@dmsdc-ai/aigentry-deliberation 0.0.43 → 0.0.45

package/doctor.js

@@ -62,6 +62,54 @@ const LOG_LOCATIONS = [
   path.join(HOME, ".local", "lib", "mcp-deliberation", "runtime.log"),
 ];
 
+// Runtime log size-check thresholds (env-configurable).
+// Doctor DIAGNOSES only — it never mutates log files.
+const LOG_SIZE_WARN_MB = Number(process.env.DELIBERATION_LOG_SIZE_WARN_MB) > 0
+  ? Number(process.env.DELIBERATION_LOG_SIZE_WARN_MB)
+  : 50;
+const LOG_SIZE_ERROR_MB = Number(process.env.DELIBERATION_LOG_SIZE_ERROR_MB) > 0
+  ? Number(process.env.DELIBERATION_LOG_SIZE_ERROR_MB)
+  : 500;
+
+function formatBytes(bytes) {
+  if (!Number.isFinite(bytes) || bytes < 0) return "? B";
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+  return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+}
+
+/**
+ * Inspect ~/.local/lib/mcp-deliberation/ for runtime.log* files and report on
+ * total footprint. Returns { level, totalBytes, topFiles } without mutating
+ * anything (doctor is diagnostic-only).
+ */
+function checkRuntimeLogFootprint(installDir) {
+  const result = { level: "ok", totalBytes: 0, topFiles: [], dir: installDir };
+  try {
+    if (!fs.existsSync(installDir)) return result;
+    const entries = [];
+    for (const name of fs.readdirSync(installDir)) {
+      if (!/^runtime\.log(\.|$)/.test(name)) continue;
+      const p = path.join(installDir, name);
+      try {
+        const st = fs.statSync(p);
+        if (!st.isFile()) continue;
+        entries.push({ path: p, size: st.size });
+        result.totalBytes += st.size;
+      } catch { /* skip */ }
+    }
+    entries.sort((a, b) => b.size - a.size);
+    result.topFiles = entries.slice(0, 3);
+    if (result.totalBytes >= LOG_SIZE_ERROR_MB * 1024 * 1024) {
+      result.level = "error";
+    } else if (result.totalBytes >= LOG_SIZE_WARN_MB * 1024 * 1024) {
+      result.level = "warn";
+    }
+  } catch { /* ignore */ }
+  return result;
+}
+
 // ── TOML parser (minimal, mcp_servers only) ────────────────────
 
 function parseMcpServersFromToml(content) {
@@ -381,6 +429,34 @@ function runDiagnostics() {
       )
     : path.join(HOME, ".local", "lib", "mcp-deliberation");
 
+  // Runtime log footprint check — diagnose only, never mutate.
+  const logCheck = checkRuntimeLogFootprint(installDir);
+  if (logCheck.totalBytes > 0) {
+    const sizeStr = formatBytes(logCheck.totalBytes);
+    if (logCheck.level === "error") {
+      totalIssues++;
+      console.log(`   ❌ runtime.log footprint: ${sizeStr} (>= ${LOG_SIZE_ERROR_MB} MB ERROR threshold)`);
+    } else if (logCheck.level === "warn") {
+      totalIssues++;
+      console.log(`   ⚠️  runtime.log footprint: ${sizeStr} (>= ${LOG_SIZE_WARN_MB} MB WARN threshold)`);
+    } else {
+      console.log(`   ✅ runtime.log footprint: ${sizeStr}`);
+    }
+    if (logCheck.level !== "ok" && logCheck.topFiles.length > 0) {
+      console.log(`      top offenders:`);
+      for (const f of logCheck.topFiles) {
+        console.log(`        - ${formatBytes(f.size).padStart(10)}  ${f.path}`);
+      }
+      console.log(`      fix: upgrade to v0.0.45+ and let normal rotation / budget enforcement reclaim space. Immediate: rm ${path.join(installDir, 'runtime.log.old')} && : > ${path.join(installDir, 'runtime.log')}`);
+      allIssues.push({
+        config: "logs",
+        server: "runtime.log",
+        issue: logCheck.level === "error" ? "log dir >= 500 MB" : "log dir >= 50 MB",
+        fix: "upgrade to v0.0.45+ or manual cleanup",
+      });
+    }
+  }
+
   const selfPath = path.join(installDir, "index.js");
   if (checkPathExists(selfPath)) {
     console.log(`   ✅ Server file: ${selfPath}`);

package/index.js

@@ -413,22 +413,154 @@ function formatRuntimeError(error) {
   return String(error);
 }
 
-function appendRuntimeLog(level, message) {
+// ── Runtime log configuration (env-overridable) ────────────────
+const LOG_MAX_SIZE_MB = Number(process.env.DELIBERATION_LOG_MAX_SIZE_MB) > 0
+  ? Number(process.env.DELIBERATION_LOG_MAX_SIZE_MB)
+  : 1;
+const LOG_TOTAL_BUDGET_MB = Number(process.env.DELIBERATION_LOG_TOTAL_BUDGET_MB) > 0
+  ? Number(process.env.DELIBERATION_LOG_TOTAL_BUDGET_MB)
+  : 10;
+const LOG_DEDUP_MS = Number.isFinite(Number(process.env.DELIBERATION_LOG_DEDUP_MS)) && Number(process.env.DELIBERATION_LOG_DEDUP_MS) >= 0
+  ? Number(process.env.DELIBERATION_LOG_DEDUP_MS)
+  : 1000;
+const LOG_HARD_CAP_BYTES = LOG_MAX_SIZE_MB * 2 * 1024 * 1024; // race fallback: 2× per-file threshold
+const LOG_TAIL_BYTES = 500 * 1024; // truncate to last 500 KB on hard-cap overflow
+const LOG_PRE_UPGRADE_EXPIRY_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+
+// Module-level dedup state
+let _dedupLastKey = null;
+let _dedupLastWriteMs = 0;
+let _dedupLastMessage = null;
+let _dedupPendingCount = 0;
+
+// Module-level upgrade-safety guard (once per process)
+let _logUpgradeSafetyRan = false;
+
+function _flushDedupToFile() {
+  if (_dedupPendingCount <= 0) return;
   try {
-    fs.mkdirSync(path.dirname(GLOBAL_RUNTIME_LOG), { recursive: true });
-    
-    // Simple rotation: if log > 1MB, truncate it
+    const elapsed = Date.now() - _dedupLastWriteMs;
+    const summary = `${new Date().toISOString()} [DEDUP] [${_dedupPendingCount}x in ${elapsed}ms] ${_dedupLastMessage || ""}\n`;
+    fs.appendFileSync(GLOBAL_RUNTIME_LOG, summary, "utf-8");
+  } catch { /* ignore */ }
+  _dedupPendingCount = 0;
+}
+
+function _runLogUpgradeSafetyOnce() {
+  if (_logUpgradeSafetyRan) return;
+  _logUpgradeSafetyRan = true;
+  try {
+    const dir = path.dirname(GLOBAL_RUNTIME_LOG);
+    if (!fs.existsSync(dir)) return;
+    const markerPath = path.join(dir, ".log-upgrade-v0.0.45");
+    if (!fs.existsSync(markerPath)) {
+      let totalSize = 0;
+      const candidates = [];
+      for (const name of fs.readdirSync(dir)) {
+        if (!/^runtime\.log(\.|$)/.test(name)) continue;
+        if (name.startsWith("runtime.log.pre-")) continue;
+        const p = path.join(dir, name);
+        try {
+          const s = fs.statSync(p).size;
+          totalSize += s;
+          candidates.push(p);
+        } catch { /* skip */ }
+      }
+      if (totalSize > 1024 * 1024) {
+        const preBackup = GLOBAL_RUNTIME_LOG + ".pre-0.0.45";
+        try {
+          if (fs.existsSync(GLOBAL_RUNTIME_LOG) && !fs.existsSync(preBackup)) {
+            fs.renameSync(GLOBAL_RUNTIME_LOG, preBackup);
+          }
+          // Any other rotated files (runtime.log.old etc.) — removed so normal
+          // rotation can start fresh. The .pre-0.0.45 backup retains the latest.
+          for (const p of candidates) {
+            if (p === preBackup) continue;
+            if (!fs.existsSync(p)) continue;
+            try { fs.unlinkSync(p); } catch { /* ignore */ }
+          }
+        } catch { /* ignore */ }
+      }
+      try { fs.writeFileSync(markerPath, new Date().toISOString()); } catch { /* ignore */ }
+    }
+    // Expire .pre-0.0.45 after 7 days OR on budget overflow
     try {
-      if (fs.existsSync(GLOBAL_RUNTIME_LOG)) {
-        const stats = fs.statSync(GLOBAL_RUNTIME_LOG);
-        if (stats.size > 1024 * 1024) { // 1MB
-          const oldLog = GLOBAL_RUNTIME_LOG + ".old";
-          fs.renameSync(GLOBAL_RUNTIME_LOG, oldLog);
+      const preBackup = GLOBAL_RUNTIME_LOG + ".pre-0.0.45";
+      if (fs.existsSync(preBackup)) {
+        const preStat = fs.statSync(preBackup);
+        let totalDir = preStat.size;
+        try {
+          for (const name of fs.readdirSync(dir)) {
+            if (!/^runtime\.log(\.|$)/.test(name)) continue;
+            if (name === "runtime.log.pre-0.0.45") continue;
+            try { totalDir += fs.statSync(path.join(dir, name)).size; } catch { /* skip */ }
+          }
+        } catch { /* skip */ }
+        const age = Date.now() - preStat.mtimeMs;
+        if (age > LOG_PRE_UPGRADE_EXPIRY_MS || totalDir > LOG_TOTAL_BUDGET_MB * 1024 * 1024) {
+          try { fs.unlinkSync(preBackup); } catch { /* ignore */ }
         }
       }
-    } catch { /* ignore rotation failures */ }
+    } catch { /* ignore */ }
+  } catch { /* ignore */ }
+}
 
-    const line = `${new Date().toISOString()} [${level}] ${message}\n`;
+function _rotateOrTruncate() {
+  try {
+    if (!fs.existsSync(GLOBAL_RUNTIME_LOG)) return;
+    const stats = fs.statSync(GLOBAL_RUNTIME_LOG);
+    // Hard cap: if file exceeds 2× per-file threshold (race under concurrent writers),
+    // truncate in place to the last LOG_TAIL_BYTES to prevent runaway growth.
+    if (stats.size > LOG_HARD_CAP_BYTES) {
+      try {
+        const fd = fs.openSync(GLOBAL_RUNTIME_LOG, "r");
+        try {
+          const tailStart = Math.max(0, stats.size - LOG_TAIL_BYTES);
+          const buf = Buffer.alloc(stats.size - tailStart);
+          fs.readSync(fd, buf, 0, buf.length, tailStart);
+          fs.writeFileSync(GLOBAL_RUNTIME_LOG, buf, "utf-8");
+        } finally {
+          try { fs.closeSync(fd); } catch { /* ignore */ }
+        }
+      } catch { /* fall through */ }
+      return;
+    }
+    if (stats.size > LOG_MAX_SIZE_MB * 1024 * 1024) {
+      const oldLog = GLOBAL_RUNTIME_LOG + ".old";
+      // Explicit cleanup: delete previous .old before rename (robustness over
+      // atomic-rename-overwrite assumption, especially under concurrent writers).
+      try {
+        if (fs.existsSync(oldLog)) fs.unlinkSync(oldLog);
+      } catch { /* ignore */ }
+      try { fs.renameSync(GLOBAL_RUNTIME_LOG, oldLog); } catch { /* ignore */ }
+    }
+  } catch { /* ignore rotation failures */ }
+}
+
+function appendRuntimeLog(level, message) {
+  try {
+    fs.mkdirSync(path.dirname(GLOBAL_RUNTIME_LOG), { recursive: true });
+    _runLogUpgradeSafetyOnce();
+
+    const safeMessage = String(message ?? "");
+    const key = `${level}:${safeMessage.slice(0, 200)}`;
+    const now = Date.now();
+
+    // Dedup: suppress repeated identical messages within window
+    if (_dedupLastKey === key && (now - _dedupLastWriteMs) < LOG_DEDUP_MS) {
+      _dedupPendingCount += 1;
+      return;
+    }
+
+    // New key or window expired — flush prior suppression summary first
+    if (_dedupPendingCount > 0) _flushDedupToFile();
+    _dedupLastKey = key;
+    _dedupLastWriteMs = now;
+    _dedupLastMessage = `[${level}] ${safeMessage}`;
+
+    _rotateOrTruncate();
+
+    const line = `${new Date(now).toISOString()} [${level}] ${safeMessage}\n`;
     fs.appendFileSync(GLOBAL_RUNTIME_LOG, line, "utf-8");
   } catch {
     // ignore logging failures
@@ -582,34 +714,48 @@ for (const stream of [process.stdout, process.stderr]) {
   });
 }
 
+// Module-level reentrance guard. Once a fatal handler has fired, subsequent
+// invocations become no-ops. This breaks the EPIPE self-amplifying loop where
+// writing the previous error's log line itself triggered another EPIPE.
+let _hasHandledFatalError = false;
+
+function _isBrokenStdioError(err) {
+  if (!err) return false;
+  const code = err.code;
+  if (code === "EPIPE" || code === "ERR_STREAM_DESTROYED" || code === "ERR_STREAM_WRITE_AFTER_END") return true;
+  const message = String(err?.message ?? err ?? "");
+  return /EPIPE|write after end/i.test(message);
+}
+
 process.on("uncaughtException", (error) => {
-  // EPIPE = MCP client disconnected (normal shutdown). Exit cleanly.
-  if (error?.code === "EPIPE" || error?.code === "ERR_STREAM_DESTROYED") {
+  if (_hasHandledFatalError) return;
+  if (_isBrokenStdioError(error)) {
+    _hasHandledFatalError = true;
+    try { _flushDedupToFile(); } catch { /* noop */ }
     try { appendRuntimeLog("INFO", "Client disconnected (EPIPE). Shutting down."); } catch { /* noop */ }
-    process.exit(0);
-  }
-  const message = formatRuntimeError(error);
-  appendRuntimeLog("UNCAUGHT_EXCEPTION", message);
-  try {
-    process.stderr.write(`[mcp-deliberation] uncaughtException: ${message}\n`);
-  } catch {
-    // ignore stderr write failures
+    try { process.exit(0); } catch { /* noop */ }
+    return;
   }
+  // Non-stdio fatal: log to file only. process.stderr.write was REMOVED here
+  // because it was the re-trigger source when stdio was the broken channel.
+  try { appendRuntimeLog("UNCAUGHT_EXCEPTION", formatRuntimeError(error)); } catch { /* noop */ }
 });
 
 process.on("unhandledRejection", (reason) => {
-  // EPIPE = MCP client disconnected (normal shutdown). Exit cleanly.
-  if (reason?.code === "EPIPE" || reason?.code === "ERR_STREAM_DESTROYED") {
+  if (_hasHandledFatalError) return;
+  if (_isBrokenStdioError(reason)) {
+    _hasHandledFatalError = true;
+    try { _flushDedupToFile(); } catch { /* noop */ }
     try { appendRuntimeLog("INFO", "Client disconnected (EPIPE). Shutting down."); } catch { /* noop */ }
-    process.exit(0);
-  }
-  const message = formatRuntimeError(reason);
-  appendRuntimeLog("UNHANDLED_REJECTION", message);
-  try {
-    process.stderr.write(`[mcp-deliberation] unhandledRejection: ${message}\n`);
-  } catch {
-    // ignore stderr write failures
+    try { process.exit(0); } catch { /* noop */ }
+    return;
   }
+  try { appendRuntimeLog("UNHANDLED_REJECTION", formatRuntimeError(reason)); } catch { /* noop */ }
+});
+
+// Flush any pending dedup summary on graceful exit so the tail summary is not lost
+process.on("exit", () => {
+  try { _flushDedupToFile(); } catch { /* noop */ }
 });
 
 // Read version from package.json (single source of truth)
@@ -3109,4 +3255,4 @@ if (__entryFile && path.resolve(__currentFile) === __entryFile) {
 }
 
 // ── Test exports (used by vitest) ──
-export { checkToolEntitlement, selectNextSpeaker, loadRolePrompt, inferSuggestedRole, parseVotes, ROLE_KEYWORDS, ROLE_HEADING_MARKERS, loadRolePresets, applyRolePreset, detectDegradationLevels, formatDegradationReport, DEGRADATION_TIERS, DECISION_STAGES, STAGE_TRANSITIONS, createDecisionSession, advanceStage, buildConflictMap, parseOpinionFromResponse, buildOpinionPrompt, generateConflictQuestions, buildSynthesis, buildActionPlan, loadTemplates, matchTemplate, hasExplicitBrowserParticipantSelection, resolveIncludeBrowserSpeakers, confirmSpeakerSelectionToken, validateSpeakerSelectionRequest, truncatePromptText, getPromptBudgetForSpeaker, formatRecentLogForPrompt, getCliAutoTurnTimeoutSec, getCliExecArgs, buildCliAutoTurnFailureText, buildClipboardTurnPrompt, getProjectStateDir, loadSession, saveSession, listActiveSessions, multipleSessionsError, findSessionRecord, mapParticipantProfiles, formatSpeakerCandidatesReport, buildTeleptyTurnRequestEnvelope, buildTeleptyTurnCompletedEnvelope, buildTeleptySynthesisEnvelope, validateTeleptyEnvelope, registerPendingTeleptyTurnRequest, handleTeleptyBusMessage, completePendingTeleptySemantic, cleanupPendingTeleptyTurn, getTeleptySessionHealth, TELEPTY_TRANSPORT_TIMEOUT_MS, TELEPTY_SEMANTIC_TIMEOUT_MS };
+export { appendRuntimeLog, _flushDedupToFile, _isBrokenStdioError, checkToolEntitlement, selectNextSpeaker, loadRolePrompt, inferSuggestedRole, parseVotes, ROLE_KEYWORDS, ROLE_HEADING_MARKERS, loadRolePresets, applyRolePreset, detectDegradationLevels, formatDegradationReport, DEGRADATION_TIERS, DECISION_STAGES, STAGE_TRANSITIONS, createDecisionSession, advanceStage, buildConflictMap, parseOpinionFromResponse, buildOpinionPrompt, generateConflictQuestions, buildSynthesis, buildActionPlan, loadTemplates, matchTemplate, hasExplicitBrowserParticipantSelection, resolveIncludeBrowserSpeakers, confirmSpeakerSelectionToken, validateSpeakerSelectionRequest, truncatePromptText, getPromptBudgetForSpeaker, formatRecentLogForPrompt, getCliAutoTurnTimeoutSec, getCliExecArgs, buildCliAutoTurnFailureText, buildClipboardTurnPrompt, getProjectStateDir, loadSession, saveSession, listActiveSessions, multipleSessionsError, findSessionRecord, mapParticipantProfiles, formatSpeakerCandidatesReport, buildTeleptyTurnRequestEnvelope, buildTeleptyTurnCompletedEnvelope, buildTeleptySynthesisEnvelope, validateTeleptyEnvelope, registerPendingTeleptyTurnRequest, handleTeleptyBusMessage, completePendingTeleptySemantic, cleanupPendingTeleptyTurn, getTeleptySessionHealth, TELEPTY_TRANSPORT_TIMEOUT_MS, TELEPTY_SEMANTIC_TIMEOUT_MS };

package/lib/transport.js

@@ -1128,6 +1128,22 @@ export async function runAutoHandoff(sessionId) {
   const retryConfig = { maxRetries: 2, retryDelayMs: 10000 };
 
   try {
+    // Pre-flight: if every speaker matches the orchestrator's CLI identity, there is
+    // no one to auto-dispatch. Halt Phase 1 and skip Phase 2 synthesis so the session
+    // remains `active` and the orchestrator can provide turns manually.
+    {
+      const initialState = loadSession(sessionId);
+      const callerId = detectCallerSpeaker();
+      if (initialState && callerId && Array.isArray(initialState.speakers) && initialState.speakers.length > 0) {
+        const normalizedCaller = normalizeSpeaker(callerId);
+        const allSelf = initialState.speakers.every(s => normalizeSpeaker(s) === normalizedCaller);
+        if (allSelf) {
+          _deps.appendRuntimeLog("WARN", `AUTO_HANDOFF_ALL_SELF_TURN: ${sessionId} | all speakers match caller identity "${normalizedCaller}" | halting auto-dispatch; orchestrator must proceed manually`);
+          return;
+        }
+      }
+    }
+
     // Phase 1: Run all deliberation turns
     let maxIterations = 100; // safety limit
     while (maxIterations-- > 0) {
@@ -1157,10 +1173,19 @@ export async function runAutoHandoff(sessionId) {
           break;
         }
 
-        // self_turn blocks should break immediately — the orchestrator itself is the speaker
+        // self_turn: orchestrator is the speaker. The defensive guard at runUntilBlockedCore
+        // prevented a recursive CLI spawn; here we submit a visible placeholder so the session
+        // can advance to the next speaker rather than aborting Phase 1 entirely.
         if (runResult.block_reason === "self_turn") {
-          _deps.appendRuntimeLog("WARN", `AUTO_HANDOFF_SELF_TURN: ${sessionId} | speaker: ${speaker} | breaking`);
-          turnSucceeded = false;
+          _deps.appendRuntimeLog("WARN", `AUTO_HANDOFF_SELF_TURN_SKIP: ${sessionId} | speaker: ${speaker} | submitting placeholder and advancing`);
+          submitDeliberationTurn({
+            session_id: sessionId,
+            speaker,
+            content: `[SELF_TURN_SKIP] Speaker ${speaker} matches the orchestrator identity; auto-dispatch skipped to avoid recursive self-spawn. The orchestrator may contribute this speaker's input manually via deliberation_respond before synthesis.`,
+            channel_used: "self_turn_skip",
+            fallback_reason: "caller_identity_match",
+          });
+          turnSucceeded = true; // placeholder submitted, advance to next speaker
           break;
         }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dmsdc-ai/aigentry-deliberation",
-  "version": "0.0.43",
+  "version": "0.0.45",
   "description": "MCP server for structured multi-AI discussions — deliberate across Claude, GPT, Gemini and more before committing to decisions",
   "type": "module",
   "license": "MIT",