@kybernesis/buzz 0.9.5 → 0.9.8

package/README.md

@@ -61,7 +61,8 @@ sessions are keyed by channel.
 | `BUZZ_AGENT_URL` | Where the agent listens (default `http://127.0.0.1:8000`) |
 | `BUZZ_KEYFILE` | The agent's key (default `~/.kybernesis/buzz-agent.json`) |
 | `BUZZ_SESSIONS_FILE` | Channel-to-session continuity store (default beside the key file; an existing legacy `.buzz-sessions.json` is reused) |
-| `BUZZ_AGENT_SILENCE_TIMEOUT_MS` | Maximum silence while opening an agent request or waiting between complete events (default `300000`, five minutes; not a total turn-duration limit) |
+| `BUZZ_AGENT_SILENCE_TIMEOUT_MS` | Maximum silence before the agent acknowledges a request: unread drain, send and create acknowledgement (default `300000`, five minutes). This is where a genuine stall shows: no run is ever created. |
+| `BUZZ_AGENT_WORK_TIMEOUT_MS` | Ceiling on silence once the response stream is open (default `3600000`, sixty minutes). The stream is quiet while the agent works, a long tool call or a delegated subagent produces nothing until it returns, so this is a ceiling on work, not a stall detector. |
 | `KYBERNESIS_ISSUER` | The control plane |
 | `KYBERNESIS_AGENT_CREDENTIAL` | This agent's credential |
 

package/dist/bridge.d.ts

@@ -21,6 +21,8 @@ export type BuzzBridgeOptions = {
     pollMs?: number;
     /** Maximum silence during one agent request or event stream; defaults to five minutes. */
     agentSilenceTimeoutMs?: number;
+    /** Ceiling on a turn once acknowledged; the agent is working while its stream is quiet. Default 60 minutes. */
+    agentWorkTimeoutMs?: number;
     onLog?: (message: string) => void;
 };
 export declare function buzzBridge(options: BuzzBridgeOptions): {
@@ -29,6 +31,8 @@ export declare function buzzBridge(options: BuzzBridgeOptions): {
     pubkey: string;
     /** The communities this agent is a member of. */
     relays: string[];
+    /** Where this bridge declares itself for the management routes to read. */
+    surfaceFile: string;
     start(): void;
     /** Say goodbye rather than letting presence lapse: a stopped agent should not look online. */
     stop(): void;

