Dev

.github/workflows/ci.yml

@@ -69,7 +69,44 @@ jobs:
       matrix:
         node: ['22', '24']
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout_1
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 2
+        if: steps.checkout_1.outcome == 'failure'
+        run: |
+          echo "::warning::actions/checkout failed on attempt 1; retrying in 15s"
+          sleep 15
+
+      - name: Checkout (retry 2)
+        id: checkout_2
+        if: steps.checkout_1.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 3
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
+        run: |
+          echo "::warning::actions/checkout failed on attempt 2; retrying in 30s"
+          sleep 30
+
+      - name: Checkout (retry 3)
+        id: checkout_3
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 4
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
+        run: |
+          echo "::warning::actions/checkout failed on attempt 3; retrying in 60s"
+          sleep 60
+
+      - name: Checkout (retry 4)
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
+        uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
@@ -164,7 +201,47 @@ jobs:
     name: Unit Tests (Windows ConPTY)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout_1
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 2
+        if: steps.checkout_1.outcome == 'failure'
+        shell: bash
+        run: |
+          echo "::warning::actions/checkout failed on attempt 1; retrying in 15s"
+          sleep 15
+
+      - name: Checkout (retry 2)
+        id: checkout_2
+        if: steps.checkout_1.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 3
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
+        shell: bash
+        run: |
+          echo "::warning::actions/checkout failed on attempt 2; retrying in 30s"
+          sleep 30
+
+      - name: Checkout (retry 3)
+        id: checkout_3
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 4
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
+        shell: bash
+        run: |
+          echo "::warning::actions/checkout failed on attempt 3; retrying in 60s"
+          sleep 60
+
+      - name: Checkout (retry 4)
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
+        uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION_PRIMARY }}
@@ -243,8 +320,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION_PRIMARY }}
           cache: 'npm'
           cache-dependency-path: server/package-lock.json
-      - run: npm ci
-        working-directory: server
+      - run: ./scripts/ci-npm-ci.sh server
       - name: Run DB integration tests
         run: npm run test:integration
         working-directory: server
@@ -258,7 +334,61 @@ jobs:
     runs-on: ubuntu-latest
     needs: [unit-tests]
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        id: checkout_1
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 2
+        if: steps.checkout_1.outcome == 'failure'
+        shell: bash
+        run: |
+          echo "::warning::actions/checkout failed on attempt 1; retrying in 15s"
+          sleep 15
+
+      - name: Checkout (retry 2)
+        id: checkout_2
+        if: steps.checkout_1.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 3
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
+        shell: bash
+        run: |
+          echo "::warning::actions/checkout failed on attempt 2; retrying in 30s"
+          sleep 30
+
+      - name: Checkout (retry 3)
+        id: checkout_3
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 4
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
+        shell: bash
+        run: |
+          echo "::warning::actions/checkout failed on attempt 3; retrying in 60s"
+          sleep 60
+
+      - name: Checkout (retry 4)
+        id: checkout_4
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@v4
+
+      - name: Wait before checkout retry 5
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure' && steps.checkout_4.outcome == 'failure'
+        shell: bash
+        run: |
+          echo "::warning::actions/checkout failed on attempt 4; retrying in 90s"
+          sleep 90
+
+      - name: Checkout (retry 5)
+        if: steps.checkout_1.outcome == 'failure' && steps.checkout_2.outcome == 'failure' && steps.checkout_3.outcome == 'failure' && steps.checkout_4.outcome == 'failure'
+        uses: actions/checkout@v4
+
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ env.NODE_VERSION_PRIMARY }}
@@ -390,15 +520,40 @@ jobs:
         run: npm version ${{ needs.docker.outputs.npm_version }} --no-git-tag-version
       - name: Publish (skip if version already on npm)
         run: |
+          set -euo pipefail
           VERSION=${{ needs.docker.outputs.npm_version }}
+          PUBLISH_ARGS=(--access public)
+          if [ "${{ github.ref }}" = "refs/heads/dev" ]; then
+            PUBLISH_ARGS=(--tag dev "${PUBLISH_ARGS[@]}")
+          fi
+
           if npm view "imcodes@${VERSION}" version >/dev/null 2>&1; then
             echo "::warning::Version ${VERSION} already published — skipping"
-          elif [ "${{ github.ref }}" = "refs/heads/dev" ]; then
-            npm publish --tag dev --provenance --access public
-          else
-            npm publish --provenance --access public
+            exit 0
+          fi
+
+          set +e
+          npm publish "${PUBLISH_ARGS[@]}" --provenance 2>&1 | tee npm-publish.log
+          publish_status=${PIPESTATUS[0]}
+          set -e
+
+          if [ "${publish_status}" -eq 0 ]; then
+            exit 0
+          fi
+
+          if npm view "imcodes@${VERSION}" version >/dev/null 2>&1; then
+            echo "::warning::Version ${VERSION} was published despite npm publish exiting ${publish_status}; treating as success"
+            exit 0
+          fi
+
+          if grep -q 'TLOG_CREATE_ENTRY_ERROR' npm-publish.log; then
+            echo "::warning::npm provenance transparency-log entry already exists, but ${VERSION} is not published; retrying once without --provenance"
+            npm publish "${PUBLISH_ARGS[@]}"
+            exit 0
           fi
 
