ctrlrelay 0.12.2__tar.gz → 0.13.0__tar.gz

{ctrlrelay-0.12.2 → ctrlrelay-0.13.0}/CHANGELOG.md

@@ -7,6 +7,88 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.13.0] - 2026-10-30
+
+New database columns and one new config value. All of them are added
+automatically and have defaults, so **no config edit is required**.
+
+### Added
+
+- A re-asked question says so: "Repeat: asked N times before, last on
+  <date> UTC, no answer yet" (#213, closes #200)
+- Finished questions older than 90 days are pruned from `pending_resumes`.
+  Open ones are always kept. New config value `question_retention_days`,
+  default 90 (#213, closes #200)
+
+### Changed
+
+- The scheduled secops sweep holds back a question nobody answered, posting it again after 1, 2, 4, then 7 days (#215, closes #214)
+- A reply to an earlier post of a question whose session expired unanswered goes to the newest open session asking the same thing in that repo, instead of being refused (#215, closes #214)
+- The relay-health alert is sent in the background instead of while the per-repository lock is held, so a stuck chat bridge no longer slows down every repo in a sweep (#212, closes #208)
+
+### Fixed
+
+- A state file path with an apostrophe, a trailing newline in a folder name, or a leading dash broke every checkpoint snippet, so the agent looked crashed (#211, closes #191)
+- A secops repo that failed after its result was recorded no longer adds a second result, which paired every later repo's notification with its neighbour's result (#215)
+
+## [0.12.4] - 2026-10-18
+
+Carries 0.12.3's entries too: v0.12.3 was never tagged, so nothing has
+shipped since v0.12.2 and this is the first release to reach a running
+daemon with any of it.
+
+### Fixed
+
+- Reconcile the claim comment with a failed dispatch, alert on a run of
+  failures, and keep the exit code and the worker's output (#206, closes
+  #204)
+
+  The dev lane posted *"a PR will be opened for review"* before the
+  worker started and never returned to the issue when the worker
+  exited non-zero, so that sentence stood on a beta tester's own ticket
+  for eighteen hours. Separately, 163 consecutive failed dispatches over
+  two days told nobody while both units stayed `active (running)`.
+  Separately again, `sessions.claude_exit_code` was never written on the
+  failure path and no worker output was retained, so the only durable
+  evidence of why they failed was that each took about two seconds.
+
+  New: `sessions.output_tail`, the `dispatch_health` table, and an
+  `alerts` config block (`alerts.enabled`,
+  `alerts.consecutive_dispatch_failures`, default 3). All additive and
+  defaulted — no config edit is needed.
+
+  **Known limits**, stated because they are decisions rather than
+  oversights: the relay-health alert is awaited inside the dispatcher,
+  so it can hold the per-repo lock for up to ~15 s against a wedged
+  bridge; delivery is at-least-once, so an alert that is sent but whose
+  delivery cannot be recorded may be sent once more; and the output
+  scrubber removes known credential shapes, which is not a proof that
+  nothing sensitive remains. A numeric value under a credential key is
+  kept, because treating every number as a possible secret destroyed the
+  token counts in an API error.
+
+### Added
+
+- Announce a pull request whose review could not run (#202, closes #196)
+
+### Fixed (0.12.3, never released)
+
+- Resolve the reviewer binary before exec, and ship a unit PATH that finds
+  it (#201, closes #197)
+- Resolve the notification transport at use, not at boot (#199, closes #198)
+
+## [0.12.3] - 2026-10-12
+
+### Added
+
+- Announce a pull request whose review could not run (#202, closes #196)
+
+### Fixed
+
+- Resolve the reviewer binary before exec, and ship a unit PATH that finds
+  it (#201, closes #197)
+- Resolve the notification transport at use, not at boot (#199, closes #198)
+
 ## [0.12.2] - 2026-10-06
 
 ### Fixed
@@ -1689,7 +1771,10 @@ pipeline).
   per-phase implementation plans (Phase 0 through Phase 4).
 - `docs/Claude_Code_Project_Guide.md` — project development guide.
 