package/dist/bridge.js

@@ -1,9 +1,10 @@
 import { channelIdentity } from "@kybernesis/enterprise";
 import { fetchMedia, parseMedia } from "./media.js";
 import { speakerCredentials } from "./credentials.js";
+import { surfaceWriter } from "./surface.js";
 import { SessionStore } from "./sessions.js";
-import { agentSilenceReply, answerTurn, composeMessage, DEFAULT_AGENT_SILENCE_TIMEOUT_MS, describeSilentTurn, rejectedTurnReply, silentTurnReply, validateAgentSilenceTimeoutMs, } from "./turn.js";
-import { followPendingConversation, formatInputRequests, invalidInputReply, needsPendingFollower, resolveInputReply, respondToPendingConversation, } from "./hitl.js";
+import { agentSilenceReply, answerTurn, composeMessage, DEFAULT_AGENT_SILENCE_TIMEOUT_MS, DEFAULT_AGENT_WORK_TIMEOUT_MS, describeSilentTurn, rejectedTurnReply, silentTurnReply, validateAgentSilenceTimeoutMs, } from "./turn.js";
+import { followPendingConversation, followerRetryDelayMs, formatInputRequests, invalidInputReply, needsPendingFollower, resolveInputReply, respondToPendingConversation, resumeStalledReply, } from "./hitl.js";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { Client } from "eve/client";
@@ -31,6 +32,7 @@ export function buzzBridge(options) {
     const key = loadKey(options.keyFile);
     const identity = channelIdentity({ issuer: options.issuer, credential: options.credential });
     const log = options.onLog ?? ((message) => console.log(new Date().toISOString().slice(11, 19), message));
+    const agentWorkTimeoutMs = validateAgentSilenceTimeoutMs(options.agentWorkTimeoutMs ?? DEFAULT_AGENT_WORK_TIMEOUT_MS);
     const agentSilenceTimeoutMs = validateAgentSilenceTimeoutMs(options.agentSilenceTimeoutMs ?? DEFAULT_AGENT_SILENCE_TIMEOUT_MS);
     /**
      * One conversation per channel — the SESSION ID, not a handle to it.
@@ -177,6 +179,14 @@ export function buzzBridge(options) {
     /** One abortable durable-stream follower owns each parked conversation. */
     const followers = new Map();
     const followerRestartTimers = new Map();
+    /**
+     * Why a follower keeps reattaching, per conversation.
+     *
+     * `index` is the durable cursor it last reattached at. The cursor moving is
+     * the only honest evidence that anything is happening: KYB-545's spin held a
+     * frozen index across 25 minutes of retries while the room was told nothing.
+     */
+    const followerRetries = new Map();
     let stopped = false;
     function clearFollowerRestart(conversation) {
         const timer = followerRestartTimers.get(conversation);
@@ -187,6 +197,7 @@ export function buzzBridge(options) {
     function stopFollower(community, channel) {
         const conversation = SessionStore.key(community, channel);
         clearFollowerRestart(conversation);
+        followerRetries.delete(conversation);
         followers.get(conversation)?.abort();
         followers.delete(conversation);
     }
@@ -256,13 +267,42 @@ export function buzzBridge(options) {
             if (followers.get(conversation) === controller)
                 followers.delete(conversation);
             const recoverable = sessions.get(community, channel);
-            if (!controller.signal.aborted && recoverable && needsPendingFollower(recoverable)) {
-                const timer = setTimeout(() => {
-                    followerRestartTimers.delete(conversation);
-                    startFollower(community, channel);
-                }, 1_000);
-                followerRestartTimers.set(conversation, timer);
+            if (controller.signal.aborted || !recoverable || !needsPendingFollower(recoverable)) {
+                followerRetries.delete(conversation);
+                return;
             }
+            const previous = followerRetries.get(conversation);
+            const progressed = previous === undefined || recoverable.streamIndex > previous.index;
+            const retry = progressed
+                ? { cycles: 0, index: recoverable.streamIndex, since: Date.now() }
+                : { ...previous, cycles: previous.cycles + 1 };
+            followerRetries.set(conversation, retry);
+            /**
+             * A resumed turn is the agent working, so it answers to the same ceiling
+             * a live turn does. A question nobody has answered yet is not: a person
+             * may reply tomorrow, and waiting for them is the entire point. Only the
+             * first case can be a stall, and only it gives up.
+             */
+            if (recoverable.resumeInFlight && Date.now() - retry.since >= agentWorkTimeoutMs) {
+                followerRetries.delete(conversation);
+                void serialize(community, channel, async () => {
+                    const current = sessions.get(community, channel);
+                    if (!current || !needsPendingFollower(current))
+                        return;
+                    if (current.promptEventIds?.length)
+                        relay.unwatchReplies(current.promptEventIds);
+                    const { pendingInputRequests: _p, resumeInFlight: _r, promptEventIds: _e, ...cleared } = current;
+                    sessions.set(community, channel, cleared);
+                    relay.reply(channel, resumeStalledReply(agentWorkTimeoutMs));
+                    log(`gave up on the resumed turn in ${channel.slice(0, 8)}: no progress past index ${retry.index}`);
+                });
+                return;
+            }
+            const timer = setTimeout(() => {
+                followerRestartTimers.delete(conversation);
+                startFollower(community, channel);
+            }, followerRetryDelayMs(retry.cycles));
+            followerRestartTimers.set(conversation, timer);
         });
     }
     async function handle(event, from) {
@@ -327,6 +367,24 @@ export function buzzBridge(options) {
                     });
                     await respondToPendingConversation(session, responses, from, channel);
                     log(`submitted ${responses.length} input response(s) in ${channel.slice(0, 8)}`);
+                    /**
+                     * The answer is in, so this conversation is no longer waiting on a
+                     * person. It is waiting on the agent, and that is a thing the bridge
+                     * may time out.
+                     *
+                     * Recording it here rather than leaving it to the follower's
+                     * `input.resolved` is what makes a stalled resume detectable at all.
+                     * In KYB-545 the follower could not reach the agent, so it never saw
+                     * that event, and the store still read "one question pending" an hour
+                     * after the person had answered. Nothing may ever time out a wait for
+                     * a human, so while that flag was set the room could only be told
+                     * nothing.
+                     */
+                    const answered = sessions.get(from, channel);
+                    if (answered?.pendingInputRequests?.length) {
+                        const { pendingInputRequests: _resolved, ...rest } = answered;
+                        sessions.set(from, channel, { ...rest, resumeInFlight: true });
+                    }
                     return;
                 }
                 if (pending?.resumeInFlight) {
@@ -341,7 +399,7 @@ export function buzzBridge(options) {
                 }
                 /** Images become file parts; unreadable files become explicit model context. */
                 const message = await composeMessage(text, attachments, (ref) => fetchMedia(key, ref), log);
-                const result = await answerTurn(clientFor(event.pubkey), sessions, channel, message, from, log, agentSilenceTimeoutMs);
+                const result = await answerTurn(clientFor(event.pubkey), sessions, channel, message, from, log, agentSilenceTimeoutMs, agentWorkTimeoutMs);
                 if (result.status === "waiting" && result.inputRequests.length > 0) {
                     sessions.set(from, channel, {
                         id: result.sessionId,
@@ -400,14 +458,19 @@ export function buzzBridge(options) {
             stopTyping();
         }
     }
+    // What this bridge is, for the consoles: see surface.ts.
+    const surface = surfaceWriter({ relays: urls, npub: key.npub, conversations: () => sessions.size }, log);
     return {
         /** The key the workspace has to invite for any of this to happen. */
         npub: key.npub,
         pubkey: key.publicKey,
         /** The communities this agent is a member of. */
         relays: urls,
+        /** Where this bridge declares itself for the management routes to read. */
+        surfaceFile: surface.file,
         start() {
             stopped = false;
+            surface.start();
             for (const relay of relays.values())
                 relay.connect();
             for (const { community, channel, session } of sessions.entries()) {
@@ -425,6 +488,7 @@ export function buzzBridge(options) {
         /** Say goodbye rather than letting presence lapse: a stopped agent should not look online. */
         stop() {
             stopped = true;
+            surface.stop();
             for (const controller of followers.values())
                 controller.abort();
             followers.clear();

