@feng0531/dsh-code-review 0.85.13 → 0.86.1

package/src/snapshot-reader.mjs

@@ -21,15 +21,17 @@ function budgetError(kind) {
 }
 
 // This capability reads only caller-approved text entries, never the filesystem.
-export function createSnapshotReader(snapshotId, entries, { maxBytes = 4 * 1024 * 1024, maxCalls = 50, maxOutputBytes = 256 * 1024, signal } = {}) {
+export function createSnapshotReader(snapshotId, entries, { maxBytes = 4 * 1024 * 1024, maxCalls = 50, maxOutputBytes = 256 * 1024, signal, reuseResults = false } = {}) {
   if (typeof snapshotId !== 'string' || !snapshotId || snapshotId.length > 200) throw new Error('Invalid snapshot identity');
   if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 16 * 1024 * 1024) throw new Error('Invalid reader budget');
   if (!Array.isArray(entries) || entries.length > 500) throw new Error('Invalid reader entries');
   for (const [value, cap] of [[maxCalls, 1000], [maxOutputBytes, 4 * 1024 * 1024]]) {
     if (!Number.isSafeInteger(value) || value < 1 || value > cap) throw new Error('Invalid reader budget');
   }
+  if (typeof reuseResults !== 'boolean') throw new Error('Invalid reader reuse option');
   signal?.throwIfAborted();
 
+  let cache = new Map(), cacheBytes = 0, cacheHits = 0, deliveries = 0;
   let calls = 0, outputBytes = 0, inTransaction = false;
   const begin = () => {
     signal?.throwIfAborted();
@@ -103,16 +105,66 @@ export function createSnapshotReader(snapshotId, entries, { maxBytes = 4 * 1024
     return { snapshotId, sourceId: id, hash: source.hash, start, count: selectedCount, text, endOfSource: endOffset === source.text.length };
   };
 
