Harden session persistence, worker recovery, and daemon refreshes - #2028

Note

High Risk
Touches authentication storage, session transcript repair, daemon protocol/worker recovery, and billing-related provider fields—failures could corrupt sessions, block attach, or mis-price usage.

Overview
This PR hardens durable state and daemon/session I/O while fixing a few provider and runtime edge cases.

Persistence and transcripts: Durable JSON/JSONL writes go through shared atomic rename (writeFileAtomicSync), including auth.json (exclusive create + atomic update), settings, cron jobs, telemetry, and session rewrites. Session files get crash repair at open (torn tails, zero-filled lines) when the owning process persists; export and daemon-client read paths use in-memory managers so they do not repair another process’s file. The shared event-log tail rule is unified (unterminated final line skipped on read, truncated on append). Semantic-edge ledgers now append via that substrate.

Daemon performance and correctness: Session-list metadata uses incremental resumable scans with a bounded usage cache and serialized per-path reads. Passive subagent topology is memoized until ledger/roster/session inputs change. Snapshot transfer ids bind to the materialized event cursor so a mismatched chunked transfer fails locally (clients resync). Failed workers with a live process can be retried for recovery; known-but-not-ready sessions return session_recovering instead of “unknown session”. Zombie-aware liveness is shared for daemon ps, leases, supervisor ownership, and update-restart. Idle status sweeps coalesce journal writes and backoff repeated failed summary generations.

Session runtime: RLM child usage flushes one attribution batch per settle boundary (not per child message); live “own usage” subtracts not-yet-indexed child spend. Auto-retry ends cleanly when a scheduled continue() never starts. Compaction keeps only the final turn when the token budget is crossed inside trailing tool results. Bash/output spill paths degrade instead of crashing when temp files fail.

Providers (packages/ai): OpenAI Responses omit service_tier for GitHub Copilot (field rejected) but still send explicit tiers elsewhere. Anthropic streaming reprices cache writes from message_delta cache_creation breakdown when usage shifts after message_start.

Smaller fixes: Dead IPython kernels drop the memo and restart on next use; piped CLI input joins file/instruction with a blank line; zai default glm-5.3; WebP EXIF scan termination; tail truncation and frontmatter BOM handling; daemon protocol revision 27.

^{Reviewed by Cursor Bugbot for commit 1c2c9f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Harden session persistence with atomic writes, crash repair, and worker recovery

• Adds shared writeFileAtomicSync in atomic-file.ts and migrates session, auth, event-log, daemon, and harness persistence from bespoke temp-file/rename sequences to the shared utility, preserving symlinks and file modes
• Adds session-file crash damage detection (tailLooksDamaged) and repair (repairJsonlDamage) in session-manager.ts that removes zero-filled or torn JSONL tails at open before subsequent appends
• Replaces size-and-mtime session cache with resumable incremental scanning in readSessionInfo/scanSessionInfo, so repeated reads resume from the last complete line and concurrent reads for the same path execute in order
• Reworks daemon worker recovery in daemon-supervisor.ts so failed workers with a current process identity can retry recovery, concurrent commands share one in-flight recovery, and snapshot transfer failures trigger client resync only when the failed transfer matches the published snapshot
• Adds zombie-aware process liveness checks in child-process.ts and daemon-supervisor-ownership.ts with a 5-second probe cache, so zombie owners are treated as reclaimable without probing on every fence poll
• Risk: readSessionInfo now serializes same-path reads through a per-path queue and requires a session header as the first parsed entry; files whose first entry is not a header will return null. EventLog.replaySync now skips any unterminated final line including one that parses as valid JSON, so previously-tolerated partial tails are dropped on replay

Changes since #2028 opened

• Introduced read-only session management mode that prevents repairs and writes when loading sessions as a daemon client, during HTML export, or when rendering active daemon summaries [1c2c9f2]
• Implemented deferred child usage attribution with unindexed usage tracking to ensure own usage reporting excludes child usage that has been accounted live but not yet durably indexed [1c2c9f2]
• Replaced single-write file initialization with loop-based complete writes that fail fast on short writes for credentials storage and preserved file mode across atomic replacements in harness state saves [1c2c9f2]
• Removed early-break special case for current file key in session scan cache trimming to enforce retained usage entry cap strictly [1c2c9f2]
• Added test coverage for read-only session behaviors, unindexed child usage handling, file write safety under partial writes, session scan cache limit enforcement, and permission preservation across atomic saves [1c2c9f2]

^{Macroscope summarized 5ccfad6.}