@fungi.computer/truffle 0.4.0 → 0.5.0

package/dist/private-local-service-owner.js

@@ -17,12 +17,13 @@ import { z } from "zod";
 import * as Schema from "effect/Schema";
 import { selectionSchema } from "./private-local-service-discovery.js";
 import { createShiitakeHttpRoutes } from "@fungi.computer/shiitake/http";
+import { questionContract } from "@fungi.computer/shiitake-extensions/question";
 import { listPrivateLocalAgentStores, LocalStoreSchemaError, readPrivateLocalAgentProfile, readPrivateLocalSessionSummaries, isArchivedStore, unreadableStoreReason, } from "./private-local-session-discovery.js";
 import { createPrivateLocalSessionRequestId, openPrivateLocalRuntimeHost, resolvePrivateLocalCreateStore, } from "./private-local-runtime-host.js";
 import { parsePrivateLocalExecPath } from "./private-local-exec-path.js";
 import { createLocalMeshLinks, localMeshLinkKey, } from "./private-local-mesh-links.js";
 import { agentMailAddressSchema, machineAgentRequestSchema, machineDirectorySchema, } from "@fungi.computer/seam/machine-link-protocol";
-import { commandSettlementSchema } from "@fungi.computer/shiitake/fleet";
+import { commandSettlementSchema, settlementReadableBy, } from "@fungi.computer/shiitake/fleet";
 import { BirdDogMailSchema } from "@fungi.computer/bird-dog/effect";
 export class LocalSessionPathConflict extends Error {
     name = "LocalSessionPathConflict";
@@ -163,7 +164,7 @@ serviceNative, onExecApprovalDecision = () => undefined) {
                         return { status: "accepted", receipt: { sessionId } };
                     }
                     const facts = await admitted(owner, () => owner.readSettlement(operation.sessionId, operation.commandId));
-                    if (facts !== undefined && facts.acceptedSender !== actorAgentId)
+                    if (facts !== undefined && !settlementReadableBy(facts, actorAgentId))
                         return "refused";
                     return {
                         status: "accepted",
@@ -902,6 +903,62 @@ serviceNative, onExecApprovalDecision = () => undefined) {
                 throw new AgentArchiveRefused("archived", `Agent ${agentId} is archived; unarchive it to work with it`);
             throw new Error("Agent is outside this Local project");
         }
+        /**
+         * Run one sender-authenticated command on a child's question owner. Which
+         * Agent the item waits on is decided by the child's own store; this door
+         * only states who is calling.
+         */
+        async function callQuestionAsSender(target, senderAgentId, senderSessionId, command, commandInput, output, signal) {
+            ensureRunning();
+            signal.throwIfAborted();
+            const databasePath = (await targets(signal, "all")).get(target.agentId);
+            if (databasePath === undefined)
+                return outsideOrArchived(target.agentId, signal);
+            const { owner, release } = await admittedOwner(target.agentId, signal);
+            try {
+                return await admitted(owner, async () => Schema.decodeUnknownSync(output)(await owner
+                    .getSession(target.sessionId)
+                    .extension("botanical-session-question")
+                    .call(command, commandInput, {
+                    agentId: senderAgentId,
+                    sessionId: senderSessionId,
+                })));
+            }
+            finally {
+                release();
+            }
+        }
+        async function answerAsSender(input, senderAgentId, senderSessionId, signal) {
+            const decoded = await callQuestionAsSender(input, senderAgentId, senderSessionId, "answerAgent", {
+                askId: input.askId,
+                requestId: input.requestId,
+                answers: input.answers,
+            }, questionContract.commands.answerAgent.output, signal);
+            const { result } = decoded;
+            if (result.result === "accepted")
+                return result.commandId === undefined
+                    ? { status: "answered", via: result.via }
+                    : {
+                        status: "answered",
+                        via: result.via,
+                        commandId: result.commandId,
+                    };
+            if (result.result === "closed")
+                return { status: "closed", reason: result.status };
+            if (result.result === "refused")
+                return { status: "refused", reason: result.reason };
+            return { status: "not_found" };
+        }
+        async function escalateAsSender(input, senderAgentId, senderSessionId, signal) {
+            const decoded = await callQuestionAsSender(input, senderAgentId, senderSessionId, "escalateAgent", { askId: input.itemId }, questionContract.commands.escalateAgent.output, signal);
+            if (decoded.result === "escalated")
+                return { status: "escalated", to: decoded.to };
+            if (decoded.result === "closed")
+                return { status: "closed", reason: decoded.status };
+            if (decoded.result === "refused")
+                return { status: "refused", reason: decoded.reason };
+            return { status: "not_found" };
+        }
         /**
          * The first command still queued or running on any of an Agent's Sessions,
          * so an archive can name it rather than cancel it.
@@ -978,6 +1035,8 @@ serviceNative, onExecApprovalDecision = () => undefined) {
         }
         return {
             owner: admittedOwner,
+            answer: answerAsSender,
+            escalate: escalateAsSender,
             archive: (request, signal) => setArchived(request, true, signal),
             unarchive: (request, signal) => setArchived(request, false, signal),
             list: async (signal, options) => {

