@coreplane/switchboard 1.244.0 → 1.246.0

package/dist/assets/src/core/ship/renewal.ts

@@ -24,8 +24,12 @@ export interface ProgressInput {
   /** The heads the segment's coding run pushed (`RunRecord.pushed`). */
   pushed: readonly PushedHeadFact[];
   /** The head the segment started from — the previous segment's recorded sha.
-   *  Absent on a fresh branch, where any push is progress. */
+   *  Absent on a fresh branch, where the base head stands in for it. */
   startHead?: string;
+  /** The base branch's head the unit's branch was created at. On a fresh
+   *  branch (no `startHead`) a push of this head is the branch's creation,
+   *  not the unit's progress; with neither known, any push is progress. */
+  baseHead?: string;
   /** When the segment's lease began; a push stamped before it is not this segment's. */
   leaseStartedAt?: number;
   /** The previous segment's handoff and this one's, when both exist. */
@@ -53,7 +57,10 @@ export function progressOf(input: ProgressInput): Progress {
   if (last !== undefined) {
     const newerThanLease =
       input.leaseStartedAt === undefined || last.at === undefined || last.at >= input.leaseStartedAt;
-    const moved = input.startHead === undefined || !sameSha(last.sha, input.startHead);
+    // A fresh branch starts at the base head, so that head is the bar a push
+    // must move past when no segment recorded a start.
+    const startHead = input.startHead ?? input.baseHead;
+    const moved = startHead === undefined || !sameSha(last.sha, startHead);
     if (newerThanLease && moved) return { progressed: true, by: "push", sha: last.sha };
   }
   const pushWhy = `no head newer than the lease's start was pushed to \`${input.branch}\``;
@@ -95,7 +102,7 @@ export function renewalDecision(input: RenewalInput): RenewalDecision {
     const detail =
       input.grant.renewals === 0
         ? "the grant holds no renewals"
-        : `the grant's ${input.grant.renewals} renewal${input.grant.renewals === 1 ? "" : "s"} are spent`;
+        : `the grant's ${input.grant.renewals} renewal${input.grant.renewals === 1 ? " is" : "s are"} spent`;
     return { renew: false, why: "grant_exhausted", detail, renewalsLeft };
   }
   const cap = input.grant.costCapUsd;

package/dist/assets/src/execution/bashTimeout.ts

@@ -4,7 +4,7 @@
 // Deliberately free of node: imports so wrangler can bundle it into Workers.
 // The numbers are rows of src/core/budgets.ts (docs/decisions/0046); this file
 // keeps their names for the readers that learned them here.
-import { ALLOWANCES, BASH_COMMAND, MINUTE_MS } from "../core/budgets.js";
+import { ALLOWANCES, ATTACH_REQUEST_MIN_MS, BASH_COMMAND, MINUTE_MS } from "../core/budgets.js";
 
 /** Default per-command budget when the caller passes no timeoutMs. */
 export const BASH_TIMEOUT_MS = BASH_COMMAND.defaultMinutes * MINUTE_MS;
@@ -50,8 +50,10 @@ export function clampBashTimeout(requested: unknown): number {
 export type RunBudget =
   { kind: "unchanged" } | { kind: "clipped"; timeoutMs: number; note: string } | { kind: "exhausted"; note: string };
 
+/** Whole seconds for the notes below, never negative: the two clip notes phrase the reserve alike. */
+const secs = (ms: number): number => Math.max(0, Math.round(ms / 1000));
+
 export function bashBudgetWithinRun(wantedMs: number, remainingMs: number): RunBudget {
-  const secs = (ms: number) => Math.max(0, Math.round(ms / 1000));
   const cap = Math.trunc(remainingMs - RUN_DEADLINE_RESERVE_MS);
   if (cap < BASH_TIMEOUT_MIN_MS) {
     return {
@@ -69,6 +71,48 @@ export function bashBudgetWithinRun(wantedMs: number, remainingMs: number): RunB
   };
 }
 
+/** The bound on an attach request an executor opens while its run has
+ *  `remainingMs` of wall clock left (`ResidentExecutorOptions.remainingMs`):
+ *  `bounded` by the attach's own default, `BASH_TIMEOUT_MS` — an attach may
+ *  clone and install deps — clipped to what the run has left less the same
+ *  write-up reserve a command keeps back, so an attach never holds a run past
+ *  its lease and the model keeps its write-up; never raised above the default.
+ *  Inside the reserve, or with less than an attach's floor past it
+ *  (`ATTACH_REQUEST_MIN_MS`: a bound too short to clone would be cut and
+ *  struck as a rollout), `exhausted`: the request is not opened at all — the
+ *  resident would run the attach to its end server-side for a run that is
+ *  ending, and the caller would get a deadline it could read as waitable — and
+ *  the note names the run's clock and the bound that refused (the reserve, or
+ *  the floor past it): it is the one sentence every reader carries, the
+ *  executor's refusal and the relaunch's note alike. The command's own budget
+ *  never bounds an attach: the attach is not the command, and the command's
+ *  one-second floor is the model's to choose. */
+export type AttachBound = { kind: "bounded"; timeoutMs: number } | { kind: "exhausted"; note: string };
+
+export function attachBoundWithinRun(remainingMs: number): AttachBound {
+  const left = Math.trunc(remainingMs - RUN_DEADLINE_RESERVE_MS);
+  // The one sentence every reader of an exhausted bound carries — the
+  // executor's refusal, the relaunch's note — worded by the bound that refused.
+  if (left <= 0) {
+    return {
+      kind: "exhausted",
+      note:
+        `the run has ${secs(remainingMs)}s of wall clock left, inside the ${secs(RUN_DEADLINE_RESERVE_MS)}s ` +
+        "write-up reserve, so no attach was opened",
+    };
+  }
+  if (left < ATTACH_REQUEST_MIN_MS) {
+    return {
+      kind: "exhausted",
+      note:
+        `the run has ${secs(remainingMs)}s of wall clock left, only ${secs(left)}s past the ` +
+        `${secs(RUN_DEADLINE_RESERVE_MS)}s write-up reserve — under the ${secs(ATTACH_REQUEST_MIN_MS)}s an attach needs — ` +
+        "so no attach was opened",
+    };
+  }
+  return { kind: "bounded", timeoutMs: Math.min(BASH_TIMEOUT_MS, left) };
+}
+
 /** The line a timed-out command shows the model: names the limit that fired
  *  and the knob that raises it, so the model can self-correct (re-run with a
  *  larger timeoutMs, split the command, or background it) instead of guessing

package/dist/assets/src/execution/residentRefresh.ts

@@ -180,11 +180,15 @@ export function killStaleBuildProcessesCommand(user: string, dir: string): strin
 }
 
 /** Signature of a step killed from OUTSIDE its own budget: the exit status of
- *  SIGTERM (128 + 15), bash's "Session terminated" on a killed login shell, or
- *  a tool naming the signal. A bare "killed" is NOT enough — compilers and
- *  OOM messages say it too — and a step the cycle itself timed out is a real
- *  failure however it died. */
-const INTERRUPTION_SIGNATURE = /\bexit 143\b|Session terminated|SIGTERM|^restore-interrupted:/;
+ *  SIGTERM (128 + 15) — as a shell reports it (`exit 143`) or as the platform
+ *  words a container that died under a short exec ("Container exited with
+ *  unexpected exit code: 143"; seen live on the wake path's ready-stamp probe
+ *  when a stop landed on it) — bash's "Session terminated" on a killed login
+ *  shell, or a tool naming the signal. Only 143: the platform's same wording
+ *  with any other code (1, 137, 139) is a genuine crash and stays a failure.
+ *  A bare "killed" is NOT enough — compilers and OOM messages say it too —
+ *  and a step the cycle itself timed out is a real failure however it died. */
+const INTERRUPTION_SIGNATURE = /\bexit 143\b|exit code: 143\b|Session terminated|SIGTERM|^restore-interrupted:/;
 
