fix(desktop): refuse untaggable tmux runs, keep install ids durable, never reject a reconcile

- A tmux run whose pane cannot be tagged is closed at once and reported,
  so nothing the agent starts is ever beyond a later stop.
- A pane tmux cannot be asked about is neither stopped nor given up on;
  only a confirmed absence or a mismatched tag releases a run.
- A new install id is used only once it is saved. Registration retries
  instead of running under an id the next launch would not find.
- A Sim without the executor routes is rechecked every 15 minutes, logged
  once, so an upgrade reaches an open app.
- An inbox read never rejects: a failing notifier is logged, and the
  read settles.
- A long completion message is shortened without splitting a character.

Author: waleedlatif1

apps/desktop/src/main/desktop-executor/client.test.ts

@@ -24,4 +24,28 @@ describe('desktop executor client', () => {
     ).rejects.toBeInstanceOf(UnsendableRequestError)
     expect(sent).toBe(0)
   })
+
+  it('never splits a character when it shortens a long completion message', async () => {
+    const sent: string[] = []
+    const client = createDesktopExecutorClient({
+      origin: () => 'https://sim.test',
+      fetch: async (_url, init) => {
+        sent.push(String(init.body))
+        return Response.json({ outcome: 'recorded', status: 'completed' })
+      },
+      deviceId: '00000000-0000-4000-8000-000000000000',
+    })
+    // An emoji straddles the cut point, so a cut by code units would leave half of it behind.
+    const message = `${'a'.repeat(9_996)}😀${'b'.repeat(10)}`
+
+    await client.complete({
+      toolCallId: 'call-1',
+      executionToken: 'token-1',
+      completion: { status: 'success', message },
+    })
+
+    const sentMessage: string = JSON.parse(sent[0] ?? '{}').message
+    const loneSurrogate = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/
+    expect(loneSurrogate.test(sentMessage)).toBe(false)
+  })
 })

apps/desktop/src/main/desktop-executor/client.ts

@@ -5,7 +5,7 @@
 
 import { getErrorMessage } from '@sim/utils/errors'
 import { parseRetryAfter } from '@sim/utils/retry'
-import { truncate } from '@sim/utils/string'
+import { truncateAtCodePoint } from '@sim/utils/string'
 import {
   type ClaimedDesktopCall,
   COMPLETION_MESSAGE_MAX_CHARS,
@@ -197,7 +197,7 @@ export function createDesktopExecutorClient(
           executionToken,
           status: completion.status,
           // Leaves room for the ellipsis, so a cut message still fits Sim's limit.
-          message: truncate(completion.message, COMPLETION_MESSAGE_MAX_CHARS - 3),
+          message: truncateAtCodePoint(completion.message, COMPLETION_MESSAGE_MAX_CHARS - 3),
           ...(completion.data !== undefined ? { data: completion.data } : {}),
         })
       )

apps/desktop/src/main/desktop-executor/executor.test.ts

@@ -671,6 +671,23 @@ describe('registration', () => {
     expect(journal.entries.size).toBe(0)
   })
 
+  it('settles an inbox read whose notifier throws instead of rejecting', async () => {
+    const sim = new FakeSim()
+    const executor = new DesktopExecutor({
+      client: sim.client,
+      journal: new MemoryJournal(),
+      runner: new FakeRunner(),
+      leaseRenewMs: 60_000,
+      retryBaseMs: 5,
+      onUnregistered: () => {},
+      onApprovals: () => {
+        throw new Error('notifications are unavailable')
+      },
+    })
+
+    await expect(executor.reconcile()).resolves.toBeUndefined()
+  })
+
   it('raises no approval from an inbox read that Sim answers after sign-out', async () => {
     const { sim, executor, approvals } = setup()
     const answer = deferred<void>()

apps/desktop/src/main/desktop-executor/executor.ts

@@ -196,6 +196,9 @@ export class DesktopExecutor {
           this.reconcileAgain = false
           await this.reconcileOnce()
         } while (this.reconcileAgain && !this.disposed)
+      } catch (error) {
+        // Callers fire and forget; one bad read must never become an unhandled rejection.
+        logger.error('Desktop inbox read failed unexpectedly', { error: getErrorMessage(error) })
       } finally {
         this.reconciling = null
       }

apps/desktop/src/main/desktop-executor/service.test.ts

@@ -1,4 +1,4 @@
-import { mkdir, mkdtemp } from 'node:fs/promises'
+import { chmod, mkdir, mkdtemp } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { sleep } from '@sim/utils/helpers'
@@ -101,16 +101,38 @@ describe('desktop executor registration', () => {
     expect(sim.requests.filter((request) => request.includes('/api/desktop/inbox'))).toEqual([])
   })
 
