@intentic/constants 1.389.0 → 1.391.0

package/README.md

@@ -31,13 +31,20 @@ flowchart LR
   on any Node an agent's project pins. A rule may also match the program's working directory (`cwd`), name its memory
   price (`size`), and be judged under a program that already holds a slot (`nests`): the editor's `vue-tsc` takes the
   `vue-typecheck` lane, one at a time, from under a `pnpm -r typecheck`. Only a pool no `nests` rule names may wait on
-  one that does, so the waits cannot form a cycle.
+  one that does, so the waits cannot form a cycle. `cargoBuildArgs` translates supported `cargo run` options into
+  a build; `heavy-exec.cjs` queues that build in a child and starts the original run once its slot is released.
+  Unknown arguments retain the original invocation. The prebuild stays local even when ordinary Cargo builds
+  are offloaded, so its artifacts warm the original run.
 - `memory-room`'s `SIZE_BYTES` prices a toolchain command by its measured shape instead of its class: `targeted` (a test
   run aimed at named files), `editor-typecheck` (the editor's full `vue-tsc`, 7 GiB) and `scoped-typecheck` (`lsp diag`
-  on a Vue package, 4 GiB).
+  on a Vue package, 4 GiB), and `cargo-build` (7 GiB per admission, based on Shinobi's 2026-11-02 Rust build peaks).
+  Two Cargo reservations fit an 18 GiB sandbox with headroom; the price does not cap compiler RSS.
 - `memory-room` is the one formula for whether the sandbox has room (limit, used, free, stall, and what each workload
   class costs). The daemon's resource budget judges by it, and it is also the `memory-room` command `queue-run` asks:
-  it asks the daemon's room socket, and applies the formula itself where no daemon answers.
+  it asks the daemon's room socket, and applies the formula itself where no daemon answers. (2026-11-02) A reading may
+  carry `host`, the machine the sandbox runs on as the daemon last heard from it: work nobody waits on then also waits
+  while its cost would take that machine under `host.reserveBytes`. Only the daemon adds it, so the fallback formula
+  never has a host to answer to.
 - `dev-previews` is the record of a conversation's managed dev preview (its demo server): where the records live
   (`/tmp/intentic-previews`), what makes one trustworthy (pid, start tick, conversation stamp, pid namespace), the cap
   of three and the ten-minute idle bound, the conversation's own port in 47150-47199, and how a preview is stopped

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/constants",
-  "version": "1.389.0",
+  "version": "1.391.0",
   "description": "Shared constants for the intentic packages, ports, paths, and image references the daemon, CLIs and desktop app all agree on",
   "license": "MIT",
   "type": "module",

package/src/heavy/heavy-exec.cjs

@@ -7,7 +7,10 @@
 
 const { accessSync, constants } = require("node:fs");
 const { delimiter, join, resolve } = require("node:path");
-const { takeTurn } = require("./heavy-turn.cjs");
+const { spawnSync } = require("node:child_process");
+const { constants: osConstants } = require("node:os");
+const { takeTurn, pendingSpec } = require("./heavy-turn.cjs");
+const { cargoBuildArgs, matchInvocation } = require("./heavy-rules.cjs");
 
 const [shims = "", program = "", ...args] = process.argv.slice(2);
 