+  const validate = (kind, request) => {
+    if (!request || typeof request !== 'object') throw new Error('Invalid reader request');
+    if (kind === 'read') {
+      if (!sources.has(request.id)) throw new Error('Source not authorized');
+      if (!Number.isSafeInteger(request.start) || request.start < 1 || !Number.isSafeInteger(request.count) || request.count < 1 || request.count > 200) throw new Error('Invalid line range');
+    } else {
+      if (!validQuery(request.query, request.limit === undefined ? 20 : request.limit)) throw new Error('Invalid query request');
+      if (kind === 'search' && request.sourceIds !== undefined && (!Array.isArray(request.sourceIds) || !request.sourceIds.length || request.sourceIds.length > 20 || new Set(request.sourceIds).size !== request.sourceIds.length || request.sourceIds.some(id => !sources.has(id)))) throw new Error('Invalid search source filter');
+    }
+  };
+  const keyOf = (kind, request) => JSON.stringify(kind === 'read' ? [kind, request.id, request.start, request.count] : kind === 'find' ? [kind, request.query, request.limit ?? 20] : [kind, request.query, request.limit ?? 20, request.sourceIds === undefined ? null : [...request.sourceIds].sort()]);
+  const materialize = (kind, request) => kind === 'read' ? read(request) : kind === 'find' ? find(request) : search(request);
+  const deliver = (kind, request, decorate = value => value) => {
+    signal?.throwIfAborted();
+    // Validation is never bypassed by canonicalization (e.g. duplicate filters).
+    if (reuseResults) validate(kind, request);
+    const key = reuseResults ? keyOf(kind, request) : null;
+    const cached = reuseResults && cache.get(key);
+    if (!cached) begin();
+    const raw = cached ? structuredClone(cached.result) : materialize(kind, request);
+    const result = finish(decorate(structuredClone(raw)));
+    if (reuseResults) {
+      deliveries++;
+      if (cached) cacheHits++;
+      else {
+        const size = resultSize(raw);
+        if (cache.size < maxCalls && cacheBytes + size <= maxOutputBytes) { cache.set(key, { result: structuredClone(raw), size }); cacheBytes += size; }
+      }
+    }
+    return result;
+  };
+  const preflight = requests => {
+    signal?.throwIfAborted();
+    if (!Array.isArray(requests) || !requests.length || requests.length > 8) throw new Error('Invalid retrieval batch');
+    const staged = new Map(cache); let stagedBytes = cacheBytes, needed = 0, size = 0, hits = 0;
+    for (const request of requests) {
+      if (!['read', 'find', 'search'].includes(request?.kind)) throw new Error('Unsupported retrieval operation');
+      // Dry-run validates against immutable approved sources; it grants no receipts.
+      validate(request.kind, request);
+      const key = reuseResults ? keyOf(request.kind, request) : null;
+      const raw = reuseResults && staged.has(key) ? staged.get(key).result : materialize(request.kind, request), bytes = resultSize(raw);
+      if (reuseResults && staged.has(key)) hits++;
+      else { needed++; if (reuseResults && staged.size < maxCalls && stagedBytes + bytes <= maxOutputBytes) { staged.set(key, { result: raw, size: bytes }); stagedBytes += bytes; } }
+      size += bytes;
+    }
+    if (calls + needed > maxCalls) throw budgetError('call');
+    if (outputBytes + size > maxOutputBytes) throw budgetError('output');
+    return { calls: needed, outputBytes: size, cacheHits: hits };
+  };
   return Object.freeze({
-    usage: () => ({ calls, outputBytes }),
-    budget: () => ({ maxCalls, maxOutputBytes, remainingCalls: maxCalls - calls, remainingOutputBytes: maxOutputBytes - outputBytes, maxResultBytes: 64 * 1024 }),
+    usage: () => ({ calls, outputBytes, ...(reuseResults ? { cacheHits, deliveries, cacheEntries: cache.size, cacheBytes } : {}) }),
+    budget: () => ({ maxCalls, maxOutputBytes, remainingCalls: maxCalls - calls, remainingOutputBytes: maxOutputBytes - outputBytes, maxResultBytes: 64 * 1024, ...(reuseResults ? { reusableResults: cache.size > 0 } : {}) }),
+    canServe(requests) { try { preflight(requests); return true; } catch { return false; } },
     // A synchronous host-only batch commits its ledger only as a whole. This
     // also covers decorated response bytes that preflight cannot predict.
     // Callers must not publish results/audit records before this returns.
     transaction(execute) {
       signal?.throwIfAborted();
       if (inTransaction || typeof execute !== 'function') throw new Error('Invalid reader transaction');
-      const previousCalls = calls, previousBytes = outputBytes;
+      const previousCalls = calls, previousBytes = outputBytes, previousCache = new Map(cache), previousCacheBytes = cacheBytes, previousHits = cacheHits, previousDeliveries = deliveries;
       inTransaction = true;
       try {
         const result = execute();
@@ -120,29 +172,17 @@ export function createSnapshotReader(snapshotId, entries, { maxBytes = 4 * 1024
         signal?.throwIfAborted();
         return result;
       } catch (error) {
-        calls = previousCalls; outputBytes = previousBytes;
+        calls = previousCalls; outputBytes = previousBytes; cache = previousCache; cacheBytes = previousCacheBytes; cacheHits = previousHits; deliveries = previousDeliveries;
         throw error;
       } finally { inTransaction = false; }
     },
     // Host-only dry run. Validate ALL ranges and sources before charging anything.
     // No evidence or receipts escape this preflight. Decorated reads are still
     // measured by finish; this never reserves or increases the shared budget.
-    preflight(requests) {
-      signal?.throwIfAborted();
-      if (!Array.isArray(requests) || !requests.length || requests.length > 8) throw new Error('Invalid retrieval batch');
-      const results = requests.map(request => {
-        if (request?.kind === 'read') return read(request);
-        if (request?.kind === 'find') return find(request);
-        if (request?.kind === 'search') return search(request);
-        throw new Error('Unsupported retrieval operation');
-      });
-      if (calls + requests.length > maxCalls) throw budgetError('call');
-      const size = results.reduce((sum, result) => sum + resultSize(result), 0);
-      if (outputBytes + size > maxOutputBytes) throw budgetError('output');
-    },
-    find(request) { begin(); return finish(find(request)); },
-    search(request) { begin(); return finish(search(request)); },
-    // decorate is a host-only callback; model requests never supply it.
-    read(request, decorate = value => value) { begin(); return finish(decorate(read(request))); },
+    preflight,
+    find(request) { return deliver('find', request); },
+    search(request) { return deliver('search', request); },
+    // Only immutable raw text is cached; each delivery creates fresh decorations.
+    read(request, decorate) { return deliver('read', request, decorate); },
   });
 }

package/src/verification-loop.mjs

@@ -1,6 +1,7 @@
 import { VERIFICATION_INSTRUCTIONS } from './prompts.mjs';
 import { CONTEXT_SIDE_NOTICE } from './context-identity.mjs';
 import { defectGuidance } from './defect-guidance.mjs';
+import { modelWireBudget } from './model-wire-budget.mjs';
 import { createEvidenceReceipts } from './evidence-receipts.mjs';
 import { retrievalLoop, retrievalRequest } from './retrieval-loop.mjs';
 import { verificationSeeds } from './verification-seeds.mjs';
@@ -28,7 +29,7 @@ export async function verificationLoop(model, request, candidates, scope, option
     onReceipt: (id, resolve) => seedReceipts.set(id, resolve),
     fits: seeds => {
       const next = retrievalRequest(verificationRequest, scope, seeds);
-      return Buffer.byteLength(next.input) + Buffer.byteLength(next.instructions) <= (options.maxInputBytes ?? 96 * 1024);
+      return request.nativeOutputTools === true ? modelWireBudget(next, options.maxInputBytes ?? 96 * 1024).fits : Buffer.byteLength(next.input) + Buffer.byteLength(next.instructions) <= (options.maxInputBytes ?? 96 * 1024);
     },
   });
   const receipts = createEvidenceReceipts(scope.read, { limit: 50 - seedReceipts.size });

package/src/verification-seeds.mjs

@@ -35,8 +35,10 @@ export function verificationSeeds(candidates, scope, { signal, fits, onReceipt =
     const budget = scope.budget?.();
     // At least one exact final validation read per candidate must remain. This
     // reserves no new authority; additional evidence can still exhaust budgets.
-    if (budget && (budget.remainingCalls <= candidates.length || budget.remainingOutputBytes <= finalEvidenceBytes)) break;
+    if (budget && budget.remainingOutputBytes <= finalEvidenceBytes) break;
     try {
+      const cached = budget?.reusableResults === true && scope.preflight?.([request])?.calls === 0 && scope.canServe?.([request]) === true;
+      if (budget && !cached && budget.remainingCalls <= candidates.length) continue;
       // Failed transactions discard their receipt table too, not just the ledger.
       const receipts = createEvidenceReceipts(scope.read, { limit: 1 });
       const item = scope.transaction(() => {
@@ -48,7 +50,22 @@ export function verificationSeeds(candidates, scope, { signal, fits, onReceipt =
         const proposed = [...seeds, { request, result }];
         const nextBudget = scope.budget?.();
         const reserve = finalEvidenceBytes + Buffer.byteLength(JSON.stringify(result)) * references;
+        if (cached) {
+          // Validation reads the actual returned count, not the seed's requested
+          // EOF-clamped count. These are different exact cache keys. Reserve all
+          // final reads explicitly before admitting a zero-call cached seed.
+          let calls = 0;
+          for (const item of proposed) {
+            const validation = { kind: 'read', id: item.result.sourceId, start: item.result.start, count: item.result.count };
+            const cost = scope.preflight([validation]);
+            if (!Number.isSafeInteger(cost?.calls) || cost.calls < 0) throw capacityError();
+            const matching = [...ranges.values()].find(range => JSON.stringify(range.request) === JSON.stringify(item.request));
+            calls += cost.calls * (matching?.references ?? 1);
+          }
+          if (nextBudget && calls > nextBudget.remainingCalls) throw capacityError();
+        }
         if (Buffer.byteLength(JSON.stringify(proposed)) > MAX_SEED_BYTES || !fits(proposed) || (nextBudget && nextBudget.remainingOutputBytes < reserve)) throw capacityError();
+        signal?.throwIfAborted();
         return { request, result };
       });
       // Publish only after the approved reader has committed the transaction.