@agent-compose/sdk 0.8.4 → 0.8.6

package/src/agent/desktop-open.ts

@@ -392,12 +392,24 @@ export function browserBackfillCmd(): string {
   // browser without flags is a failed heal, reported as one.
   // installChromiumDefaultsCmd() is quote-free by construction, so it embeds
   // verbatim in this single-quoted payload.
+  //
+  // `chromium x11-utils luit-` mirrors — and heals — the luit/x11-utils
+  // conflict the bake fixed in 8ba2d96b but this line never got: bookworm's
+  // xterm Recommends `luit | x11-utils (<< 7.7+6~)`, so grandfathered images
+  // (baked before 2026-08-16) carry standalone `luit`, which
+  // `Breaks: x11-utils (<< 7.7+6)` — and chromium hard-Depends on x11-utils
+  // via chromium-common. Bare `apt-get install chromium` into that state is
+  // pkgProblemResolver exit 100, on EVERY fresh boot, forever (the exact
+  // `backfill-install=failed` storm of 2026-08-30). Naming x11-utils is not
+  // enough here — luit is already INSTALLED — so the trailing `luit-` tells
+  // apt to remove it in the same transaction (a no-op where it's absent,
+  // e.g. post-8ba2d96b images where chromium is present anyway).
   return (
     `mkdir -p ${AC_OPEN_STATE_DIR} && ` +
     `if command -v chromium >/dev/null 2>&1; then echo backfill=present; ` +
     `elif [ -f ${pid} ] && kill -0 "$(cat ${pid} 2>/dev/null)" 2>/dev/null; then echo backfill=in-progress; ` +
     `else rm -f ${BROWSER_BACKFILL_FAILED}; ` +
-    `setsid sh -c 'if apt-get update -q && DEBIAN_FRONTEND=noninteractive apt-get install -y -q chromium && command -v chromium >/dev/null 2>&1 && ${installChromiumDefaultsCmd()}; then echo backfill-install=ok; else echo backfill-install=failed; touch ${BROWSER_BACKFILL_FAILED}; fi; rm -f ${pid}' </dev/null >>${BROWSER_BACKFILL_LOG} 2>&1 & ` +
+    `setsid sh -c 'if apt-get update -q && DEBIAN_FRONTEND=noninteractive apt-get install -y -q chromium x11-utils luit- && command -v chromium >/dev/null 2>&1 && ${installChromiumDefaultsCmd()}; then echo backfill-install=ok; else echo backfill-install=failed; touch ${BROWSER_BACKFILL_FAILED}; fi; rm -f ${pid}' </dev/null >>${BROWSER_BACKFILL_LOG} 2>&1 & ` +
     `echo $! > ${pid}; echo backfill=started; fi`
   );
 }

package/src/agent/perf-sampler.ts

@@ -47,8 +47,32 @@ export const PERF_PROBE_WINDOW_SECONDS = 2;
 /** The standalone probe's output line leads with this prefix. */
 export const PERF_PROBE_LINE_PREFIX = "perf ";
 
-/** Longest token the parsers accept — anything bigger is garbage. */
-export const PERF_TOKEN_MAX_CHARS = 200;
+/** Longest token the parsers accept — anything bigger is garbage. The
+ *  `top` field (three process names of up to 20 chars with their RSS) is
+ *  what moved this up from 200. */
+export const PERF_TOKEN_MAX_CHARS = 320;
+
+/** THE TOP PROCESSES BY RESIDENT MEMORY ("why was it at 99%?", the
+ *  2026-10-03 flight incident: a 4 vCPU / 8 GB machine sat at 99% memory
+ *  for twelve minutes and nothing recorded what held it): at most this many
+ *  entries ride the token, name and resident MB each. A machine fact, read
+ *  by the same /proc burst; never a judgment. */
+export const PERF_TOP_PROCESSES = 3;
+/** A process name as the token carries it: `comm`, sanitized on the guest
+ *  to this alphabet and length, so it can ride a comma-separated token. */
+export const PERF_TOP_NAME_MAX = 20;
+const TOP_NAME_RE = /^[A-Za-z0-9._-]{1,20}$/;
+/** A process resident set the clamp believes, in MB (a 64 GB machine is
+ *  past every sandbox we run). */
+const TOP_RSS_MAX_MB = 65_536;
+
+/** One process by resident memory. */
+export interface GuestTopProcess {
+  /** Its `comm` (the executable's short name), sanitized. */
+  name: string;
+  /** Resident set in MB, whole. */
+  rssMb: number;
+}
 
