🤖 perf: scope workspace.activity.list to config-known workspaces and prune stale extensionMetadata entries

src/cli/trust.test.ts

@@ -227,7 +227,14 @@ describe("xum trust CLI", () => {
       .quiet();
 
     expect(result.exitCode).not.toBe(0);
-    expect(result.stderr.toString()).toContain("Failed to persist trust change");
+    // Either failure surface is acceptable: the corrupt-config write gate
+    // (config.json exists but cannot be read, so editConfig refuses to write
+    // defaults over it) or the post-write trust verification (the write was
+    // silently swallowed). Both must fail loudly instead of reporting
+    // success.
+    expect(result.stderr.toString()).toMatch(
+      /Failed to persist trust change|Skipping config write/
+    );
     expect(result.stdout.toString()).toBe("");
   }, 15_000);
 

src/node/services/coreServices.ts

@@ -98,6 +98,45 @@ export function createCoreServices(opts: CoreServicesOptions): CoreServices {
     providerService.getConfig()
   );
   const extensionMetadata = new ExtensionMetadataService(extensionMetadataPath);
+  // Write tombstones are process-local removal knowledge; the shared config
+  // is the authority (with XUM_ALLOW_MULTIPLE_INSTANCES a downgraded backend
+  // can legitimately re-register a deterministic legacy id this process
+  // pruned). Without this probe, a tombstoned id that becomes active again
+  // would have every metadata write and broadcast suppressed until an
+  // activity bootstrap happens to run. Raw view first (cheap; complete when
+  // every persisted entry carries an inline id); only id-less legacy entries
+  // require the authoritative enumeration. Throws propagate: unknowable
+  // registration keeps the tombstone.
+  extensionMetadata.setRegistrationProbe(async (workspaceId) => {
+    const evidence = config.readPersistedWorkspaceIdEvidence();
+    if (evidence.ids.has(workspaceId)) {
+      return true;
+    }
+    if (!evidence.hasWorkspaceEntriesWithoutIds) {
+      return false;
+    }
+    // Targeted lenient positive first: a POSITIVE identity match needs no
+    // completeness, so a re-registered workspace whose own compatibility
+    // metadata is healthy must not stay write-suppressed because an
+    // UNRELATED legacy entry's metadata is malformed (the strict
+    // enumeration below throws on the first such entry, and the tombstone
+    // would then pin every one of the target's writes as transient
+    // indefinitely). A lenient scan only skips unreadable entries — it
+    // never fabricates a match.
+    if (config.findWorkspace(workspaceId) != null) {
+      return true;
+    }
+    // Negatives keep requiring the complete strict view: a lenient miss is
+    // indistinguishable from an identity hidden by a read failure. Alias
+    // ids: a second resolvable compatibility file's identity stays
+    // registered for findWorkspace even though it is not any entry's
+    // primary id — refusing its writes/deletions requires knowing it here.
+    const legacyAliasIds = new Set<string>();
+    const registered = (
+      await config.getAllWorkspaceMetadata({ throwOnError: true, legacyAliasIds })
+    ).some((metadata) => metadata.id === workspaceId);
+    return registered || legacyAliasIds.has(workspaceId);
+  });
   const workspaceGoalService = new WorkspaceGoalService(
     config,
     historyService,

src/node/services/taskService.test.ts

@@ -592,6 +592,7 @@ function createWorkspaceServiceMocks(
   emitChatEvent: ReturnType<typeof mock>;
   isWorkflowInvocationCurrent: ReturnType<typeof mock>;
   create: ReturnType<typeof mock>;
+  discardExtensionMetadataEntry: ReturnType<typeof mock>;
 } {
   const sendMessage =
     overrides?.sendMessage ?? mock((): Promise<Result<void>> => Promise.resolve(Ok(undefined)));
@@ -678,10 +679,12 @@ function createWorkspaceServiceMocks(
       (): Promise<Result<{ metadata: WorkspaceMetadata }>> =>
         Promise.resolve(Err("workspaceService.create not mocked"))
     );
+  const discardExtensionMetadataEntry = mock((): Promise<void> => Promise.resolve());
 
   return {
     workspaceService: {
       create,
+      discardExtensionMetadataEntry,
       // No-op by default: task-create tests exercise launch flow, not the
       // registration-time plugin-override sanitizer (workspaceService.test.ts
       // covers it). Returning undefined means "clean".
@@ -731,6 +734,7 @@ function createWorkspaceServiceMocks(
       countQueuedAgentPeerMessages,
     } as unknown as WorkspaceService,
     create,
+    discardExtensionMetadataEntry,
     sendMessage,
     resumeStream,
     clearQueue,
@@ -23801,7 +23805,9 @@ describe("TaskService", () => {
     );
     const { aiService } = createAIServiceMocks(config);
     const failingSendMessage = mock(() => Promise.resolve(Err("send failed")));
-    const { workspaceService } = createWorkspaceServiceMocks({ sendMessage: failingSendMessage });
+    const { workspaceService, discardExtensionMetadataEntry } = createWorkspaceServiceMocks({
+      sendMessage: failingSendMessage,
+    });
     const { taskService } = createTaskServiceHarness(config, { aiService, workspaceService });
 
     const created = await createAgentTask(taskService, parentId, "do the thing");
@@ -23814,6 +23820,11 @@ describe("TaskService", () => {
       .some((w) => w.id === "aaaaaaaaaa");
     expect(stillExists).toBe(false);
 