-  it('stays dormant against a Sim without the executor routes, without retrying', async () => {
+  it('stays dormant against a Sim without the executor routes, checking back only slowly', async () => {
     const { sim, desktopExecutor } = await service()
-    desktopExecutor.start()
-    await vi.waitFor(() => expect(sim.registrations).toHaveLength(1))
+    vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout', 'setInterval', 'clearInterval'] })
+    try {
+      desktopExecutor.start()
+      await vi.waitFor(() => expect(sim.registrations).toHaveLength(1))
+
+      sim.registrations[0]?.(404)
+      await vi.advanceTimersByTimeAsync(60_000)
+      expect(sim.registrations).toHaveLength(1)
+      expect(sim.requests.filter((request) => request.includes('/api/desktop/inbox'))).toEqual([])
+
+      await vi.advanceTimersByTimeAsync(15 * 60_000)
+      expect(sim.registrations).toHaveLength(2)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
 
-    sim.registrations[0]?.(404)
-    await sleep(2_500)
+  it('registers with no install id it could not save', async () => {
+    const userData = await mkdtemp(join(tmpdir(), 'sim-executor-service-'))
+    await chmod(userData, 0o500)
+    try {
+      const { sim, desktopExecutor } = await service(1, userData)
 
-    expect(sim.registrations).toHaveLength(1)
-    expect(sim.requests.filter((request) => request.includes('/api/desktop/inbox'))).toEqual([])
+      desktopExecutor.start()
+      await sleep(200)
+
+      expect(sim.requests.filter((request) => request.includes('/api/desktop/devices'))).toEqual([])
+    } finally {
+      await chmod(userData, 0o700)
+    }
   })
 
   it('keeps its install id through a read failure instead of minting a new one', async () => {

apps/desktop/src/main/desktop-executor/service.ts

@@ -110,6 +110,8 @@ export function createDesktopExecutorService(
   let registering = false
   let registerAgain = false
   let registrationAttempt = 0
+  /** Logged once per run of missing routes, not on every recheck. */
+  let routesMissingNoted = false
   let suspended = false
   let started = false
   /** Bumped on sign-out, so work started for the previous session cannot resume it. */
@@ -122,12 +124,23 @@ export function createDesktopExecutorService(
     return deviceId
   }
 
+  /**
+   * Mints a new install id and makes it durable before anything uses it: an id the next launch
+   * would not find again could never resume the calls bound to it. Fails if it cannot be saved.
+   */
   async function rotateInstallId(): Promise<string> {
-    deviceId = generateId()
-    await writeJsonFileAtomically(identityPath, { deviceId }).catch((error) =>
-      logger.warn('Could not save the desktop install id', { error: getErrorMessage(error) })
+    const next = generateId()
+    deviceId = null
+    await writeJsonFileAtomically(identityPath, { deviceId: next })
+    deviceId = next
+    return next
+  }
+
+  /** Rotates where a failure must not stop the caller; the next registration tries again. */
+  async function retireInstallId(): Promise<void> {
+    await rotateInstallId().catch((error) =>
+      logger.warn('Could not save a new desktop install id', { error: getErrorMessage(error) })
     )
-    return deviceId
   }
 
   function fetchWithAppSession(url: string, init: RequestInit): Promise<Response> {
@@ -251,6 +264,7 @@ export function createDesktopExecutorService(
       })
       if (registrationGeneration !== generation || id !== deviceId) return
       registrationAttempt = 0
+      routesMissingNoted = false
       // A Sim that speaks another protocol version gets no new turns bound to this device.
       device =
         nextTiming.enabled && nextTiming.protocolVersion === DESKTOP_EXECUTOR_PROTOCOL_VERSION
@@ -274,7 +288,7 @@ export function createDesktopExecutorService(
         // The id belongs to another account (a copied profile); this install takes a new one.
         logger.warn('Desktop install id is registered to another account; minting a new one')
         await resetExecutor()
-        await rotateInstallId()
+        await retireInstallId()
         scheduleRegistration(0)
         return
       }
@@ -284,10 +298,14 @@ export function createDesktopExecutorService(
         return
       }
       if (error instanceof DeviceRequestError && (error.status === 404 || error.status === 405)) {
-        // A Sim without the executor routes (older, or self-hosted): nothing to retry against. The
-        // next launch, session change or settings toggle asks again.
+        // A Sim without the executor routes (older, or self-hosted): dormant, with only the slow
+        // recheck, so an upgrade of Sim reaches this device without a relaunch.
         stopLoops()
-        logger.info('Sim does not offer the desktop background executor; staying dormant')
+        if (!routesMissingNoted) {
+          routesMissingNoted = true
+          logger.info('Sim does not offer the desktop background executor; staying dormant')
+        }
+        scheduleRegistration(DORMANT_RECHECK_MS)
         return
       }
       registrationAttempt += 1
@@ -384,7 +402,7 @@ export function createDesktopExecutorService(
       registrationTimer = null
       await resetExecutor()
       await journal.clear()
-      await rotateInstallId()
+      await retireInstallId()
     },
   }
 }

apps/desktop/src/main/terminal/index.ts

@@ -45,12 +45,12 @@ import {
   capturePane,
   closeRunPane,
   isRunComplete,
-  isRunPaneOurs,
   isTmuxUnavailable,
   killPane,
   listPanes,
   pollRun,
   resolveAttachment,
+  runPaneState,
   sendKey,
   sendText,
   startRun,
@@ -485,7 +485,7 @@ export class TerminalService {
   private async reapFinishedRuns(terminalId: string, env: NodeJS.ProcessEnv): Promise<void> {
     for (const handle of this.pendingRuns.get(terminalId) ?? []) {
       if (this.awaitedRuns.has(handle)) continue
-      if (isRunComplete(handle) || !(await isRunPaneOurs(handle, env))) {
+      if (isRunComplete(handle) || (await runPaneState(handle, env)) === 'gone') {
         this.untrackRun(terminalId, handle)
         handle.dispose()
       }

