIRE_UNATTENDED=1`` (see ``_with_unattended_env``).
+    """
+    quoted_path = shlex.quote(path_str)
+    session_ref = "${AGENTWIRE_SESSION_NAME:-unknown session}"
+    missing_body = f"cd failed at launch: {path_str}"
+    notify_parent = (
+        '[ -n "$AGENTWIRE_CREATED_BY" ] && agentwire msg send --to "$AGENTWIRE_CREATED_BY" '
+        f'--kind escalation --subject "agentwire: worktree missing at launch — {session_ref}" '
+        f'--body "{missing_body}" >/dev/null 2>&1'
+    )
+    notify_owner = (
+        '[ -z "$AGENTWIRE_CREATED_BY" ] && [ "$AGENTWIRE_UNATTENDED" = "1" ] && agentwire email '
+        f'--subject "agentwire: worktree missing — {session_ref}" '
+        f'--body "{missing_body}" >/dev/null 2>&1'
+    )
+    alert = (
+        f"echo \"agentwire: worktree missing at launch, aborting: {path_str}\" >&2; "
+        f"{notify_parent}; {notify_owner}"
+    )
+    guard = f"cd {quoted_path} || {{ {alert}; exit 1; }}"
+    return f"{guard} && {agent_cmd}" if agent_cmd else guard
+
+
 def _launch_tmux_session(
     session_name: str,
     session_path,
@@ -859,8 +915,9 @@ def _launch_tmux_session(
     The one launch sequence shared by ``new`` / ``recreate`` / ``fork`` (#630):
     `tmux new-session -e K=V` injects *env* into the session environment
     BEFORE the initial shell starts (post-hoc `set-environment` never reaches
-    it), then `send-keys` cd's into place and, if *agent_cmd* is non-empty,
-    starts the agent after a short settle.
+    it), then `send-keys` cd's into place (guarded — see
+    ``_guarded_launch_command``) and, if *agent_cmd* is non-empty, starts the
+    agent after a short settle.
 
     Local (machine_id None): runs subprocess calls with check=True (raises on
     tmux failure) and returns None. Remote: runs one composite shell command
@@ -869,17 +926,14 @@ def _launch_tmux_session(
     import time
 
     path_str = str(session_path)
+    launch_cmd = _guarded_launch_command(path_str, agent_cmd)
     if machine_id:
         env_flags = _build_tmux_env_flags_shell(env)
         create_cmd = (
             f"tmux new-session -d -s {shlex.quote(session_name)} -c {shlex.quote(path_str)} {env_flags}&& "
-            f"tmux send-keys -t {shlex.quote(session_name)} 'cd {shlex.quote(path_str)}' Enter"
+            f"sleep 0.1 && "
+            f"tmux send-keys -t {shlex.quote(session_name)} {shlex.quote(launch_cmd)} Enter"
         )
-        if agent_cmd:
-            create_cmd += (
-                f" && sleep 0.1 && "
-                f"tmux send-keys -t {shlex.quote(session_name)} {shlex.quote(agent_cmd)} Enter"
-            )
         return _run_remote(machine_id, create_cmd)
 
     subprocess.run(
@@ -887,16 +941,11 @@ def _launch_tmux_session(
          *_build_tmux_env_flags(env)],
         check=True,
     )
+    time.sleep(0.1)
     subprocess.run(
-        ["tmux", "send-keys", "-t", session_name, f"cd {shlex.quote(path_str)}", "Enter"],
+        ["tmux", "send-keys", "-t", session_name, launch_cmd, "Enter"],
         check=True,
     )
-    time.sleep(0.1)
-    if agent_cmd:
-        subprocess.run(
-            ["tmux", "send-keys", "-t", session_name, agent_cmd, "Enter"],
-            check=True,
-        )
     return None
 
 

{agentwire_dev-1.59.0 → agentwire_dev-1.61.0}/agentwire/doctor_cli.py

@@ -404,6 +404,77 @@ def _render_task_migration_section() -> int:
     return len(unmigrated)
 
