fix(reset): refuse id-less claude/grok targets, gate submit during a reset, validate the spec (#78)
Review round 1 of PR #82: - A running claude/grok row without a recorded id is refused by the precheck (stop would fill it with a folder-wide guess the purge then deletes); record-id never records a pre-assigned guess, and a target is skipped (id_unverified) when the row's id after the normal stop is not the one recorded before it. - reset takes the update admission lock exclusively while it publishes .mam/loop-guard-active and .mam/reset-in-progress; delegate submit refuses on a live reset marker (mam_reset_admit). Before each target's stop its open jobs are re-read (skipped as open_job, never cancelled), and a row whose agent/server no longer matches the spec is skipped. - read_spec validates every stored field (herdr_server required, never defaulted) and rejects duplicate names. - Signal tests wait 60 s for the kill-session gate (this Mac needs ~18 s). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
GodopuandClaude Opus 5.5 committed
1 parent
f90a705316
commit
5c3c2eb861
6 files changed
+529
-62
No files matched your search
@@ -20,13 +20,13 @@ bash .agents/skills/multi-agent-mux-reset/scripts/reset.sh --yes [--dry-run]
|
||||
|
||||
| Item | Behaviour |
|
||||
|---|---|
|
||||
| Targets | Every registry row with `status: running` and `realpath(pane.cwd) == realpath(WS)`. Worktree rows, `stopped`/`terminated` rows, and `orchestrator_uuids` are skipped and listed with their reason. |
|
||||
| Targets | Every registry row with `status: running` and `realpath(pane.cwd) == realpath(WS)`. Rows with any other status, worktree rows, and `orchestrator_uuids` are skipped and listed with their reason. |
|
||||
| Confirmation | `[y/N]` prompt; without a terminal `-y`/`--yes` is required (exits `3` otherwise). `--dry-run` inspects without `--yes` and changes nothing. |
|
||||
| Prechecks | Refuses before any change when an open job exists (prints the `registry.py ... close --request cancelled` command), when `.mam/loop-guard-active` or `.mam/update-in-progress` is held, when a target row lacks a valid agent or role, or when the caller itself is one of the targets. |
|
||||
| Lock & concurrency | Takes update admission (`mam_update_admit`), acquires `.mam/loop-guard-active` (`mam_acquire_loop_lock`), then releases update admission so `run_loop.sh`, `update.sh`, and concurrent resets refuse while the reset runs. |
|
||||
| Prechecks | Refuses before any change when an open job exists (prints the `registry.py ... close --request cancelled` command), when `.mam/loop-guard-active` or `.mam/update-in-progress` is held, when a target row lacks a valid agent or role, when a running `claude`/`grok` target has no recorded conversation id (the monitor had not pinned one; record it, or stop/purge it by hand first), when `.mam/reset-spec.json` is invalid, or when the caller itself is one of the targets. |
|
||||
| Lock & concurrency | Takes the update admission lock exclusively, acquires `.mam/loop-guard-active` and publishes `.mam/reset-in-progress`, then releases the admission lock and runs the prechecks. `run_loop.sh`, `update.sh` and another reset refuse on the loop marker; `multi-agent-mux-delegate-job submit` refuses on the reset marker. |
|
||||
| Spec file & rerun | Writes `.mam/reset-spec.json` atomically before the first stop/purge and removes it only when all targets reach `done`. Rerunning resumes from the spec file without re-purging already recreated agents (`created` or `done`). |
|
||||
| Sequence per target | Sequential (never parallel): ① normal `stop_session.sh --reason reset` (captures verified ID onto the row while herdr is live and sets `status: stopped`), ② checks that the row has a recorded conversation ID, ③ `stop_session.sh --reason reset --purge-conversation --yes` (using the row's recorded ID, never a CLI UUID), then `create_session.sh` with the original name, agent, role, `--herdr-session`, and `--herdr-workspace` (onboarding enabled by default). |
|
||||
| When skipped (exit 4) | If step ② finds no recorded ID or step ③ exits `4` (in-use gate), the target is skipped and the reset continues to the next agent: the skipped agent is stopped but resumable (its row keeps its id) and its conversation files are untouched; rerun once its holders end, or resume it. |
|
||||
| Sequence per target | Sequential (never parallel): ⓪ re-checks that its row still has the spec's agent and herdr server and that no job addressed to it is open, ① normal `stop_session.sh --reason reset` (a post-discovered agent's id is captured onto the row while herdr is live; `status: stopped`), ② checks that the row's id is the one recorded before the stop, ③ `stop_session.sh --reason reset --purge-conversation --yes` (using the row's recorded ID, never a CLI UUID), then `create_session.sh` with the original name, agent, role, `--herdr-session`, and `--herdr-workspace` (onboarding enabled by default). |
|
||||