apps/desktop/src/main/terminal/pending-runs.test.ts

@@ -22,7 +22,7 @@ vi.mock('@/main/terminal/tmux', () => ({
   capturePane: vi.fn(async () => ({ ok: true, stdout: '', stderr: '' })),
   closeRunPane: vi.fn(async () => undefined),
   isRunComplete: vi.fn((handle: { window: string }) => tmuxStub.complete.has(handle.window)),
-  isRunPaneOurs: vi.fn(async () => true),
+  runPaneState: vi.fn(async () => 'ours'),
   isTmuxUnavailable: vi.fn(() => false),
   killPane: vi.fn(async () => ({ ok: true, stdout: '', stderr: '' })),
   listPanes: vi.fn(async () => []),

apps/desktop/src/main/terminal/service.test.ts

@@ -46,9 +46,9 @@ vi.mock('@/main/terminal/tmux', async () => {
         dispose: () => rmSync(dir, { recursive: true, force: true }),
       }
     },
-    isRunPaneOurs: async (...args: Parameters<typeof actual.isRunPaneOurs>) => {
-      if (!tmuxFake.on) return actual.isRunPaneOurs(...args)
-      return !tmuxFake.gone.has(args[0].pane)
+    runPaneState: async (...args: Parameters<typeof actual.runPaneState>) => {
+      if (!tmuxFake.on) return actual.runPaneState(...args)
+      return tmuxFake.gone.has(args[0].pane) ? 'gone' : 'ours'
     },
     stopRun: async (...args: Parameters<typeof actual.stopRun>) => {
       if (!tmuxFake.on) return actual.stopRun(...args)

apps/desktop/src/main/terminal/tmux.test.ts

@@ -5,9 +5,9 @@ import { afterEach, describe, expect, it } from 'vitest'
 import {
   awaitRun,
   isDescendantOf,
-  isRunPaneOurs,
   parseFormatLines,
   pollRun,
+  runPaneState,
   startRun,
   stopRun,
   type TmuxRunHandle,
@@ -101,6 +101,8 @@ interface FakeTmuxState {
   panes: Record<string, { window: string; options: Record<string, string> }>
   /** Every command that reached a pane: `send-keys %1 C-c`, `kill-pane %1`. */
   log: string[]
+  /** Commands the fake fails, with the error tmux would print. */
+  fail?: Record<string, string>
 }
 
 const FAKE_TMUX = `
@@ -111,6 +113,7 @@ const args = process.argv.slice(2)
 const save = () => fs.writeFileSync(file, JSON.stringify(state))
 const target = () => args[args.indexOf('-t') + 1]
 const fail = (message) => { process.stderr.write(message); process.exit(1) }
+if (state.fail && state.fail[args[0]]) fail(state.fail[args[0]])
 switch (args[0]) {
   case 'new-window': {
     const window = '@' + state.nextWindow++
@@ -210,7 +213,7 @@ describe('stopping a tmux run touches only its own pane', () => {
     state.panes[run.pane] = { window: run.window, options: {} }
     tmux.write(state)
 
-    expect(await isRunPaneOurs(run, tmux.env)).toBe(false)
+    expect(await runPaneState(run, tmux.env)).toBe('gone')
     await stopRun(run, tmux.env, 0)
 
     expect(tmux.read().log).toEqual([])
@@ -224,8 +227,31 @@ describe('stopping a tmux run touches only its own pane', () => {
     delete state.panes[run.pane]
     tmux.write(state)
 
-    expect(await isRunPaneOurs(run, tmux.env)).toBe(false)
+    expect(await runPaneState(run, tmux.env)).toBe('gone')
     await stopRun(run, tmux.env, 0)
     expect(tmux.read().log).toEqual([])
   })
+
+  it('closes a run it could not tag instead of leaving an unstoppable command', async () => {
+    const tmux = fakeTmux()
+    dirs.push(tmux.dir)
+    tmux.write({ ...tmux.read(), fail: { 'set-option': 'invalid option: @sim-run-id' } })
+
+    const started = await startRun('agent', 'sleep 600', null, tmux.env)
+
+    expect('error' in started).toBe(true)
+    expect(tmux.read().log).toEqual(['kill-pane %0'])
+    expect(tmux.read().panes).toEqual({})
+  })
+
+  it('neither stops nor gives up on a run while tmux cannot be asked', async () => {
+    const tmux = fakeTmux()
+    const run = await started(tmux)
+    tmux.write({ ...tmux.read(), fail: { 'display-message': 'server exited unexpectedly' } })
+
+    expect(await runPaneState(run, tmux.env)).toBe('unknown')
+    await stopRun(run, tmux.env, 0)
+
+    expect(tmux.read().log).toEqual([])
+  })
 })