package/dist/private-local-service.js

@@ -466,7 +466,13 @@ export function createPrivateLocalServiceManager(options = {}) {
                 // stopped it decides when it returns.
                 const ready = await status();
                 if (ready === undefined)
-                    return { kind: "unavailable" };
+                    return {
+                        kind: "unavailable",
+                        // The discovery owner's process-lifetime lease distinguishes an
+                        // overloaded listener from a stopped service without guessing
+                        // from the failed HTTP probe or an error message.
+                        alive: await serviceOwnerIsLive(selectedDirectory),
+                    };
                 accept(ready);
                 const again = await postSelection("select", {
                     invocationRoot: input.invocationRoot,

package/dist/private-local-session-discovery.d.ts

@@ -29,24 +29,29 @@ export declare class LocalStoreSchemaError extends Error {
     readonly name = "LocalStoreSchemaError";
     constructor(databasePath: string, options?: ErrorOptions);
 }
+export type PrivateLocalAgentProfile = ReturnType<typeof openAgentProfile>;
 /**
  * One Agent store's chosen display name, default model, whether it is
  * archived and the Agent that created it (absent when a human made it), read
- * without opening a host.
+ * without opening a host. Directory listings and the sub-agents footer read
+ * every store's profile on each call; an unchanged store file answers from
+ * memory instead of reopening SQLite (each Bun open/close also leaks native
+ * memory).
  */
-export declare function readPrivateLocalAgentProfile(path: string): {
+export declare function readPrivateLocalAgentProfile(path: string): PrivateLocalAgentProfile;
+declare function openAgentProfile(path: string): Readonly<{
     name: string | undefined;
     createdBy: string | null;
     archived: boolean;
     mode: "read-only" | "workspace" | "full-access";
-    writableFolders: string[];
+    writableFolders: readonly string[];
     folder: string;
     model: {
         readonly providerId: string;
         readonly modelId: string;
         readonly reasoning?: "high" | "low" | "max" | "medium" | "minimal" | "xhigh" | undefined;
     } | null;
-};
+}>;
 export declare function readPrivateLocalSessionSummaries(path: string): Promise<readonly LocalSummary[]>;
 /**
  * Discover existing folder sessions without opening or reconciling a host.
@@ -71,3 +76,4 @@ export declare function readPrivateLocalSessionDiscovery(invocationRoot: string,
 }>;
 /** Project the service-owned discovery into choices that resume through it. */
 export declare function projectPrivateLocalSessionDiscovery(discovered: Awaited<ReturnType<typeof readPrivateLocalSessionDiscovery>>, connect: PrivateLocalServiceManager["connect"]): PrivateLocalSessionDiscovery;
+export {};