 
+def _find_dead_managed_shims() -> list[dict]:
+    """Managed voice shims whose tmux session is alive but ``/health`` is dead.
+
+    The #734 failure mode: a wedged Kokoro (:8102) or Moonshine STT (:8101) shim
+    inside a live ``agentwire-kokoro``/``agentwire-stt`` session — say/transcribe
+    then silently fall back to browser voice/recognition with no error, and the
+    old session-existence-only ``ensure`` never relaunches it. Only the default
+    tier runs a managed shim, so we check that tier only, and reuse the same
+    ``_shim_session_state`` liveness predicate as ``start`` (SSOT).
+    """
+    from .config import load_config as load_config_typed
+    from .core import (
+        get_kokoro_session_name,
+        get_stt_session_name,
+        tmux_session_exists,
+    )
+    from .tts_cli import _shim_session_state
+
+    cfg = load_config_typed()
+    checks: list[tuple[str, str, int, str, str]] = []
+
+    if getattr(getattr(cfg, "tts", None), "backend", "default") == "default":
+        checks.append((
+            "Kokoro TTS", get_kokoro_session_name(), 8102,
+            "agentwire kokoro start", "say falls back to browser voice",
+        ))
+
+    if getattr(getattr(cfg, "stt", None), "backend", "default") == "default":
+        # Only the Moonshine path runs a shim; without it the default tier
+        # transcribes in the browser and there is nothing to probe.
+        from .stt import moonshine_importable
+
+        if moonshine_importable():
+            checks.append((
+                "Moonshine STT", get_stt_session_name(), 8101,
+                "agentwire stt start",
+                "transcription falls back to browser recognition",
+            ))
+
+    dead: list[dict] = []
+    for label, session, port, fix, impact in checks:
+        if not tmux_session_exists(session):
+            continue
+        live, status = _shim_session_state(session, port)
+        if not live:
+            dead.append({
+                "label": label, "session": session, "port": port,
+                "status": status, "fix": fix, "impact": impact,
+            })
+    return dead
+
+
+def _render_shim_liveness_section() -> int:
+    """Doctor section: managed shim session alive but ``/health`` dead (#734)."""
+    dead = _find_dead_managed_shims()
+    if not dead:
+        print("  [ok] No dead-but-present voice shims")
+        return 0
+    for d in dead:
+        print(
+            f"  [!!] {d['label']} shim session '{d['session']}' is alive but "
+            f":{d['port']}/health is not serving (state: "
+            f"{d['status'] or 'no response'}) — {d['impact']}."
+        )
+    print(
+        f"     Self-heal: re-run `{dead[0]['fix']}` — it is now health-aware and "
+        "reaps a dead session before relaunching."
+    )
+    return len(dead)
+
+
 def cmd_doctor(args) -> int:
     """Auto-diagnose and fix common issues."""
     from .hooks_cli import _managed_file_state, _managed_hook_files, get_hooks_source
@@ -926,6 +997,41 @@ def cmd_doctor(args) -> int:
     except Exception as e:
         print(f"  [..] Could not check project task migration: {e}")
 
+    # 13. Managed voice shims (Kokoro :8102, Moonshine STT :8101) whose tmux
+    # session is alive but whose /health is dead (#734). The old
+    # session-existence-only idempotency masked a wedged engine forever, so
+    # say/transcribe silently fell back to browser voice. Surfaced distinctly
+    # here with the now-health-aware self-heal command.
+    print("\nChecking managed voice shim liveness (#734)...")
+    try:
+        issues_found += _render_shim_liveness_section()
+    except Exception as e:
+        print(f"  [..] Could not check managed voice shim liveness: {e}")
+
+    # 14. Zombie scheduler sessions (#739): a worktree dispatch whose launch
+    # crashed before the agent started (e.g. the worktree dir went missing
+    # between `agentwire new` reporting success and the pane's `cd`) drops to
+    # a bare shell the idle-reaper never touches. `agentwire limits tick`
+    # self-heals these every minute, so a live one here means the watchdog
+    # isn't installed/running, not that reaping is broken.
+    print("\nChecking for zombie scheduler sessions (#739)...")
+    try:
+        from .scheduler import scan_zombie_sessions
+
+        zombie_sessions = scan_zombie_sessions()
+        if not zombie_sessions:
+            print("  [ok] No zombie scheduler sessions found")
+        else:
+            issues_found += 1
+            print(f"  [!!] {len(zombie_sessions)} scheduler session(s) stuck at a bare shell:")
+            for z in zombie_sessions:
+                print(f"       - {z['session']} ({z['command']}, {z['age_seconds']}s old)")
+            print("       `agentwire limits tick` reaps these automatically — "
+                  "run it now, or check the usage-limit watchdog is installed "
+                  "(`agentwire limits install`).")
+    except Exception as e:
+        print(f"  [..] Could not check for zombie scheduler sessions: {e}")
+
     # Summary
     print()
     print("-" * 60)

