@bridge4dev/runner 0.42.0 → 0.44.1

package/dist/supervisor.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { log } from './log.js';
 import { claimAutoResume, clearAutoResume, pruneAutoResume } from './auto-resume.js';
+import { classifyFailure, isRepeatOfSameFailure, MAX_RETRIES_PER_SESSION, retryDelayMs, } from './adapters/error-policy.js';
 import { evaluateRecipeCommand, maskSecrets, maskString } from './policy.js';
 import { agentPromptSizeLabel, inspectAgentPrompt, quotePath, readAgentPrompt, } from './agent-prompt.js';
 import { JournalStore } from './journal.js';
@@ -480,6 +481,10 @@ export class Supervisor {
             return LAUNCH_REFUSED;
         }
         running.lastPrompt = prompt;
+        // #252: a launch is also the start of a turn, so the retry path needs it too.
+        // Both are set here and only here they agree; `deliverMessage` moves the
+        // second one on its own afterwards.
+        running.lastTurnPrompt = prompt;
         // Facts about this session only, plus the one file the project named. The
         // rest of the project's documentation is read by each agent itself — see
         // `composeWorkspaceContext`.
@@ -897,6 +902,7 @@ export class Supervisor {
         // full disk, a daemon already shutting down) must not take the exit path
         // with it, because everything below it is cleanup.
         try {
+            this.clearApiRetry(running);
             this.withdrawOpenQuestions(running, 'session_stopped');
         }
         catch (error) {
@@ -1328,6 +1334,13 @@ export class Supervisor {
                 });
                 return;
             case 'turn_end': {
+                // #252: decided BEFORE the frame goes out. A `turn_end{ok:false}` files
+                // the session as FAILED, and FAILED is terminal — a session we intend to
+                // retry must never be told it has ended. So a turn that is going to be
+                // retried emits no `turn_end` at all; exactly one leaves this session,
+                // when it finally succeeds or finally gives up.
+                if (!event.ok && this.armApiRetry(running, descriptor, event))
+                    return;
                 this.sendEvent(running, 'turn_end', {
                     ok: event.ok,
                     errorMessage: event.errorMessage,
@@ -1813,7 +1826,138 @@ export class Supervisor {
      * resolves them and a refusal puts exactly those records back in the queue —
      * the message is retired from disk only once an agent has it.
      */
+    /**
+     * Should this failed turn be retried by itself, and if so, arm it (#252, #257).
+     *
+     * Returns `true` when a retry is armed, and the caller must then emit NOTHING —
+     * a `turn_end{ok:false}` files the session as FAILED, which is terminal, and a
+     * session we intend to retry cannot be told it has ended.
+     *
+     * The owner's standing priority governs every branch here: «лучше, чтобы ретрай
+     * не сработал, чем сработал там, где не нужно». So this reads as a list of
+     * reasons to decline, and the permission is the last thing it reaches.
+     */
+    armApiRetry(running, descriptor, event) {
+        // A refusal by the plan is not a failure to repeat — it is a pause measured
+        // in hours, and the API has already armed a clock for it (#258). Retrying
+        // into a spent limit changes nothing and would fight the pause.
+        if (event.limitBlocked === true)
+            return false;
+        // The session is on its way out with a meaning of its own.
+        if (running.stopRequested || running.budgetSpent || running.parkRequested)
+            return false;
+        if (Supervisor.isPaused(running))
+            return false;
+        // An open card means the agent asked the person something. Retrying would
+        // orphan the card, and — worse — the suppressed `turn_end` is what clears the
+        // API's open-ask counter, so the session would sit unanswerable.
+        if (running.openQuestions.size > 0)
+            return false;
+        // The ceiling that does not depend on the table being right.
+        if ((running.apiRetriesUsed ?? 0) >= MAX_RETRIES_PER_SESSION)
+            return false;
+        const decision = classifyFailure({
+            provider: descriptor.agent === 'CODEX' ? 'codex' : 'claude',
+            code: typeof event['failureCode'] === 'string' ? event['failureCode'] : null,
+            status: typeof event['failureStatus'] === 'number' ? event['failureStatus'] : null,
+            text: event.errorMessage ?? null,
+            produced: event['produced'] === true,
+            irreversible: event['irreversible'] === true,
+        });
+        if (decision.bucket === 'stop')
+            return false;
+        // Pinned to a local: the narrowing above does not survive into the timer's
+        // closure, and widening it back to `RetryBucket` there would let a `stop`
+        // through as if it were a permission.
+        const bucket = decision.bucket;
+        // The same failure came straight back. Spending the rest of the allowance on
+        // it proves nothing — it is a deterministic fault wearing a transient face.
+        const previous = running.apiRetry?.ruleId ?? null;
+        const attempt = (running.apiRetry?.attempt ?? 0) + 1;
+        if (attempt > 1 && isRepeatOfSameFailure(previous, decision)) {
+            this.clearApiRetry(running);
+            this.sendEvent(running, 'system_note', {
+                code: 'agent_retry',
+                text: 'The same failure came back after an automatic retry — stopping so a person can look.',
+            });
+            return false;
+        }
+        if (attempt > decision.attempts) {
+            this.clearApiRetry(running);
+            return false;
+        }
+        const delay = retryDelayMs(decision.backoff, attempt);
+        const at = new Date(Date.now() + delay);
+        const timer = setTimeout(() => {
+            this.runApiRetry(running, bucket);
+        }, delay);
+        timer.unref();
+        running.apiRetry = { timer, attempt, ruleId: decision.ruleId };
+        running.apiRetriesUsed = (running.apiRetriesUsed ?? 0) + 1;
+        // Supervisor-minted rather than an adapter notice: adapter notices are
+        // de-duplicated for the session's whole life, so «attempt 2» would appear
+        // once and never again (gotcha #148).
