@code-yeongyu/senpi-agent-core 2026.10.27-2 → 2026.10.30-2

package/dist/durable/wake-host-bun-timer.js

@@ -0,0 +1,66 @@
+const DEFAULT_MAX_DELAY_MS = 60_000;
+const defaultSetTimer = (callback, ms) => {
+    const handle = setTimeout(callback, ms);
+    return () => clearTimeout(handle);
+};
+export function createBunTimerHost(options) {
+    const now = options.now ?? Date.now;
+    const setTimer = options.setTimer ?? defaultSetTimer;
+    const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+    const entries = new Map();
+    const delivering = new Set();
+    function schedule(key, entry, retry = false) {
+        entry.cancel?.();
+        entry.cancel = undefined;
+        if (entry.at === undefined || entries.get(key) !== entry || delivering.has(key))
+            return;
+        const delay = retry ? maxDelayMs : Math.min(Math.max(0, entry.at - now()), maxDelayMs);
+        entry.cancel = setTimer(() => tick(key, entry), delay);
+    }
+    async function tick(key, entry) {
+        entry.cancel = undefined;
+        const firedAt = entry.at;
+        if (firedAt === undefined || entries.get(key) !== entry)
+            return;
+        if (now() < firedAt)
+            return schedule(key, entry);
+        delivering.add(key);
+        try {
+            await entry.onFire();
+        }
+        catch (error) {
+            options.onFireError(key, error);
+        }
+        finally {
+            delivering.delete(key);
+            const current = entries.get(key);
+            if (current !== undefined)
+                schedule(key, current, current === entry && current.at === firedAt);
+        }
+    }
+    return {
+        async openAlarm(key, persistence, onFire, alarmOptions = {}) {
+            const entry = { at: await persistence.read(), cancel: undefined, onFire };
+            entries.get(key)?.cancel?.();
+            entries.set(key, entry);
+            schedule(key, entry);
+            const write = async (at) => {
+                if (entries.get(key) !== entry)
+                    throw new Error(`the alarm instance of ${key} was replaced by a newer one`);
+                const point = (stage) => alarmOptions.onAlarmPoint?.(at === undefined ? { op: "clear", at: stage } : { op: "set", at: stage, time: at });
+                point("before");
+                await persistence.write(at);
+                entry.at = at;
+                schedule(key, entry);
+                point("durable");
+            };
+            return { read: () => persistence.read(), set: (at) => write(at), clear: () => write(undefined) };
+        },
+        close() {
+            for (const entry of entries.values())
+                entry.cancel?.();
+            entries.clear();
+        },
+    };
+}
+//# sourceMappingURL=wake-host-bun-timer.js.map

package/dist/durable/wake-host-store-alarm.d.ts

@@ -0,0 +1,13 @@
+import type { DurableStore } from "./store.ts";
+/** Where a timer host keeps one session's armed alarm, durably. */
+export interface AlarmPersistence {
+    read(): Promise<number | undefined>;
+    /** Durably arm at `at`, or clear with `undefined`. */
+    write(at: number | undefined): Promise<void>;
+}
+/**
+ * The alarm as a document in the session's own DurableStore, written under the owner `epoch`: an old owner's alarm
+ * write is refused (`stale-epoch`) like any other write of it, and the alarm moves with the store on claim + import.
+ */
+export declare function storeAlarmPersistence(store: DurableStore, epoch: number): AlarmPersistence;
+//# sourceMappingURL=wake-host-store-alarm.d.ts.map

package/dist/durable/wake-host-store-alarm.js

@@ -0,0 +1,20 @@
+const WAKE_ALARM_DOCUMENT = "durable.wake.alarm";
+/**
+ * The alarm as a document in the session's own DurableStore, written under the owner `epoch`: an old owner's alarm
+ * write is refused (`stale-epoch`) like any other write of it, and the alarm moves with the store on claim + import.
+ */
+export function storeAlarmPersistence(store, epoch) {
+    return {
+        read: async () => {
+            const at = await store.getDocument(WAKE_ALARM_DOCUMENT);
+            return typeof at === "number" ? at : undefined;
+        },
+        write: async (at) => {
+            const write = at === undefined
+                ? { op: "delete", key: WAKE_ALARM_DOCUMENT }
+                : { op: "put", key: WAKE_ALARM_DOCUMENT, data: at };
+            await store.commit(epoch, [write], () => { });
+        },
+    };
+}
+//# sourceMappingURL=wake-host-store-alarm.js.map