+    // Rollback must also drop the extension-metadata entry: the failed send
+    // may already have scheduled metadata writes that would otherwise leak a
+    // stale key after deregistration (#3959).
+    expect(discardExtensionMetadataEntry).toHaveBeenCalledWith("aaaaaaaaaa");
+
     const workspaceName = "agent_explore_aaaaaaaaaa";
     const workspacePath = runtime.getWorkspacePath(projectPath, workspaceName);
     let workspacePathExists = true;
@@ -23825,6 +23836,63 @@ describe("TaskService", () => {
     expect(workspacePathExists).toBe(false);
   }, 20_000);
 
+  test("failed config deregistration during rollback does not tombstone the task's metadata", async () => {
+    const config = await createTestConfig(rootDir);
+    stubStableIds(config, ["bbbbbbbbbb"], "bbbbbbbbbb");
+
+    const projectPath = await createTestProject(rootDir);
+
+    const runtimeConfig = { type: "worktree" as const, srcBaseDir: config.srcDir };
+    const runtime = createRuntime(runtimeConfig, { projectPath });
+    const initLogger = createNullInitLogger();
+
+    const parentName = "parent-b";
+    const parentCreate = await runtime.createWorkspace({
+      projectPath,
+      branchName: parentName,
+      trunkBranch: "main",
+      directoryName: parentName,
+      initLogger,
+    });
+    expect(parentCreate.success).toBe(true);
+
+    const parentId = "2222222222";
+    const parentPath = runtime.getWorkspacePath(projectPath, parentName);
+
+    await saveWorkspaces(
+      config,
+      projectPath,
+      [
+        {
+          path: parentPath,
+          id: parentId,
+          name: parentName,
+          createdAt: new Date().toISOString(),
+          runtimeConfig,
+        },
+      ],
+      testTaskSettings()
+    );
+    const { aiService } = createAIServiceMocks(config);
+    const failingSendMessage = mock(() => Promise.resolve(Err("send failed")));
+    const { workspaceService, discardExtensionMetadataEntry } = createWorkspaceServiceMocks({
+      sendMessage: failingSendMessage,
+    });
+    const { taskService } = createTaskServiceHarness(config, { aiService, workspaceService });
+    // Deregistration fails: the rollback must NOT discard (and thereby
+    // write-tombstone) metadata for a workspace that is still registered.
+    const removeSpy = spyOn(config, "removeWorkspace").mockImplementation(() =>
+      Promise.reject(new Error("config locked"))
+    );
+    try {
+      const created = await createAgentTask(taskService, parentId, "do the thing");
+      expect(created.success).toBe(false);
+      expect(discardExtensionMetadataEntry).not.toHaveBeenCalled();
+    } finally {
+      removeSpy.mockRestore();
+    }
+  }, 20_000);
+
   test("agent_report posts report to parent, finalizes pending task tool output, and triggers cleanup", async () => {
     const config = await createTestConfig(rootDir);
 

src/node/services/taskService.ts

@@ -7312,15 +7312,28 @@ export class TaskService {
       preservePhysicalWorkspace?: boolean;
     }
   ): Promise<void> {
+    let removedFromConfig = false;
     try {
       await this.config.removeWorkspace(taskId);
+      removedFromConfig = true;
     } catch (error: unknown) {
       log.error("Task.create rollback: failed to remove workspace from config", {
         taskId,
         error: getErrorMessage(error),
       });
     }
 
+    // A create that failed after sendMessage may already have scheduled
+    // extension-metadata writes (e.g. the recency update), which would
+    // recreate the entry after the deregistration above and leak a stale key
+    // until the next process start's lazy prune. Only after deregistration
+    // actually succeeded: discarding also write-tombstones the id for this
+    // process, which must not silence metadata for a workspace that is still
+    // registered because removeWorkspace failed.
+    if (removedFromConfig) {
+      await this.workspaceService.discardExtensionMetadataEntry(taskId);
+    }
+
     this.workspaceService.emit("metadata", { workspaceId: taskId, metadata: null });
 
     if (options?.preservePhysicalWorkspace) {

src/node/services/workspaceGoalService.test.ts

@@ -2298,6 +2298,32 @@ describe("WorkspaceGoalService", () => {
     });
   });
 