package/dist/cli.js

@@ -137,6 +137,9 @@ function run() {
         issuer: env("KYBERNESIS_ISSUER", "https://agent.kybernesis.ai"),
         credential: env("KYBERNESIS_AGENT_CREDENTIAL"),
         ...(process.env.BUZZ_POLL_MS ? { pollMs: Number(process.env.BUZZ_POLL_MS) } : {}),
+        ...(process.env.BUZZ_AGENT_WORK_TIMEOUT_MS
+            ? { agentWorkTimeoutMs: Number(process.env.BUZZ_AGENT_WORK_TIMEOUT_MS) }
+            : {}),
         ...(process.env.BUZZ_AGENT_SILENCE_TIMEOUT_MS
             ? { agentSilenceTimeoutMs: Number(process.env.BUZZ_AGENT_SILENCE_TIMEOUT_MS) }
             : {}),
@@ -298,7 +301,8 @@ else {
     BUZZ_AGENT_URL                 where the agent listens (default http://127.0.0.1:8000)
     BUZZ_KEYFILE                   this agent's key (default ~/.kybernesis/buzz-agent.json)
     BUZZ_SESSIONS_FILE             channel-to-session continuity store
-    BUZZ_AGENT_SILENCE_TIMEOUT_MS   maximum agent silence (default 300000ms)
+    BUZZ_AGENT_SILENCE_TIMEOUT_MS   maximum silence before a turn is acknowledged (default 300000ms)
+    BUZZ_AGENT_WORK_TIMEOUT_MS      ceiling on a turn once acknowledged (default 3600000ms)
     KYBERNESIS_ISSUER              the control plane
     KYBERNESIS_AGENT_CREDENTIAL    this agent's credential
 `);