package/dist/private-local-session-discovery.js

@@ -1,3 +1,4 @@
+import { statSync } from "node:fs";
 import { readdir, realpath, stat } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import * as Effect from "effect/Effect";
@@ -151,12 +152,44 @@ export class LocalStoreSchemaError extends Error {
         this.databasePath = databasePath;
     }
 }
+/** Profiles held at once; directory listings touch every store each call. */
+const cachedProfiles = 1_024;
+const profiles = new Map();
+/** Every committed write moves the store file (or its WAL); none rewrites it in place unseen. */
+function storeVersion(path) {
+    const version = (file) => {
+        const metadata = statSync(file, { bigint: true, throwIfNoEntry: false });
+        return metadata === undefined
+            ? "-"
+            : `${String(metadata.dev)}:${String(metadata.ino)}:${String(metadata.size)}:${String(metadata.mtimeNs)}:${String(metadata.ctimeNs)}`;
+    };
+    return `${version(path)}/${version(`${path}-wal`)}`;
+}
 /**
  * One Agent store's chosen display name, default model, whether it is
  * archived and the Agent that created it (absent when a human made it), read
- * without opening a host.
+ * without opening a host. Directory listings and the sub-agents footer read
+ * every store's profile on each call; an unchanged store file answers from
+ * memory instead of reopening SQLite (each Bun open/close also leaks native
+ * memory).
  */
 export function readPrivateLocalAgentProfile(path) {
+    const version = storeVersion(path);
+    const cached = profiles.get(path);
+    if (cached?.version === version)
+        return cached.profile;
+    const profile = openAgentProfile(path);
+    // The version is taken before the read, so a write racing it misses next time.
+    profiles.delete(path);
+    profiles.set(path, { version, profile });
+    if (profiles.size > cachedProfiles) {
+        const oldest = profiles.keys().next().value;
+        if (oldest !== undefined)
+            profiles.delete(oldest);
+    }
+    return profile;
+}
+function openAgentProfile(path) {
     const database = openPrivateReadOnlySqliteDatabase(path);
     try {
         const columns = database
@@ -184,15 +217,15 @@ export function readPrivateLocalAgentProfile(path) {
             folder: identity?.folder,
             model: readAgentDefaultModelJson(database),
         });
-        return {
+        return Object.freeze({
             name: stored.name ?? undefined,
             createdBy: stored.createdBy,
             archived: stored.archived === 1,
             mode: stored.mode,
-            writableFolders: stored.writableFolders,
+            writableFolders: Object.freeze(stored.writableFolders),
             folder: stored.folder,
             model: parseModelPreferenceJson(stored.model),
-        };
+        });
     }
     finally {
         database.close();

package/dist/private-provider-rejection.d.ts

@@ -1,5 +1,5 @@
 import type { AssistantMessage } from "@earendil-works/pi-ai";
-import type { ProviderRejection } from "@fungi.computer/mule";
+import { type ProviderRejection } from "@fungi.computer/mule";
 /** Evidence owned by one Local request, never inferred from assistant prose. */
 export type ModelFailureInput = Readonly<{
     refusal?: Readonly<{

package/dist/private-provider-rejection.js

@@ -1,24 +1,44 @@
 import { isContextOverflow } from "@earendil-works/pi-ai/utils/overflow";
+import { isRetryableProviderRejection, } from "@fungi.computer/mule";
 /** Local retries only a typed transient, never cancellation or a turn refusal. */
 export function modelFailureRetryable(failure) {
     return (failure.refusal === undefined &&
         failure.upstream?.stopReason !== "aborted" &&
-        failure.rejection?.code === "provider_unavailable");
+        isRetryableProviderRejection(failure.rejection));
 }
 /** The one owned wording for a failed Local model request. */
 export function modelFailureMessage(provider, failure) {
+    const name = provider === "anthropic"
+        ? "Anthropic"
+        : provider === "openai"
+            ? "OpenAI"
+            : provider;
     if (failure.refusal !== undefined)
         return `${failure.refusal.category}: ${failure.refusal.message}`;
     // Typed subscription evidence wins over all SDK/provider wording.
-    if (failure.rejection?.code === "usage-limit-reached")
-        return `${provider} usage limit reached (usage-limit-reached). Check ChatGPT Settings > Usage, then try again later.`;
-    if (modelFailureRetryable(failure))
-        return `${provider} service unavailable. Try again shortly.`;
+    if (failure.rejection?.code === "usage-limit-reached") {
+        const subscription = provider === "anthropic"
+            ? " on your Claude subscription"
+            : provider === "openai"
+                ? " on your ChatGPT subscription"
+                : "";
+        const resetAt = failure.rejection.resetAt;
+        const reset = resetAt === undefined
+            ? ""
+            : `; resets at ${new Intl.DateTimeFormat(undefined, { hour: "2-digit", minute: "2-digit", hourCycle: "h23" }).format(resetAt)}`;
+        return `${name} usage limit reached${subscription}${reset}.`;
+    }
+    if (failure.rejection?.code === "rate-limit")
+        return `${name} rate limit reached; try again shortly.`;
+    if (failure.rejection?.code === "overloaded")
+        return `${name} is overloaded; try again shortly.`;
+    if (failure.rejection?.code === "provider_unavailable")
+        return `${name} is unavailable; try again shortly.`;
     if (failure.upstream !== undefined) {
         if (isContextOverflow(failure.upstream))
-            return `${provider} request exceeds the context window. Compact the Session or choose another model.`;
+            return `${name} request exceeds the context window; compact the Session or choose another model.`;
     }
     if (failure.rejection?.code === "provider_rejected")
-        return `${provider} rejected the model request (${failure.rejection.code}, HTTP ${String(failure.rejection.status)}). Check /login or choose another model with /model.`;
-    return `${provider} model request failed without a provider rejection. Retry the request.`;
+        return `${name} rejected the request (HTTP ${String(failure.rejection.status)}); check your sign-in or choose another model.`;
+    return `${name} model request failed; try again.`;
 }