| When skipped (exit 4) | The target is skipped and the reset continues to the next agent when step ⓪ finds a changed row (`row changed`) or an open job (`job open`) - nothing was changed for it -, or when step ② finds no id (`no conversation id recorded`) or an id other than the recorded one (`id not verified`), or step ③ exits `4` (`purge refused`, in-use gate) - it is stopped but resumable (its row keeps its id) and its conversation files are untouched. Rerun once the cause is gone, or resume it. |
|
||||
|
||||
| Exit | Meaning |
|
||||
|---|---|
|
||||
@@ -34,9 +34,9 @@ bash .agents/skills/multi-agent-mux-reset/scripts/reset.sh --yes [--dry-run]
|
||||
| 1 | Refused by precheck (nothing changed), corrupt/mismatched `.mam/reset-spec.json`, or a `stop`/`create` step failed (`.mam/reset-spec.json` is kept so rerunning resumes) |
|
||||
| 2 | Invalid arguments |
|
||||
| 3 | Not a terminal and `-y`/`--yes` was not passed; nothing was changed |
|
||||
| 4 | Completed the pass, but one or more agents were skipped (purge refused with stop exit 4, or no conversation ID recorded); `.mam/reset-spec.json` is kept for rerun |
|
||||
| 4 | Completed the pass, but one or more agents were skipped (see *When skipped*); `.mam/reset-spec.json` is kept for rerun |
|
||||
| 5 | No agent was skipped or failed, but one or more newly created post-discovered agents do not have their new conversation ID recorded yet; `.mam/reset-spec.json` is kept so rerunning re-checks without re-purging |
|
||||
| other | Under `set -e`, an unexpected sub-step failure passes its nonzero exit code through |
|
||||
| other | 130 / 143 / 129 when interrupted by SIGINT / SIGTERM / SIGHUP (the in-flight stop/create ends first, nothing further runs, `.mam/reset-spec.json` is kept); otherwise, under `set -e`, an unexpected internal step failure passes its nonzero exit code through |
|
||||
|
||||
## Safety Notes
|
||||
|
||||
@@ -44,5 +44,5 @@ bash .agents/skills/multi-agent-mux-reset/scripts/reset.sh --yes [--dry-run]
|
||||
- **No external process termination**: processes holding conversation files open (reported via `lsof` in `in_use_hints`) are never signalled by MAM; end them yourself when safe, then rerun.
|
||||
- **Shared stores preserved**: Grok's shared `memory-v2.db` is left intact during purge; only session rows and per-session files are removed.
|
||||
- **Orchestrator hook during reset**: while `.mam/loop-guard-active` is held by the reset, the AGY orchestrator's direct file-edit hook (`loop_delegation_guard.sh`) blocks direct edits until the reset finishes.
|
||||
- **Post-precheck job submissions**: `multi-agent-mux-delegate-job submit` does not check `.mam/loop-guard-active`; do not submit new jobs to resident agents while a reset is running.
|
||||
- **Job submissions during a reset**: `multi-agent-mux-delegate-job submit` refuses with `a reset of <WS> is in progress` until the reset ends; submit again afterwards. A job registered for a target by other means after the precheck makes that target `job open` (skipped, not cancelled).
|
||||
- **Same-type post-discovered ordering**: when resetting multiple post-discovered agents of the same type, the second `create_session.sh` waits up to `MAM_ID_ORDER_WAIT_S` for the first agent's ID to be recorded; if it times out, rerun the reset once the ID is recorded.
|
||||
@@ -42,6 +42,7 @@ fi
|
||||
|
||||
MAM="$WS/.mam"
|
||||
MARKER="${MAM_LOOP_MARKER:-$MAM/loop-guard-active}"
|
||||
RESET_MARKER="$MAM/reset-in-progress"
|
||||
SPEC_FILE="$MAM/reset-spec.json"
|
||||
|
||||
# shellcheck disable=SC1091
|
||||
@@ -82,26 +83,38 @@ fi
|
||||
source "$WS/.agents/skills/lib.sh"
|
||||
PY="$(_delegate_py_bin)"
|
||||
|
||||
mam_update_admit "$WS" || exit 1
|
||||
_refuse_locked() {
|
||||
exec 7>&-
|
||||
echo "ERROR: reset refused; nothing was changed:" >&2
|
||||
echo " - $1" >&2
|
||||
exit 1
|
||||
}
|
||||
# The update admission lock is taken exclusively, as update.sh does, while the
|
||||
# reset publishes its markers: a delegate submit admitted earlier has written
|
||||
# its job record (the precheck below sees it), and one admitted later sees
|
||||
# .mam/reset-in-progress and refuses.
|
||||
mkdir -p "$MAM"
|
||||
exec 7>>"$MAM/update-admission.lock"
|
||||
case "$("$PY" -m lib_py.pane_lock acquire --fd 7 --wait-env MAM_UPDATE_ADMISSION_WAIT_S)" in
|
||||
locked) ;;
|
||||
timeout) _refuse_locked "a create, resume, loop, delegate submit, stop or orc-onboard kept the admission lock past MAM_UPDATE_ADMISSION_WAIT_S; try again" ;;
|
||||
*) _refuse_locked "the admission lock $MAM/update-admission.lock could not be decided (lib_py.pane_lock)" ;;
|
||||
esac
|
||||
if [ -f "$MAM/update-in-progress" ]; then
|
||||
upd_st="$(_mam_lock_holder_state "$MAM/update-in-progress")"
|
||||
if [ "$upd_st" != "stale" ]; then
|
||||
_refuse_locked "an update of $WS is in progress (pid $(_mam_lock_field "$MAM/update-in-progress" pid), holder $upd_st); wait for it to finish"
|
||||
fi
|
||||
fi
|
||||
_acquire_rc=0
|
||||
mam_acquire_loop_lock "$MARKER" || _acquire_rc=$?