package/dist/hitl.d.ts

@@ -8,6 +8,26 @@ export declare function resolveInputReply(text: string, requests: readonly Input
 export declare function invalidInputReply(requests: readonly InputRequest[]): string;
 /** Submit a matched reply without consuming its response stream. */
 export declare function respondToPendingConversation(session: Pick<ClientSession, "respond">, responses: readonly InputResponse[], community: string, channel: string): Promise<void>;
+/**
+ * How long a follower waits between reattaching when it saw no progress.
+ *
+ * @remarks
+ * The follower used to reattach on a flat one-second timer. With eve's client
+ * spending about 100 s on an idle stream before giving up, that produced the
+ * fixed ~110 s cycle observed in KYB-545: forever, for as long as the process
+ * lived. Backing off turns a spin into a wait, and the cap keeps a genuinely
+ * slow resume from being abandoned for minutes at a time.
+ */
+export declare function followerRetryDelayMs(cycles: number, capMs?: number): number;
+/**
+ * What the room is told when a resumed turn produced nothing for too long.
+ *
+ * @remarks
+ * KYB-529's rule applied to the resumed phase: the person committed attention
+ * to answering a question, so silence is the one outcome they must not get.
+ * Say the answer arrived, say the work did not, and say the channel is usable.
+ */
+export declare function resumeStalledReply(stallMs: number): string;
 /** A session needs its follower while asking or while resumed output is unpublished. */
 export declare function needsPendingFollower(session: Pick<StoredSession, "pendingInputRequests" | "resumeInFlight">): boolean;
 export interface PendingFollowerCallbacks {

package/dist/hitl.js

@@ -38,6 +38,34 @@ export async function respondToPendingConversation(session, responses, community
         streamReconnectPolicy: { reconnect: false },
     });
 }
+/**
+ * How long a follower waits between reattaching when it saw no progress.
+ *
+ * @remarks
+ * The follower used to reattach on a flat one-second timer. With eve's client
+ * spending about 100 s on an idle stream before giving up, that produced the
+ * fixed ~110 s cycle observed in KYB-545: forever, for as long as the process
+ * lived. Backing off turns a spin into a wait, and the cap keeps a genuinely
+ * slow resume from being abandoned for minutes at a time.
+ */
+export function followerRetryDelayMs(cycles, capMs = 60_000) {
+    const safeCycles = Number.isFinite(cycles) ? Math.max(0, Math.trunc(cycles)) : 0;
+    return Math.min(1_000 * 2 ** Math.min(safeCycles, 30), capMs);
+}
+/**
+ * What the room is told when a resumed turn produced nothing for too long.
+ *
+ * @remarks
+ * KYB-529's rule applied to the resumed phase: the person committed attention
+ * to answering a question, so silence is the one outcome they must not get.
+ * Say the answer arrived, say the work did not, and say the channel is usable.
+ */
+export function resumeStalledReply(stallMs) {
+    const minutes = Math.max(1, Math.round(stallMs / 60_000));
+    return (`Your answer reached me, but the turn it restarted then went quiet for over ${minutes} minute` +
+        `${minutes === 1 ? "" : "s"} without producing anything, so I have stopped waiting on it. ` +
+        `Nothing was posted and no work landed from it. This channel is clear — ask me again and I will start fresh.`);
+}
 /** A session needs its follower while asking or while resumed output is unpublished. */
 export function needsPendingFollower(session) {
     return Boolean(session.pendingInputRequests?.length || session.resumeInFlight);

package/dist/index.d.ts

@@ -3,3 +3,4 @@ export { BuzzRelay, type NostrEvent, type PresenceStatus, type RelayOptions, KIN
 export { asHexPubkey, loadKey, loadOrCreateKey, npubEncode, type AgentKey } from "./keys.js";
 export * as profile from "./profile.js";
 export type { Profile } from "./profile.js";
+export { readSurfaceManifest, surfaceWriter, surfacesDir, type SurfaceManifest } from "./surface.js";

