* fix: fail send when killed session delivery is not confirmed
* fix(core): drop requireConfirmation throw that re-introduced duplicate-message bug
The PR's sendWithConfirmation added a throw when confirmation heuristics
did not flip within SEND_CONFIRMATION_ATTEMPTS on a restored session.
But runtimePlugin.sendMessage had already fired, so the throw bubbled up
to the lifecycle manager's catch-all, leaving lastCIFailureDispatchHash
(and its merge-conflict twin) unset. Next poll re-dispatched the same
message — exactly the duplicate-message bug that commit 77685a5 removed.
Real fix for #1074 is preserved: restoreForDelivery still throws when
waitForRestoredSession returns false, which happens before sendMessage
fires. Killed sessions that cannot be revived are still reported as
failures, with no duplicate-send risk.
- sendWithConfirmation no longer takes requireConfirmation; unconfirmed
delivery always returns (soft success).
- prepareSession returns Session (the tuple only existed to drive the
removed throw).
- send's retry predicate reverts to prepared.restoredAt === undefined
&& isRestorable(prepared).
- Adds regression test: restored session + sendMessage fires +
confirmation never flips → send() resolves.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* feat(cli): filter terminated sessions from ao session ls / ao status by default
Closes#1310. Terminated sessions (killed/terminated/done/merged/errored/cleanup,
plus lifecycle-driven terminal states) are now hidden from `ao session ls` and
`ao status` by default. A dim footer reports how many were hidden and how to
surface them. Pass `--include-terminated` to restore the full list.
JSON output wraps into `{ data: [...], meta: { hiddenTerminatedCount } }` on
both commands so text and machine-readable views tell the same story. This is a
breaking change for script consumers of `--json`; `--include-terminated` is the
escape hatch.
Orthogonal to `-a, --all` (orchestrator visibility, unchanged). Restore of
terminated sessions by id is unaffected — that path goes through `sm.get`, not
`sm.list`.
Docs (`SETUP.md`, `docs/CLI.md`) updated to match. Tests cover both the legacy
status branch and the canonical lifecycle branch of `isTerminalSession`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(cli): drop unused `lc` param in lifecycle-alive test case
ESLint's no-unused-vars rejects unprefixed unused args. The "alive — should
remain visible" branch of the new lifecycle-driven filter test in
`session.test.ts` took `lc` but never touched it. Switch to `()`. Matches the
equivalent case in `status.test.ts`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(core): preserve pr.state=merged when legacy metadata lacks pr= URL
Review blocker on PR #1340: a metadata file with `status=merged` but no `pr=`
URL was still showing as active in `ao session ls` / `ao status` by default.
Root cause: `synthesizePRState()` in lifecycle-state.ts short-circuited to
`{ state: "none" }` whenever no PR URL was present, ignoring the fact that the
legacy `status` column already encodes terminal truth. Once lifecycle was
synthesized as `session.state="idle"` + `pr.state="none"`, `deriveLegacyStatus`
returned `"idle"` and `isTerminalSession()` (lifecycle branch) returned false.
The new CLI filter then let the session through.
Fix: when legacy `status === "merged"` and no URL is available, synthesize
`pr.state="merged", reason="merged"` with `number: null, url: null`. The
terminal signal survives the flat-metadata → canonical-lifecycle round trip.
Also:
- Export `sessionFromMetadata` from the core barrel. CLI tests and external
consumers need it to round-trip metadata through the canonical lifecycle.
- Update CLI `buildSessionsFromDir` helpers to route through `sessionFromMetadata`
so mocked `sm.list()` reflects production reconstruction (the old shortcut
bypassed synthesis entirely and was the reason the bug slipped past the
original test suite).
- Add regression tests: one at the core level (`parseCanonicalLifecycle` for
merged-without-URL) and one integration-style test per CLI command asserting
the reviewer's exact repro produces the expected filtered output.