@@ -30,8 +33,33 @@ if (real === undefined) {
     process.stderr.write(`${program}: command not found\n`);
     process.exit(127);
 }
+// The child holds the slot only while compiling. The original run then starts with its untouched environment,
+// so a server inherits neither the build's slot nor its toolchain priority. This build stays local to warm its artifacts.
+let build;
+let buildEnv = process.env;
+try {
+    const spec = pendingSpec();
+    const translated = program === "cargo" ? cargoBuildArgs(args) : undefined;
+    if (spec !== undefined && translated !== undefined &&
+        matchInvocation([program, ...translated].join(" "), spec.rules, undefined, { cwd: process.cwd() })?.id === "cargo") {
+        build = translated;
+        const offload = { ...spec.offload };
+        delete offload.cargo;
+        buildEnv = { ...process.env, INTENTIC_HEAVY: JSON.stringify({ ...spec, offload }) };
+    }
+} catch {
+    // allow(silent-catch): an unreadable table preserves the original invocation
+}
+if (build !== undefined) {
+    const compiled = spawnSync(process.execPath, [__filename, shims, program, ...build], { stdio: "inherit", env: buildEnv });
+    if (compiled.status !== 0) {
+        process.exit(compiled.status ?? (compiled.signal === null ? 1 : 128 + (osConstants.signals[compiled.signal] ?? 0)));
+    }
+}
 try {
-    takeTurn({ program, args, command: [real, ...args] });
+    if (build === undefined) {
+        takeTurn({ program, args, command: [real, ...args] });
+    }
 } catch {
     // allow(silent-catch): a table that does not parse runs the program as if unjudged
 }
@@ -39,6 +67,5 @@ try {
 if (typeof process.execve === "function") {
     process.execve(real, [program, ...args], process.env);
 }
-const { spawnSync } = require("node:child_process");
 const run = spawnSync(real, args, { stdio: "inherit", env: process.env, argv0: program });
 process.exit(run.status ?? 1);

package/src/heavy/heavy-rules.cjs

@@ -113,13 +113,14 @@ const SHIPPED_HEAVY_COMMANDS = Object.freeze({
         { id: "typechecker", pattern: "(?<![-.])\\b(tsc|tsgo|vue-tsc)\\b(?![-.])" },
         { id: "turbo-fanout", pattern: "\\bturbo\\b.*\\brun\\b.*\\b(build|test|typecheck|check)\\b" },
         { id: "package-script", pattern: "\\b(pnpm|npm|yarn|bun)\\b.*\\b(test|typecheck|verify|check|build)\\b" },
-        { id: "cargo", pattern: "^cargo\\s+(\\+\\S+\\s+)?(build|test|check|clippy|bench|doc)\\b" },
+        { id: "cargo", pattern: "^cargo\\s+(\\+\\S+\\s+)?(build|test|check|clippy|bench|doc)\\b", size: "cargo-build" },
     ]),
 });
 
 // Every rule an earlier release shipped, as it shipped it (matched against the agent's shell line then). A stored rule
 // equal to one of these was seeded, not chosen, so converting a stored file drops it and the current rule takes over.
 const EARLIER_SHIPPED_RULES = Object.freeze([
+    { id: "cargo", pattern: "^cargo\\s+(\\+\\S+\\s+)?(build|test|check|clippy|bench|doc)\\b" },
     {
         id: "read-only",
         pattern: "^\\s*(grep|rg|iq|ag|cat|bat|head|tail|less|ls|find|fd|wc|which|echo|git\\s+(log|status|diff|show|blame))\\b",
@@ -342,6 +343,44 @@ const sizeArgs = (match, invocation) => {
     return ["vitest", "package-script"].includes(match.id) && targetedRun(invocation) ? ["--size", "targeted"] : [];
 };
 
+// Translate only known Cargo options. Unknown flags, aliases and help requests keep the original invocation.
+// Runtime arguments after `--` belong only to `run`; a toolchain selector belongs before either verb.
+const cargoBuildArgs = (args) => {
+    const prefix = args[0]?.startsWith("+") ? [args[0]] : [];
+    if (args[prefix.length] !== "run") {
+        return undefined;
+    }
+    const build = [...prefix, "build"];
+    const values = new Set([
+        "--package", "--bin", "--example", "--features", "--profile", "--target", "--target-dir", "--manifest-path",
+        "--jobs", "--color", "--message-format", "--config", "--lockfile-path", "-p", "-F", "-j", "-Z",
+    ]);
+    const switches = new Set([
+        "--release", "-r", "--all-features", "--no-default-features", "--locked", "--offline", "--frozen",
+        "--verbose", "--quiet", "-q", "--timings", "--future-incompat-report", "--ignore-rust-version", "--keep-going",
+    ]);
+    for (let i = prefix.length + 1; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--") {
+            break;
+        }
+        if (switches.has(arg) || /^-v+$/u.test(arg) || /^-(p|F|j|Z).+/u.test(arg)) {
+            build.push(arg);
+        } else if (values.has(arg)) {
+            const value = args[++i];
+            if (value === undefined || value === "--" || (value.startsWith("-") && !(arg === "-j" || arg === "--jobs"))) {
+                return undefined;
+            }
+            build.push(arg, value);
+        } else if (arg.includes("=") && (values.has(arg.split("=")[0]) || arg.startsWith("--timings="))) {
+            build.push(arg);
+        } else {
+            return undefined;
+        }
+    }
+    return build;
+};
+
 // When a slot held this long is worth a line in the log: half of what its own rule lets it hold, never for a rule that
 // lets it hold forever.
 const holdWarnSeconds = (maxHold) => (maxHold > 0 ? maxHold / 2 : undefined);
@@ -363,4 +402,5 @@ module.exports = {
     holdWarnSeconds,
     ruleById,
     heldPoolsOf,
+    cargoBuildArgs,
 };

package/src/heavy/heavy-rules.d.cts

@@ -95,3 +95,6 @@ export function holdWarnSeconds(maxHold: number): number | undefined;
 export function ruleById(config: HeavyCommands, id: string): HeavyCommandRule | undefined;
 // The pools the programs above one already hold slots of, from INTENTIC_HEAVY_HELD and INTENTIC_QUEUE_SLOT.
 export function heldPoolsOf(env: Readonly<Record<string, string | undefined>>, config: HeavyCommands): string[];
+
+// The build before a cargo run, or undefined when its arguments cannot be translated safely.
+export function cargoBuildArgs(args: readonly string[]): string[] | undefined;

package/src/memory-room.d.mts

@@ -5,8 +5,8 @@ export const COST_BYTES: Readonly<Record<RoomWorkload, number>>;
 export const PERSON_RESERVE_BYTES: number;
 export const TARGETED_RUN_BYTES: number;
 // A toolchain command priced by its named shape instead of its class's cost (SIZE_BYTES): one aimed at named files,
-// the editor's full typecheck, a changed-files Vue typecheck.
-export type RoomSize = "targeted" | "editor-typecheck" | "scoped-typecheck";
+// the editor's full typecheck, a changed-files Vue typecheck, a Cargo build.
+export type RoomSize = "targeted" | "editor-typecheck" | "scoped-typecheck" | "cargo-build";
 export const SIZE_BYTES: Readonly<Record<RoomSize, number>>;
 export function isRoomSize(size: string): size is RoomSize;
 export const TEST_PROCESS_BYTES: Readonly<{ fanOutWorker: number; standaloneWorker: number; typecheck: number; ceiling: number }>;
@@ -40,6 +40,18 @@ export interface MemoryReading {
     readonly ioStallSustainedPercent?: number | undefined;
     // memory.events `oom_kill`, cumulative; undefined without a cgroup.
     readonly oomKills: number | undefined;
+    // (2026-11-02) The machine this sandbox runs on, as its agent last said, added by the daemon only while that is
+    // fresh; absent is "no host to answer to", never "no room". Work nobody waits on waits while it would take the host
+    // under `reserveBytes`.
+    readonly host?: HostRoom | undefined;
+}
+
+export interface HostRoom {
+    // The machine's name as the owner knows it (its device card), for the sentence a held command is given.
+    readonly name: string;
+    readonly availableBytes: number;
+    readonly totalBytes: number;
+    readonly reserveBytes: number;
 }
 
 export interface ShortMemory {

package/src/memory-room.mjs

@@ -34,6 +34,10 @@ export const TARGETED_RUN_BYTES = 512 * MIB;
 // `size`, which queue-run passes as `--size <name>`). One name per measured shape:
 export const SIZE_BYTES = Object.freeze({
     targeted: TARGETED_RUN_BYTES,
+    // Shinobi resource-metrics.jsonl, 2026-11-02: `other` RSS peaked at 12.70 GiB at 19:25 with one cargo slot held,
+    // and 13.88 GiB at 23:14 with two. Rust was unclassified then, so this includes other work and unqueued runs.
+    // Admission estimate per slot: two fit the 18 GiB sandbox with headroom. Cargo's jobs still bound its fan-out.
+    "cargo-build": 7 * GIB,
     // The editor's full typecheck, `vue-tsc` over `_editor/web`, or `_site/demo`'s, which compiles the same source:
     // 6.8 GiB at its peak (measured 2026-10-26, cold and warm alike), under the 8 GiB heap its script gives it.
     "editor-typecheck": 7 * GIB,
@@ -209,6 +213,11 @@ export const judge = (reading, { workload, attended, reservedBytes = 0, size })
     const stallSustainedPercent = reading.stallSustainedPercent ?? 0;
     const unreserved = freeBytesOf(reading);
     const counted = countedBytesOf(reading);
+    // Asked before the sandbox's own figures, which may measure nothing: a VM with room says nothing of the PC under it.
+    const hostHeld = hostWait(reading, { workload, attended, reservedBytes, size }, need, unreserved);
+    if (hostHeld !== undefined) {
+        return hostHeld;
+    }
     if (limitBytes === undefined || usedBytes === undefined || counted === undefined || unreserved === undefined) {
         return { verdict: "run", needBytes: need, freeBytes: undefined, reservedBytes };
     }
@@ -252,6 +261,29 @@ export const judge = (reading, { workload, attended, reservedBytes = 0, size })
     return shortOf(`Sandbox memory is low: ${used}${held}`, { limitBytes, residentBytes: usedBytes - swapBytes, swapBytes });
 };
 
+// (2026-11-02) Why work nobody is waiting on should wait for the machine this sandbox runs on, or undefined while it need
+// not. Everything else here reads the sandbox's own cgroup and the kernel under it, which on a Windows PC is Docker
+// Desktop's WSL2 VM: on 2026-11-02 that VM read as roomy while Windows had 1.1 GB left and froze for 43 s. The daemon adds
+// `reading.host` from what the host's agent last said (hosts/host-memory.ts), only while that is fresh, so a reading
+// without it is "no host to answer to", never "no room". Work waits while starting it would take the host below its
+// reserve, the line under which the host's agent starts giving the VM's cache back. Only the work's own cost counts here:
+// the person's share in `needBytes` is room inside the sandbox, which the sandbox's own figures already keep.
+const hostShortOf = (host, costBytes, reservedBytes) => {
+    if (host === undefined || host.availableBytes - host.reserveBytes - reservedBytes >= costBytes) {
+        return undefined;
+    }
+    const held = reservedBytes > 0 ? `, ${gib(reservedBytes)} of it held for work that just started` : "";
+    return `${host.name}, the machine this sandbox runs on, is low on memory: it has ${gib(host.availableBytes)} available of ${gib(host.totalBytes)}${held}, and heavy work waits while starting it would leave it under ${gib(host.reserveBytes)}`;
+};
+
+// The verdict that holds work nobody waits on for the host, or undefined while the host has room for it (hostShortOf).
+const hostWait = (reading, { workload, attended, reservedBytes, size }, need, unreserved) => {
+    const diagnosis = attended ? undefined : hostShortOf(reading.host, costBytesOf(workload, size), reservedBytes);
+    return diagnosis === undefined
+        ? undefined
+        : { verdict: "wait", needBytes: need, freeBytes: unreserved === undefined ? undefined : Math.max(0, unreserved - reservedBytes), reservedBytes, diagnosis };
+};
+
 // Why work nobody is waiting on should wait for the disk, or undefined while it need not (the `disk` clause).
 const diskStalled = (reading) => {
     const recent = reading.ioStallPercent ?? 0;