@coreplane/switchboard 1.242.0 → 1.244.0

package/dist/assets/src/core/ship/handoff.ts

@@ -196,6 +196,15 @@ function entryLines(h: Handoff): Array<{ list: ListKey; bullet: string; row: str
   ];
 }
 
+/** Each entry as one line, list by list — a deviation as `Deviation: from → to
+ *  — why`, a follow-up as `what — where`, an unproven criterion as `Unproven:
+ *  criterion — why` — the same words the ledger rows carry, for a reader that
+ *  wants the handoff as plain lines (the thread's artifacts block). Empty for
+ *  an empty handoff. */
+export function handoffLines(h: Handoff): string[] {
+  return entryLines(h).map((e) => e.row);
+}
+
 function prLink(pr: HandoffRenderContext["pr"]): string | undefined {
   return pr ? `[#${pr.number}](${pr.url})` : undefined;
 }

package/dist/assets/src/core/ship/renewal.ts

@@ -0,0 +1,155 @@
+// The renewal decision (decision 0046, Renewal: the grant decides, the lease
+// continues). A lease is sized by the infrastructure; the problem is bounded by
+// the grant. When a segment ends with its unit unfinished, the runner reads
+// progress off the row — never off a model's word — and renews only when three
+// things hold: the row shows progress, the grant has a renewal left and the
+// spend is under its cap, and the pipeline's ask still passes the fit.
+// Otherwise it stops and names the clause that failed; a person's reply spends
+// a renewal by hand. Pure and node-free: the unit machine (a Worker) and the
+// bot's routes compute the same decision from the same facts.
+
+import { fit, type Grant, type Pipeline } from "../budgets.js";
+import type { Handoff } from "./handoff.js";
+
+/** A head the run pushed, as the record carries it (run-history item 2). */
+export interface PushedHeadFact {
+  ref: string;
+  sha: string;
+  at?: number;
+}
+
+export interface ProgressInput {
+  /** The unit's branch: a push to any other ref is not the unit's progress. */
+  branch: string;
+  /** The heads the segment's coding run pushed (`RunRecord.pushed`). */
+  pushed: readonly PushedHeadFact[];
+  /** The head the segment started from — the previous segment's recorded sha.
+   *  Absent on a fresh branch, where any push is progress. */
+  startHead?: string;
+  /** When the segment's lease began; a push stamped before it is not this segment's. */
+  leaseStartedAt?: number;
+  /** The previous segment's handoff and this one's, when both exist. */
+  handoff?: { previous: Handoff; current: Handoff };
+}
+
+export type Progress =
+  | { progressed: true; by: "push"; sha: string }
+  | { progressed: true; by: "handoff" }
+  | { progressed: false; why: string };
+
+/** Two shas name one commit when the shorter is a prefix of the longer. */
+const sameSha = (a: string, b: string): boolean => {
+  const x = a.toLowerCase();
+  const y = b.toLowerCase();
+  return x.length <= y.length ? y.startsWith(x) : x.startsWith(y);
+};
+
+/** Progress is a fact the row records after unit eight and the runner reads
+ *  without a model: the last head pushed to the unit's branch that differs from
+ *  the head the segment started at and is not older than the lease; failing
+ *  that, a handoff whose follow-ups shrank or whose deviations grew. */
+export function progressOf(input: ProgressInput): Progress {
+  const last = [...input.pushed].reverse().find((h) => h.ref === input.branch);
+  if (last !== undefined) {
+    const newerThanLease =
+      input.leaseStartedAt === undefined || last.at === undefined || last.at >= input.leaseStartedAt;
+    const moved = input.startHead === undefined || !sameSha(last.sha, input.startHead);
+    if (newerThanLease && moved) return { progressed: true, by: "push", sha: last.sha };
+  }
+  const pushWhy = `no head newer than the lease's start was pushed to \`${input.branch}\``;
+  if (input.handoff === undefined) return { progressed: false, why: pushWhy };
+  const { previous, current } = input.handoff;