-[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.2...HEAD
+[Unreleased]: https://github.com/AInvirion/ctrlrelay/compare/v0.13.0...HEAD
+[0.13.0]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.4...v0.13.0
+[0.12.4]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.2...v0.12.4
+[0.12.3]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.2...v0.12.3
 [0.12.2]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.1...v0.12.2
 [0.12.1]: https://github.com/AInvirion/ctrlrelay/compare/v0.12.0...v0.12.1
 [0.12.0]: https://github.com/AInvirion/ctrlrelay/compare/v0.11.3...v0.12.0

{ctrlrelay-0.12.2 → ctrlrelay-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ctrlrelay
-Version: 0.12.2
+Version: 0.13.0
 Summary: Local-first orchestrator for headless coding agents across multiple GitHub repos
 Project-URL: Homepage, https://github.com/AInvirion/ctrlrelay
 Project-URL: Documentation, https://ainvirion.github.io/ctrlrelay/

{ctrlrelay-0.12.2 → ctrlrelay-0.13.0}/config/orchestrator.yaml.example

@@ -76,6 +76,9 @@ transport:
     # Read from whichever transport is active, so a Mattermost deployment
     # takes this value and not the telegram block's.
     question_ttl_seconds: 172800
+    # How long a finished (expired or resumed) question is kept before it
+    # is deleted. Open questions are never deleted.
+    question_retention_days: 90
   file_mock:
     inbox: "~/.ctrlrelay/inbox.txt"
     outbox: "~/.ctrlrelay/outbox.txt"

{ctrlrelay-0.12.2 → ctrlrelay-0.13.0}/docs/bridge.md

@@ -245,6 +245,38 @@ exists. Messages it sends:
 - `✅ PR ready: ...` — pipeline finished green.
 - `❌ Failed on #123: ...` — pipeline failed.
 
+**A question asked again is marked.** A scheduled sweep starts a fresh
+session each day and the agent often reaches the same blocker and asks
+again, in new words. When that happens the post carries a line such as
+`Repeat: asked 3 times before, last on Oct 28 UTC, no answer yet.` Two
+questions count as the same if they cite at least one PR or issue number
+in common (or, when neither cites a number, have the same text). The
+count runs from the last answer to that question, including an answer
+on a row a later re-block rewrote (rows rewritten before this was kept
+can still count too high). The history this reads is kept for
+`question_retention_days`.
+
+**A question nobody answers is asked less often.** On the scheduled
+secops sweep, each earlier post of the same question that got no answer
+counts as a miss: one that expired on `question_ttl_seconds`, or one
+still open and more than 6 hours old (one closed as resolved elsewhere
+does not count, and neither does one that never reached the chat
+because the bridge was down, the post failed, or the bridge never
+confirmed it). After one miss the next post waits 1 day from the last
+post, after two 2 days, after three 4 days, then once a week, so a daily
+sweep posts it on days 0, 1, 3, 7, 14, 21. An answer to any post of it
+resets the count. A held question is not posted and
+gets no `blocked on <repo>` message; the sweep summary lists it with its
+session id and the time it is next due, and the poller logs
+`secops.question.held`. The session still ends blocked with its row
+saved, so it stays answerable and expires on the TTL like any unanswered
+question. To answer it, name its session in a message, or reply to the
+earlier post: while that post's own session is still open the reply
+answers that session; once it has expired without an answer, the reply
+goes to the newest open session asking the same thing in that repo, and
+the confirmation says so. A manual
+`ctrlrelay run secops` never holds a question back.
+
 For the full BLOCKED → answer → resume mechanics, see
 [Feedback loop]({{ '/feedback-loop/' | relative_url }}).
 