package/dist/private-sqlite-owner.d.ts

@@ -18,13 +18,19 @@ export type PrivateBunSqliteDatabase = {
 };
 /** The actual Node connection or Local's explicit native Bun adapter. */
 export type PrivateSqliteDatabase = DatabaseSync | PrivateBunSqliteDatabase;
+/**
+ * How long a store's writer waits out a reader's shared lock before its
+ * commit fails. Status reads and the Board read a live store; a reader holds
+ * its lock for one statement, so this bounds a rare wait, never a hang.
+ */
+export declare const storeWriteBusyTimeoutMs = 2000;
 /**
  * A listing owns this database until its existing finally close. Bun's
  * node:sqlite prepare/close leaves native statements alive until GC. Native
  * close(true) on the native Bun driver explicitly finalizes every statement
  * before releasing the connection, including when a read or decoding fails.
  */
-export declare function openPrivateReadOnlySqliteDatabase(path: string): PrivateSqliteDatabase;
+export declare function openPrivateReadOnlySqliteDatabase(path: string, timeout?: number): PrivateSqliteDatabase;
 /** Writable connections own their statements through deterministic close. */
 export declare function openPrivateWritableSqliteDatabase(path: string, timeout: number): PrivateSqliteDatabase;
 export type PrivateSqliteFailureCode = "busy" | "locked" | "corrupt" | "not_a_database" | "other";

package/dist/private-sqlite-owner.js

@@ -7,14 +7,26 @@ const decodeSqliteRow = Schema.decodeUnknownSync(sqliteRowSchema);
 const bunSqlite = Object.hasOwn(process.versions, "bun")
     ? await import("bun:sqlite")
     : undefined;
+/**
+ * How long a reader waits out a live runtime's commit. Stores use a rollback
+ * journal, so a commit briefly locks readers out; a reader that gives up at
+ * once would read a busy store as an unreadable one.
+ */
+const readBusyTimeoutMs = 250;
+/**
+ * How long a store's writer waits out a reader's shared lock before its
+ * commit fails. Status reads and the Board read a live store; a reader holds
+ * its lock for one statement, so this bounds a rare wait, never a hang.
+ */
+export const storeWriteBusyTimeoutMs = 2_000;
 /**
  * A listing owns this database until its existing finally close. Bun's
  * node:sqlite prepare/close leaves native statements alive until GC. Native
  * close(true) on the native Bun driver explicitly finalizes every statement
  * before releasing the connection, including when a read or decoding fails.
  */
-export function openPrivateReadOnlySqliteDatabase(path) {
-    return openPrivateSqliteDatabase(path, true, 0);
+export function openPrivateReadOnlySqliteDatabase(path, timeout = readBusyTimeoutMs) {
+    return openPrivateSqliteDatabase(path, true, timeout);
 }
 /** Writable connections own their statements through deterministic close. */
 export function openPrivateWritableSqliteDatabase(path, timeout) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/truffle",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "private": false,
   "description": "Truffle: Fungi's local Agent runtime, bundled into the fungi command",
   "type": "module",
@@ -57,6 +57,14 @@
     "./rules": {
       "types": "./dist/private-local-exec-rules.d.ts",
       "import": "./dist/private-local-exec-rules.js"
+    },
+    "./board-agents": {
+      "types": "./dist/local-board-agents.d.ts",
+      "import": "./dist/local-board-agents.js"
+    },
+    "./board-shipping": {
+      "types": "./dist/local-board-shipping.d.ts",
+      "import": "./dist/local-board-shipping.js"
     }
   },
   "files": [
@@ -69,26 +77,26 @@
     "@cf-wasm/photon": "0.4.0",
     "@earendil-works/pi-ai": "1.3.0",
     "@effect/platform-node": "4.0.2",
-    "@fungi.computer/agar": "0.4.0",
+    "@fungi.computer/agar": "0.5.0",
     "@fungi.computer/approvals": "0.2.0",
-    "@fungi.computer/bird-dog": "0.2.1",
+    "@fungi.computer/bird-dog": "0.3.0",
     "@fungi.computer/cairn": "0.1.0",
     "@fungi.computer/capnweb": "0.12.0",
     "@fungi.computer/carrier": "0.2.0",
     "@fungi.computer/cordyceps": "0.4.0",
     "@fungi.computer/gills": "0.2.0",
-    "@fungi.computer/graft": "0.1.3",
-    "@fungi.computer/knapsack": "0.3.1",
-    "@fungi.computer/lantern": "0.3.0",
-    "@fungi.computer/mycelium": "0.2.2",
-    "@fungi.computer/nacre": "0.0.3",
+    "@fungi.computer/graft": "0.1.4",
+    "@fungi.computer/knapsack": "0.4.0",
+    "@fungi.computer/lantern": "0.3.1",
+    "@fungi.computer/mycelium": "0.2.3",
+    "@fungi.computer/nacre": "0.1.0",
     "@fungi.computer/seam": "0.2.0",
-    "@fungi.computer/shiitake": "0.5.0",
-    "@fungi.computer/shiitake-extensions": "0.3.0",
+    "@fungi.computer/shiitake": "0.6.0",
+    "@fungi.computer/shiitake-extensions": "0.4.0",
     "@fungi.computer/veil": "0.2.1",
     "@fungi.computer/watchdog": "0.1.0",
-    "@fungi.computer/whistle": "0.2.0",
-    "@fungi.computer/zookeeper": "0.0.4",
+    "@fungi.computer/whistle": "0.3.0",
+    "@fungi.computer/zookeeper": "0.0.5",
     "@jellybrick/dbus-next": "0.11.4",
     "@modelcontextprotocol/client": "2.0.0",
     "@napi-rs/keyring": "2.1.2",
@@ -109,7 +117,7 @@
   },
   "devDependencies": {
     "@cloudflare/codemode": "0.5.1",
-    "@fungi.computer/mule": "0.2.0",
+    "@fungi.computer/mule": "0.2.1",
     "@modelcontextprotocol/server": "2.0.0",
     "@types/node": "24.13.3",
     "@types/proper-lockfile": "4.1.4",
@@ -156,6 +164,7 @@
     "build": "if [ ! -f src/private-local-native-digests.js ]; then pnpm run build:native; fi && node scripts/generate-native-digests.mjs --verify && pnpm run clean && tsc -p tsconfig.build.json && cp src/private-local-native-digests.js dist/private-local-native-digests.js && node scripts/copy-seatbelt.mjs && esbuild src/internal/private-workerd-sandbox-worker.mjs --outfile=dist/internal/private-workerd-sandbox-worker.mjs --bundle --format=esm --platform=neutral --conditions=workerd,browser --target=es2024 --external:cloudflare:workers --metafile=dist/internal/sandbox-metafile.json --log-level=warning && esbuild src/internal/local-image-fit-worker.mjs --outfile=dist/internal/local-image-fit-worker.mjs --bundle --format=esm --platform=node --target=es2024 --metafile=dist/internal/image-fit-metafile.json --log-level=warning",
     "clean": "node --input-type=module --eval \"import { rm } from 'node:fs/promises'; await rm('dist', { recursive: true, force: true });\"",
     "test": "pnpm run test:node && pnpm run test:merge && pnpm run test:stop-all",
+    "soak:memory": "bun scripts/service-memory-soak.mjs",
     "test:stop-all": "bun test ./test/private-local-stop-all.bun.test.ts",
     "test:full": "pnpm run test && pnpm run test:bun",
     "test:node": "../../node_modules/.bin/vitest run",