+  if (current.followUps.length < previous.followUps.length || current.deviations.length > previous.deviations.length)
+    return { progressed: true, by: "handoff" };
+  return { progressed: false, why: `${pushWhy} and the handoff is unchanged` };
+}
+
+export interface RenewalInput {
+  grant: Grant;
+  /** Renewals already spent under this request: the segments beyond the first. */
+  renewalsSpent: number;
+  /** Dollars spent under this request so far; null when a run's model had no
+   *  price, since a total that left a model's tokens out would understate it. */
+  spendUsd: number | null;
+  progress: Progress;
+  /** The pipeline the next segment would run: its fit is re-asserted before every segment. */
+  pipeline: Pipeline;
+}
+
+export type RenewalWhy = "no_progress" | "grant_exhausted" | "cost_cap" | "unfit";
+
+export type RenewalDecision =
+  | { renew: true; segment: number; from?: string; renewalsLeft: number }
+  | { renew: false; why: RenewalWhy; detail: string; renewalsLeft: number };
+
+const usd = (n: number): string => `$${n.toFixed(2)}`;
+
+/** The decision, in the order the record states the clauses: progress, the
+ *  grant's count, the cap, the fit. `segment` is the one the renewal opens
+ *  (the first segment is 1); `from` the sha it continues from when a push made
+ *  the progress. */
+export function renewalDecision(input: RenewalInput): RenewalDecision {
+  const renewalsLeft = Math.max(0, input.grant.renewals - input.renewalsSpent);
+  if (!input.progress.progressed) return { renew: false, why: "no_progress", detail: input.progress.why, renewalsLeft };
+  if (renewalsLeft === 0) {
+    const detail =
+      input.grant.renewals === 0
+        ? "the grant holds no renewals"
+        : `the grant's ${input.grant.renewals} renewal${input.grant.renewals === 1 ? "" : "s"} are spent`;
+    return { renew: false, why: "grant_exhausted", detail, renewalsLeft };
+  }
+  const cap = input.grant.costCapUsd;
+  if (cap !== undefined) {
+    if (input.spendUsd === null)
+      return {
+        renew: false,
+        why: "cost_cap",
+        detail: `spend is unknown (a model had no price) under the grant's cap of $${cap}`,
+        renewalsLeft,
+      };
+    if (input.spendUsd >= cap)
+      return {
+        renew: false,
+        why: "cost_cap",
+        detail: `spend ${usd(input.spendUsd)} reached the grant's cap of $${cap}`,
+        renewalsLeft,
+      };
+  }
+  const held = fit(input.pipeline);
+  if (!held.ok)
+    return {
+      renew: false,
+      why: "unfit",
+      detail: `a ${held.have}-minute segment cannot hold the ship loop (${input.pipeline.maxRounds} review rounds need ${held.need} min)`,
+      renewalsLeft,
+    };
+  return {
+    renew: true,
+    segment: input.renewalsSpent + 2,
+    ...(input.progress.by === "push" ? { from: input.progress.sha } : {}),
+    renewalsLeft: renewalsLeft - 1,
+  };
+}
+
+/** The card's words (the record's trace, steps 4 and 9): a renewal names its
+ *  number of the grant's and the sha it continues from; a stop names the
+ *  clause and, when renewals remain, the reply that spends one by hand. */
+export function renderRenewal(decision: RenewalDecision, grant: Grant): string {
+  if (decision.renew)
+    return `renewal ${decision.segment - 1} of ${grant.renewals}, continues ${decision.from !== undefined ? decision.from.slice(0, 7) : "the branch's head"}`;
+  const holds =
+    decision.renewalsLeft > 0
+      ? `grant holds ${decision.renewalsLeft} renewal${decision.renewalsLeft === 1 ? "" : "s"}`
+      : "the grant holds no renewals";
+  switch (decision.why) {
+    case "no_progress":
+      return decision.renewalsLeft > 0
+        ? `no progress in the last lease; ${holds}; reply continue to spend one`
+        : `no progress in the last lease; ${holds}`;
+    case "cost_cap":
+      return decision.renewalsLeft > 0 ? `${decision.detail}; ${holds} unspent` : decision.detail;
+    case "grant_exhausted":
+    case "unfit":
+      return decision.detail;
+  }
+}

package/dist/assets/src/core/trace/attrs.ts

@@ -34,6 +34,14 @@ export interface AttrDomain {
   /** The `<provider>/<model>` that took the turn — a ship run's children answer
    *  on different models, and the run page badges the switch per step. */
   model: string;
+  /** The tools a proxied call offered the model (model-proxy.md item 6): how
+   *  many, their names sorted and comma-joined, and the request's `tool_choice`
+   *  by its word — `auto` when tools came and nothing was said, `none` when no
+   *  tools came or the request said so, `any` for OpenAI's `required`, `tool`
+   *  for a named tool. */
+  tools: number;
+  toolNames: string;
+  toolChoice: "auto" | "none" | "any" | "tool";
   stopReason: "end_turn" | "tool_use" | "max_tokens" | "stop_sequence" | "other";
   inputTokens: number;
   outputTokens: number;
@@ -159,6 +167,9 @@ const ATTR_TYPE: Record<SpanAttrKey, "string" | "number" | "boolean"> = {
   backend: "string",
   command: "string",
   model: "string",
+  tools: "number",
+  toolNames: "string",
+  toolChoice: "string",
   stopReason: "string",
   inputTokens: "number",
   outputTokens: "number",

package/dist/assets/src/core/trace/types.ts

@@ -70,9 +70,10 @@ export interface TraceOptions {
   span?: Span;
   /** Which door the call came through when it was not the surface's own
    *  grammar: `route` for a command the request router bound from prose
-   *  (record 0036). Copied onto the registry's audit line, never read by a
-   *  handler. Absent for a typed command. */
-  source?: "route";
+   *  (record 0036), `confirm` for a stored input run at a confirmation's
+   *  click (record 0044). Copied onto the registry's audit line, never read
+   *  by a handler. Absent for a typed command. */
+  source?: "route" | "confirm";
 }
 
 export interface Span {

package/dist/assets/src/execution/bashTimeout.ts

@@ -2,28 +2,31 @@
 // one set of bounds, shared by the tool layer, every executor, and both deploy
 // Workers (which import from src/execution like shellQuote/residentDetach).
 // Deliberately free of node: imports so wrangler can bundle it into Workers.
+// The numbers are rows of src/core/budgets.ts (docs/decisions/0046); this file
+// keeps their names for the readers that learned them here.
+import { ALLOWANCES, BASH_COMMAND, MINUTE_MS } from "../core/budgets.js";
 
 /** Default per-command budget when the caller passes no timeoutMs. */
-export const BASH_TIMEOUT_MS = 5 * 60_000;
+export const BASH_TIMEOUT_MS = BASH_COMMAND.defaultMinutes * MINUTE_MS;
 
 /** Floor: anything lower is a typo or an attack, not a budget. */
-export const BASH_TIMEOUT_MIN_MS = 1_000;
+export const BASH_TIMEOUT_MIN_MS = BASH_COMMAND.minMs;
 
 /** Hard ceiling a caller can raise the budget to. Not by itself a guarantee
  *  against one command eating a run — 20 minutes is 80% of a 25-minute review
  *  — which is what `bashBudgetWithinRun` below is for. */
-export const BASH_TIMEOUT_MAX_MS = 20 * 60_000;
+export const BASH_TIMEOUT_MAX_MS = BASH_COMMAND.maxMinutes * MINUTE_MS;
 
 /** Wall clock a run keeps back from its last command for the write-up: the
  *  runner's deadline forces a final answer, and a command still running at
  *  that moment would have been wasted anyway. */
-export const RUN_DEADLINE_RESERVE_MS = 60_000;
+export const RUN_DEADLINE_RESERVE_MS = ALLOWANCES.commandWriteUp * MINUTE_MS;
 
 /** Margin the remote exec clients add to their HTTP wait over the command
  *  budget, so the server's own timeout answer (a streamed exit 124) wins the
  *  race against the client's transport deadline instead of both firing at the
  *  same instant. */
-export const EXEC_CALL_MARGIN_MS = 30_000;
+export const EXEC_CALL_MARGIN_MS = ALLOWANCES.execCall * MINUTE_MS;
 
 /** The documented clamp rule, applied identically bot-side and server-side
  *  (a server never trusts the client's number): a finite number is truncated

package/dist/assets/src/execution/residentRefresh.ts

@@ -186,6 +186,22 @@ export function killStaleBuildProcessesCommand(user: string, dir: string): strin
  *  failure however it died. */
 const INTERRUPTION_SIGNATURE = /\bexit 143\b|Session terminated|SIGTERM|^restore-interrupted:/;
 
+/** The wordings git gives when the MIRROR itself is broken: its `origin`
+ *  remote gone from `config`, the repository not a repository, an object store
+ *  with bad, corrupt or unreadable objects, a local file it cannot open. None
+ *  of these is GitHub's doing, and none is cured by waiting for GitHub. */
+const MIRROR_FAILURE_WORDING =
+  /'origin' does not appear to be a git repository|not a git repository|\bbad object\b|\bcorrupt\b|unable to read (?:tree|object|commit|blob)|object file .* is empty|cannot open \.git\/|unable to open object|missing object/i;
+
+/** Whether a failed mirror fetch failed on the mirror (the resident's own
+ *  disk — item 67 counts it) rather than on GitHub (`github-unreachable`, a
+ *  serviceable reason that parks on repeat, item 16b). GitHub is the default:
+ *  a message names the mirror only through the wordings above, so an unknown
+ *  failure keeps the reading it always had. */
+export function fetchFailureIsMirrors(message: string): boolean {
+  return MIRROR_FAILURE_WORDING.test(message);
+}
+
 /** Message wording of the Sandbox SDK's runtime-replacement error family — the
  *  container went away UNDER a live SDK call, so the failure never reaches the
  *  shell-kill signature above: a step that dies this way surfaces as
@@ -209,9 +225,34 @@ const INTERRUPTION_SIGNATURE = /\bexit 143\b|Session terminated|SIGTERM|^restore
  *  exec path and the refresh classifier agree on one wording list (a container
  *  stop mid-snapshot produces "Process supervisor is closed"; classified as the
  *  repo's own `snapshot-failed` it would end the instance `degraded` instead of
- *  being retried into the same step). */
-export const RUNTIME_REPLACEMENT_WORDING =
-  /previous runtime incarnation|interrupted because the runtime changed|runtime identity is no longer active|sandbox lifetime is no longer current|platform was updating the sandbox runtime|no longer identifies pid|process supervisor is closed|container is not running, consider calling start/i;
+ *  being retried into the same step).
+ *
+ *  The list is the union of two a reader tells apart, because the resident's
+ *  `/exec` answer treats them differently (resident-repos item 43): the SDK's
+ *  words that vouch the runtime MOVED — a new incarnation serves the thread,
+ *  so the container the command was aimed at is gone whatever else is known
+ *  — and the platform's words for a container that is merely DOWN, which say
+ *  nothing about a replacement: a stopped container answers "Process
+ *  supervisor is closed" to a spawn, and the workerd binding answers "The
+ *  container is not running" whether the container is asleep, starting, or
+ *  gone under a roll. For the refresh classifier and `isRuntimeReplacement`
+ *  the union is right: a step interrupted either way is retried onto the
+ *  container that comes back. */
+export const RUNTIME_MOVED_WORDING =
+  /previous runtime incarnation|interrupted because the runtime changed|runtime identity is no longer active|sandbox lifetime is no longer current|platform was updating the sandbox runtime|no longer identifies pid/i;
+/** The platform's words for a container that is down under a command (see
+ *  `RUNTIME_MOVED_WORDING`): the spawn refusal of a stopped container and the
+ *  binding's not-running refusal, anchored to the full phrase so a genuine
+ *  crash ("container exited with unexpected exit code") and the readiness
+ *  probe ("the container is not listening") never match. The harness's
+ *  container seam reads the same two as a container down under its one more
+ *  command — a wait, never a judgement (harness.md item 6). */
+export const STOPPED_CONTAINER_WORDING =
+  /process supervisor is closed|container is not running, consider calling start/i;
+export const RUNTIME_REPLACEMENT_WORDING = new RegExp(
+  `${RUNTIME_MOVED_WORDING.source}|${STOPPED_CONTAINER_WORDING.source}`,
+  "i",
+);
 
 /** `runtimeUnreachable` is the caller's word that the failure was the SDK's
  *  connect abort at the exec choke point (the Worker's typed check over the
@@ -314,10 +355,14 @@ export const WAKE_PORT_READY_MS = 3 * 60_000;
  *  SDK by a test. */
 export const SDK_RUNTIME_RECORD_KEY = "currentRuntimeIdentity";
 
