@iowarp/clio-coder 0.4.2 → 0.4.4

package/src/engine/acp/server.ts

@@ -60,7 +60,7 @@ export interface AcpServerChat {
 	onEvent(handler: (event: AcpServerEvent) => void): () => void;
 	isStreaming(): boolean;
 	getSessionId(): string | null;
-	/** Replace provider context and the next persisted parent after session/load. */
+	/** Replace provider context and the next persisted parent for a new or loaded session. */
 	resetForSession?(leafTurnId: string | null, replayMessages?: ReadonlyArray<AgentMessage>): void;
 	dispose?(): void;
 }
@@ -1406,6 +1406,7 @@ function installPermissionBridge(input: {
 	toolCallSnapshot: (wireId: string) => AcpToolCallSnapshot | null;
 	permissionTimeoutMs: number;
 	expireActivePrompt: () => void;
+	cancelActivePrompt: (reason: string) => void;
 }): AcpPermissionBridge {
 	if (!input.toolRegistry) return { unregister: () => {}, cancelPending: () => {} };
 	let pendingCancel: ((reason: string) => void) | null = null;
@@ -1573,6 +1574,17 @@ function installPermissionBridge(input: {
 					// client mint `allow-always` and get a grant this server never
 					// offered as an option.
 					const answer = outcome.response.outcome;
+					if (answer.outcome === "cancelled") {
+						const reason = "ACP client cancelled permission";
+						// Abort before releasing the parked tools so their results cannot
+						// start another model request while session/cancel is in flight.
+						input.cancelActivePrompt(reason);
+						emitResolution({ status: "denied", decidedBy: "cancelled", reason });
+						queuedRequestIds.clear();
+						queuedRequestDetails.clear();
+						input.toolRegistry?.cancelParkedCalls(reason);
+						return;
+					}
 					if (answer.outcome === "selected" && answer.optionId === "allow-once") {
 						emitResolution({ status: "granted", decidedBy: "acp-client" });
 						await input.toolRegistry?.resumeParkedCalls({
@@ -1695,6 +1707,10 @@ export async function serveClioAcpAgent(options: ClioAcpServerOptions): Promise<
 			activePromptState.permissionExpired = true;
 			options.chat.cancel();
 		},
+		cancelActivePrompt: (reason) => {
+			const session = activeSessionId === null ? undefined : sessions.get(activeSessionId);
+			if (session) cancelSession(session, reason);
+		},
 	});
 	/**
 	 * Sends one frame of the opt-in stream. Every forwarded channel goes through
@@ -2128,9 +2144,8 @@ export async function serveClioAcpAgent(options: ClioAcpServerOptions): Promise<
 
 	options.transport.onRequest("session/new", (params) => {
 		requireInitialized();
-		// One chat instance, one provider context, one ledger ancestry. A second
-		// session id over the same process would share all three with the first,
-		// so the honest answer is to refuse and let the client start a process.
+		// The chat instance can bind only one session at a time. Closing that
+		// session releases the slot; the next creation resets its conversation.
 		if (sessionCreated) {
 			throw new AcpRequestError(-32000, "this server hosts one session per process", { code: "session_limit" });
 		}
@@ -2144,6 +2159,7 @@ export async function serveClioAcpAgent(options: ClioAcpServerOptions): Promise<
 		if (safeStoredIdentifier(id, ACP_MAX_SESSION_ID_BYTES) === null) {
 			throw new AcpRequestError(-32000, "session creation failed", { code: "internal_error" });
 		}
+		options.chat.resetForSession?.(null);
 		const autonomy = options.autonomy?.() ?? DEFAULT_AUTONOMY_LEVEL;
 		const boundTarget = safeConfiguredIdentifier(meta?.target ?? route.target, ACP_MAX_TARGET_ID_BYTES);
 		const boundModel = safeConfiguredIdentifier(meta?.model ?? route.model, ACP_MAX_MODEL_ID_BYTES);
@@ -2529,6 +2545,7 @@ export async function serveClioAcpAgent(options: ClioAcpServerOptions): Promise<
 		if (options.session?.current()?.id === session.id) await options.session.close();
 		sessions.delete(session.id);
 		if (boundSessionId === session.id) boundSessionId = null;
+		sessionCreated = false;
 		closedSessionIds.add(session.id);
 		return {};
 	});

package/src/engine/acp/transport.ts

@@ -534,6 +534,10 @@ export function createStdioTransport(
 }
 
 class StreamJsonRpcPeerTransport implements AcpJsonRpcPeerTransport {
+	private outputPaused = false;
+	private queuedOutputBytes = 0;
+	private sinkOutputBytes = 0;
+	private readonly outputQueue: string[] = [];
 	private nextId = 1;
 	private buffer = "";
 	/** True while the bytes of an oversized line are being dropped up to its terminating newline. */
@@ -626,18 +630,56 @@ class StreamJsonRpcPeerTransport implements AcpJsonRpcPeerTransport {
 	}
 
 	private write(message: AcpJsonRpcMessage): void {
+		if (this.closed) return;
 		const line = `${JSON.stringify(message)}\n`;
-		if (this.writeOverride) {
-			this.writeOverride(line);
-			return;
+		if (this.outputPaused) {
+			const bytes = Buffer.byteLength(line, "utf8");
+			// Include bytes already held by the sink in the existing frame budget.
+			if (this.queuedOutputBytes + this.sinkOutputBytes + bytes > ACP_MAX_INPUT_LINE_BYTES) {
+				this.markClosed(new AcpProcessError("ACP output buffer exceeded byte limit"));
+				return;
+			}
 		}
-		// A `false` return means the stream buffered rather than flushed. Honoring
-		// it means pausing frame production, which changes turn timing, so the
-		// decision to keep writing is deferred rather than forgotten (CONTRACT
-		// C001 §6 leaves stdout backpressure out of this profile).
-		this.output.write(line);
+		this.outputQueue.push(line);
+		this.queuedOutputBytes += Buffer.byteLength(line, "utf8");
+		if (!this.outputPaused) this.flushOutput();
 	}
 
+	private readonly flushOutput = (): void => {
+		this.outputPaused = false;
+		while (!this.closed && !this.outputPaused && this.outputQueue.length > 0) {
+			const line = this.outputQueue.shift();
+			if (line === undefined) break;
+			this.queuedOutputBytes -= Buffer.byteLength(line, "utf8");
+			try {
+				// Stdout can count buffered strings in UTF-16 units rather than bytes.
+				// Retain their byte count until drain, bounding earlier writes by at
+				// most three UTF-8 bytes per unit still held by the sink.
+				this.sinkOutputBytes = Math.min(this.sinkOutputBytes, this.output.writableLength * 3);
+				let ready: boolean;
+				if (this.writeOverride) {
+					this.writeOverride(line);
+					// The stdout guard writes to this sink but does not return write's boolean.
+					ready = !this.output.writableNeedDrain;
+				} else {
+					ready = this.output.write(line);
+				}
+				this.sinkOutputBytes =
+					this.output.writableLength === 0 ? 0 : this.sinkOutputBytes + Buffer.byteLength(line, "utf8");
+				if (!ready && !this.closed) {
+					if (this.queuedOutputBytes + this.sinkOutputBytes > ACP_MAX_INPUT_LINE_BYTES) {
+						this.markClosed(new AcpProcessError("ACP output buffer exceeded byte limit"));
+						return;
+					}
+					this.outputPaused = true;
+					this.output.once("drain", this.flushOutput);
+				}
+			} catch (err) {
+				this.markClosed(new AcpProcessError(`ACP output write failed: ${errorMessage(err)}`));
+			}
+		}
+	};
+
 	private consume(chunk: string): void {
 		this.buffer += chunk;
 		for (;;) {
@@ -757,6 +799,9 @@ class StreamJsonRpcPeerTransport implements AcpJsonRpcPeerTransport {
 	private markClosed(reason: unknown): void {
 		if (this.isClosed) return;
 		this.isClosed = true;
+		this.output.removeListener("drain", this.flushOutput);
+		this.outputQueue.length = 0;
+		this.queuedOutputBytes = 0;
 		this.failAll(reason);
 		for (const handler of this.closeHandlers) handler();
 	}

package/src/engine/acp/types.ts

@@ -194,6 +194,10 @@ export interface AcpDelegationUsage {
 	cacheReadTokens: number;
 	cacheWriteTokens: number;
 	reasoningTokens: number;
+	/** Peer-reported total when present, otherwise input+output+cacheRead+cacheWrite, matching the ACP server side. */
+	totalTokens: number;
+	/** Sum of the peer's `usage.cost.total`; stays 0 when the peer reports no cost. */
+	costUsd: number;
 }
 
 export interface AcpDelegationResult {

package/src/engine/agent.ts

@@ -14,7 +14,11 @@ import { Agent, type AgentOptions, type StreamFn } from "@earendil-works/pi-agen
 import { isDispositionedToolResultError } from "../tools/result-disposition.js";
 import { engineStreamSimple } from "./api-registry.js";
 
-export type EngineAgentOptions = Omit<AgentOptions, "streamFn"> & { streamFn?: StreamFn };
+export type EngineAgentOptions = Omit<AgentOptions, "streamFn"> & {
+	streamFn?: StreamFn;
+	/** Called immediately before each native stream delegate invocation. */
+	onStreamInvocation?: () => void;
+};
 
 export interface EngineAgentHandle {
 	agent: Agent;
@@ -34,9 +38,15 @@ function dispositionAwareAfterToolCall(
 }
 
 export function createEngineAgent(options: EngineAgentOptions = {}): EngineAgentHandle {
+	const { streamFn = engineStreamSimple, onStreamInvocation, ...agentOptions } = options;
 	const agent = new Agent({
-		streamFn: engineStreamSimple,
-		...options,
+		...agentOptions,
+		streamFn: onStreamInvocation
+			? (...args) => {
+					onStreamInvocation();
+					return streamFn(...args);
+				}
+			: streamFn,
 		afterToolCall: dispositionAwareAfterToolCall(options.afterToolCall),
 	});
 	return {

package/src/engine/ai.ts

@@ -59,6 +59,8 @@ export interface EngineTextCompletionInput {
 	signal: AbortSignal;
 	timeoutMs: number;
 	apiKey?: string;
+	/** Accounting only: observed before terminal errors throw, never carries response content. */
+	onUsage?: (observation: Pick<EngineTextCompletionResult, "usage" | "backend">) => void;
 }
 
 export interface EngineTextCompletionResult {
@@ -98,16 +100,11 @@ export async function completeEngineText(input: EngineTextCompletionInput): Prom
 			...(input.apiKey === undefined ? {} : { apiKey: input.apiKey }),
 		},
 	);
-	if (response.stopReason === "error" || response.stopReason === "aborted") {
+	const failed = response.stopReason === "error" || response.stopReason === "aborted";
+	if (failed && !response.usage) {
 		throw new Error(response.errorMessage ?? `model completion ${response.stopReason}`);
 	}
-	return {
-		text: response.content
-			.filter((block): block is Extract<(typeof response.content)[number], { type: "text" }> => block.type === "text")
-			.map((block) => block.text)
-			.join(""),
-		inputTokens: response.usage.input,
-		outputTokens: response.usage.output,
+	const observation: Pick<EngineTextCompletionResult, "usage" | "backend"> = {
 		usage: {
 			input: response.usage.input,
 			output: response.usage.output,
@@ -119,6 +116,27 @@ export async function completeEngineText(input: EngineTextCompletionInput): Prom
 		},
 		backend: response.backendTimings ?? null,
 	};
+	// Pi synthesizes all-zero usage for failures with no provider accounting.
+	// Do not turn that placeholder into a measured zero-spend call.
+	if (!failed || Object.values(observation.usage).some((value) => Number.isFinite(value) && value > 0)) {
+		try {
+			input.onUsage?.(observation);
+		} catch {
+			// Accounting observers cannot change completion success/error behavior.
+		}
+	}
+	if (failed) {
+		throw new Error(response.errorMessage ?? `model completion ${response.stopReason}`);
+	}
+	return {
+		text: response.content
+			.filter((block): block is Extract<(typeof response.content)[number], { type: "text" }> => block.type === "text")
+			.map((block) => block.text)
+			.join(""),
+		inputTokens: response.usage.input,
+		outputTokens: response.usage.output,
+		...observation,
+	};
 }
 
 export interface EngineAi {