- One pre-existing test expectation updated: when metadata has `status=working`
and `pr=<url>`, the reconstructed status is `pr_open`, not `working`. That's
what production `sm.list()` has always returned; the test was previously
hiding behind the reconstruction shortcut.
Changeset bumped to include ao-core (patch).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(cli): route review-check helper through sessionFromMetadata
Last remaining test-fidelity shortcut flagged by codex on PR #1340. The
`buildSessionsFromDir` helper in review-check.test.ts fabricated Session
objects by hand, bypassing the canonical lifecycle reconstruction that
production `sm.list()` runs. Doesn't affect review-check's actual behavior
(which reads `session.metadata["pr"]` directly), but aligns this test with
the equivalent helpers in session.test.ts and status.test.ts so future
lifecycle changes don't silently skip this surface.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(core): auto-terminate sessions on PR merge (#1309)
When a session's PR was detected as merged, the session transitioned
to status "merged" but its tmux runtime, worktree, and metadata were
never cleaned up — leaving zombie tmux sessions and stale entries in
`ao status` / `ao session ls`. Users worked around this with an
external watchdog. Close the loop in AO itself.
Changes:
- `kill()` gains an optional `reason` and returns `KillResult`
(`cleaned` / `alreadyTerminated`), with short-circuit paths so
repeated calls on archived sessions are safe no-ops instead of
throwing `SessionNotFoundError`.
- New `LifecycleConfig` (`autoCleanupOnMerge: true` default,
`mergeCleanupIdleGraceMs: 5 min`) so operators can opt out when
they need merged worktrees preserved for inspection.
- `lifecycle-manager` runs `maybeAutoCleanupOnMerge` at the end of
each `checkSession`. Reactions and notifications observe the live
session first; cleanup runs last. If the agent is still `active` /
`waiting_input` / `blocked`, cleanup is deferred and retried on
the next poll until the agent idles or the grace window elapses
(prevents killing an agent mid-task).
- New `CanonicalSessionReason` / `CanonicalRuntimeReason` variants
(`pr_merged`, `auto_cleanup`) so observability distinguishes
automated teardown from manual kills.
Scope is deliberately narrow to `merged`: `done` / `errored` often
need the worktree preserved for debugging; `killed` would self-recurse.
Follows Codex review feedback (conditional pass): scope narrowed,
reactions-before-cleanup ordering, idleness safety gate, real
idempotency guards, config opt-in.
6 new unit tests cover: idle agent cleanup, active agent deferral,
grace-window force-cleanup, config opt-out, terminated/killed no
self-recursion, kill() failure retry.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor(core): clean up lifecycle config access per review
Address review comment on PR #1311. The `config.lifecycle` field is
typed optional but always populated by Zod — the old guard chain
(`if (lifecycleConfig && lifecycleConfig.autoCleanupOnMerge === false)`)
obscured that duality. Destructure with defaults at the call site so
the contract is visible in one place, and document why the field stays
optional (hand-constructed test configs) on the interface.
Matches the existing `power?: PowerConfig` pattern — keeps churn to
zero across 60 test config literals while removing the ambiguous guard.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(core): surface auto-cleanup-on-merge in config, docs, and UI
Followup to DX audit on #1311. The lifecycle cleanup behavior was
operational but invisible — config key only in TS types, no changeset
for downstream consumers, missing observability spec, and a dashboard
summary that actively contradicted the new default-on behavior.
- agent-orchestrator.yaml.example: add commented `lifecycle:` block
with both keys so operators discover the knob in the primary
config reference.
- .changeset/auto-cleanup-on-merge.md: minor bump for @aoagents/ao-core
with migration note (default-on, opt-out via config).
- docs/observability.md: document the three new lifecycle_poll
operations (merge_cleanup.completed / deferred / failed) so
dashboard/alert authors have a spec.
