@iowarp/clio-coder 0.4.1 → 0.4.2

package/src/domains/dispatch/extension.ts

@@ -77,6 +77,7 @@ import type { PromptsContract } from "../prompts/contract.js";
 import { type EffectivePricing, resolveEffectivePricing } from "../providers/catalog.js";
 import {
 	type CapabilityFlags,
+	canonicalEndpointKey,
 	canonicalizeWireModelId,
 	type EndpointCapacity,
 	endpointCapacityFor,
@@ -181,7 +182,12 @@ import {
 	type HeartbeatStatus,
 	heartbeatMonotonicAt,
 } from "./heartbeat.js";
-import { hostVerificationRejection, runHostVerification } from "./host-verification.js";
+import {
+	type BatchVerificationGate,
+	createBatchVerificationGate,
+	hostVerificationRejection,
+	runHostVerification,
+} from "./host-verification.js";
 import { renderDispatchIntentRequirements } from "./intent-requirements.js";
 import { adaptJointRouteInput } from "./joint-route-adapter.js";
 import {
@@ -201,6 +207,8 @@ import {
 	type DispatchPathScope,
 	declaredScopeReplacementDiagnostic,
 	declaredScopeReplacementNotice,
+	inferredScopeParentTokenDiagnostic,
+	inferredScopeParentTokenNotice,
 	resolveDispatchPathScope,
 } from "./path-scope.js";
 import { deriveEnvelopePhaseDurations, deriveRunPhaseDurations, recordRunTimingBestEffort } from "./phase-timing.js";
@@ -1603,11 +1611,7 @@ function assertPostRuntimeToolCompatibility(
 }
 
 function workerToolCallHardCap(settings: EffectiveSettings): number {
-	const rawEnvCap = process.env.CLIO_CODER_WORKER_TOOL_CALL_CAP?.trim();
-	const parsedEnvCap = rawEnvCap && /^[1-9]\d*$/.test(rawEnvCap) ? Number(rawEnvCap) : Number.NaN;
-	return Number.isSafeInteger(parsedEnvCap)
-		? parsedEnvCap
-		: (settings?.fleet.limits.toolCallsPerRun ?? GUARDRAIL_DEFAULTS.workerToolCallCap);
+	return settings?.fleet.limits.toolCallsPerRun ?? GUARDRAIL_DEFAULTS.workerToolCallCap;
 }
 
 function resolveEffectiveWorkerBudget(input: {
@@ -2500,6 +2504,29 @@ export function createDispatchBundle(
 		return Object.fromEntries(Object.entries(configuredEndpointCapacities()).map(([key, value]) => [key, value.limit]));
 	}
 
+	/**
+	 * Endpoints still bound by the blind one-slot default have never been
+	 * probed by any process, or their record expired. A fresh home carried that
+	 * bound into its first batch and refused two tasks on a server running
+	 * four, until the operator happened to run `targets --probe`. Probe each
+	 * such endpoint once per process, in the background and without the
+	 * inference-based reasoning check: the slot count is a header read, and the
+	 * model's first dispatch call is seconds away at the earliest. The probe
+	 * lands in the provider statuses and the durable slot store, which is where
+	 * admission already looks.
+	 */
+	const probedDefaultBoundEndpoints = new Set<string>();
+	function probeEndpointsAtDefaultBound(): void {
+		const capacities = configuredEndpointCapacities();
+		for (const target of getEffectiveSettings()?.targets ?? []) {
+			const key = canonicalEndpointKey(target);
+			if (key === null || capacities[key]?.source !== "local-native-default") continue;
+			if (probedDefaultBoundEndpoints.has(key)) continue;
+			probedDefaultBoundEndpoints.add(key);
+			void providers.probeTarget(target.id, { reasoning: false }).catch(() => undefined);
+		}
+	}
+
 	function endpointCapacityForTarget(targetId: string): EndpointCapacity | null {
 		const status = providers.list().find((entry) => entry.target.id === targetId);
 		const target = status?.target ?? providers.getTarget(targetId);
@@ -3369,6 +3396,23 @@ export function createDispatchBundle(
 				agentId: req.agentId,
 			});
 		}
+		// A reinterpreted "../" token is the one legacy-mode scope fact that earns
+		// the channel: it fires only where the dispatch used to fail outright, so
+		// it cannot warn on the ordinary intent-less dispatch the comment above
+		// keeps quiet. Anchoring is reported alongside dropping because it is the
+		// half that adds to scope, putting a path in working context that the
+		// prose never literally spelled.
+		const parentTokenDiagnostic = inferredScopeParentTokenDiagnostic(pathScope);
+		if (parentTokenDiagnostic !== null) {
+			reportDispatchDiagnostic("inferred scope parent tokens", new Error(parentTokenDiagnostic));
+		}
+		const parentTokenNotice = inferredScopeParentTokenNotice(pathScope);
+		if (parentTokenNotice !== null) {
+			context.bus.emit(BusChannels.DispatchScopeNotice, {
+				...parentTokenNotice,
+				agentId: req.agentId,
+			});
+		}
 	}
 
 	async function resolveLifecycle(req: DispatchRequest, settings: EffectiveSettings): Promise<DispatchLifecycleStage> {
@@ -3402,6 +3446,7 @@ export function createDispatchBundle(
 						autoSelected: req.agentSelection?.mode === "auto",
 						resultContractKind: spec.resultContract.kind,
 						specs: agents.listSpecs(),
+						intent: req.intent ?? null,
 					});
 		if (capabilityMismatch?.verdict === "refuse") throw new Error(capabilityMismatch.detail);
 		const pathScope = resolveDispatchPathScope(req);
@@ -3434,17 +3479,16 @@ export function createDispatchBundle(
 			allowedTools: effectiveTools,
 		};
 		const personaBody = workerPersonaBody(req, recipe, effectiveTools);
+		const hasCanonicalContext = effectiveTools.includes(ToolNames.Context);
+		const hasBoundSkills =
+			hasCanonicalContext && recipe.skills !== undefined && recipe.skills.length > 0 && req.noSkills !== true;
 		const compiledWorkerPrompt = await prompts.compileWorkerPrompt({
 			autonomy: effectiveAutonomy,
 			providerSupportsTools: target.runtime.kind === "subprocess" ? null : targetToolCapability(target),
 			toolNames: effectiveTools,
-			toolPromptHints: toolPromptHintsForNames(effectiveTools),
-			hasCanonicalContext: effectiveTools.includes(ToolNames.Context),
-			hasBoundSkills:
-				effectiveTools.includes(ToolNames.Context) &&
-				recipe.skills !== undefined &&
-				recipe.skills.length > 0 &&
-				req.noSkills !== true,
+			toolPromptHints: toolPromptHintsForNames(effectiveTools, hasBoundSkills ? "bound-worker" : "worker"),
+			hasCanonicalContext,
+			hasBoundSkills,
 			onPermission: settings?.fleet.permissions.mode ?? "deny",
 			persona: {
 				id: `persona.${recipe.id}`,
@@ -4345,6 +4389,7 @@ export function createDispatchBundle(
 	async function dispatchAttempt(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		settlement?: BatchVerificationGate,
 	): Promise<{
 		runId: string;
 		events: AsyncIterableIterator<unknown>;
@@ -4440,10 +4485,12 @@ export function createDispatchBundle(
 			}
 			rebindReservationSlot(req, "local", null, UNKNOWN_PRICING_ADMISSION_ESTIMATE_USD, settings);
 			routeObservation = observeShadowRoute(req, undefined, settings);
-			return attachRouteObservation({
-				...(await dispatchAcpDelegation(req, settings, timing, routeObservation.decision, observer)),
-				effectiveRequest: req,
-			});
+			const delegated = await dispatchAcpDelegation(req, settings, timing, routeObservation.decision, observer);
+			// An ACP member never runs host verification, so it can only ever leave
+			// the barrier. It still edits the checkout, so the barrier has to wait
+			// for it; dispatch() releases it when its finalPromise settles.
+			settlement?.live(delegated.runId);
+			return attachRouteObservation({ ...delegated, effectiveRequest: req });
 		}
 
 		req = routeAroundCoolingTarget(req, settings) ?? req;
@@ -5368,6 +5415,14 @@ export function createDispatchBundle(
 			return { assessment, rigor };
 		};
 
+		// The worker is spawned and its ledger row exists, so from here it can
+		// write and the batch barrier has to wait for it. Registered after the
+		// try/catch at 4939-5068, which aborts the worker and releases the lease on
+		// failure, so a run that never reaches the barrier is never made live.
+		// Paired with the abandon in dispatch(), which fires the moment
+		// finalPromise settles.
+		settlement?.live(envelope.id);
+
 		const finalPromise = (async (): Promise<RunReceipt> => {
 			try {
 				const result = await workerDone;
@@ -5492,12 +5547,21 @@ export function createDispatchBundle(
 					finalDetail = WORKER_FINAL_OUTPUT_MISSING_DETAIL;
 					failureMessage = finalDetail;
 				}
-				const hostVerification = await runHostVerification({
+				const hostVerificationInput = {
 					runId: envelope.id,
 					request: req,
 					workerSuccessful: finalOutcome === "succeeded",
-					onDiagnostic: (error) => reportDispatchDiagnostic(`write host verification memo for ${envelope.id}`, error),
-				});
+					onDiagnostic: (error: unknown) =>
+						reportDispatchDiagnostic(`write host verification memo for ${envelope.id}`, error),
+				};
+				// This await is the batch barrier. It already sits before
+				// buildReceiptDraft below, which is why batch settlement needs no
+				// receipt restructuring: every member parks here with its outcome
+				// resolved and nothing sealed.
+				const hostVerification =
+					settlement === undefined
+						? await runHostVerification(hostVerificationInput)
+						: await settlement.arrive(hostVerificationInput);
 				const hostRejection = hostVerificationRejection(hostVerification);
 				if (hostRejection !== null && finalOutcome === "succeeded") {
 					finalOutcome = "failed";
@@ -5690,6 +5754,7 @@ export function createDispatchBundle(
 	async function dispatch(
 		req: DispatchRequest,
 		observer?: DispatchAdmissionObserver,
+		settlement?: BatchVerificationGate,
 	): Promise<{
 		runId: string;
 		events: AsyncIterableIterator<unknown>;
@@ -5737,7 +5802,7 @@ export function createDispatchBundle(
 		}
 		let handle: Awaited<ReturnType<typeof dispatchAttempt>>;
 		try {
-			handle = await dispatchAttempt(prepared, observer);
+			handle = await dispatchAttempt(prepared, observer, settlement);
 		} catch (error) {
 			writerLease?.release();
 			if (createdWorktree !== undefined) {
@@ -5752,6 +5817,14 @@ export function createDispatchBundle(
 			}
 			throw error;
 		}
+		// A finalization that throws before the barrier, and an ACP handle that
+		// never reaches it at all, must not park their siblings forever. A member
+		// that already arrived is parked and abandon() is a no-op for it, so this
+		// fires harmlessly on the normal path.
+		if (settlement !== undefined) {
+			const release = (): void => settlement.abandon(handle.runId);
+			handle.finalPromise.then(release, release);
+		}
 		// Requests carrying lineage are internal attempts (retry or nested
 		// orchestration) and retain the per-attempt handle contract.
 		if (req.lineage) return { ...handle, finalPromise: handle.finalPromise.finally(() => writerLease?.release()) };
@@ -6125,10 +6198,19 @@ export function createDispatchBundle(
 		finalPromise: Promise<ReadonlyArray<RunReceipt>>;
 	}> {
 		if (reqs.length === 0) throw new Error("dispatch: batch requires at least one request");
+		// Two or more concurrent workers share one checkout, so a declared check
+		// run while a sibling is still editing judges a tree neither worker
+		// authored. The barrier only exists when there is both something to verify
+		// and something that could race it; a one-request batch and a batch with no
+		// declared check keep today's per-run path exactly.
+		const settlement =
+			reqs.length > 1 && reqs.some((req) => (req.resolvedVerification?.length ?? 0) > 0)
+				? createBatchVerificationGate()
+				: undefined;
 		const handles: Array<Awaited<ReturnType<typeof dispatch>> & { agentId: string }> = [];
 		try {
 			for (const req of reqs) {
-				const handle = await dispatch(req);
+				const handle = await dispatch(req, undefined, settlement);
 				handles.push({ ...handle, agentId: req.agentId });
 			}
 		} catch (err) {
@@ -6347,6 +6429,7 @@ export function createDispatchBundle(
 				// Reconciliation is best-effort; a failure never blocks startup.
 			}
 			startHeartbeatWatchdog();
+			probeEndpointsAtDefaultBound();
 		},
 		async stop() {
 			// Shutdown is process-local. The durable machine-wide drain belongs to