{agentwire_dev-1.59.0 → agentwire_dev-1.61.0}/agentwire/limits_cli.py

@@ -177,16 +177,20 @@ def cmd_limits_tick(args) -> int:
     """One watchdog pass (called by launchd every minute).
 
     Runs the usage-limit sweep FIRST, then prompt routing (#276), then the
-    polite-message inbox drain (#296), then context auto-management (#442) —
-    the ordering guarantees a usage-limit dialog is parked before any sweep
-    looks at the pane, that the inbox only ever delivers to panes the prompt
-    sweep already cleared, and that auto-``/clear`` runs LAST so it never fights
-    a pending paste/prompt for the same idle, empty box.
+    polite-message inbox drain (#296), then context auto-management (#442),
+    then the zombie-scheduler-session reap (#739) — the ordering guarantees a
+    usage-limit dialog is parked before any sweep looks at the pane, that the
+    inbox only ever delivers to panes the prompt sweep already cleared, that
+    auto-``/clear`` runs before the reap so it never fights a pending
+    paste/prompt for the same idle, empty box, and that the reap runs LAST
+    since it kills sessions outright (nothing later should still be acting on
+    one).
 
     Each stage runs inside :func:`_run_stage` so an exception in one subsystem
     is logged and skipped rather than aborting the whole cycle (#490).
     """
     from agentwire import inbox, prompt_router, session_context
+    from agentwire.scheduler import zombie as scheduler_zombie
 
     result = _run_stage(
         "usage_limit", usage_limit.tick,
@@ -197,9 +201,12 @@ def cmd_limits_tick(args) -> int:
         "inbox", inbox.tick, {"flushed": [], "deferred": []})
     context = _run_stage(
         "session_context", session_context.tick, {"acted": [], "deferred": []})
+    zombies = _run_stage(
+        "scheduler_zombie", scheduler_zombie.tick, {"killed": []})
     if getattr(args, "json", False):
         print(json.dumps({
-            **result, "prompts": prompts, "messages": messages, "context": context,
+            **result, "prompts": prompts, "messages": messages,
+            "context": context, "zombies": zombies,
         }))
         return 0
     if result.get("skipped"):
@@ -237,6 +244,9 @@ def cmd_limits_tick(args) -> int:
     if ctx_deferred:
         print("context deferred: " + ", ".join(
             f"{e['session']}({e['deferred']})" for e in ctx_deferred))
+    killed = zombies.get("killed") or []
+    if killed:
+        print("zombie scheduler sessions reaped: " + ", ".join(killed))
     return 0
 
 

{agentwire_dev-1.59.0 → agentwire_dev-1.61.0}/agentwire/scheduler/__init__.py

@@ -24,6 +24,7 @@ from datetime import datetime, timezone
 import yaml
 
 from ..core import _atomic_write
+from . import zombie
 from .dispatch import (
     _WORKFLOW_STATUS_TO_SCHED,
     _apply_max_runs,
@@ -110,3 +111,6 @@ from .state import (
     load_board,
     save_board,
 )
+from .zombie import reap as reap_zombie_sessions
+from .zombie import scan as scan_zombie_sessions
+from .zombie import tick as zombie_tick