- packages/web/src/lib/serialize.ts: replace stale summary
"PR merged; worker is still available for a keep-or-kill decision"
with "PR merged; worker session will be cleaned up automatically".
The old copy is wrong under default-on auto-cleanup.
Deferred to follow-up issues:
- Health surface degradation on repeated cleanup failure (the
operator-facing gap Codex flagged — failures emit a metric but
don't downgrade /api/observability health).
- Dashboard "cleaning up in Nm" indicator for the deferred state.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(core,web): address PR review feedback for auto-cleanup on merge
- serialize.ts: only claim "will be cleaned up automatically" when
mergedPendingCleanupSince marker is present; otherwise show neutral
"PR merged". Avoids lying when autoCleanupOnMerge is opted out.
- lifecycle-manager.ts: use ACTIVITY_STATE constants instead of
hardcoded strings, matching the existing SESSION_STATUS.MERGED usage.
- config.ts: keep mergeCleanupIdleGraceMs=0 as a valid escape hatch
(immediate cleanup), but reject 1..9999 with a units-mistake error
so users typing `5` (intending seconds) get a clear message.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Follow-up to the first round of review comments:
- Guard `document.fonts` add/removeEventListener with feature detection.
Without the guard, environments where FontFaceSet doesn't expose
EventTarget (jsdom test mocks, older browsers) threw a TypeError
during xterm init and the terminal silently failed to attach.
- Update DirectTerminal.render.test.tsx mock so `document.fonts`
exposes addEventListener/removeEventListener stubs, restoring
happy-path coverage of the init code path.
- Export `resolveMonoFontFamily` and add unit tests covering:
CSS var present (prepended to fallback), CSS var absent
(fallback only), and the invariant that no `var(...)` token ever
leaks into the output.
- Clarify in the docblock why we read `--font-jetbrains-mono` and
deliberately avoid `--font-mono` (the latter re-wraps in `var(...)`
and would re-introduce the bug).
Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>
- Resolve --font-jetbrains-mono via getComputedStyle at runtime so
xterm honours the app's configured mono font token instead of a
hard-coded "JetBrains Mono" fallback. next/font generates a unique
family name (stored in the CSS custom property) that now gets fed
to xterm alongside the fallback stack.
- Re-resolve the font-family on `document.fonts` `loadingdone` so
xterm picks up the generated name once it registers.
- Change SessionDetail's DirectTerminal loading skeleton from a fixed
h-[440px] to h-full, so the terminal area stays viewport-sized
during the lazy-load window instead of locking to 440px.
Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>
The v5 -> v6 xterm.js upgrade regressed the in-browser terminal: each
cell rendered visibly wider and shorter than the glyph inside it,
making horizontal spacing too wide and vertical spacing too tight.
Root causes:
1. `fontFamily` contained `var(--font-jetbrains-mono)`. xterm's char
measurement ultimately hits canvas `ctx.font`, which cannot resolve
CSS custom properties. The var token poisoned the font string so
measurement fell back to a default font while DOM rows still rendered
in JetBrains Mono — cell width vs glyph width drifted apart.
2. xterm v6 defaults `lineHeight` to 1.0. Combined with JetBrains Mono's
tall x-height, rows visually collided.
3. `document.fonts.ready` can resolve before next/font's
`font-display: swap` actually paints JetBrains Mono, so the initial
`fit()` measures against the fallback font. xterm does not re-measure
when the swap later lands.
4. The fit-target div had `p-1.5` padding, skewing FitAddon's cols/rows
computation.
Fixes applied to `DirectTerminal.tsx`:
- Drop `var(...)` from `fontFamily`; use a plain font stack.
- Set `lineHeight: 1.2` to restore vertical breathing room.
- Add a `document.fonts` `loadingdone` listener that clears the
texture atlas and re-fits when the webfont swap completes. Cleaned
up in the effect teardown.
- Remove `p-1.5` from the terminal ref div.
