* feat(ai-vault): isolate scanning in service processes
* fix(ai-vault): retire idle service processes
* fix(ai-vault): discard unverified cache processes
* fix(ai-vault): clear relay sidecar cancel watchdog on acknowledgement
A cancelled relay call is settled before its 2s cancel watchdog is armed, so the acknowledgement path bailed out of settle() before clearing the timer. The watchdog then faulted a healthy sidecar two seconds after every aborted scan, killing whatever request had since become active.
* fix(ai-vault): clear the pending restart before scheduling another
recordFault overwrote this.timer, stranding a restart that dispose() could no longer cancel.
* refactor(ai-vault): drop the orphaned first-prompt IPC wrapper
session-first-user-prompt-handler.ts now owns this entry point and routes through the service; the copy left in the read module had no callers.
* fix(ai-vault): retry a faulted cold start before surfacing it
A slow first start surfaced a raw 'did not become ready' error to the caller even though the supervisor was already respawning. Requeue an unsent call once onto the scheduled respawn instead.
Also stop arming the cancellation watchdog for a call the child never received: no acknowledgement is coming, so it killed a healthy service and stalled the lane.
Invalidation bookkeeping and ready-waiter construction move to the state module to stay under the max-lines cap.
* fix(ai-vault): give relay title reads their own lane
Before this branch the relay read title files directly, concurrently with scans. Routing both through one sidecar lane put title resolution behind a list scan that may run up to 130s, so SSH tab titles could lag minutes behind.
Split cache and interactive lanes in both the relay client and the sidecar entry, mirroring the desktop service.
Also: clear the ready deadline on fault, so a sidecar that dies before ready cannot fault its healthy replacement five seconds later; retry an unsent call once across a respawn; and skip the cancellation watchdog for a call the sidecar never received.
Restart/circuit bookkeeping moves to its own module, mirroring the desktop policy, to stay under the max-lines cap.
* fix(ai-vault): degrade relay title resolution on sidecar failure
listSessions already returns a host issue when the sidecar is unavailable; titles propagated the raw RPC error instead. Return no titles so callers fall back to preview text, and keep cancellation propagating.
* fix(ai-vault): scrub the service child environment
The children are forked with a 384 MiB heap cap and no loader, but both
spawn sites handed them the full parent environment, so an exported
NODE_OPTIONS silently raised the cap or --require'd code into them.
Allowlist both, following the plugin worker. The desktop child keeps the
eleven agent-root overrides it resolves its own roots from; the relay
sidecar takes remoteHome and hostPlatform from its init message and so
needs none of them. Both children share one priority module while they
share this one.
* fix(ai-vault): soft-disable relay vault when the service is missing
A missing service threw out of the constructor, so a Vault wiring bug
would abort relay startup and take every PTY on the host with it. The
unsupported-platform branch three lines above already treats a Vault
failure as a soft disable; do the same here.
Threading the service through the two handlers instead of a field also
retires the definite-assignment assertion the throw was propping up.
* fix(ai-vault): drain consumed cache invalidations
invalidatedPaths was re-applied in every request's finally and never
drained, so once N paths had been invalidated every later request paid N
evictions for the life of the process; the 4096 cap only bounded how bad
that got.
The re-apply exists to cover a read that overlapped the invalidation, so
drain once nothing is executing. Clearing unconditionally would drop the
re-apply for a request still running on the other lane.
* fix(ai-vault): keep a busy child through slow invalidation acks
invalidate() reused the 5s ready budget as its acknowledgement deadline
and killed the child on expiry, so a delete issued during a large scan
could kill a healthy process mid-scan and burn a slot toward the restart
circuit.
Fault only when nothing is executing. Fork IPC ordering already puts the
invalidation ahead of any later request, so a busy child owes no ack
here, and the 130s/15s request deadlines still catch a wedged one.
The start-retry predicate moves to the state module to stay under the
line cap, matching the shape the relay client already uses.
* fix(ai-vault): report a failed local scan as a host issue
A local-scope scan let its error escape to the renderer, which paints it
over the session list. Service supervision now produces those errors, so
"AI Vault service restart circuit is open." replaced the list.
Route local scope through the degradation the all-hosts leg and every SSH
leg already use, so it lands as a retryable host issue row instead. Same
result shape either way, so no IPC or wire contract changes.
* test(ai-vault): cover the relay restart circuit transitions
The relay policy shipped without tests. Pin both circuit edges, the
aging-out case, the forced-refresh reopen the relay has and the desktop
does not, and the backoff schedule.
* fix(ai-vault): keep the OpenCode roots in the service child env
The scrubbed allowlist dropped XDG_DATA_HOME and OPENCODE_DB, which the child
reads to locate the OpenCode store and database. The pre-PR worker thread
inherited them, so a user who sets either lost every OpenCode session.
* test(ai-vault): anchor the service spawn env assertion
Brennan Benson
d50adec2d2