+  test("previewStreamAccounting skips the durable fallback when the strict baseline read is unavailable", async () => {
+    // "unavailable" (failed sidecar reconcile) must stay distinct from the
+    // authoritative "no baseline": the durable pushSnapshot fallback writes
+    // through the lenient load — accepting the suspect partial main the
+    // strict read refused — and emits it, clearing renderer goal/status
+    // state. The preview must resolve without delivering or writing.
+    await setGoalOk(service, { workspaceId, objective: "Preview goal" });
+    const metadataFilePath = path.join(config.rootDir, "extensionMetadata.json");
+    const before = await fs.readFile(metadataFilePath, "utf-8");
+    // A directory at the sidecar path yields a deterministic errno (EISDIR)
+    // standing in for EACCES/EIO-class reconcile failures.
+    await fs.mkdir(`${metadataFilePath}.corrupt`);
+    try {
+      const activityUpdates = captureGoalActivity(service);
+
+      const preview = await service.previewStreamAccounting({ workspaceId, costUsd: 1 });
+
+      expect(preview).toMatchObject({ objective: "Preview goal" });
+      // No emit (renderer keeps last-known state) and no durable write.
+      expect(activityUpdates).toHaveLength(0);
+      expect(await fs.readFile(metadataFilePath, "utf-8")).toBe(before);
+    } finally {
+      await fs.rm(`${metadataFilePath}.corrupt`, { recursive: true });
+    }
+  });
+
   test("successful no-op queued drains clear the pending snapshot", async () => {
     const created = await setGoalOk(service, { workspaceId, objective: "Existing goal" });
     await extensionMetadata.setStreaming(workspaceId, true);
@@ -5470,7 +5496,14 @@ describe("WorkspaceGoalService", () => {
       objective: "Preview without metadata",
       budgetCents: 1_000,
     });
-    await extensionMetadata.deleteWorkspace(workspaceId);
+    // Clear the snapshot by rewriting the file directly: deleteWorkspace now
+    // write-tombstones removed workspaces for the rest of the process, which
+    // would (correctly) block the preview persistence below. This test
+    // simulates a LIVE workspace that merely has no activity snapshot yet.
+    await fs.writeFile(
+      path.join(config.rootDir, "extensionMetadata.json"),
+      JSON.stringify({ version: 1, workspaces: {} })
+    );
     const activityUpdates = captureGoalActivity(service);
 
     const preview = await service.previewStreamAccounting({

src/node/services/workspaceGoalService.ts

@@ -1280,24 +1280,41 @@ export class WorkspaceGoalService {
   private async pushTransientGoalSnapshot(
     workspaceId: string,
     snapshot: GoalSnapshot
-  ): Promise<boolean> {
-    const activity = await this.extensionMetadata.getSnapshot(workspaceId);
+  ): Promise<"delivered" | "no_baseline" | "unavailable"> {
+    let activity: WorkspaceActivitySnapshot | null;
+    try {
+      activity = await this.extensionMetadata.getSnapshot(workspaceId, { throwOnError: true });
+    } catch (error) {
+      // A suspect baseline (failed sidecar reconcile / unreadable main)
+      // must not feed an emitted overlay: partial-main fields would clear
+      // status in the renderer. "unavailable" is deliberately DISTINCT from
+      // the authoritative "no_baseline": the durable pushSnapshot fallback
+      // writes through the lenient load (accepting the same suspect partial
+      // main this strict read refused) and emits the result — converting
+      // this failure into that fallback would clear exactly the renderer
+      // state the strict read preserves.
+      log.debug("Skipping transient goal emit after failed snapshot read", {
+        workspaceId,
+        error,
+      });
+      return "unavailable";
+    }
     if (!activity) {
       // No baseline activity snapshot to overlay the transient goal on
       // (extensionMetadata has no entry for this workspace yet). Callers
       // that must guarantee delivery — e.g. live cost previews — should
-      // observe this `false` return and fall back to `pushSnapshot`, which
+      // observe "no_baseline" and fall back to `pushSnapshot`, which
       // creates the entry and emits via the durable path. Pending-goal
       // publication does not retry here because it only fires after a
       // `setGoal` that already created the entry.
-      return false;
+      return "no_baseline";
     }
     this.onActivityChange?.(workspaceId, {
       ...activity,
       goal: snapshot,
       transientGoalOnly: true,
     });
-    return true;
+    return "delivered";
   }
 
   private async pushLiveGoalPreviewOverlay(
@@ -4114,13 +4131,17 @@ export class WorkspaceGoalService {
       });
       const snapshot = toGoalSnapshot(preview);
       this.liveGoalPreviewSnapshots.set(input.workspaceId, snapshot);
-      const didEmitTransient = await this.pushTransientGoalSnapshot(input.workspaceId, snapshot);
-      if (!didEmitTransient) {
+      const transientResult = await this.pushTransientGoalSnapshot(input.workspaceId, snapshot);
+      if (transientResult === "no_baseline") {
         // If the baseline activity snapshot does not exist yet (for
         // example, extensionMetadata was reset or stream-start's
         // fire-and-forget metadata write has not finished), fall back to
         // the durable path so this preview is still delivered to Goals UI
-        // subscribers instead of being dropped.
+        // subscribers instead of being dropped. "unavailable" must NOT take
+        // this path: the durable write's lenient load would accept the
+        // suspect partial main the strict read refused and emit it,
+        // clearing renderer goal/status state — return the computed preview
+        // without delivery instead (renderer keeps last-known state).
         return this.pushSnapshot(input.workspaceId, preview);
       }
       return snapshot;