Co-Authored-By: Claude Opus 4 <noreply@anthropic.com>
Fixes#1048. ao start used to allocate a fresh `{prefix}-orchestrator-N`
on every invocation instead of reattaching to the previous session, and
the dashboard's orchestrator link pointed at a different id than the
CLI just printed.
Changes:
runStartup (packages/cli/src/commands/start.ts):
- On startup, list existing orchestrators for the project, partition
them into live (runtime still running) and restorable (terminal but
sm.restore()-able) buckets, pick the most-recently-active from the
chosen bucket, and reuse/restore that id instead of spawning a new
one. Only spawn fresh when both buckets are empty.
- Live is preferred UNCONDITIONALLY over restorable — a newer killed
record can never beat an older-but-running one. Without this, a
cross-bucket sort could resurrect a killed record via sm.restore()
while the live orchestrator kept running, leaving two alive.
- Restored sessions get an explicit "(restored)" marker in the CLI
summary so the resurfaced id isn't a surprise.
- The phantom `${prefix}-orchestrator` id constant is removed from
every URL print, browser-open target, and summary line. Everything
now uses the real selected id.
registerStop (same file):
- ao stop now resolves the real orchestrator via sm.list(projectId)
+ isOrchestratorSession filter + most-recently-active sort, then
calls sm.kill on that id. The old phantom `${prefix}-orchestrator`
target never matched a real numbered record, so ao stop was a
silent no-op and the orchestrator kept running on disk between
start cycles. sm.list-failure warning no longer duplicates with the
generic "no orchestrator found" message.
isOrchestratorSession (packages/core/src/types.ts):
- Tightened: legacy bare-id records (`{projectId}-orchestrator` with
no role metadata) are no longer recognized as orchestrators by the
public predicate. This was the source of the dashboard/CLI id
divergence — stale bare records with a different prefix than the
numbered form were leaking into the dashboard's orchestrator list.
session-manager repair (packages/core/src/session-manager.ts):
- Split `isOrchestratorSessionRecord` (permissive, used by cleanup
protection) from a new `isRepairableOrchestratorRecord` (stricter,
used only by repairSingleSessionMetadataOnRead and
repairSessionMetadataOnRead).
- The strict repair predicate accepts role-stamped records, the bare
`{sessionPrefix}-orchestrator` correct-prefix legacy shape, and the
numbered `{sessionPrefix}-orchestrator-N` worktree shape. It
rejects foreign bare names like `{projectId}-orchestrator`, so
those records never get `role: orchestrator` backfilled on read
and therefore can no longer pass `isOrchestratorSession()` in real
`sm.list()` output via the role-metadata branch.
Tests added (~12):
- runStartup: live reuse, restore-on-killed, ignore-stale-bare
legacy records, live-beats-restorable regression, multi-live
reuse, URL fallback when --no-orchestrator.
- ao stop: kills the actual numbered id (not the phantom), handles
multiple orchestrators, tolerates sm.list throwing.
- isOrchestratorSession: rejects stale bare ids without role
metadata; accepts bare ids with role metadata stamped.
- listDashboardOrchestrators: stale bare excluded, numbered live
included, role-stamped legacy included.
- session-manager repair: does not backfill role onto foreign bare-id
records (issue #1048 regression guard).
Unblocks: review comments from cursor[bot] (dead else-if branch,
double messaging, redundant isTerminalSession check) and illegalcall
(cross-bucket sort, repair-backfill bypass of predicate tightening) —
all addressed in-place with the multi-orchestrator model preserved.
Verified: core 606/606, cli 450/450, typecheck clean across core/cli/web.
* feat(web): fix terminal height to fill viewport, prevent outside scrolling
* feat(web): add touch scroll, font size control, and accurate fit to DirectTerminal
* feat(web): add mobile sidebar overlay, hamburger toggle, and reconnect indicator
* feat(web): add hamburger and reconnect pill to topbar
* fix(web): use xterm instead of @xterm/xterm for terminal-touch-scroll import
Upstream uses xterm@5.3.0 (not @xterm/xterm), fix the type import accordingly.
