fix(runtime-host): isolate artifact invalidations from guests

Author: SummerC0zyR0ck

apps/desktop/src/main/__tests__/main-startup-lifetime.test.ts

@@ -124,6 +124,17 @@ test('does not release renderer IPC before persistent handlers are registered',
   assert.doesNotMatch(readyBody, /runtimeHostManager\?\.start\(\)/u);
 });
 
+test('wires Artifact deletion and purge events to preview invalidation for the active scope', () => {
+  const subscribe = bootSource.indexOf('client.subscribeArtifactChanges(');
+  const unsubscribe = bootSource.indexOf('unsubscribeArtifactChanges();', subscribe);
+  assert.ok(subscribe >= 0 && unsubscribe > subscribe);
+  const handler = bootSource.slice(subscribe, unsubscribe);
+  assert.match(handler, /managedArtifactPreview\.revoke\(scope\.targetEpoch,\s*frame\.sessionId,\s*frame\.artifactId\)/u);
+  assert.match(handler, /managedArtifactPreview\.releaseSession\(scope\.targetEpoch,\s*frame\.sessionId\)/u);
+  assert.match(bootSource, /managedArtifactPreview\.openScope\(scope\.targetEpoch\)/u);
+  assert.match(bootSource, /await managedArtifactPreview\.closeScope\(scope\.targetEpoch\)/u);
+});
+
 test('resolves persisted locale before first post-settings recovery prompt', () => {
   const rendererRecoveryStart = earlyWindowSource.indexOf('onRendererProcessGone: async');
   const rendererRecovery = earlyWindowSource.slice(

apps/desktop/src/main/__tests__/managed-artifact-preview.test.ts

@@ -158,15 +158,15 @@ test('bounds previews per session instead of starving another session', async ()
   }
 });
 
-test('evicts the oldest lease at the global backstop without denying another session', async () => {
+test('does not invalidate existing previews when another session prepares one', async () => {
   const service = new ManagedArtifactPreview();
   try {
     const endpoints = [];
     for (let index = 0; index < 64; index += 1) {
       endpoints.push(await service.prepare('h', client(`preview-${index}`), `s${index}`, 'a1'));
     }
     const replacement = await service.prepare('h', client('replacement'), 's64', 'a1');
-    await assert.rejects(fetch(endpoints[0]!.url));
+    assert.equal(await (await fetch(endpoints[0]!.url)).text(), 'preview-0');
     assert.equal(await (await fetch(replacement.url)).text(), 'replacement');
   } finally {
     await service.close();

apps/desktop/src/main/managed-artifact-preview.ts

@@ -24,10 +24,6 @@ import type { DesktopRuntimeHostClient } from './runtime-host-client.js';
 
 export const PREVIEW_MAX_BYTES = 8 * 1024 * 1024;
 const MAX_PREVIEWS = 16;
-// Per-Session admission alone cannot bound the Desktop, so one global backstop
-// remains. It evicts the oldest lease instead of rejecting the newest: a global
-// rejection is what let one Session starve every other for a full TTL.
-const MAX_TOTAL_PREVIEWS = 64;
 const PREVIEW_TTL_MS = 30 * 60 * 1000;
 const READ_DEADLINE_MS = 30_000;
 
@@ -82,10 +78,6 @@ export class ManagedArtifactPreview {
     if (sessionLeases.length >= MAX_PREVIEWS) {
       throw new Error('Too many active previews; wait for expiry');
     }
-    if (this.leases.size >= MAX_TOTAL_PREVIEWS) {
-      const oldest = this.leases.values().next().value as Lease | undefined;
-      if (oldest) void this.release(oldest);
-    }
     signal?.throwIfAborted();
     // Reserve before asynchronous reads, so concurrent preparations cannot exceed the bound.
     const lease: Lease = { scope, sessionId, artifactId, server: createServer() };

packages/runtime-host/src/__tests__/connection-session.test.ts

@@ -137,7 +137,7 @@ test('concurrent responses remain framed and correlated in reverse completion or
   );
 });
 
-test('scopes Session Guest Artifact changes to the shared Session', async () => {
+test('does not expose Artifact invalidations to Session Guests', async () => {
   const pair = await openTransportPair();
   const hostChanges = new HostChangeFeed();
   const session = new RuntimeHostConnectionSession({
@@ -184,11 +184,11 @@ test('scopes Session Guest Artifact changes to the shared Session', async () =>
   try {
     hostChanges.publishArtifactDeleted('session-2', 'artifact-2');
     hostChanges.publishArtifactDeleted('session-1', 'artifact-1');
+    hostChanges.publishSessionCatalog('session-1');
     assert.deepEqual(decodeHostFrame(await pair.clientTransport.read(1_000)), {
-      kind: 'artifact.changed',
-      reason: 'deleted',
+      kind: 'session.catalog.changed',
+      revision: 1,
       sessionId: 'session-1',
-      artifactId: 'artifact-1',
     });
   } finally {
     pair.clientTransport.abort();