{ctrlrelay-0.12.2 → ctrlrelay-0.13.0}/docs/configuration.md

@@ -147,6 +147,7 @@ reach anybody.
 | `socket_path` | path | `"~/.ctrlrelay/ctrlrelay.sock"` | Unix socket path the bridge listens on. Pipelines connect to this socket as clients. |
 | `ask_timeout_seconds` | int | `900` | How long a pipeline blocks waiting on your reply in-session. Minimum `60`. A reply arriving later still works: the question is persisted to `pending_resumes` and the every-minute sweeper drives the resume. |
 | `question_ttl_seconds` | int | `172800` (48h) | How long an **unanswered** question stays routable before it is retired. Minimum `3600`. Without a ceiling those rows never die — a question whose PR was merged by hand weeks ago stays a live target for an orphan reply. The hourly `question_expiry_sweeper` also retires a question early once every issue/PR it cites is closed or merged. |
+| `question_retention_days` | int | `90` | How long a **finished** question (expired, or answered and resumed) is kept before the hourly sweeper deletes it. Minimum `1`. Open questions are never deleted. The kept history is what lets a re-asked question be marked as a repeat. |
 
 See [Telegram bridge]({{ '/bridge/' | relative_url }}) for the full setup walkthrough.
 
@@ -160,6 +161,7 @@ See [Telegram bridge]({{ '/bridge/' | relative_url }}) for the full setup walkth
 | `socket_path` | path | `"~/.ctrlrelay/ctrlrelay.sock"` | Unix socket path the bridge listens on. Pipelines connect to this socket as clients. |
 | `ask_timeout_seconds` | int | `900` | Same meaning as the Telegram key above: it bounds only the in-session wait, and a later reply still resolves through `pending_resumes`. |
 | `question_ttl_seconds` | int | `172800` (48h) | Same meaning as the Telegram key above. |
+| `question_retention_days` | int | `90` | Same meaning as the Telegram key above. |
 
 **The bot must be a member of that channel.** A bot without `post:all` cannot
 post where it is not a member — and, the part that is easy to miss, it does not

{ctrlrelay-0.12.2 → ctrlrelay-0.13.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ctrlrelay"
-version = "0.12.2"
+version = "0.13.0"
 description = "Local-first orchestrator for headless coding agents across multiple GitHub repos"
 readme = "README.md"
 requires-python = ">=3.12"

{ctrlrelay-0.12.2 → ctrlrelay-0.13.0}/src/ctrlrelay/bridge/server.py

@@ -21,6 +21,11 @@ from ctrlrelay.bridge.protocol import (
     serialize_message,
 )
 from ctrlrelay.core.obs import get_logger, hash_text, log_event
+from ctrlrelay.core.question_expiry import (
+    find_repeat_history,
+    format_repeat_note,
+    same_substance,
+)
 
 if TYPE_CHECKING:
     from ctrlrelay.bridge.handler import ChatHandler
@@ -197,6 +202,7 @@ def format_question(
     repo: str | None = None,
     session_id: str | None = None,
     issue_number: int | None = None,
+    repeat_note: str | None = None,
 ) -> str:
     """Prefix an agent question with the repo and session it belongs to.
 
@@ -211,6 +217,12 @@ def format_question(
     Plain text on purpose — no handler sets a markup mode, so any Markdown
     here would reach a Telegram operator as literal backticks. Mattermost
     renders it, which is a difference the question text must not depend on.
+
+    ``repeat_note`` says this question was asked before, with no
+    answer since the last time it was answered (if it ever was). It
+    goes straight under the repo line, ahead of everything else,
+    because a reader skimming a channel decides from the first lines
+    whether a message is new.
     """
     header: list[str] = []
     if repo:
@@ -218,6 +230,8 @@ def format_question(
         if issue_number is not None:
             line += f" issue #{issue_number}"
         header.append(line)
+    if repeat_note:
+        header.append(repeat_note)
     if session_id:
         header.append(f"session: {session_id}")
     if not header:
@@ -436,8 +450,20 @@ class BridgeServer:
             return BridgeMessage(op=BridgeOp.PONG)
 