+        this.sendEvent(running, 'system_note', {
+            code: 'agent_retry',
+            text: `${bucket === 'continue' ? 'The answer was cut off part-way' : 'The provider could not be reached'} — ` +
+                `attempt ${attempt} of ${decision.attempts}, next at ${at.toISOString().slice(11, 16)} UTC. ` +
+                'This is a fault on the provider’s side, not in the task.',
+        });
+        this.reportStatus(descriptor.id, 'RUNNING', {});
+        return true;
+    }
+    /** Fire an armed retry — re-checking, at FIRE time, everything that could have changed. */
+    runApiRetry(running, bucket) {
+        const armed = running.apiRetry;
+        if (!armed)
+            return;
+        // Everything below changed while we waited, and every one of them means the
+        // retry must not happen. Checked here rather than only at arm time: the wait
+        // is minutes long, which is plenty of time for a person to press Stop, for a
+        // budget to run out, or for a limit pause to start.
+        if (running.stopRequested ||
+            running.budgetSpent ||
+            running.parkRequested ||
+            Supervisor.isPaused(running) ||
+            running.openQuestions.size > 0) {
+            this.clearApiRetry(running);
+            return;
+        }
+        if (!running.session) {
+            // The process died while we waited. Relaunching is `launchAgent`'s job and
+            // it needs a prompt; without one there is nothing honest to do here.
+            this.clearApiRetry(running);
+            this.reportStatus(running.descriptor.id, 'FAILED', {
+                errorMessage: 'The agent process ended while waiting to retry',
+            });
+            return;
+        }
+        // Never a re-send of the prompt when work was already done: `continue` asks
+        // the agent to look at what it did and carry on, which is exactly what the
+        // owner used to type by hand. `auto-resume.ts` records the cost of getting
+        // this backwards — a re-sent prompt ran a fifteen-minute command twice.
+        const text = bucket === 'continue'
+            ? 'The connection to the model dropped part-way through your previous answer — not by ' +
+                'anything you did, and nothing is wrong with the work. Check what you had already ' +
+                'finished before redoing any of it, then continue from where you stopped.'
+            : (running.lastTurnPrompt ?? 'Continue.');
+        running.session.send(text);
+        this.reportStatus(running.descriptor.id, 'RUNNING', {});
+    }
+    /** Disarm a pending retry — always through here, so no timer is ever orphaned. */
+    clearApiRetry(running) {
+        if (!running.apiRetry)
+            return;
+        clearTimeout(running.apiRetry.timer);
+        delete running.apiRetry;
+    }
     deliverMessage(running, text, held = [], originSeq) {
+        // #252: a person typing is the clearest possible evidence that the work is
+        // back on track — the same reasoning `clearAutoResume` is built on. Their
+        // words also supersede whatever we were about to retry, so any armed timer
+        // is disarmed rather than left to fire into a conversation that has moved on.
+        this.clearApiRetry(running);
+        running.apiRetriesUsed = 0;
         // Older instructions are already waiting: send them together, in order.
         // Without this a message that CAN go now jumps the queue — and the ones it
         // jumped are stranded, because the drain only runs when a process exits
@@ -1844,6 +1988,11 @@ export class Supervisor {
             }
         };
         if (running.session && !running.parkRequested) {
+            // #252: the words this turn is actually running. `lastPrompt` deliberately
+            // stays put — three older latches relaunch a PROCESS with it, and handing
+            // them a follow-up line instead of the task would start a fresh
+            // conversation with «продолжай».
+            running.lastTurnPrompt = text;
             running.session.send(text);
             settle();
             this.reportStatus(running.descriptor.id, 'RUNNING', {});
@@ -2281,6 +2430,7 @@ export class Supervisor {
             running.session.stop('session_stopped'); // pumpEvents finishes the cleanup
         }
         else {
+            this.clearApiRetry(running);
             this.withdrawOpenQuestions(running, 'session_stopped');
             this.reportStatus(sessionId, 'STOPPED', { activeMs: running.activeMs });
             this.sessions.delete(sessionId);
@@ -2318,6 +2468,7 @@ export class Supervisor {
                 running.session.stop('session_stopped'); // pumpEvents finishes the cleanup
             }
             else {
+                this.clearApiRetry(running);
                 this.withdrawOpenQuestions(running, 'session_stopped');
                 this.sessions.delete(sessionId);
             }

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const RUNNER_VERSION = "0.42.0";
+export declare const RUNNER_VERSION = "0.44.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in sync with package.json by the release script (manual for now).
-export const RUNNER_VERSION = '0.42.0';
+export const RUNNER_VERSION = '0.44.1';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bridge4dev/runner",
-  "version": "0.42.0",
+  "version": "0.44.1",
   "description": "DevBridge dev runner — connects a dev server to DevBridge and runs agent sessions (Claude Code / Codex)",
   "homepage": "https://bridge4.dev",
   "license": "MIT",