agentwire_dev-1.61.0/agentwire/scheduler/zombie.py

@@ -0,0 +1,160 @@
+"""Reap bare-shell scheduler sessions (#739).
+
+``_dispatch_worktree_task`` names every worktree branch
+``scheduler-<task>-<ts>``. If the session's launch crashes before the agent
+starts (e.g. the worktree directory went missing between ``agentwire new``
+reporting success and the pane's ``cd``), the tmux session drops to a bare
+shell — which the idle-reaper correctly never touches, since it only reaps a
+*running* agent that goes idle. Nothing else would ever clean that up, so it
+lingers indefinitely. This module finds and kills those sessions.
+
+Detected by branch naming rather than ``worktree_registry`` — scheduler
+dispatch goes through ``agentwire new``, which (unlike ``agentwire
+worktree``) never registers there.
+"""
+
+import subprocess
+import time
+
+from ..worktree import parse_session_name
+
+BRANCH_PREFIX = "scheduler-"
+
+# tmux `session_created` is whole seconds. A healthy launch's pre-agent shell
+# moment lasts well under a second (see `_launch_tmux_session`'s 0.1s
+# settle), but this gives a slow `claude` cold start real headroom before a
+# session still mid-launch could be mistaken for a zombie.
+MIN_AGE_SECONDS = 60
+
+_SHELL_COMMANDS = frozenset({"zsh", "bash", "sh", "fish", "tcsh", "csh", "dash"})
+
+
+def _is_bare_shell(command: str) -> bool:
+    """True if *command* (a ``pane_current_command`` value) is a login shell."""
+    return command.strip().lstrip("-") in _SHELL_COMMANDS
+
+
+def scan() -> list[dict]:
+    """Live scheduler-dispatched worktree sessions stuck at a bare shell.
+
+    Each entry: ``session``, ``branch``, ``command``, ``age_seconds``.
+    """
+    result = subprocess.run(
+        ["tmux", "list-sessions", "-F", "#{session_name}\t#{session_created}"],
+        capture_output=True, text=True,
+    )
+    if result.returncode != 0:
+        return []
+
+    now = time.time()
+    zombies = []
+    for line in result.stdout.strip().splitlines():
+        if "\t" not in line:
+            continue
+        session, created = line.split("\t", 1)
+        _, branch, machine = parse_session_name(session)
+        if machine or not branch or not branch.startswith(BRANCH_PREFIX):
+            continue
+        try:
+            age = now - float(created)
+        except ValueError:
+            continue
+        if age < MIN_AGE_SECONDS:
+            continue
+
+        panes = subprocess.run(
+            ["tmux", "list-panes", "-t", f"={session}", "-F", "#{pane_current_command}"],
+            capture_output=True, text=True,
+        )
+        if panes.returncode != 0:
+            continue
+        commands = [p for p in panes.stdout.strip().splitlines() if p]
+        if len(commands) == 1 and _is_bare_shell(commands[0]):
+            zombies.append({
+                "session": session, "branch": branch,
+                "command": commands[0], "age_seconds": int(age),
+            })
+    return zombies
+
+
+def _notify(session: str, branch: str, command: str) -> None:
+    """Alert on a reaped zombie session (#739 + #743).
+
+    Always posts a portal toast, so the reap is visible in-band rather than
+    only in an email the human has to notice and forward. When the session
+    has a recorded parent (``created_by`` in its metadata — set at
+    ``agentwire new`` time, see ``_record_session_creator``), the crash is
+    ALSO escalated there via the msg inbox (drained by the same watchdog that
+    runs this reap) — a worktree worker's crash reaches its orchestrator, not
+    just the owner's inbox. Owner email — the reused Resend wiring, mirrors
+    ``dispatch._notify_dispatch_timeout`` — is strictly the fallback for a
+    session with no recorded parent (the genuine root/scheduler-dispatch
+    case #739 originally covered). Each channel is independently
+    best-effort; this must never raise into the caller.
+    """
+    text = (
+        f"agentwire: reaped zombie scheduler session `{session}` (branch "
+        f"`{branch}`) — launch crashed at a bare shell (`{command}`) before "
+        "the agent started."
+    )
+
+    try:
+        from ..core import _post_desktop_notification
+        _post_desktop_notification(text, session=session, priority="high")
+    except Exception:
+        pass
+
+    parent = None
+    try:
+        from ..core import load_session_metadata
+        parent = load_session_metadata(session).get("created_by") or None
+    except Exception:
+        parent = None
+
+    if parent:
+        try:
+            from ..inbox import enqueue
+            enqueue(parent, text, kind="escalation", sender="agentwire")
+        except Exception:
+            pass
+        return
+
+    try:
+        import socket
+
+        from ..channels.email import send_email
+        send_email(
+            subject=f"[agentwire] reaped zombie scheduler session: {session}",
+            body=(
+                f"Scheduler dispatch session `{session}` (branch `{branch}`) "
+                f"on `{socket.gethostname()}` never reached its agent — the "
+                f"pane was stuck at a bare shell (`{command}`), the #739 "
+                "failure mode where the worktree launch crashes before "
+                "`claude` starts (e.g. a missing worktree directory). The "
+                "watchdog killed the session so it can't linger.\n\n"
+                "Check the scheduler events log for the originating "
+                "dispatch failure."
+            ),
+        )
+    except Exception:
+        pass
+
+
+def reap() -> dict:
+    """Kill every detected zombie session, logging + emailing each one."""
+    from agentwire import scheduler as _sched
+
+    killed = []
+    for z in scan():
+        _sched._kill_session(z["session"])
+        _sched._log_event("zombie_session_reaped", session=z["session"],
+                          branch=z["branch"], command=z["command"],
+                          age_seconds=z["age_seconds"])
+        _notify(z["session"], z["branch"], z["command"])
+        killed.append(z["session"])
+    return {"killed": killed}
+
+
+def tick() -> dict:
+    """Watchdog stage entry point — same ``{"killed": [...]}`` shape as ``reap()``."""
+    return reap()