         if msg.op == BridgeOp.SEND:
+            text = msg.text or ""
+            # The secops sweep's "blocked on <repo>" fan-out is the second
+            # time the operator sees the question, so it carries the same
+            # repeat line the ASK did. Only a SEND naming a session can be
+            # that message; anything else is posted as given.
+            if msg.session_id and msg.repo:
+                note = self._repeat_note_for_session(msg.repo, msg.session_id)
+                if note and text:
+                    first, sep, rest = text.partition("\n")
+                    text = f"{first}\n{note}{sep}{rest}"
+                elif note:
+                    text = note
             try:
-                post_id = await self.handler.send(msg.text or "")
+                post_id = await self.handler.send(text)
                 # A SEND that names a session is answerable too: the secops
                 # sweep fans out one "blocked on <repo>" message per repo
                 # after the run, and that message is the most recent — and
@@ -478,6 +504,10 @@ class BridgeServer:
                 "question_hash": hash_text(question),
                 "options": msg.options,
             }
+            repeat_note = self._repeat_note(
+                msg.repo, question, msg.session_id
+            )
+            post_fields["repeat"] = repeat_note is not None
             try:
                 # Start the expiry clock before the chat round trip, not
                 # after it: the client began counting when it wrote the ASK
@@ -493,6 +523,7 @@ class BridgeServer:
                         repo=msg.repo,
                         session_id=msg.session_id,
                         issue_number=msg.issue_number,
+                        repeat_note=repeat_note,
                     ),
                     options=msg.options,
                 )
@@ -569,6 +600,79 @@ class BridgeServer:
 
         return None
 
+    def _repeat_note(
+        self,
+        repo: str | None,
+        question: str,
+        session_id: str | None,
+    ) -> str | None:
+        """The "asked N times before" line for a question about to be
+        posted, or None when it is new or there is nothing to look in.
+
+        Anything that goes wrong, in the lookup OR in rendering the line
+        (a corrupt or millisecond ``created_at`` makes the date raise),
+        posts the question without the line and logs that it could not
+        tell. The question reaching the operator matters more than the
+        note on it; the log is what separates "first time asked" from
+        "could not check".
+        """
+        if self.state_db is None or not repo:
+            return None
+        try:
+            history = find_repeat_history(
+                self.state_db,
+                repo=repo,
+                question=question,
+                exclude_session_id=session_id,
+            )
+            return format_repeat_note(history) if history else None
+        except Exception as e:
+            log_event(
+                _logger,
+                "bridge.repeat_lookup_failed",
+                session_id=session_id,
+                repo=repo,
+                error_type=type(e).__name__,
+                error=str(e)[:200],
+            )
+            return None
+
+    def _repeat_note_for_session(
+        self, repo: str, session_id: str,
+    ) -> str | None:
+        """Repeat line for a SEND that names a session: the question is
+        read back from that session's persisted row.
+
+        Only while that row is an open question. Today the one SEND
+        carrying a session is the secops "blocked on <repo>" fan-out,
+        but a session id on a SEND exists to make a message answerable,
+        and an "answer applied" or "expired" notice that gains one later
+        must not be told the question is still waiting. Today that holds
+        because the fan-out is the only SEND with a session and a repo;
+        the open-row check is what keeps it true if that changes."""
+        if self.state_db is None:
+            return None
+        try:
+            row = self.state_db.get_pending_resume(session_id)
+            if (
+                row is None
+                or row["answered_at"] is not None
+                or row["expired_at"] is not None
+            ):
+                return None
+            question = row["question"]
+        except Exception as e:
+            log_event(
+                _logger,
+                "bridge.repeat_lookup_failed",
+                session_id=session_id,
+                repo=repo,
+                error_type=type(e).__name__,
+                error=str(e)[:200],
+            )
+            return None
+        return self._repeat_note(repo, question, session_id)
+
     def _error_code(self, unknown: bool) -> str:
         """The ERROR frame's ``error`` field for a failed post.
 