+          exit "${publish_status}"
+
   # ── Build & push Docker image ─────────────────────────────────────────────
 
   docker:

CLAUDE.md

@@ -87,7 +87,8 @@ The web project uses `i18next` with `react-i18next` for internationalization.
 - Session names follow the pattern `deck_{project}_{role}` (e.g., `deck_myapp_brain`, `deck_myapp_w1`).
 - Main sessions and sub-sessions are the same session model. Treat them as equally important in behavior, queueing, timeline semantics, edit/undo, and lifecycle handling. Differences should come only from parent/attachment relationship and presentation constraints, not from weaker semantics for sub-sessions.
 - Agent types: Process = `'claude-code' | 'codex' | 'gemini' | 'opencode' | 'shell' | 'script'`, Transport = `'openclaw' | 'qwen'` — the `AgentType` union in `src/agent/detect.ts`.
-- **Pod-sticky routing (MANDATORY for daemon-dependent requests)**: The server runs multiple replicas. Each daemon connects to ONE pod via WebSocket. The ingress uses `:serverId` in the URL path to route requests to the pod holding that daemon's WS. Any endpoint that depends on the daemon (file transfer, session commands, Watch API) **MUST** include `:serverId` in the URL path (e.g., `/api/server/:serverId/...`). In-memory state (download tokens, WsBridge instances, terminal streams) is per-pod — requests without serverId routing will hit a random pod and fail.
+- **Pod-sticky routing (MANDATORY for daemon-dependent requests)**: The server runs multiple replicas. Each daemon connects to ONE pod via WebSocket. The ingress routes any request that carries `serverId` (as a `?serverId=` query string OR as a `:serverId` URL-path parameter) to the pod holding that daemon's WS. Any endpoint that depends on the daemon (file transfer, session commands, Watch API, memory source resolution) **MUST** carry `serverId`. In-memory state (download tokens, WsBridge instances, terminal streams, pending RPCs) is per-pod — requests without serverId routing will hit a random pod and fail.
+  - **Convention going forward — prefer `?serverId=` query string** for new routes. The ingress handles this generically: any route under `/api/...` that carries `?serverId=` is pod-sticky-routed without needing a dedicated path-style mount. Use `c.req.query('serverId')` server-side and treat its presence as the routing key. Path-style `/api/server/:serverId/...` mounts still work for existing routes (file-transfer, watch, cron, session-mgmt, etc.) — don't break them — but new routes should follow the query-string convention. Example: `GET /api/memory/sources?serverId=...&projectionId=...` lives under a flat `/api` mount and is automatically routed to the pod holding that daemon's WS.
 - **MANDATORY — Transport command liveness contract:** Daemon command receipt and urgent-control delivery MUST preserve current dev behavior. The daemon MUST NOT intercept `/compact`; `/compact` is an ordinary SDK-native message and is forwarded unchanged to the transport provider. Provider adapters that expose a native compact RPC (for example Codex app-server `thread/compact/start`) MUST translate the raw `/compact` command at the SDK boundary instead of sending it as model text. Ordinary `session.send` ack is a daemon-receipt ack and MUST NOT wait for recall, live context bootstrap, memory lookup/enrichment, embedding, transport lock, pending relaunch, provider send-start, provider settlement, telemetry, or any background memory work. `/stop` and approval/feedback/control responses MUST use the priority path and MUST NOT be routed through or blocked by the ordinary send queue/locks.
 - Server secrets (`JWT_SIGNING_KEY`) are set via environment variables, never committed.
 - E2E tests require tmux. They are auto-skipped when `SKIP_TMUX_TESTS=1` or inside a Claude Code session (`CLAUDECODE` env var set).