{agentwire_dev-1.59.0 → agentwire_dev-1.61.0}/agentwire/server.py

@@ -387,10 +387,11 @@ class AgentWireServer(
         """Ensure the default-tier Moonshine shim subprocess is running.
 
         Delegates to the CLI (single source of truth): ``agentwire stt start``
-        is idempotent — ``cmd_stt_start`` early-returns if the ``agentwire-stt``
-        tmux session already exists, so a user-started shim is reused with no
-        port clash. The ~19s ONNX warm-up happens in that child process, never
-        on the portal's event loop. Mirrors ``autostart_custom_services``."""
+        is idempotent and health-aware — ``cmd_stt_start`` reuses the
+        ``agentwire-stt`` session only when it is actually serving, and reaps +
+        relaunches a dead-but-present one (#734), so a wedged shim self-heals on
+        the next ensure. The ~19s ONNX warm-up happens in that child process,
+        never on the portal's event loop. Mirrors ``autostart_custom_services``."""
         await asyncio.sleep(5)  # let the portal finish binding first
         try:
             success, result = await self.run_agentwire_cmd(["stt", "start"], json_output=False)
@@ -438,10 +439,11 @@ class AgentWireServer(
         """Ensure the default-tier Kokoro TTS shim subprocess is running.
 
         Delegates to the CLI (single source of truth): ``agentwire kokoro start``
-        is idempotent — ``cmd_kokoro_start`` early-returns if the
-        ``agentwire-kokoro`` tmux session already exists, so a user-started shim
-        is reused with no port clash. The ~200 MB download + ONNX warm-up
-        happens in that child process, never on the portal's event loop. Mirrors
+        is idempotent and health-aware — ``cmd_kokoro_start`` reuses the
+        ``agentwire-kokoro`` session only when it is actually serving, and reaps
+        + relaunches a dead-but-present one (#734), so a wedged shim self-heals
+        on the next ensure. The ~200 MB download + ONNX warm-up happens in that
+        child process, never on the portal's event loop. Mirrors
         ``ensure_managed_stt``."""
         await asyncio.sleep(5)  # let the portal finish binding first
         try: