@koda-sl/baker-bridge 0.108.0-dev.0306d9ad9 → 0.108.0-dev.92a938f8d

package/dist/hono/bridge-job.js

@@ -71,13 +71,6 @@ export function remapAnswersToQuestionText(questions, answers) {
     // Nothing mapped (unexpected shape) → pass the originals through untouched.
     return Object.keys(byText).length > 0 ? byText : answers;
 }
-// The CLI output style every turn runs under, for `settings.outputStyle`.
-//
-// Exported because the CLI accepts an unrecognized style name silently — a
-// misspelling here would leave every chat on the default voice with nothing to
-// notice — so a test pins the literal. Built into the CLI since 2.1.237, which
-// is why the SDK floor is 0.3.237.
-export const OUTPUT_STYLE = "Concise";
 const DEFAULT_ASK_USER_QUESTION_TIMEOUT_MS = 15 * 60 * 1000;
 // A model request that streams nothing for this long is a hung upstream
 // connection (observed in production: an OpenRouter request that never yields
@@ -158,11 +151,10 @@ const BASE_DISALLOWED_TOOLS = [
     // not asked to fund a research fleet. Ordinary fan-out is unaffected:
     // `Task` stays, so the scaffold's subagents still run.
     "Workflow",
-    // NOT listed: `SendMessage`. It is how the model follows up with a
-    // subagent it already ran, and the CLI tells it to on every Agent result.
-    // The continued subagent runs in the background, but it announces itself
-    // with `task_started` / `background_tasks_changed`, so the turn stays open
-    // until it finishes (`createTurnEndController`).
+    // Cross-session messaging. A Runtime holds exactly one session, so
+    // there is never a peer to reach; every call is a dead end that costs a
+    // round trip to discover.
+    "SendMessage",
     // A Session review may not change anything. Removing the definitions is
     // the second of three layers — the key it carries is read-scoped and its
     // Bash calls go through `reviewBashPolicy` — because each fails
@@ -331,6 +323,11 @@ function isUserVisibleSdkMessage(msg) {
 // failed turn clears the session, so sending again genuinely does start from the
 // shorter rehydrated history — which is the action this asks for.
 const CONTEXT_OVERFLOW_MESSAGE = "This chat has grown too long to continue in one step. Send your message again — it will pick up from a shorter version of this conversation.";
+// What the user reads when the model refused the request and no fallback model
+// retried it. The CLI's own refusal text speaks to a terminal user ("press esc"),
+// so the turn ends on this instead. The refused exchange is not saved to the
+// session, so a rephrased message starts from the conversation before it.
+const MODEL_REFUSAL_MESSAGE = "I couldn't help with that request. Try rephrasing what you need.";
 function userFacingTurnError(message) {
     if (isContextOverflowError(message)) {
         return CONTEXT_OVERFLOW_MESSAGE;
@@ -470,6 +467,10 @@ function sdkResultErrorMessage(msg) {
     const message = msg.subtype === "success" ? sdkSuccessResultErrorMessage(msg) : msg.errors.join("; ");
     return message.length > 0 ? message : "SDK result error";
 }
+/** The result's error, unless a refusal already decided how the turn ends. */
+function turnResultError(state, msg) {
+    return state.refusedWithoutFallback ? undefined : sdkResultError(msg);
+}
 function sdkResultError(msg) {
     if (msg.type !== "result" || !msg.is_error) {
         return undefined;
@@ -497,9 +498,9 @@ function sdkResultError(msg) {
 // the whole turn; the deny THRESHOLD below still guards a one-off end-of-turn race.
 // The trailing colon matters: the CLI always emits the envelope followed by the
 // error that caused it ("…failed: Error: Stream closed", "…failed: AbortError: …").
-// Prose that merely NAMES the failure quotes it without one, which is how a
-// hook explaining a block quotes it (the scaffold's former background-subagent
-// block did) — and a hook block is an is_error tool_result, so a colon-less match counted a healthy
+// Prose that merely NAMES the failure quotes it without one, which is how the
+// scaffold's guard-background-commands hook describes what it prevents — and its
+// block is an is_error tool_result, so a colon-less match counted a healthy
 // blocked spawn as a deny and could trip the breaker on a healthy turn.
 const CONTROL_CHANNEL_DENY_MARKER = "Tool permission request failed:";
 // Hook failures are reported through the same is_error tool_result channel but
@@ -662,27 +663,9 @@ export function createStallDetector(input) {
             awaitingModel = (msg.type === "user" || msg.type === "stream_event") && pendingToolUses.size === 0;
         },
         stalled: () => stalled,
-        hasPendingToolUses: () => pendingToolUses.size > 0,
         dispose: () => clearInterval(timer),
     };
 }
-// A query's cost and `modelUsage` are cumulative — on every result message and
-// on the CLI's usage reply alike — so the latest reading replaces the last one
-// rather than adding to it. It is folded into the turn totals when the query
-// settles (see `runQueryOnce`). A spuriously empty later reading never wipes a
-// real earlier one.
-function recordCumulativeUsage(state, reading) {
-    const own = ownQueryUsage(reading, state.queryUsageBaseline);
-    state.observedCostUsd = own.costUsd;
-    const snapshot = queryModelUsage(own.modelUsage);
-    if (snapshot.size > 0) {
-        state.queryModelUsage = snapshot;
-    }
-    return own.costUsd;
-}
-// How long ending a turn waits on the CLI's usage reply before going ahead
-// without it. Billing a turn late is recoverable; hanging one is not.
-const USAGE_READING_TIMEOUT_MS = 5_000;
 // Decides when the turn is really over and the CLI may be told to exit.
 //
 // The prompt rides a held-open input stream (see `createHeldOpenQuery` in
@@ -704,10 +687,7 @@ const USAGE_READING_TIMEOUT_MS = 5_000;
 // events must not, or the end would never re-arm. After input ends, an exit
 // guard closes the query if the CLI neither speaks nor exits, so a wedged
 // process cannot hang the turn until the session watchdog.
-function createTurnEndController(job, query, closeQuery, timings, onTurnEvent, 
-// Runs once, before input ends on a turn that ran tasks: a task can settle
-// without waking the model, so the last result may not include what it spent.
-beforeEndInput) {
+function createTurnEndController(job, query, closeQuery, timings, onTurnEvent) {
     const inFlightTasks = new Set();
     // The background_tasks_changed LEVEL signal, tracked separately from the
     // edge-paired set above: a foreground command the CLI auto-backgrounds emits
@@ -730,21 +710,6 @@ beforeEndInput) {
             return;
         }
         inputEnded = true;
-        if (sawAnyTask && beforeEndInput) {
-            let timeout;
-            const timedOut = new Promise((resolveTimeout) => {
-                timeout = setTimeout(resolveTimeout, USAGE_READING_TIMEOUT_MS);
-                timeout.unref?.();
-            });
-            void Promise.race([beforeEndInput().catch(() => undefined), timedOut]).finally(() => {
-                clearTimeout(timeout);
-                finishEndInput();
-            });
-            return;
-        }
-        finishEndInput();
-    };
-    const finishEndInput = () => {
         query.endInput?.();
         onTurnEvent({
             threadId: job.threadId,
@@ -817,11 +782,14 @@ beforeEndInput) {
                 exitGuard.refresh();
             }
         },
-        maybeEndAfter: (msg) => {
+        maybeEndAfter: (msg, refused) => {
             if (inputEnded) {
                 return;
             }
-            if (msg.type === "result" && !msg.is_error) {
+            // A refusal's error result is not thrown (the refusal already decided how
+            // the turn ends), so it has to end input like a clean one or the CLI idles
+            // on stdin until the session watchdog.
+            if (msg.type === "result" && (!msg.is_error || refused)) {
                 cleanResultSeen = true;
                 if (hasInFlightWork()) {
                     console.error(`[BridgeJob] result received with ${inFlightTasks.size} task(s) and ${backgroundTaskCount} background command(s) in flight — holding the turn open (thread ${job.threadId})`);
@@ -838,7 +806,6 @@ beforeEndInput) {
                 scheduleEnd();
             }
         },
-        hasInFlightWork,
         dispose: () => {
             if (settleTimer) {
                 clearTimeout(settleTimer);
@@ -1142,6 +1109,11 @@ export class BridgeJobExecutor {
             await this.clearIfDirty(job, controls, state, "abort");
             return { kind: "cancelled", costUsd, model: state.model, modelUsage };
         }
+        // No boundary is handed back, so the refused exchange never becomes part of
+        // the conversation the next message resumes.
+        if (state.refusedWithoutFallback) {
+            return { kind: "errored", costUsd, model: state.model, modelUsage, errors: [MODEL_REFUSAL_MESSAGE] };
+        }
         if (!state.postedAssistantEvent && state.turnText.length > 0) {
             await this.postSyntheticAssistantEvent(job, state);
         }
@@ -1303,7 +1275,8 @@ export class BridgeJobExecutor {
         // avatar's casting would never open.
         const command = typeof input?.command === "string" ? input.command : undefined;
         // The agent asking for the casting we already owe is not the NEXT piece of work — it
-        // is that same casting, and the tool's own description tells it to call this here.
+        // is that same casting, so an explicit call is tolerated (e.g. a re-ask after the
+        // user declined every portrait).
         // Handled under its own tool-use id so the user's pick reaches the call that asked
         // for it; run as an auto-cast instead, the explicit call fell through to `allow` and
         // the tool answered itself with `{ status: "declined" }` — the agent was told the
@@ -1370,21 +1343,11 @@ export class BridgeJobExecutor {
         const skills = await readSessionSkills(bridgeRuntimeFiles.projectRoot());
         const autoCompactWindow = autoCompactWindowForModel(model);
         const betas = betasForModel(model);
+        // No `outputStyle`: the built-in `Concise` style was pinned here against Opus 5's
+        // preamble, and on Opus 5.5 it suppressed the one-line progress notes a
+        // marketer reads while a long turn works. When to speak is now the scaffold
+        // CLAUDE.md's job ("Talking to the User").
         const settings = {
-            // Lead with the answer. The chat's readers are marketers, and the CLI's
-            // default voice narrates its way to a result — preamble, a recap of what
-            // it is about to do, then the thing itself. `Concise` cuts that without
-            // touching how thoroughly the work gets done, and it keeps error reports
-            // and destructive-action confirmations complete, which is the part a
-            // shorter voice must not eat.
-            //
-            // Two limits to know before relying on it. It reaches the **main
-            // conversation only** — a subagent runs its own system prompt, so the
-            // fan-out workers are unaffected. And the CLI accepts an unrecognized
-            // style name **silently**: `outputStyle: "NotARealStyle"` returns a clean
-            // 200 with the default voice, so a typo here is invisible at runtime.
-            // That is why the literal is pinned by a test rather than left to review.
-            outputStyle: OUTPUT_STYLE,
             // Publish opts out of the CLI's threshold-driven summarization so the turn
             // starts working immediately instead of collapsing the chat first; a real
             // overflow is caught in `runAttempt` and retried with compaction on. Only
@@ -1411,11 +1374,11 @@ export class BridgeJobExecutor {
             // capacity, which also clamps the `autoCompactWindow` pin below to 200k. Not
             // an API requirement — see `betasForModel`. Omitted for Haiku 4.5, genuinely 200k.
             ...(betas ? { betas } : {}),
-            // How hard the model works per turn — thinking depth, preamble, and how
-            // many tool calls it makes. The API default is `high`; `medium` trades a
-            // slice of that for fewer, more consolidated tool calls. That matters more
-            // than the thinking saving alone: every tool call is another request that
-            // re-reads the whole prompt, so cutting calls cuts cache-read volume too.
+            // How hard the model works per turn — thinking depth, preamble, and how many
+            // tool calls it makes. `medium` is Opus 5.5's API default; it is set explicitly
+            // so an SDK or model default change cannot move it silently. Opus 5.5 thinks
+            // more per level than Opus 5, so compare `low` on real Sessions before
+            // treating this as tuned.
             //
             // MUST stay a single constant. The resolved effort is rendered into the
             // prompt, so changing it between requests invalidates every cache
@@ -1444,6 +1407,12 @@ export class BridgeJobExecutor {
             ...reviewQueryOptions(job),
             ...(job.planMode ? { permissionMode: "plan" } : {}),
             canUseTool: (toolName, input, opts) => this.routeToolUse(job, controls, toolName, input, opts),
+            // No `fallbackModel`, and no server-side refusal `fallbacks` in the extra
+            // body: the CLI's refusal fallback is gated on a first-party base URL (see
+            // `betasForModel`), and nothing shows OpenRouter's passthrough honouring the
+            // API's `fallbacks` field. A refusal therefore ends the turn on
+            // `MODEL_REFUSAL_MESSAGE`; a `model_refusal_fallback`, if one ever arrives,
+            // is still handled (its superseded messages are retracted).
             model: modelForJob(job, model),
             abortController: controls.abortController ?? { signal: controls.abortSignal },
             // The SDK treats `env` as a full replacement for the subprocess environment
@@ -1525,16 +1494,7 @@ export class BridgeJobExecutor {
     // in-progress session.
     async drainQuery(job, controls, state, query, closeQuery) {
         const stallDetector = this.createStallDetector(job, controls, closeQuery);
-        // What the query had spent when its turn ended, read from the CLI — set
-        // only when a task ran, and higher than the last result's figure when a
-        // task kept working after it.
-        let settledCostUsd = 0;
-        const turnEnd = createTurnEndController(job, query, closeQuery, { settleMs: this.turnEndSettleMs, exitGuardMs: this.turnEndExitGuardMs }, this.recordTurnEvent, async () => {
-            const reading = await query.usage?.();
-            if (reading) {
-                settledCostUsd = recordCumulativeUsage(state, reading);
-            }
-        });
+        const turnEnd = createTurnEndController(job, query, closeQuery, { settleMs: this.turnEndSettleMs, exitGuardMs: this.turnEndExitGuardMs }, this.recordTurnEvent);
         let costUsd = 0;
         // Errors thrown while HANDLING a message (control-channel breaker, error
         // results) are real verdicts and must surface as-is; only errors from the
@@ -1544,7 +1504,6 @@ export class BridgeJobExecutor {
             for await (const msg of query) {
                 stallDetector.observeMessage(msg);
                 turnEnd.observeMessage(msg);
-                controls.setWorkInFlight?.(stallDetector.hasPendingToolUses() || turnEnd.hasInFlightWork());
                 try {
                     costUsd = await this.consumeSdkMessage(job, controls, state, msg, costUsd);
                 }
@@ -1552,7 +1511,7 @@ export class BridgeJobExecutor {
                     consumeError = true;
                     throw error;
                 }
-                turnEnd.maybeEndAfter(msg);
+                turnEnd.maybeEndAfter(msg, state.refusedWithoutFallback === true);
                 if (!controls.isActive()) {
                     closeQuery();
                     break;
@@ -1567,7 +1526,6 @@ export class BridgeJobExecutor {
             throw error;
         }
         finally {
-            controls.setWorkInFlight?.(false);
             stallDetector.dispose();
             turnEnd.dispose();
             await this.openPendingCastingAtTurnEnd(job, controls);
@@ -1575,7 +1533,7 @@ export class BridgeJobExecutor {
         if (stallDetector.stalled() && controls.isActive()) {
             throw new StreamStallError();
         }
-        return Math.max(costUsd, settledCostUsd);
+        return costUsd;
     }
     /**
      * Open a casting the turn recorded but never reached.
@@ -1650,23 +1608,7 @@ export class BridgeJobExecutor {
             return costUsd;
         }
         controls.markEvent?.();
-        // Drop the size refusal outright. A recovered turn must not leave a raw
-        // provider error sitting above the work that then succeeded, and a turn that
-        // fails anyway says so once, in product language, through the error outcome —
-        // never twice, and never in the provider's words. Dropping it before
-        // `observeInProgressSession` also keeps it from setting `resumeSessionAt` —
-        // the refusal is not work the agent did, and counting it as such would send
-        // the retry a "continue where you left off" note instead of the `/publish`
-        // the turn still owes.
-        if (isContextOverflowRefusal(msg)) {
-            // Today the refusal is synthetic — the request is rejected pre-flight, so
-            // no deltas precede it and `turnText` is empty. Clearing it anyway is what
-            // makes the drop hold if that ever changes: streamed text survives the
-            // dropped message, and a retry that ends on tool work with no assistant
-            // text of its own would post the refusal as this turn's end-of-turn text
-            // (`postSyntheticAssistantEvent`). The live preview needs no such guard —
-            // the next `message_start` restarts it and the turn's end clears it.
-            state.turnText = "";
+        if (this.droppedBeforeRelay(job, state, msg)) {
             return costUsd;
         }
         state.inProgressSession = observeInProgressSession(state.inProgressSession, msg);
@@ -1684,7 +1626,17 @@ export class BridgeJobExecutor {
         }
         trackMainRequestUsage(state, msg);
         if (msg.type === "result") {
-            const ownCostUsd = recordCumulativeUsage(state, { totalCostUsd: msg.total_cost_usd, modelUsage: msg.modelUsage });
+            const own = ownQueryUsage({ totalCostUsd: msg.total_cost_usd, modelUsage: msg.modelUsage }, state.queryUsageBaseline);
+            state.observedCostUsd = own.costUsd;
+            // A query's result `modelUsage` is cumulative (like `total_cost_usd`, which
+            // we overwrite above), so keep the latest snapshot rather than summing —
+            // it is folded into the turn totals when the query settles (see
+            // `runQueryOnce`). Guard against a spuriously empty later result wiping a
+            // real earlier one.
+            const snapshot = queryModelUsage(own.modelUsage);
+            if (snapshot.size > 0) {
+                state.queryModelUsage = snapshot;
+            }
             await this.publishContextUsage(job, state, msg.modelUsage);
             // What a Session review returns. The SDK enforces the JSON schema, so this
             // either parses against the findings contract or the review failed to
@@ -1694,12 +1646,14 @@ export class BridgeJobExecutor {
             if (structured !== undefined) {
                 state.structuredOutput = structured;
             }
-            const resultError = sdkResultError(msg);
+            // A refused turn's result can be an error; the refusal already decided
+            // how the turn ends, and in product words rather than the CLI's.
+            const resultError = turnResultError(state, msg);
             if (resultError) {
                 await this.clearIfDirty(job, controls, state, "result_error");
                 throw resultError;
             }
-            return ownCostUsd;
+            return own.costUsd;
         }
         if (isUserVisibleSdkMessage(msg)) {
             state.sawUserVisibleSdkMessage = true;
@@ -1733,7 +1687,7 @@ export class BridgeJobExecutor {
      * turn (one per tool call, plus any same-model subagent work), so a handful of
      * tool calls inflates them past the window and pins the meter at 100% on an
      * almost-empty chat. The window is the model's real OpenRouter context length
-     * (opus/sonnet 4.6 = 1M); we resolve it from the model id because the runtime
+     * (Opus 5.5 = 1M); we resolve it from the model id because the runtime
      * under-reports it through the OpenRouter passthrough, falling back to the
      * reported window for unknown models. A relay failure must never fail the turn.
      */
@@ -1789,6 +1743,61 @@ export class BridgeJobExecutor {
             await this.relay.assistantEvent(target, msg, state.model);
         }
     }
+    /**
+     * A message consumed here and never relayed or counted as the agent's work:
+     * a provider refusal for size, or part of a model refusal.
+     */
+    droppedBeforeRelay(job, state, msg) {
+        // Drop the size refusal outright. A recovered turn must not leave a raw
+        // provider error sitting above the work that then succeeded, and a turn that
+        // fails anyway says so once, in product language, through the error outcome —
+        // never twice, and never in the provider's words. Dropping it before
+        // `observeInProgressSession` also keeps it from setting `resumeSessionAt` —
+        // the refusal is not work the agent did, and counting it as such would send
+        // the retry a "continue where you left off" note instead of the `/publish`
+        // the turn still owes.
+        if (isContextOverflowRefusal(msg)) {
+            // Today the refusal is synthetic — the request is rejected pre-flight, so
+            // no deltas precede it and `turnText` is empty. Clearing it anyway is what
+            // makes the drop hold if that ever changes: streamed text survives the
+            // dropped message, and a retry that ends on tool work with no assistant
+            // text of its own would post the refusal as this turn's end-of-turn text
+            // (`postSyntheticAssistantEvent`). The live preview needs no such guard —
+            // the next `message_start` restarts it and the turn's end clears it.
+            state.turnText = "";
+            return true;
+        }
+        return this.observeModelRefusal(job, state, msg);
+    }
+    /**
+     * A refusal with no fallback model to retry it. True when the message is part
+     * of the refusal — the CLI's error frame (`stop_reason: "refusal"`, written for
+     * a terminal user) or the refusal notice — and is consumed here, never relayed.
+     */
+    observeModelRefusal(job, state, msg) {
+        if (msg.type === "assistant") {
+            if (msg.message.stop_reason === "refusal") {
+                return true;
+            }
+            if (!msg.parent_tool_use_id) {
+                state.refusedWithoutFallback = false;
+            }
+            return false;
+        }
+        if (msg.type !== "system" || msg.subtype !== "model_refusal_no_fallback") {
+            return false;
+        }
+        state.refusedWithoutFallback = true;
+        const category = msg.api_refusal_category ?? null;
+        console.error(`[BridgeJob] model refused with no fallback (category: ${category ?? "none"}, model: ${msg.original_model}) for thread ${job.threadId}`);
+        this.recordTurnEvent({
+            threadId: job.threadId,
+            turnId: job.turnId,
+            event: "model_refusal",
+            detail: { category, model: msg.original_model, fallback: false },
+        });
+        return true;
+    }
     async handleSystemMessage(state, msg, target) {
         // Relay the compaction lifecycle so the dashboard can show a spinner then a
         // summary notice. This fires for both a manual `/compact` (which otherwise
@@ -1812,6 +1821,25 @@ export class BridgeJobExecutor {
             await this.relay.compaction(target, "done");
             return;
         }
+        // A fallback model retried a refused request. The refused leg's messages
+        // were already relayed; the SDK names them so they can leave the chat
+        // instead of sitting above the answer that replaced them.
+        if (msg.type === "system" && msg.subtype === "model_refusal_fallback") {
+            this.recordTurnEvent({
+                ...target,
+                event: "model_refusal",
+                detail: {
+                    category: msg.api_refusal_category ?? null,
+                    model: msg.original_model,
+                    fallback: msg.fallback_model,
+                },
+            });
+            const retracted = msg.retracted_message_uuids ?? [];
+            if (retracted.length > 0) {
+                await this.relay.retractEvents(target, retracted);
+            }
+            return;
+        }
         const agentTasks = applyTaskLifecycleMessage(state.agentTasks, msg, this.now());
         if (agentTasks) {
             state.agentTasks = agentTasks;