 /** The wordings git gives when the MIRROR itself is broken: its `origin`
  *  remote gone from `config`, the repository not a repository, an object store
@@ -241,14 +245,17 @@ export function fetchFailureIsMirrors(message: string): boolean {
 export const RUNTIME_MOVED_WORDING =
   /previous runtime incarnation|interrupted because the runtime changed|runtime identity is no longer active|sandbox lifetime is no longer current|platform was updating the sandbox runtime|no longer identifies pid/i;
 /** The platform's words for a container that is down under a command (see
- *  `RUNTIME_MOVED_WORDING`): the spawn refusal of a stopped container and the
- *  binding's not-running refusal, anchored to the full phrase so a genuine
+ *  `RUNTIME_MOVED_WORDING`): the spawn refusal of a stopped container, the
+ *  binding's not-running refusal, and the SDK's "The container just exited"
+ *  for a container that died under a live exec (a roll landing mid-step; the
+ *  bot side reads the same words as a roll, residentWake's
+ *  CONTAINER_GONE_WORDING), each anchored to the full phrase so a genuine
  *  crash ("container exited with unexpected exit code") and the readiness
  *  probe ("the container is not listening") never match. The harness's
  *  container seam reads the same two as a container down under its one more
  *  command — a wait, never a judgement (harness.md item 6). */
 export const STOPPED_CONTAINER_WORDING =
-  /process supervisor is closed|container is not running, consider calling start/i;
+  /process supervisor is closed|container is not running, consider calling start|the container just exited/i;
 export const RUNTIME_REPLACEMENT_WORDING = new RegExp(
   `${RUNTIME_MOVED_WORDING.source}|${STOPPED_CONTAINER_WORDING.source}`,
   "i",
@@ -358,12 +365,28 @@ export const SDK_RUNTIME_RECORD_KEY = "currentRuntimeIdentity";
 /** The DOMException the SDK's connect abort raises — `fetchUpgradeAttempt`
  *  calls `controller.abort()` with no reason when `DEFAULT_CONNECT_TIMEOUT_MS`
  *  passes, so the runtime's own `AbortError` with the message exactly `The
- *  operation was aborted`. Anchored on the WHOLE message, so a command's own
- *  `Aborted (core dumped)` never matches and neither does a `TimeoutError`'s
+ *  operation was aborted`. Anchored on the WHOLE message: a command's own
+ *  `Aborted (core dumped)` never matches, and neither does a `TimeoutError`'s
  *  `The operation was aborted due to timeout` — the text `AbortSignal.timeout`
- *  raises, a route's own bound on a slow GitHub, not a silent runtime. */
+ *  raises, a route's own bound on a slow GitHub, not a silent runtime. A
+ *  wrapper is read by its `cause`, where the DOMException rides whole; a
+ *  wrapper that only pasted the sentence into a longer message is not the
+ *  signal. */
 export const RUNTIME_UNREACHABLE_WORDING = /^The operation was aborted\.?$/;
 
+/** `err` and its `cause` chain, bounded like the SDK's own `selfAndCauses`
+ *  walker: the SDK wraps platform errors, so the telling message can sit one or
+ *  two links down. The one walker for every reader of a throw's chain — the
+ *  resident Worker's classifiers and its thread-error builders, the sandbox
+ *  Worker's — so the depth bound and the shape are decided once. */
+export function* selfAndCauses(err: unknown): Generator<unknown> {
+  let current = err;
+  for (let depth = 0; depth < 8 && current != null; depth++) {
+    yield current;
+    current = typeof current === "object" ? (current as { cause?: unknown }).cause : undefined;
+  }
+}
+
 /** Is this one link of an error's cause chain the SDK's connect abort? By
  *  name first (the DOMException's `AbortError`), by the DOMException's message
  *  when a wrapper copied only that. Applied by the Worker to the SPAWN-phase

package/dist/assets/src/execution/sandboxErrors.ts

@@ -154,10 +154,15 @@ export const SANDBOX_STARTING_EXPLANATION =
   "the thread's sandbox container is starting (image pull, boot, runtime) — nothing ran yet; the request is re-sent once it is up";
 
 /** The executor waits at most this long for a container to start, whatever
- *  the command's own budget: the platform's own start allowances (30 s for an
- *  instance, 90 s for the port) plus a slow image pull fit inside it, and a
- *  60 s command is never killed by a two-minute start it did not cause. */
-export const SANDBOX_START_WAIT_MAX_MS = 5 * 60_000;
+ *  the command's own budget: the platform's own start allowances (the
+ *  instance grant, 90 s for the port) plus a slow image pull fit inside it,
+ *  and a 60 s command is never killed by a two-minute start it did not cause.
+ *  Ten minutes, not five: under a midday burst the platform admitted about
+ *  seven starts at once and granted the rest 2.5 to 5 minutes later — two
+ *  threads of twenty-four died at the five-minute mark with their container
+ *  a minute away. A run that waits ten minutes for its container starts; one
+ *  that dies at five does not, and nothing else in the run was in progress. */
+export const SANDBOX_START_WAIT_MAX_MS = 10 * 60_000;
 
 /** Backoff between re-sends while a container starts: 5 s, 10 s, then 15 s.
  *  A start takes tens of seconds, not minutes, so the poll is denser than the