package/dist/durable/wake-host.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The WakeHost contract of the durable core (packages/agent/docs/durable-core-adr.md): wake ordering for hosts that can
+ * be evicted (a Durable Object) or put to sleep (a laptop). A process timer is lost with its host and runs late across
+ * a sleep, so the host keeps a durable alarm and follows one ordering, shared by every host here:
+ *
+ * - admit: arm a recovery heartbeat durably BEFORE work that can commit starts. A commit whose host dies before the
+ *   alarm update would otherwise strand its wake; an early alarm is harmless, a missing one loses work. The host counts
+ *   admissions in flight and arms as active while any is, so no concurrent update or fire can clear that heartbeat
+ *   before the admitted work commits; when the last admitted work succeeds, it arms from the loop's wake.
+ * - update: after each commit, arm min(heartbeat if active, the loop's earliest wake); clear only when idle.
+ * - fire: re-arm the heartbeat before resuming, so a resume that dies is retried; then arm from the loop's wake.
+ * - start (a new instance): arm a fallback before anything can throw, then resume what a lost instance left.
+ *
+ * Timers inside the loop are not the WakeHost's. Where a host can neither be evicted nor sleep it reduces to a timer.
+ */
+/** The loop's wake state: `active` while some work can run now or is running; `at`, the earliest later wake. */
+export interface Wake {
+    readonly active: boolean;
+    readonly at?: number;
+}
+/** A host's durable alarm for one session; the armed time (epoch ms) survives instance loss and host restarts. */
+export interface WakeAlarm {
+    read(): Promise<number | undefined>;
+    set(at: number): Promise<void>;
+    clear(): Promise<void>;
+}
+/** A point inside an alarm write. `before`: nothing is durable yet. `durable`: the write is durable. */
+export type WakeAlarmPoint = {
+    readonly op: "set";
+    readonly at: "before" | "durable";
+    readonly time: number;
+} | {
+    readonly op: "clear";
+    readonly at: "before" | "durable";
+    readonly time?: undefined;
+};
+export interface WakeAlarmOptions {
+    /** Test seam for cuts and kills: a throw at `before` leaves the alarm unchanged, at `durable` leaves it written. */
+    readonly onAlarmPoint?: (point: WakeAlarmPoint) => void;
+}
+/** The point after an operation's arm is durable and before its work (`admit`) or resume (`start`, `fire`) runs. */
+export interface WakePoint {
+    readonly op: "start" | "admit" | "fire";
+    readonly at: "armed";
+}
+export interface WakeHostOptions {
+    readonly alarm: WakeAlarm;
+    /** The host clock, epoch milliseconds; the same clock the loop's wake times use. */
+    readonly now: () => number;
+    readonly wake: () => Wake;
+    /** Run what the loop can run now: due wakes and work a lost instance left. Resolves when it has. */
+    readonly resume: () => Promise<void>;
+    /** The recovery interval while work is active or admitted. Default 60 s. */
+    readonly heartbeatMs?: number;
+    /** Test seam for kills between an arm and the work it protects. */
+    readonly onWakePoint?: (point: WakePoint) => void;
+}
+export interface WakeHost {
+    /** A new instance: arm a fallback, resume, then arm from the loop's wake. */
+    start(): Promise<void>;
+    /** Run work that can commit, after a recovery heartbeat is durable. */
+    admit<T>(work: () => Promise<T>): Promise<T>;
+    update(wake: Wake): Promise<void>;
+    /** The alarm fired: re-arm the heartbeat, resume, then arm from the loop's wake. */
+    fire(): Promise<void>;
+}
+export declare function createWakeHost(options: WakeHostOptions): WakeHost;
+//# sourceMappingURL=wake-host.d.ts.map