 /** One clamped guest perf sample. Null fields = unreadable/absent on the
  *  guest — never zero-filled (a zero is a claim; null is honesty). */
@@ -67,6 +91,9 @@ export interface GuestPerfSample {
   ramMb: number | null;
   /** Guest clock at sample time, epoch seconds. Dedupe only. */
   sampledAtS: number | null;
+  /** The processes holding the most memory, biggest first (`top`); null
+   *  when the guest did not report them (an older image, no `ps`). */
+  topProcesses: GuestTopProcess[] | null;
 }
 
 export interface PerfSamplerPaths {
@@ -113,7 +140,13 @@ function perfReadFunctionFragment(procRoot: string, diskPath: string): string {
     + `if [ "\${ac_pmt:-0}" -gt 0 ] && [ -n "\${ac_pma:-}" ]; then ac_pmem=$(( 100 * (ac_pmt - ac_pma) / ac_pmt )); fi; `
     + `[ "$ac_pmem" -gt 100 ] && ac_pmem=100; [ "$ac_pmem" -lt -1 ] && ac_pmem=-1; `
     + `ac_pdsk=$(df -kP ${disk} 2>/dev/null | awk 'NR==2 && $2>0 {print int(100*$3/$2)}'); `
-    + `ac_tok="v=1,cpu=$ac_pcpu,l1=\${ac_pl1:--1},mem=$ac_pmem,dsk=\${ac_pdsk:--1},vc=\${ac_pvc:-0},ram=$(( \${ac_pmt:-0} / 1024 )),ts=$(date +%s)"; `
+    // The top processes by resident memory (the "why 99%?" fact): three
+    // `comm` names with their RSS in MB, each name sanitized to the token's
+    // alphabet, `;`-joined so the field stays one comma-free word. A guest
+    // whose `ps` lacks `--sort` (not procps) prints nothing and the field is
+    // absent — the parser reads that as "not reported", never as zero.
+    + `ac_ptop=$(ps -eo rss=,comm= --sort=-rss 2>/dev/null | head -${PERF_TOP_PROCESSES} | awk '{ n=$2; gsub(/[^A-Za-z0-9._-]/, "_", n); if (length(n) > ${PERF_TOP_NAME_MAX}) n=substr(n, 1, ${PERF_TOP_NAME_MAX}); if (n == "") n="_"; printf "%s%s:%d", (NR > 1 ? ";" : ""), n, int($1 / 1024) }' 2>/dev/null); `
+    + `ac_tok="v=1,cpu=$ac_pcpu,l1=\${ac_pl1:--1},mem=$ac_pmem,dsk=\${ac_pdsk:--1},vc=\${ac_pvc:-0},ram=$(( \${ac_pmt:-0} / 1024 )),ts=$(date +%s)\${ac_ptop:+,top=$ac_ptop}"; `
     + `}; `;
 }
 
@@ -184,12 +217,30 @@ export function parsePerfToken(token: string): GuestPerfSample | null {
     ramMb: bounded("ram", 1, 16 * 1024 * 1024),
     // Bounded to [2020, 2100) in epoch seconds — dedupe-grade only.
     sampledAtS: bounded("ts", 1_577_836_800, 4_102_444_800),
+    topProcesses: parseTopProcesses(kv.get("top")),
   };
   if (sample.cpuBusyPct === null && sample.load1 === null
     && sample.memUsedPct === null && sample.diskUsedPct === null) return null;
   return sample;
 }
 
+/** The `top` field, clamped entry by entry: a name outside the alphabet or
+ *  an RSS outside [0, 64 GB] drops THAT entry; more than the cap is cut;
+ *  an absent or empty field is null (not reported). */
+export function parseTopProcesses(raw: string | undefined): GuestTopProcess[] | null {
+  if (raw === undefined || raw.length === 0) return null;
+  const out: GuestTopProcess[] = [];
+  for (const entry of raw.split(";").slice(0, PERF_TOP_PROCESSES)) {
+    const i = entry.lastIndexOf(":");
+    if (i <= 0) continue;
+    const name = entry.slice(0, i);
+    const rssMb = Number(entry.slice(i + 1));
+    if (!TOP_NAME_RE.test(name) || !Number.isInteger(rssMb) || rssMb < 0 || rssMb > TOP_RSS_MAX_MB) continue;
+    out.push({ name, rssMb });
+  }
+  return out.length > 0 ? out : null;
+}
+
 /** Parse the standalone probe's stdout (the LAST `perf ` line wins — envd
  *  occasionally prepends shell noise). */
 export function parsePerfProbeOutput(stdout: string): GuestPerfSample | null {

package/src/agent/run-agent.ts

@@ -1,6 +1,6 @@
 /**
  * agent — canonical entry point for embedding an LLM agent inside a
- * workflow. The workflow's `run()` body calls it; the loop executes
+ * workflow. A step's `run()` body calls it; the loop executes
  * against the runner's own VM.
  *
  * Glue packaged so workflows don't duplicate it: