@davait/aipictury 1.19.5 → 1.20.1

package/ext/feedback.js

@@ -2,7 +2,11 @@
 // A problem report: what AIPictury needs to understand a problem — versions, settings, the
 // last lines of its log, your description — with keys, tokens and passwords taken out, saved
 // on this machine (~/.aipictury/feedback/). Sent to your AIPictury server only when you say so
-// (/bug, /feedback, or AIPictury: Report a Problem).
+// (/bug, /feedback, or AIPictury: Report a Problem). The folder is also the outbox: a report
+// you chose to send that did not reach the server is sent again by itself when the extension
+// starts and now and then after (sendWaiting), under the same `ref`, so the server keeps it
+// once however many tries it takes. It used to be one 10-second try, then never (1.20.0).
+const crypto = require('crypto')
 const fs = require('fs')
 const os = require('os')
 const path = require('path')
@@ -38,18 +42,86 @@ function redactDeep(value) {
 
 const dir = () => path.join(home(), 'feedback')
 
-/** Writes a report: kind "bug" or "feedback". */
-function save({ kind = 'report', description = '', versions = {}, settings = {}, log = [], extra = {} }) {
+/** Writes a report: kind "bug" or "feedback". `send`: it is to reach the server (the outbox).
+ *  `body` is what is sent: with its `ref`, without this machine's note of how sending goes. */
+function save({ kind = 'report', description = '', versions = {}, settings = {}, log = [], extra = {}, send = false }) {
   fs.mkdirSync(dir(), { recursive: true })
   const stamp = new Date().toISOString().replace(/[:.]/g, '-')
-  const file = path.join(dir(), `${stamp}-${kind}.json`)
+  const ref = crypto.randomUUID()           // the same at every try: the server keeps the report once
+  // Named by its ref too: two reports in the same millisecond were one file.
+  const file = path.join(dir(), `${stamp}-${kind}-${ref.slice(0, 8)}.json`)
   const body = redactDeep({
     kind, created: new Date().toISOString(), description,
     versions: { ...versions, platform: `${os.platform()} ${os.release()}`, node: process.version },
     settings, log, ...extra,
   })
-  fs.writeFileSync(file, `${JSON.stringify(body, null, 2)}\n`, { mode: 0o600 })
+  body.ref = ref
+  write(file, { ...body, delivery: { send: !!send, sent: null, tries: 0 } })
   return { file, body }
 }
 
-module.exports = { redact, redactDeep, save, dir }
+function write(file, report) { fs.writeFileSync(file, `${JSON.stringify(report, null, 2)}\n`, { mode: 0o600 }) }
+
+function read(file) { try { return JSON.parse(fs.readFileSync(file, 'utf8')) } catch { return null } }
+
+/** The server took it (its id): not sent again. */
+function markSent(file, id) {
+  const report = read(file)
+  if (report) write(file, { ...report, delivery: { ...(report.delivery || {}), sent: String(id || 'sent') } })
+}
+
+// Reports being sent by this app now, by ref: the first send (the dialog's) and the outbox's retry
+// 45 s after start could post the same report at once, and the server kept it twice (1.20.0).
+const sending = new Map()
+
+/** One report sent, and marked sent once the server took it: resolves to its id there. While it
+ *  is on its way, asking again (the outbox) gets the same try, never a second post. */
+function sendOne(server, file, body, send) {
+  if (!sending.has(body.ref)) {
+    sending.set(body.ref, (async () => {
+      const id = await send(server, body)
+      markSent(file, id)
+      return id
+    })().finally(() => sending.delete(body.ref)))
+  }
+  return sending.get(body.ref)
+}
+
+/** The reports to send that have not reached the server: [{ file, body }], oldest first. */
+function unsent() {
+  let names
+  try { names = fs.readdirSync(dir()).filter((n) => n.endsWith('.json')).sort() } catch { return [] }
+  const out = []
+  for (const name of names) {
+    const report = read(path.join(dir(), name))
+    if (!report?.delivery?.send || report.delivery.sent || report.delivery.refused || !report.ref) continue
+    const body = { ...report }
+    delete body.delivery
+    out.push({ file: path.join(dir(), name), body })
+  }
+  return out
+}
+
+/** Sends what is waiting, with `send(server, body)` (dialogs.sendReport); stops at the first that
+ *  cannot reach the server — it is not there yet — and says how many went. One the server
+ *  refuses (a 4xx it will always answer) is put aside, not tried for ever. */
+async function sendWaiting(server, send) {
+  if (!server) return 0
+  let sent = 0
+  for (const { file, body } of unsent()) {
+    if (sending.has(body.ref)) continue                 // on its way already: counted by its sender
+    try {
+      await sendOne(server, file, body, send)
+      sent += 1
+    } catch (error) {
+      const report = read(file)
+      const refused = error.status >= 400 && error.status < 500 && ![401, 403, 408, 429].includes(error.status)
+      if (report) write(file, { ...report, delivery: { ...report.delivery, tries: (report.delivery.tries || 0) + 1,
+        error: String(error.message).slice(0, 300), ...(refused ? { refused: true } : {}) } })
+      if (!refused) break
+    }
+  }
+  return sent
+}
+
+module.exports = { redact, redactDeep, save, markSent, sendOne, unsent, sendWaiting, dir }