package/dist/durable/wake-host.js

@@ -0,0 +1,70 @@
+/**
+ * The WakeHost contract of the durable core (packages/agent/docs/durable-core-adr.md): wake ordering for hosts that can
+ * be evicted (a Durable Object) or put to sleep (a laptop). A process timer is lost with its host and runs late across
+ * a sleep, so the host keeps a durable alarm and follows one ordering, shared by every host here:
+ *
+ * - admit: arm a recovery heartbeat durably BEFORE work that can commit starts. A commit whose host dies before the
+ *   alarm update would otherwise strand its wake; an early alarm is harmless, a missing one loses work. The host counts
+ *   admissions in flight and arms as active while any is, so no concurrent update or fire can clear that heartbeat
+ *   before the admitted work commits; when the last admitted work succeeds, it arms from the loop's wake.
+ * - update: after each commit, arm min(heartbeat if active, the loop's earliest wake); clear only when idle.
+ * - fire: re-arm the heartbeat before resuming, so a resume that dies is retried; then arm from the loop's wake.
+ * - start (a new instance): arm a fallback before anything can throw, then resume what a lost instance left.
+ *
+ * Timers inside the loop are not the WakeHost's. Where a host can neither be evicted nor sleep it reduces to a timer.
+ */
+const DEFAULT_HEARTBEAT_MS = 60_000;
+/** The alarm time for a wake state: a heartbeat while active, never later than the earliest wake. */
+function recoveryAlarmAt(wake, now, heartbeatMs) {
+    const heartbeat = wake.active ? now + heartbeatMs : undefined;
+    if (heartbeat === undefined)
+        return wake.at;
+    return wake.at === undefined ? heartbeat : Math.min(heartbeat, wake.at);
+}
+export function createWakeHost(options) {
+    const { alarm, now, wake, resume } = options;
+    const heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+    const point = (op) => options.onWakePoint?.({ op, at: "armed" });
+    let admitted = 0;
+    const arm = async (state) => {
+        const at = recoveryAlarmAt(admitted > 0 ? { ...state, active: true } : state, now(), heartbeatMs);
+        if (at === undefined)
+            await alarm.clear();
+        else
+            await alarm.set(at);
+    };
+    return {
+        async start() {
+            const fallback = now() + heartbeatMs;
+            const current = await alarm.read();
+            if (current === undefined || current > fallback)
+                await alarm.set(fallback);
+            point("start");
+            await resume();
+            await arm(wake());
+        },
+        async admit(work) {
+            admitted++;
+            let result;
+            try {
+                await arm({ ...wake(), active: true });
+                point("admit");
+                result = await work();
+            }
+            finally {
+                admitted--;
+            }
+            if (admitted === 0)
+                await arm(wake());
+            return result;
+        },
+        update: (state) => arm(state),
+        async fire() {
+            await arm({ ...wake(), active: true });
+            point("fire");
+            await resume();
+            await arm(wake());
+        },
+    };
+}
+//# sourceMappingURL=wake-host.js.map

package/dist/harness/utils/read-folders/index.d.ts

@@ -3,7 +3,7 @@ export * from "./types.ts";
 /** Frozen measured selection, not a runtime registry that can enable unmeasured grammars. */
 export declare const READ_FOLDER_SELECTION: Readonly<{
     readonly head: "6da8ef1361ef73928df8685e071f2a1826d3b17e";
-    readonly selectionSha256: "d7c502a1597e652f584877c0004ba6cde7c9393c8661ccbc388e3661ae66a634";
+    readonly selectionSha256: "dd4b1fa66ed151e330cd7efaf7ca649d244257d52e2a79422e868da60c0edd8b";
     readonly wasm: true;
     readonly rawReasons: Readonly<{
         readonly ts: "wasm_candidate_below_threshold";

package/dist/harness/utils/read-folders/index.js

@@ -4,7 +4,7 @@ export * from "./types.js";
 /** Frozen measured selection, not a runtime registry that can enable unmeasured grammars. */
 export const READ_FOLDER_SELECTION = Object.freeze({
     head: "6da8ef1361ef73928df8685e071f2a1826d3b17e",
-    selectionSha256: "d7c502a1597e652f584877c0004ba6cde7c9393c8661ccbc388e3661ae66a634",
+    selectionSha256: "dd4b1fa66ed151e330cd7efaf7ca649d244257d52e2a79422e868da60c0edd8b",
     wasm: true,
     rawReasons: Object.freeze({
         ts: "wasm_candidate_below_threshold",

