@evident-ai/cli 3.1.1-dev.1e270a5 → 3.1.1-dev.201318e

package/dist/index.js

@@ -797,6 +797,16 @@ async function checkStatus(jsonMode) {
       exitCode: 1
     };
   }
+  if (response.status === 404) {
+    return {
+      ok: false,
+      endpoint: apiUrl,
+      authLabel: authLabelFor(credentials2),
+      reason: "endpoint_not_found",
+      error: `${apiUrl}/me returned HTTP 404 \u2014 that endpoint has no /me route, so it is probably missing the /v1 prefix. The credentials were NOT validated.`,
+      exitCode: 75
+    };
+  }
   if (response.status >= 500) {
     const serverMessage = await readErrorMessage(response);
     return {
@@ -3318,6 +3328,23 @@ var ChannelDriver = class _ChannelDriver {
    * `clearRedriveUnresolved` the instant either PATCH succeeds.
    */
   redriveOutcomeUnreportedSignalled = /* @__PURE__ */ new Map();
+  /**
+   * First `now()` a Class B outcome PATCH (reattach/settle/fail_permanent) was
+   * observed to fail for this message (#1366's failure-window trip arm,
+   * `boundRedriveOutcome`). Duration, not a tick count — bounded by the
+   * existing `pausedMaxWaitMs` window (reusing the knob, not a new constant).
+   * Cleared by `clearRedriveUnresolved` the instant the original PATCH
+   * succeeds.
+   */
+  redriveOutcomeFailingSince = /* @__PURE__ */ new Map();
+  /**
+   * "Already posted `redrive_outcome_abandoned` with `reported: false` for this
+   * row" (#1366) — the bound tripped but the terminal `markFailed` fallback ALSO
+   * failed (the route-level fault of G2), so every following tick re-attempts
+   * the same terminal PATCH. Guards that quiet retry from re-signalling on
+   * every tick. Cleared by `clearRedriveUnresolved`.
+   */
+  redriveOutcomeAbandonedSignalled = /* @__PURE__ */ new Set();
   /**
    * Consecutive-UNCONFIRMED-dispatch streak for a `pending` row with NO stored
    * `opencode_message_id` yet — i.e. one that has never even reached the
@@ -3674,6 +3701,9 @@ var ChannelDriver = class _ChannelDriver {
       }
       if (message.opencode_message_id) {
         const outcome = await this.resolveRedrive(conv, sessionId, message, sessionCreated);
+        if (outcome === "abandoned") {
+          continue;
+        }
         if (outcome !== "dispatch") {
           break;
         }
@@ -3943,8 +3973,8 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: conv.id,
         message_id: message.id
       });
-      this.signalRedriveOutcomeUnreported(conv, message, "reattach");
-      return "unresolved";
+      const bound = await this.boundRedriveOutcome(conv, message, "reattach");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
     }
     this.clearRedriveUnresolved(message.id);
     this.registerReadopted(conv, sessionId, message, ocId ?? "", anchorMs);
@@ -4004,8 +4034,8 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: conv.id,
         message_id: message.id
       });
-      this.signalRedriveOutcomeUnreported(conv, message, "settle");
-      return "unresolved";
+      const bound = await this.boundRedriveOutcome(conv, message, "settle");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
     }
     this.clearRedriveUnresolved(message.id);
     void this.postSignal(conv.id, message.id, "redrive_settled");
@@ -4044,8 +4074,8 @@ var ChannelDriver = class _ChannelDriver {
         conversation_id: conv.id,
         message_id: message.id
       });
-      this.signalRedriveOutcomeUnreported(conv, message, "fail_permanent");
-      return "unresolved";
+      const bound = await this.boundRedriveOutcome(conv, message, "fail_permanent");
+      return bound === "abandoned" ? "abandoned" : "unresolved";
     }
     this.clearRedriveUnresolved(message.id);
     void this.postSignal(conv.id, message.id, "redrive_poll_failed");
@@ -4054,10 +4084,12 @@ var ChannelDriver = class _ChannelDriver {
   /**
    * The bounded `unresolved` outcome (Task 3.4): opencode's state could not be
    * observed (snapshot unreadable/empty, or `isSessionOngoing` returned `null`).
-   * A `pending` row is invisible to every cron arm (all require `status =
-   * 'processing'`), so an indefinitely-`unresolved` row would be stranded with
-   * nothing driving it — bound it to the existing `pausedMaxWaitMs` window
-   * (reusing the knob, not a new constant) and take `dispatch` once elapsed.
+   * A `pending` row is swept by the server's own `PENDING_MAX_AGE_MS` (24h,
+   * #1368) cron arm, but that is a day-scale backstop — this local bound acts
+   * in minutes so the row (and the conversation it starves, per the ordering
+   * invariant below) isn't left stranded for that long. Bound to the existing
+   * `pausedMaxWaitMs` window (reusing the knob, not a new constant); takes
+   * `dispatch` once elapsed.
    */
   resolveRedriveUnresolved(conv, message) {
     const now = this.now();
@@ -4082,16 +4114,15 @@ var ChannelDriver = class _ChannelDriver {
     this.redriveUnresolvedSignalled.delete(messageId);
     this.redrivePollFailures.delete(messageId);
     this.redriveOutcomeUnreportedSignalled.delete(messageId);
+    this.redriveOutcomeFailingSince.delete(messageId);
+    this.redriveOutcomeAbandonedSignalled.delete(messageId);
   }
   /**
    * Class B (#1340): the runner DECIDED an outcome (reattach/settle/fail_permanent)
-   * but its own PATCH to record it failed. Deliberately NOT bounded like
-   * `resolveRedriveUnresolved`, for two load-bearing reasons: (1) the only
-   * remedy is a PATCH to the server — the very call that is failing, so a bound
-   * would act by retrying it; (2) this class is self-clearing by construction
-   * (the next successful PATCH resolves it via `clearRedriveUnresolved`),
-   * unlike #1340's deterministic, permanent shape. Fires at most once per
-   * (message, outcome) streak.
+   * but its own PATCH to record it failed. Fires at most once per (message,
+   * outcome) streak, and only while `boundRedriveOutcome` has not yet tripped —
+   * once it trips, `redrive_outcome_abandoned` takes over reporting for the row
+   * (#1366).
    */
   signalRedriveOutcomeUnreported(conv, message, outcome) {
     if (this.redriveOutcomeUnreportedSignalled.get(message.id) === outcome) return;
@@ -4100,6 +4131,81 @@ var ChannelDriver = class _ChannelDriver {
       attempted_outcome: outcome
     });
   }
+  /**
+   * The runner-authored, honest error text for the terminal fallback a tripped
+   * `boundRedriveOutcome` sends. Distinguishable per outcome and truthful about
+   * what actually happened — the `settle`/done case must say the turn finished
+   * but its result could not be recorded, never that the runner stopped
+   * responding (that would be a lie for this shape, see #1366's "why this ships").
+   */
+  static REDRIVE_ABANDON_ERROR = {
+    reattach: "your runner could not record that this message had started, so it was given up on",
+    settle: "your runner finished this message but could not record the result, so the reply could not be delivered",
+    fail_permanent: "the runner could not read this conversation's state from OpenCode, and could not record that failure either, so the message was given up on"
+  };
+  /**
+   * Bound for Class B (#1340, #1366): the runner DECIDED an outcome but its own
+   * PATCH to record it failed. Two independent trip arms (either sufficient):
+   * (1) this failure streak has lasted `pausedMaxWaitMs` — DURATION, not a tick
+   * count, reusing the knob `resolveRedriveUnresolved` already established; (2)
+   * the turn's `processing_started_at` age has crossed
+   * `ABSOLUTE_MAX_PROCESSING_MS` — durable and restart-surviving, since arm (1)'s
+   * in-memory streak resets on a scale-to-zero restart.
+   *
+   * INVARIANT — a tripped bound never suppresses the original outcome attempt;
+   * it only adds a fallback after that attempt has failed again. This is only
+   * ever reached from inside the catch of the ORIGINAL outcome PATCH, which is
+   * attempted first on every tick whether or not this bound tripped before —
+   * there is no give-up latch that would short-circuit it. That is what lets a
+   * route-level fault that heals later still deliver the turn's real
+   * `done`/`failed` payload: once the original PATCH succeeds again, this
+   * helper is never entered and the row settles with its real result.
+   */
+  async boundRedriveOutcome(conv, message, outcome) {
+    const now = this.now();
+    const since = this.redriveOutcomeFailingSince.get(message.id);
+    if (since === void 0) this.redriveOutcomeFailingSince.set(message.id, now);
+    const durationTripped = now - (since ?? now) >= this.pausedMaxWaitMs;
+    const parsed = message.processing_started_at ? Date.parse(message.processing_started_at) : NaN;
+    const absoluteAgeTripped = !Number.isNaN(parsed) && now - parsed >= ABSOLUTE_MAX_PROCESSING_MS;
+    if (!durationTripped && !absoluteAgeTripped) {
+      this.signalRedriveOutcomeUnreported(conv, message, outcome);
+      return "retry";
+    }
+    const arm = durationTripped ? "failure_window" : "absolute_age";
+    try {
+      await this.markFailed(
+        conv.id,
+        message.id,
+        void 0,
+        _ChannelDriver.REDRIVE_ABANDON_ERROR[outcome]
+      );
+    } catch (err) {
+      if (err instanceof ChannelAuthError) throw err;
+      this.log({
+        level: "warn",
+        message: `Re-drive bound: fallback markFailed for message ${message.id.slice(0, 8)} also failed (arm ${arm}, will retry next drain): ${err instanceof Error ? err.message : String(err)}`,
+        conversation_id: conv.id,
+        message_id: message.id
+      });
+      if (!this.redriveOutcomeAbandonedSignalled.has(message.id)) {
+        this.redriveOutcomeAbandonedSignalled.add(message.id);
+        void this.postSignal(conv.id, message.id, "redrive_outcome_abandoned", {
+          attempted_outcome: outcome,
+          reported: false,
+          arm
+        });
+      }
+      return "retry";
+    }
+    this.clearRedriveUnresolved(message.id);
+    void this.postSignal(conv.id, message.id, "redrive_outcome_abandoned", {
+      attempted_outcome: outcome,
+      reported: true,
+      arm
+    });
+    return "abandoned";
+  }
   /**
    * Record one poll outcome toward the re-drive fence's consecutive-identical-
    * failure streak (#1348) and return the resulting count. `signature === null`