|
||||
case "$_acquire_rc" in
|
||||
0) ;;
|
||||
3)
|
||||
mam_update_admit_release
|
||||
_holder_pid="$(_mam_lock_field "$MARKER" "pid" 2>/dev/null || echo "unknown")"
|
||||
echo "ERROR: reset refused; nothing was changed:" >&2
|
||||
echo " - a review loop or another reset is running (pid $_holder_pid); wait for it to end" >&2
|
||||
exit 1
|
||||
;;
|
||||
*)
|
||||
mam_update_admit_release
|
||||
echo "ERROR: reset refused; nothing was changed:" >&2
|
||||
echo " - cannot determine whether a review loop or another reset is running (ps unavailable?)" >&2
|
||||
exit 1
|
||||
;;
|
||||
3) _refuse_locked "a review loop or another reset is running (pid $(_mam_lock_field "$MARKER" "pid" 2>/dev/null || echo "unknown")); wait for it to end" ;;
|
||||
*) _refuse_locked "cannot determine whether a review loop or another reset is running (ps unavailable?)" ;;
|
||||
esac
|
||||
_release_reset_lock() {
|
||||
mam_release_loop_lock "$RESET_MARKER" || true
|
||||
mam_release_loop_lock "$MARKER" || true
|
||||
}
|
||||
_on_reset_signal() {
|
||||
@@ -113,7 +126,10 @@ trap _release_reset_lock EXIT
|
||||
trap '_on_reset_signal 130' INT
|
||||
trap '_on_reset_signal 143' TERM
|
||||
trap '_on_reset_signal 129' HUP
|
||||
mam_update_admit_release
|
||||
if ! mam_acquire_loop_lock "$RESET_MARKER"; then
|
||||
_refuse_locked "cannot publish $RESET_MARKER"
|
||||
fi
|
||||
exec 7>&-
|
||||
|
||||
STATE_JSON=""
|
||||
if ! STATE_JSON="$(load_state_json strict)"; then
|
||||
@@ -189,6 +205,17 @@ for target_name in ${ENTRY_NAMES[@]+"${ENTRY_NAMES[@]}"}; do
|
||||
continue
|
||||
;;
|
||||
pending)
|
||||
if [ "$R_ROW_AGENT" != "$R_AGENT" ] || [ "$R_ROW_SERVER" != "$R_SERVER" ]; then
|
||||
echo "skipped $R_NAME: its row ($R_ROW_AGENT on herdr server $R_ROW_SERVER) no longer matches $SPEC_FILE ($R_AGENT on $R_SERVER); nothing was changed for it; check the row, then rerun the reset"
|
||||
SKIPPED_ARGS+=(--skipped "$R_NAME:changed")
|
||||
continue
|
||||
fi
|
||||
jobs_out=""
|
||||
jobs_out="$(MAM_STATE_JSON="$STATE_JSON" "$PY" -m lib_py.reset open-jobs --workspace "$WS" --session "$R_NAME")" || {
|
||||
echo "skipped $R_NAME: a job was registered for it after the precheck (${jobs_out//$'\n'/; }); nothing was changed for it; rerun the reset once the job has ended"
|
||||
SKIPPED_ARGS+=(--skipped "$R_NAME:open_job")
|
||||
continue
|
||||
}
|
||||
STOP_CMD=(bash "$SKILL_DIR/multi-agent-mux-stop/scripts/stop_session.sh" --session "$R_NAME" --agent "$R_AGENT")
|
||||
if [ -n "$R_SERVER" ]; then
|
||||
STOP_CMD+=(--herdr-session "$R_SERVER")
|
||||
@@ -223,6 +250,11 @@ for target_name in ${ENTRY_NAMES[@]+"${ENTRY_NAMES[@]}"}; do
|
||||
SKIPPED_ARGS+=(--skipped "$R_NAME:no_id")
|
||||
continue
|
||||
fi
|
||||
if [ "$R_ROW_ID" != "$R_OLD_ID" ]; then
|
||||
echo "skipped $R_NAME: the stop left id $R_ROW_ID on its row, not the one recorded before the reset (${R_OLD_ID:-none}); it may be another conversation's, so nothing is purged; check it, purge it by hand if it is this agent's, and rerun the reset"
|
||||
SKIPPED_ARGS+=(--skipped "$R_NAME:id_unverified")
|
||||
continue
|
||||
fi
|
||||
|
||||
echo "reset [$R_NAME]: ${STOP_CMD[*]} --purge-conversation --yes"
|
||||
purge_rc=0
|
||||
|
||||
Reference in new issue
Block a user