package/dist/harness/utils/read-folders/tree-sitter/engine.d.ts

@@ -11,7 +11,7 @@ export type TreeSitterFolderOptions = {
     readonly parseBudgetMs?: number;
     readonly resolveGrammar?: GrammarResolver;
     readonly resolveRuntime?: () => Promise<string | undefined>;
-    /** Off for tests that inject resolvers; the shipped read path always shares one loaded grammar. */
+    /** Controls grammar/parser sharing; runtime initialization is always shared by resolved path. */
     readonly cache?: boolean;
 };
 /**

package/dist/harness/utils/read-folders/tree-sitter/engine.js

@@ -5,32 +5,47 @@ import { foldRangesFromSyntax } from "./syntax.js";
 export const TREE_SITTER_PARSE_BUDGET_MS = 250;
 export const TREE_SITTER_FOLDER_ID = "tree-sitter-wasm";
 export const TREE_SITTER_FOLDER_VERSION = "1";
-let runtime;
+const runtimes = new Map();
 const grammars = new Map();
-async function loadRuntime(resolveRuntime) {
-    try {
+// Parser.init and Language.load share process-global state, even across cache resets.
+let runtimeLoads = Promise.resolve();
+function loadRuntime(wasm) {
+    const existing = runtimes.get(wasm);
+    if (existing)
+        return existing;
+    const pending = runtimeLoads
+        .then(async () => {
         const module = await import("web-tree-sitter");
-        const wasm = await resolveRuntime();
         await module.Parser.init(wasm ? { locateFile: () => wasm } : undefined);
         return module;
-    }
-    catch {
+    })
+        .catch(() => {
+        if (runtimes.get(wasm) === pending)
+            runtimes.delete(wasm);
         return undefined;
-    }
+    });
+    runtimes.set(wasm, pending);
+    return pending;
 }
 async function loadParser(language, options) {
-    const resolveGrammar = options.resolveGrammar ?? resolveGrammarPath;
-    const resolveRuntime = options.resolveRuntime ?? resolveRuntimePath;
-    const grammar = await resolveGrammar(language);
-    if (!grammar)
+    try {
+        const grammar = await (options.resolveGrammar ?? resolveGrammarPath)(language);
+        // A missing grammar is a stable negative cache entry, not a failed load.
+        if (!grammar)
+            return null;
+        const wasm = await (options.resolveRuntime ?? resolveRuntimePath)();
+        const runtime = loadRuntime(wasm);
+        const pending = runtimeLoads.then(async () => {
+            const module = await runtime;
+            return module && instantiate(module, grammar, language);
+        });
+        // Reserve the whole init/grammar operation before another path can enqueue an init.
+        runtimeLoads = pending.then(() => undefined);
+        return pending;
+    }
+    catch {
         return undefined;
-    if (options.cache === false) {
-        const module = await loadRuntime(resolveRuntime);
-        return module && instantiate(module, grammar, language);
     }
-    runtime ??= loadRuntime(resolveRuntime);
-    const module = await runtime;
-    return module && instantiate(module, grammar, language);
 }
 async function instantiate(module, grammar, language) {
     try {
@@ -76,7 +91,11 @@ export async function loadTreeSitterFolder(language, options) {
         ? load()
         : (grammars.get(language) ??
             (() => {
-                const pending = load();
+                const pending = load().then((loaded) => {
+                    if (loaded === undefined && grammars.get(language) === pending)
+                        grammars.delete(language);
+                    return loaded;
+                });
                 grammars.set(language, pending);
                 return pending;
             })()));
@@ -91,7 +110,7 @@ export async function loadTreeSitterFolder(language, options) {
 }
 /** Test seam: drop the memoized runtime/grammars so a resolver change is observable. */
 export function resetTreeSitterGrammars() {
-    runtime = undefined;
+    runtimes.clear();
     grammars.clear();
 }
 //# sourceMappingURL=engine.js.map

package/dist/stream-keepalive.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Transport liveness for one provider request (senpi#4608).
+ *
+ * The loop's silence bounds count public assistant events. A provider that accepted the request and keeps its
+ * connection alive - SSE `ping` events, `:` comment keep-alives a relay sends while the upstream model is still
+ * thinking - emits none of those, so a slow first token used to be killed as if the connection were dead. Providers
+ * report received bytes through `onTransportActivity`; a silence bound that fires within one bound of the last
+ * byte is extended instead of ending the request, and keep-alives alone are bounded by their own budget.
+ */
+export declare class StreamKeepAliveTimeoutError extends Error {
+    constructor(timeoutMs: number);
+}
+export type SilenceDeadlineVerdict = {
+    kind: "expire";
+} | {
+    kind: "extend";
+    delayMs: number;
+} | {
+    kind: "keep-alive-exhausted";
+    error: StreamKeepAliveTimeoutError;
+};
+export interface TransportLiveness {
+    readonly noteActivity: () => void;
+    contentArrived(): void;
+    onSilenceDeadline(windowMs: number): SilenceDeadlineVerdict;
+}
+export declare function createTransportLiveness(keepAliveTimeoutMs: number | undefined): TransportLiveness;
+//# sourceMappingURL=stream-keepalive.d.ts.map

package/dist/stream-keepalive.js

@@ -0,0 +1,42 @@
+/**
+ * Transport liveness for one provider request (senpi#4608).
+ *
+ * The loop's silence bounds count public assistant events. A provider that accepted the request and keeps its
+ * connection alive - SSE `ping` events, `:` comment keep-alives a relay sends while the upstream model is still
+ * thinking - emits none of those, so a slow first token used to be killed as if the connection were dead. Providers
+ * report received bytes through `onTransportActivity`; a silence bound that fires within one bound of the last
+ * byte is extended instead of ending the request, and keep-alives alone are bounded by their own budget.
+ */
+// The wording keeps "timed out" so the retryable-error classifier treats it like the other stream bounds.
+export class StreamKeepAliveTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`Provider stream sent only keep-alives and timed out after ${timeoutMs}ms (raise streamKeepAliveTimeoutMs: retry.provider.keepAliveTimeoutMs in senpi settings; 0 disables)`);
+        this.name = "StreamKeepAliveTimeoutError";
+    }
+}
+export function createTransportLiveness(keepAliveTimeoutMs) {
+    let lastActivityAt;
+    let contentSilenceSince = Date.now();
+    return {
+        noteActivity: () => {
+            lastActivityAt = Date.now();
+        },
+        contentArrived: () => {
+            contentSilenceSince = Date.now();
+        },
+        onSilenceDeadline: (windowMs) => {
+            const now = Date.now();
+            if (lastActivityAt === undefined || now - lastActivityAt >= windowMs)
+                return { kind: "expire" };
+            const delayMs = windowMs - (now - lastActivityAt);
+            if (keepAliveTimeoutMs === undefined)
+                return { kind: "extend", delayMs };
+            const keepAliveLeftMs = keepAliveTimeoutMs - (now - contentSilenceSince);
+            if (keepAliveLeftMs <= 0) {
+                return { kind: "keep-alive-exhausted", error: new StreamKeepAliveTimeoutError(keepAliveTimeoutMs) };
+            }
+            return { kind: "extend", delayMs: Math.max(1, Math.min(delayMs, keepAliveLeftMs)) };
+        },
+    };
+}
+//# sourceMappingURL=stream-keepalive.js.map

package/dist/testing/win32-sim.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Win32 simulation profile for code-level Windows tests on any host (test support only; no product code imports it).
+ *
+ * It simulates five Windows behaviors:
+ * - `\` paths with a drive letter (`C:\dir\file`), mapped onto a backing POSIX directory;
+ * - case-insensitive, case-preserving names;
+ * - named-pipe endpoints (`\\.\pipe\<name>`), which are not filesystem paths;
+ * - `EBUSY`/`EPERM` on rename or delete of a file that is open;
+ * - signal-less process termination: a supported signal terminates at once and no handler runs.
+ */
+import type { ChildProcess } from "node:child_process";
+import * as fsp from "node:fs/promises";
+type Win32ErrorCode = "EBUSY" | "EPERM" | "ENOSYS";
+export type Win32OpenFileErrorCode = "EBUSY" | "EPERM";
+/** The errno error shape Node throws on Windows, with `dest` for two-path calls such as rename. */
+export interface Win32ErrnoException extends NodeJS.ErrnoException {
+    dest?: string;
+}
+/** Builds the error Node throws on Windows for `code` from `syscall`. */
+export declare function win32Error(code: Win32ErrorCode, syscall: string, filePath?: string, dest?: string): Win32ErrnoException;
+/** Compares two Windows names (path segments, paths or pipe names) the way Windows does: case-insensitively. */
+export declare function win32NamesEqual(left: string, right: string): boolean;
+/** Turns a relative POSIX-style path (`dir/file`) into a drive-letter Windows path (`C:\dir\file`). */
+export declare function toWin32Path(relativePath: string, drive?: string): string;
+/** True for an absolute drive-letter path such as `C:\dir` (forward slashes are accepted, as on Windows). */
+export declare function isWin32DrivePath(candidate: string): boolean;
+export declare const WIN32_PIPE_PREFIX = "\\\\.\\pipe\\";
+/** Builds the named-pipe endpoint (`\\.\pipe\<name>`) a Windows transport listens on instead of a socket file. */
+export declare function win32PipeEndpoint(name: string): string;
+/** True when `endpoint` is a local named-pipe endpoint; the prefix is matched case-insensitively, as on Windows. */
+export declare function isWin32PipeEndpoint(endpoint: string): boolean;
+export interface Win32SimFsOptions {
+    /** Backing POSIX directory; drive `C:` maps to `<root>/C`. */
+    root: string;
+    /** Error for a rename whose source or destination is open. Default `EPERM`. */
+    renameOpenFileError?: Win32OpenFileErrorCode;
+    /** Error for an unlink or rm that would remove an open file. Default `EBUSY`. */
+    deleteOpenFileError?: Win32OpenFileErrorCode;
+}
+/** An open file in a {@link Win32SimFs}; the file counts as open until `close()`. */
+export interface Win32SimFileHandle {
+    readonly handle: fsp.FileHandle;
+    close(): Promise<void>;
+}
+/**
+ * A filesystem that behaves like Windows over a backing directory: it takes only drive-letter paths, resolves every
+ * segment case-insensitively while keeping the case a name was created with, and refuses to rename or delete an open
+ * file with Windows errors.
+ */
+export declare class Win32SimFs {
+    #private;
+    constructor(options: Win32SimFsOptions);
+    /** Maps a drive-letter path to its backing path, matching existing names case-insensitively. */
+    resolve(win32Path: string): Promise<string>;
+    mkdir(win32Path: string): Promise<void>;
+    writeFile(win32Path: string, data: string | Uint8Array): Promise<void>;
+    readFile(win32Path: string): Promise<Buffer>;
+    /** Names in a directory, in the case each was created with. */
+    readdir(win32Path: string): Promise<string[]>;
+    exists(win32Path: string): Promise<boolean>;
+    /** Opens a file; until `close()` it cannot be renamed or deleted. */
+    open(win32Path: string, flags?: string): Promise<Win32SimFileHandle>;
+    /** Renames or replaces a file; a rename that only changes a name's case keeps one entry with the new case. */
+    rename(from: string, to: string): Promise<void>;
+    unlink(win32Path: string): Promise<void>;
+    /** Like `fs.rm` with `recursive`; fails with the delete error while any file at or under the path is open. */
+    rm(win32Path: string): Promise<void>;
+}
+/**
+ * Sends `signal` with Windows semantics. Signal `0` only probes liveness. A supported signal terminates the process
+ * immediately, so no signal handler runs (the POSIX child is sent `SIGKILL` and reports it). Any other signal throws
+ * `ENOSYS` and leaves the process running.
+ */
+export declare function win32Kill(target: ChildProcess | number, signal?: NodeJS.Signals | 0): boolean;
+export {};
+//# sourceMappingURL=win32-sim.d.ts.map