@@ -757,10 +861,18 @@ class BridgeServer:
         )
         if outcome["status"] == "queued":
             row = outcome["row"]
+            redirected = (
+                f"The message you replied to was an earlier ask of the "
+                f"same question; its session "
+                f"`{outcome['redirected_from']}` had expired.\n"
+                if outcome.get("redirected_from")
+                else ""
+            )
             await self._send_notice(
                 "✅ Answer queued for BLOCKED session "
                 f"`{row['session_id']}` "
                 f"(pipeline={row['pipeline']}, repo={row['repo']}).\n"
+                f"{redirected}"
                 "The pending-resume sweeper will drive it on the next "
                 "tick — you'll get another message with the result."
             )
@@ -922,8 +1034,10 @@ class BridgeServer:
         2. ``session_id`` was given and does NOT name an unanswered row.
            The operator pointed at something specific, so the only other
            pointer we accept is an equally explicit one: a session_id
-           written in the reply text. Failing that we stop at
-           ``"stale_hint"`` and route nothing.
+           written in the reply text, or (#214) the same question open
+           on a newer session in the same repo, when the row pointed at
+           expired unanswered. Failing that we stop at ``"stale_hint"``
+           and route nothing.
         3. No ``session_id`` at all: the reply text contains exactly one
            unanswered session_id as a substring — route there.
         4. No ``session_id`` at all and exactly one unanswered row exists —
@@ -974,6 +1088,28 @@ class BridgeServer:
                 return await self._attach_orphan_answer(named[0], text)
             if len(named) > 1:
                 return {"status": "ambiguous", "rows": named}
+            # The post they replied to expired, but the same question
+            # may be open on a newer session: the next sweep asked it
+            # again, or held it back as a repeat and left the earlier
+            # post as the only one on screen (#214). That open row is
+            # what the operator is answering.
+            newer = self._newest_open_repeat(session_id, rows)
+            if newer is not None:
+                outcome = await self._attach_orphan_answer(newer, text)
+                if outcome["status"] == "queued":
+                    log_event(
+                        _logger,
+                        "bridge.reply.redirected",
+                        from_session_id=session_id,
+                        to_session_id=newer["session_id"],
+                        repo=newer["repo"],
+                    )
+                    return {**outcome, "redirected_from": session_id}
+                # The newer row stopped taking answers between the two
+                # reads (answered by another reply, or expired). That
+                # row is what this reply was for, so say what happened
+                # to IT, not that the older post expired.
+                return self._describe_stale_hint(newer["session_id"])
             return self._describe_stale_hint(session_id)
 
         matched_by_id = [r for r in rows if names_session(text, r["session_id"])]
@@ -999,6 +1135,48 @@ class BridgeServer:
 
         return await self._attach_orphan_answer(target, text)
 
+    def _newest_open_repeat(
+        self, session_id: str, open_rows: list[dict],
+    ) -> dict | None:
+        """The newest open row asking the same thing as ``session_id``'s
+        EXPIRED question in the same repo, or None.
+
+        Only an expired, unanswered row redirects. An answered one keeps
+        refusing: the operator already answered that question, and a
+        second reply to it is not an answer to the next one. A pruned
+        row has no question left to compare, so it keeps refusing too.
+
+        A failed lookup returns None, which keeps the refusal that was
+        the behaviour before this existed, and is logged.
+        """
+        assert self.state_db is not None
+        try:
+            old = self.state_db.get_pending_resume(session_id)
+            if (
+                old is None
+                or old["answered_at"] is not None
+                or old["expired_at"] is None
+            ):
+                return None
+            same = [
+                r for r in open_rows
+                if r["session_id"] != session_id
+                and r["repo"] == old["repo"]
+                and same_substance(old["question"], r["question"])
+            ]
+        except Exception as e:
+            log_event(
+                _logger,
+                "bridge.reply.redirect_lookup_failed",
+                session_id=session_id,
+                reason=type(e).__name__,
+                error=str(e)[:200],
+            )
+            return None
+        if not same:
+            return None
+        return max(same, key=lambda r: int(r["created_at"]))
+
     def _describe_stale_hint(self, session_id: str) -> dict:
         """Say WHY a resolved reply-to cannot take an answer.