-/** The DOMException the SDK's connect abort raises: `AbortError`, message
- *  `The operation was aborted`. Anchored on the whole sentence so a command's
- *  own `Aborted (core dumped)` never matches. */
-export const RUNTIME_UNREACHABLE_WORDING = /\bThe operation was aborted\b/;
+/** The DOMException the SDK's connect abort raises — `fetchUpgradeAttempt`
+ *  calls `controller.abort()` with no reason when `DEFAULT_CONNECT_TIMEOUT_MS`
+ *  passes, so the runtime's own `AbortError` with the message exactly `The
+ *  operation was aborted`. Anchored on the WHOLE message, so a command's own
+ *  `Aborted (core dumped)` never matches and neither does a `TimeoutError`'s
+ *  `The operation was aborted due to timeout` — the text `AbortSignal.timeout`
+ *  raises, a route's own bound on a slow GitHub, not a silent runtime. */
+export const RUNTIME_UNREACHABLE_WORDING = /^The operation was aborted\.?$/;
 
 /** Is this one link of an error's cause chain the SDK's connect abort? By
  *  name first (the DOMException's `AbortError`), by the DOMException's message

package/dist/assets/src/execution/residentSteps.ts

@@ -49,7 +49,7 @@ export const RESIDENT_STEP_LABELS = {
   "worktree-clean": "cleaning the worktree",
   "clean-workspace": "cleaning the workspace",
   "clean-before-restore": "cleaning before the restore",
-  "break-mirror": "removing the mirror's objects (fault injection)",
+  "break-mirror": "removing the mirror's config (fault injection)",
   "unmount-restores": "unmounting earlier restores",
   "mirror-restore-extract": "extracting the mirror snapshot",
   "checkout-restore-extract": "extracting the checkout snapshot",

package/dist/assets/src/execution/residentText.ts

@@ -38,7 +38,12 @@ export function residentErrorText(text: string): string {
   return redactAndCap(stripAnsi(text), RESIDENT_ERROR_CAP);
 }
 
-const SANITIZED_FIELDS = ["error", "reason", "summary"] as const;
+/** The free-text fields a resident body carries: `error` (the reply), `reason`
+ *  (the answer's own word or a lifecycle reason), `stateReason` (the lifecycle
+ *  reason beside `state` on a thread route's 503 — the same remote text
+ *  `reason` used to carry there, item 62), `summary`. A field added to a
+ *  resident answer that carries remote output is added HERE first. */
+const SANITIZED_FIELDS = ["error", "reason", "stateReason", "summary"] as const;
 
 /** How deep the sanitizer descends. The deepest resident shape today is
  *  `/residents` → `residents[]` → `live` → `reason` (depth 3); the bound exists
@@ -48,8 +53,8 @@ const SANITIZE_DEPTH = 4;
 /** A parsed resident body with its free-text fields made safe, at every level:
  *  `/residents` nests each resident's `state`/`reason` (or an `error`) under
  *  `residents[].live`, and `repo list` renders those. In each plain object only
- *  `error`, `reason` and `summary` are touched (when strings) — `error` at the
- *  reply-sized cap, the other two at the card-sized one; `stderr` is
+ *  `error`, `reason`, `stateReason` and `summary` are touched (when strings) —
+ *  `error` at the reply-sized cap, the others at the card-sized one; `stderr` is
  *  rewritten only when it mirrors `error` (the thread routes' failure shape
  *  copies the error into stderr). Every other field — `needs`, `state`,
  *  `stdout`, `status`, bindings, numbers — passes through untouched. Arrays are

package/dist/assets/src/mcp/registry.ts

@@ -238,6 +238,9 @@ export interface McpServerView {
   promotedFromName?: string;
   /** A user row's owner (the id after `user:` in `scopeKey`) as a display name, when the lookup answered. */
   ownerName?: string;
+  /** A channel row's channel (the id after `channel:` in `scopeKey`) as its name without the hash,
+   *  when the lookup answered. */
+  channelName?: string;
   /** A higher tier holds this name, so runs use that entry and this one is idle (`mcpServersFor`'s
    *  `shadowedBy`, the winning scope key — `org`, or `channel:<id>`); absent when this entry serves. */
   shadowedBy?: string;