* ci: make pnpm audit strict step non-blocking
npm's legacy audit endpoint (/npm/v1/security/audits) is returning 410 Gone
as it's being retired. Add continue-on-error until pnpm ships support for
the new bulk advisory endpoint.
* fix(web): replace TerminalLike with minimal interface compatible with xterm@5.3.0
xterm@5.3.0 does not have 'input' or 'attachCustomWheelEventHandler' methods
(those are @xterm/xterm v6 APIs). Define a minimal structural interface
matching only the members actually used in the file.
* fix(web): replace mobile back button with hamburger sidebar toggle on session page
On mobile, the session detail page now shows a hamburger button instead of a back arrow, which toggles the sidebar via SidebarContext. This provides better navigation consistency with the main dashboard.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): filter sidebar sessions strictly by projectId to prevent prefix collision
Sessions are now filtered to only show those whose projectId matches a configured project. This prevents sessions from different AO projects (e.g., 'ao-' and 'unl-' prefixes) from being incorrectly merged under the same project entry.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): add ResizeObserver and deferred fit to fix blank terminal on mount
The terminal now uses a 100ms deferred fit timeout to ensure the container has been sized before measuring. Additionally, a ResizeObserver monitors the terminal container and calls fit() whenever its size changes, ensuring the terminal refits when flex layouts settle.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): debounce session refresh to prevent aborting in-flight fetch calls
The useSessionEvents hook now tracks when the last fetch was started and skips scheduling a new refresh if one was started less than 500ms ago. This prevents aggressive AbortController usage that was canceling in-flight requests unnecessarily. Also avoid rescheduling if a debounce timer is already pending.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test(web): update SessionDetail mobile test for new sidebar toggle button
Update the test to expect the new "Toggle sidebar" aria-label instead of the previous "Back to dashboard" label on the mobile floating header.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): active session amber color, compact session meta row, tighter font controls
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): address review feedback — fontSize rerender, dead code, test cleanup
- DirectTerminal: remove fontSize from main init useEffect deps. A dedicated
effect below mutates terminal.options.fontSize in place; keeping it in the
init deps tore down and recreated the terminal (and WebSocket) on every
stepper click, losing scrollback and flashing content.
- Remove dead ReconnectingPill component — it rendered null with a placeholder
comment. Delete the file, import, and render site rather than leaving a shell.
- ProjectSidebar: make the done-filter consistent by using getAttentionLevel
in the sessionsByProject collector. Previously the collector filtered by the
narrow `status === "done"` while the render sites filtered by the broader
`getAttentionLevel(s) === "done"`, so the project badge count could include
merged/killed/terminated sessions that the rendered list hid.
- Drop the two gutted tests that tested JS primitives rather than the component
(layout-height.test.tsx, DirectTerminal.test.tsx). They provided false
coverage. Update ProjectSidebar.test.tsx for the new anchor-based session
rows (click behavior now queries role="link", and clicking the project
toggle expands rather than navigates — the separate dashboard button handles
navigation).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): make SessionDetail topbar tests pass after redesign
Reconcile the rebased-upstream tests with our redesigned SessionDetail:
Component:
- Show session.id in the topbar next to the headline. The ID is a stable
identifier (useful for copy/paste) while the headline changes with PR/
issue titles.
- Gate the topbar Orchestrator link on `!isOrchestrator` so we don't link
the orchestrator page to itself.
- Convert the PR popover toggle from a <button> to an <a href={pr.url}>.
Plain click still toggles the popover; ctrl/cmd-click opens the PR on
GitHub in a new tab. aria-label="PR #N" keeps the accessible name stable
regardless of the rendered chevron.