packages/runtime-host/src/__tests__/host-change-feed.test.ts

@@ -56,7 +56,10 @@ test('routes each change kind only to subscribed connections', () => {
   );
   feed.attachConnection(
     'other-guest',
-    { sessionCatalog: { sessionId: 'session-1', principalId: 'guest-2' } },
+    {
+      artifact: { sessionId: 'session-1' },
+      sessionCatalog: { sessionId: 'session-1', principalId: 'guest-2' },
+    },
     { send: async (frame) => void otherGuest.push(frame) },
   );
 

packages/runtime-host/src/__tests__/session-retirement-coordinator.test.ts

@@ -196,7 +196,7 @@ describe('Host Session retirement coordinator', () => {
     assert.equal(garbageBatches, 0);
   });
 
-  test('publishes Session Artifact invalidation only when Artifact purge succeeds', async () => {
+  test('publishes Session Artifact invalidation even when a purge partially fails', async () => {
     const purged: string[] = [];
     await purgeSessionSidecars(
       {
@@ -225,7 +225,7 @@ describe('Host Session retirement coordinator', () => {
       ),
       AggregateError,
     );
-    assert.deepEqual(purged, ['session-success']);
+    assert.deepEqual(purged, ['session-success', 'session-artifact-failure']);
 
     await assert.rejects(
       purgeSessionSidecars(
@@ -243,7 +243,11 @@ describe('Host Session retirement coordinator', () => {
       ),
       AggregateError,
     );
-    assert.deepEqual(purged, ['session-success', 'session-other-failure']);
+    assert.deepEqual(purged, [
+      'session-success',
+      'session-artifact-failure',
+      'session-other-failure',
+    ]);
   });
 
   test('rejects ordinary archive and remove operations for the Coordination Session', async () => {

packages/runtime-host/src/protocol/index.ts

@@ -106,8 +106,9 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1 as const;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0 as const;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 198 as const;
-// 198: Host change feed includes Artifact deletion and Session purge invalidation frames.
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 199 as const;
+// 199: Artifact invalidation feed and guest routing require matching peers.
+// 198: Usage queries can filter by model call kind.
 // 197: Queue reorder requests carry the expected queue revision. Epoch-196
 // peers reject the required field or send an unfenced reorder request.
 // 196: `turn.start` carries an optional durable external-message origin; older

packages/runtime-host/src/server/connection-session.ts

@@ -366,14 +366,14 @@ export class RuntimeHostConnectionSession {
         : hasRuntimeHostOperationGrant(this.#options.connection.authority, 'session.catalog.query')
           ? true
           : undefined;
+    // Artifact invalidations are consumed by the owner Desktop. Guest clients
+    // must not learn Artifact identities or share a session-scoped subscription
+    // whose lifetime is tied to another guest's catalog scope.
     const artifact: HostChangeSubscriptionMask['artifact'] =
-      this.#options.connection.authority.principalKind === 'session_guest'
-        ? sharedSessionId !== undefined
-          ? { sessionId: sharedSessionId }
-          : undefined
-        : hasRuntimeHostOperationGrant(this.#options.connection.authority, 'artifact.query')
-          ? true
-          : undefined;
+      this.#options.connection.authority.principalKind !== 'session_guest' &&
+      hasRuntimeHostOperationGrant(this.#options.connection.authority, 'artifact.query')
+        ? true
+        : undefined;
     this.#hostChanges = service.attachConnection(
       this.#options.connection.connectionId,
       {

packages/runtime-host/src/server/host-change-feed.ts

@@ -168,15 +168,6 @@ export class HostChangeFeed {
         this.#subscriptions.delete(connectionId);
         continue;
       }
-      if (
-        closeScopeFor !== undefined &&
-        frame.kind === 'session.catalog.changed' &&
-        subscription.mask.artifact !== true &&
-        subscription.mask.artifact?.sessionId === frame.sessionId &&
-        this.#subscriptions.get(connectionId) === subscription
-      ) {
-        this.#subscriptions.delete(connectionId);
-      }
     }
   }
 }

packages/runtime-host/src/server/session-sidecar-purge.ts

@@ -39,9 +39,9 @@ export async function purgeSessionSidecars(
     ...(authority.contextOffload ? [authority.contextOffload.retireSession(sessionId)] : []),
     authority.purgeOperationalState(sessionId),
   ]);
-  // Once Artifacts are purged their previews must stop serving, even when a
-  // sibling sidecar fails and the aggregate error is thrown below.
-  if (artifactPurge.status === 'fulfilled') authority.onArtifactsPurged?.(sessionId);
+  // Invalidation is idempotent and must happen even when the Artifact purge
+  // rejects: a failed purge may have removed only part of the Session's data.
+  authority.onArtifactsPurged?.(sessionId);
   const failures = [artifactPurge, ...sidecarPurges].flatMap((outcome) =>
     outcome.status === 'rejected' ? [outcome.reason] : [],
   );