package/ext/firestore.js

@@ -47,6 +47,12 @@ function decodeFields(fields) {
   return out
 }
 
+/** A field path as Firestore reads it: a segment that is not a plain name ("qwen3.5:27b", a tool
+ *  name with a dash) is quoted in backticks. */
+function fieldPath(...segments) {
+  return segments.map((seg) => (/^[A-Za-z_][A-Za-z_0-9]*$/.test(seg) ? seg : `\`${String(seg).replace(/[\\`]/g, (c) => `\\${c}`)}\``)).join('.')
+}
+
 class FirestoreError extends Error {
   constructor(status, message, code) { super(message); this.status = status; this.code = code }
 }
@@ -105,7 +111,8 @@ class Firestore {
     try { await this.request('DELETE', this.url(path)) } catch (error) { if (error.status !== 404) throw error }
   }
 
-  /** Every document of a collection: [{ id, data }]. */
+  /** Every document of a collection: [{ id, data }]. Only documents that exist: Firestore's
+   *  showMissing is for admin credentials, and refuses a signed-in person outright. */
   async list(collectionPath, { pageSize = 300 } = {}) {
     const out = []
     let token = ''
@@ -117,15 +124,39 @@ class Firestore {
     return out
   }
 
-  /** Several writes, all or nothing (in commits of up to 400). Each: { set: [path, data] } or { delete: path }. */
+  /** Several writes, in commits of up to 400. Each commit is all or nothing, the whole is not: a
+   *  cut between commits leaves the first ones done, so a caller that must survive that writes
+   *  its marker first (cloud.deleteEverything). Each: { set: [path, data] }, { delete: path }, or
+   *  { change: [path, change] } (see change()). */
   async batch(writes) {
     for (let i = 0; i < writes.length; i += BATCH_MAX) {
-      const part = writes.slice(i, i + BATCH_MAX).map((w) => (w.delete
-        ? { delete: `${this.root}/${w.delete}` }
-        : { update: { name: `${this.root}/${w.set[0]}`, fields: encodeFields(w.set[1]) } }))
+      const part = writes.slice(i, i + BATCH_MAX).map((w) => (w.delete ? { delete: `${this.root}/${w.delete}` }
+        : w.change ? this.changeWrite(w.change[0], w.change[1])
+          : { update: { name: `${this.root}/${w.set[0]}`, fields: encodeFields(w.set[1]) } }))
       await this.request('POST', `${this.base}/${this.root}:commit`, { writes: part })
     }
   }
+
+  /**
+   * Changes a document on the server, in one step, whatever another device writes meanwhile: the
+   * fields of `set` replaced, numbers in `increment` added to (a field path → by how much), and
+   * the values in `append` / `remove` added to an array (when not there) or taken out of it.
+   * The document is made when it is missing. Read-modify-write lost one of two rules saved at
+   * once, and one of two machines' turns in the day's usage (1.20.0).
+   */
+  async change(path, spec) {
+    await this.request('POST', `${this.base}/${this.root}:commit`, { writes: [this.changeWrite(path, spec)] })
+  }
+
+  changeWrite(path, { set = {}, increment = {}, append = {}, remove = {} } = {}) {
+    const transforms = [
+      ...Object.entries(increment).map(([field, by]) => ({ fieldPath: field, increment: encode(by) })),
+      ...Object.entries(append).map(([field, values]) => ({ fieldPath: field, appendMissingElements: { values: values.map(encode) } })),
+      ...Object.entries(remove).map(([field, values]) => ({ fieldPath: field, removeAllFromArray: { values: values.map(encode) } })),
+    ]
+    return { update: { name: `${this.root}/${path}`, fields: encodeFields(set) },
+      updateMask: { fieldPaths: Object.keys(set).map((k) => fieldPath(k)) }, updateTransforms: transforms }
+  }
 }
 
-module.exports = { Firestore, FirestoreError, encode, decode, encodeFields, decodeFields }
+module.exports = { Firestore, FirestoreError, encode, decode, encodeFields, decodeFields, fieldPath }

package/ext/gpuRun.js

@@ -2,8 +2,13 @@
 // The GPU, held for one run at a time (the server's gpu.py): an agent run — from the prompt to
 // its last step, helpers and tools included — names itself on every call it makes to the GPU
 // server (X-AIPictury-Client, -Run, -Label: account.js serverFetch adds them), takes the GPU when
-// it starts, keeps it alive while its tools work between model calls, and lets go when it ends.
-// Another app holding the GPU: the run does not start, and says who has it.
+// it starts, keeps it alive while a GPU call of its own is under way (a model turn, streamed for
+// minutes: using()), and lets go when it ends. Between its calls — a test suite, a build, any
+// local step — nothing keeps it: the server lets it go 90 s after the run's last call, so another
+// app is not kept off an idle GPU for as long as the step takes, and the run's next model call
+// takes it again, or waits for it as for a render (agent.js, 423). It used to beat for the whole
+// run, local steps included (1.20.0). Another app holding the GPU: the run does not start, and
+// says who has it.
 const crypto = require('crypto')
 const { AsyncLocalStorage } = require('async_hooks')
 
@@ -77,19 +82,38 @@ async function holding({ server, client, label = '' }, fn) {
       // No answer about holds (an older server, a moment's network trouble): the work goes on —
       // its calls still carry the run, so the server holds the GPU for it if it can.
     }
-    const beat = held ? setInterval(() => {
-      fetch(`${server}/api/gpu/hold`, { method: 'POST', headers: h, signal: AbortSignal.timeout(10_000) }).catch(() => {})
-    }, BEAT) : null
+    run.held = held
+    run.hold = h
     try {
       return await fn()
     } finally {
       run.ended = true
-      if (beat) clearInterval(beat)
+      if (run.beat) clearInterval(run.beat)
+      run.beat = null
       if (held) await fetch(`${server}/api/gpu/hold`, { method: 'DELETE', headers: h, signal: AbortSignal.timeout(10_000) }).catch(() => {})
     }
   })
 }
 
+/** A GPU call of the run in hand is under way: its hold is kept alive (every BEAT) until the
+ *  function this returns is called, and while no such call is, it is not. Outside a run, or for
+ *  a server without holds: nothing to keep. */
+function using() {
+  const r = store.getStore()
+  if (!r || r.ended || !r.held) return () => {}
+  r.busy = (r.busy || 0) + 1
+  r.beat ||= setInterval(() => {
+    fetch(`${r.server}/api/gpu/hold`, { method: 'POST', headers: r.hold, signal: AbortSignal.timeout(10_000) }).catch(() => {})
+  }, BEAT)
+  let over = false
+  return () => {
+    if (over) return
+    over = true
+    r.busy -= 1
+    if (r.busy <= 0 && r.beat) { clearInterval(r.beat); r.beat = null }
+  }
+}
+
 /** Who holds the GPU now: { lanes: [{ hold }] } — null when the server cannot say. */
 async function state(server) {
   try {
@@ -106,4 +130,4 @@ function busyFor(gpu, mine = null) {
   return lanes[0].hold
 }
 
-module.exports = { holding, headers, setApp, nameCalls, state, busyFor, GpuBusyError, store }
+module.exports = { holding, using, headers, setApp, nameCalls, state, busyFor, GpuBusyError, store, BEAT }

package/ext/keeping.js

@@ -0,0 +1,171 @@
+'use strict'
+// The agent's renders kept with the account (cloud.keepRender: compressed on the GPU server, put in
+// Storage, renders/{jobId} last), as an outbox on disk that the extension and the CLI share: a render
+// is noted when it is done and crossed off only once it is kept, or once there is nothing to keep.
+// The chain used to run once, from the render's own callback: a reload during the compression,
+// Ctrl+C twice in the CLI or one failed upload lost it for good — with the files already uploaded
+// left in Storage with no record — and the card said "Compressing" for ever (1.20.0). Whatever is
+// left is now taken up again at the next start, at sign-in and every few minutes, by either app.
+// A server that keeps renders by itself (keeper.py, GET /api/health `keeps`) needs no app for it:
+// cloud.keepRender then only follows it, so the outbox serves the card, and older servers.
+//
+// Every VS Code window and the CLI drain the same file, so each render is taken by one of them at a
+// time: its entry gets a lease (who, until when) before keepRender starts, renewed while it runs,
+// and the others leave it alone while it holds — or until the app holding it is gone. Each change
+// is made under a lock file. Without them a second window's sign-in compressed the same clip again
+// on the GPU while the first was at it, and two renders finishing at once could lose one (1.20.0).
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+const crypto = require('crypto')
+const { home } = require('./sessions')
+
+const RETRY = [60_000, 5 * 60_000, 30 * 60_000, 2 * 3600_000]   // after each failure, then every 2 h
+const GIVE_UP = 7 * 24 * 3600_000                                // not kept within a week: dropped
+const LEASE = 2 * 60_000            // a render taken by an app is its own this long, renewed while it works
+const RENEW = 30_000
+const LOCK_STALE = 10_000           // a lock left by an app killed mid-write is broken after this
+const LOCK_WAIT = 5_000
+
+// This app, as a lease names it: the machine and process (to tell a dead holder from a busy one)
+// and a token of its own (to know its own leases again).
+const ME = { host: os.hostname(), pid: process.pid, token: crypto.randomBytes(6).toString('hex') }
+
+const file = () => path.join(home(), 'keeping.json')
+
+const pause = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
+
+/** `fn` run under the outbox's lock: one app at a time reads, changes and writes it. The lock is
+ *  held for a read and a write, never across keepRender. */
+function locked(fn) {
+  const lock = `${file()}.lock`
+  fs.mkdirSync(path.dirname(lock), { recursive: true })
+  const end = Date.now() + LOCK_WAIT
+  let fd = null
+  while (fd == null) {
+    try {
+      fd = fs.openSync(lock, 'wx', 0o600)
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error
+      let since
+      try { since = fs.statSync(lock).mtimeMs } catch { continue }   // just let go of
+      if (Date.now() - since > LOCK_STALE) { try { fs.unlinkSync(lock) } catch { /* another app broke it first */ } continue }
+      if (Date.now() > end) throw new Error('the keeping outbox is locked by another app', { cause: error })
+      pause(15)
+    }
+  }
+  try { return fn() } finally {
+    fs.closeSync(fd)
+    try { fs.unlinkSync(lock) } catch { /* already broken as stale */ }
+  }
+}
+
+/** Whether an entry is held by another app now: its lease is not over, and its app is not gone. */
+function heldByOther(entry, at) {
+  const lease = entry.lease
+  if (!lease || !(lease.until > at) || lease.token === ME.token) return false
+  if (lease.host !== ME.host) return true                   // another machine's: its time alone says
+  try { process.kill(lease.pid, 0); return true } catch (error) { return error.code === 'EPERM' }
+}
+
+function read() {
+  try { return JSON.parse(fs.readFileSync(file(), 'utf8')).jobs || [] } catch { return [] }
+}
+
+/** Written whole or not at all (another app may be reading it). */
+function write(jobs) {
+  const target = file()
+  fs.mkdirSync(path.dirname(target), { recursive: true })
+  const tmp = `${target}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`
+  fs.writeFileSync(tmp, JSON.stringify({ jobs }), { mode: 0o600 })
+  fs.renameSync(tmp, target)
+}
+
+/** Changes one entry (or removes it, when `fn` returns null), read afresh under the lock: the
+ *  other app may have written. */
+function change(jobId, fn) {
+  locked(() => {
+    const jobs = read()
+    const at = jobs.findIndex((j) => j.job === jobId)
+    if (at < 0) return
+    const next = fn(jobs[at])
+    if (next) jobs[at] = next; else jobs.splice(at, 1)
+    write(jobs)
+  })
+}
+
+/** A render done for the account `uid`, on the GPU server `server`: to be kept with it. */
+function add(server, jobId, uid) {
+  if (!jobId || !uid) return
+  locked(() => {
+    const jobs = read()
+    if (jobs.some((j) => j.job === jobId)) return
+    jobs.push({ server, job: jobId, uid, added: Date.now(), tries: 0, next: 0 })
+    write(jobs)
+  })
+}
+
+/** The next render of `uid` that is due and nobody else holds, taken by this app (its lease
+ *  written before it is worked on), or null. */
+function claim(uid, at, seen) {
+  return locked(() => {
+    const jobs = read()
+    const due = jobs.find((j) => j.uid === uid && (j.next || 0) <= at && !seen.has(j.job) && !heldByOther(j, at))
+    if (!due) return null
+    due.lease = { ...ME, until: at + LEASE }
+    write(jobs)
+    return { ...due }
+  })
+}
+
+/** What is still to be kept: [{ server, job, uid, added, tries, next, error }]. */
+const pending = () => read()
+
+let running = null
+
+/**
+ * Keeps every render of the signed-in account that is due, one at a time; one run at a time in
+ * this app (a call while it runs gets the same run). `onState(jobId, state)` follows each: the
+ * compression's progress, the upload, then { stage: 'kept', stats } — or { stage: 'failed', error,
+ * again } when it is tried again later. Resolves to how many were kept.
+ */
+function drain(cloud, { onState = () => {}, now = () => Date.now() } = {}) {
+  if (running) return running
+  running = (async () => {
+    const uid = await cloud.uid()
+    if (!uid) return 0
+    let kept = 0
+    const seen = new Set()
+    for (;;) {
+      const due = claim(uid, now(), seen)
+      if (!due) return kept
+      seen.add(due.job)
+      let last = null
+      // Held while it works: a compression takes minutes, the lease is renewed; this app gone,
+      // it runs out and another app takes the render up.
+      const renew = setInterval(() => {
+        try { change(due.job, (j) => (j.lease?.token === ME.token ? { ...j, lease: { ...j.lease, until: now() + LEASE } } : j)) } catch { /* next time */ }
+      }, RENEW)
+      renew.unref?.()
+      try {
+        const done = await cloud.keepRender(due.server, due.job, (_, state) => { if (state.stage === 'kept') last = state; onState(due.job, state) })
+        change(due.job, () => null)
+        if (done) kept += 1
+        onState(due.job, last || { stage: done ? 'kept' : 'gone' })
+      } catch (error) {
+        const tries = (due.tries || 0) + 1
+        const again = now() - (due.added || 0) < GIVE_UP
+        change(due.job, (j) => (again ? { ...j, lease: undefined, tries, next: now() + RETRY[Math.min(tries - 1, RETRY.length - 1)], error: error.message } : null))
+        onState(due.job, { stage: 'failed', error: error.message, again })
+      } finally {
+        clearInterval(renew)
+      }
+    }
+  })().finally(() => { running = null })
+  return running
+}
+
+/** Waits for the run in progress, if any (the CLI, before it exits). */
+const settled = () => running || Promise.resolve(0)
+
+module.exports = { add, pending, drain, settled, RETRY, GIVE_UP, LEASE }