Tests:
- Mobile tests scope orchestrator link queries to the topbar via
within(getByRole("banner")) because MobileBottomNav also has an
"Orchestrator" entry.
- Desktop test opens the PR popover before asserting the PR detail
contents (blocker chips, file count, unresolved comments) — they now
live inside the popover rather than inline.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(web): restore behavioral tests + remove dead mobileOpen prop
Adds missing behavioral coverage the reviewer flagged on Dashboard.mobile.test.tsx:
- Termination confirmation flow: clicking the kill button once enters a
confirming state (aria-label becomes "Confirm terminate session") without
firing the kill request; a second click POSTs to /api/sessions/:id/kill.
- CI check chip rendering: SessionCard renders passing CI check names as chips
when the session has an enriched PR.
Removes the dead `mobileOpen` prop from ProjectSidebar:
- It was declared but immediately aliased as `_mobileOpen` and never used —
the actual mobile overlay state is driven by the `sidebar-wrapper--mobile-open`
class on the parent wrapper div in Dashboard/SessionDetail.
- PullRequestsPage was passing it too but never wired the wrapper class, so
its hamburger buttons were silently no-ops. Wrapped its sidebar in the same
sidebar-wrapper + backdrop pattern so the buckled hamburgers now actually
open the sidebar overlay on mobile.
Not in scope for this round (per reviewer): attention bucket filter /
MobileBottomNav on Dashboard — Dashboard doesn't implement those features,
so there's no behavior to assert. Those would need a feature add, not a test.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(core): listCached stale-data bug + drop inline styles in DirectTerminal
Addresses the reviewer's critical and minor feedback on PR #1278.
Critical — listCached was stale across mutation paths
listCached() had a 35s TTL, invalidated only by spawn() and kill().
Every other metadata-writing path (claimPR, restore, send, remap,
cleanup, lifecycle-manager's direct updateMetadata calls for PR
detection and state transitions) left stale data visible to
/api/sessions for up to 35s.
Fix:
- Wrap updateMetadata / writeMetadata / deleteMetadata inside
createSessionManager() so every in-file mutation auto-invalidates
the cache. The raw imports are aliased as _rawXxx and only used
by the wrappers. No call site needs to remember to invalidate.
- Expose invalidateCache() on the SessionManager interface for
callers that write metadata outside this module.
- lifecycle-manager.ts: call sessionManager.invalidateCache() after
its two direct updateMetadata sites (PR detection, state update)
so polling-driven mutations are visible on the next poll.
- Move the _cache / invalidateCache declarations to the top of the
closure so the mutation wrappers can reference them.
- Update createMockSessionManager + api-routes.test.ts mocks to
satisfy the expanded interface.
- New regression test: external mutation + sm.invalidateCache() →
next listCached() re-reads disk.
C-02 — inline styles on the terminal-container div
DirectTerminal.tsx was using style={{ overflow, display,
flexDirection, flex, minHeight }} — all static values moved to
Tailwind utilities: "w-full p-1.5 flex flex-col flex-1 min-h-0
overflow-hidden".
Not addressed in this commit (noted as out-of-scope refactor):
C-04 400-line cap on DirectTerminal.tsx. Splitting fontSizeControls
and touch-scroll wiring into sub-components is worthwhile but
mechanical — separate PR.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
The shared gh wrapper now extracts PR URLs with a regex instead of embedding a literal github URL, so the old codex assertion was stale and broke CI on PR #1300.
Record that the remaining lifecycle-state review regressions were fixed in this follow-up branch so the changeset summary matches the actual scope of the patch.
Fix legacy merged-session rehydration so merged PRs stay non-restorable after v2 synthesis. Also validate canonical lifecycle payloads before normalizing them so malformed statePayload data falls back to synthesized metadata instead of corrupting lifecycle state.
Harshit Singh Bhandari
Dhruv Sharma
Ashish Huddar
yyovil
Harsh Batheja
fastestdevalive
Harshit Singh Bhandari