package/dist/index.js

@@ -2,3 +2,4 @@ export { buzzBridge } from "./bridge.js";
 export { BuzzRelay, KIND_MESSAGE, KIND_REACTION, KIND_PRESENCE, KIND_TYPING, KIND_DM_OPEN, } from "./relay.js";
 export { asHexPubkey, loadKey, loadOrCreateKey, npubEncode } from "./keys.js";
 export * as profile from "./profile.js";
+export { readSurfaceManifest, surfaceWriter, surfacesDir } from "./surface.js";

package/dist/surface.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The bridge, declaring itself.
+ *
+ * eve's `/eve/v1/info` lists the channels an agent authored; a workspace bridge
+ * is a separate process the agent knows nothing about, so every console showed
+ * an agent that was plainly answering in a workspace as reachable "only through
+ * this app". Rather than have a console guess from process names, the bridge
+ * writes one small file saying what it is connected to and touches it every
+ * minute. Anything that reads the file — the agent's management routes, and
+ * through them the desktop and the phone — can tell a live bridge from a stale
+ * file by the heartbeat alone.
+ */
+export declare const HEARTBEAT_MS = 60000;
+/** Where every surface on this host writes its manifest; the management routes read the same directory. */
+export declare function surfacesDir(): string;
+export interface SurfaceManifest {
+    kind: "buzz";
+    name: string;
+    /** The workspaces this bridge is connected to. */
+    relays: string[];
+    /** The key the workspace invited. */
+    npub: string;
+    /** Channels with a live conversation. */
+    conversations: number;
+    pid: number;
+    startedAt: string;
+    heartbeatAt: string;
+}
+export interface SurfaceWriter {
+    /** Write the manifest now and keep its heartbeat fresh until `stop()`. */
+    start(): void;
+    /** Refresh what the manifest says, without waiting for the next beat. */
+    update(patch: Partial<Pick<SurfaceManifest, "conversations">>): void;
+    /** Remove the manifest: a stopped bridge should not look like a stale one. */
+    stop(): void;
+    readonly file: string;
+}
+export declare function surfaceWriter(input: {
+    relays: string[];
+    npub: string;
+    conversations(): number;
+    dir?: string;
+}, onError?: (message: string) => void): SurfaceWriter;
+/** Read one manifest back; null when it is not one. */
+export declare function readSurfaceManifest(file: string): SurfaceManifest | null;

package/dist/surface.js

@@ -0,0 +1,82 @@
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * The bridge, declaring itself.
+ *
+ * eve's `/eve/v1/info` lists the channels an agent authored; a workspace bridge
+ * is a separate process the agent knows nothing about, so every console showed
+ * an agent that was plainly answering in a workspace as reachable "only through
+ * this app". Rather than have a console guess from process names, the bridge
+ * writes one small file saying what it is connected to and touches it every
+ * minute. Anything that reads the file — the agent's management routes, and
+ * through them the desktop and the phone — can tell a live bridge from a stale
+ * file by the heartbeat alone.
+ */
+export const HEARTBEAT_MS = 60_000;
+/** Where every surface on this host writes its manifest; the management routes read the same directory. */
+export function surfacesDir() {
+    return process.env.KYB_SURFACES_DIR ?? join(homedir(), ".kybernesis", "surfaces");
+}
+export function surfaceWriter(input, onError = () => undefined) {
+    const dir = input.dir ?? surfacesDir();
+    // One file per connection set, so two bridges on one host for different workspaces do not overwrite each other.
+    const file = join(dir, `buzz-${input.npub.slice(-8)}.json`);
+    const startedAt = new Date().toISOString();
+    let timer;
+    const write = () => {
+        const manifest = {
+            kind: "buzz",
+            name: "Buzz",
+            relays: input.relays,
+            npub: input.npub,
+            conversations: input.conversations(),
+            pid: process.pid,
+            startedAt,
+            heartbeatAt: new Date().toISOString(),
+        };
+        try {
+            mkdirSync(dir, { recursive: true });
+            writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n");
+        }
+        catch (error) {
+            // A manifest that cannot be written costs a row on a console, not a conversation.
+            onError(`could not write surface manifest ${file}: ${error.message}`);
+        }
+    };
+    return {
+        file,
+        start() {
+            write();
+            timer = setInterval(write, HEARTBEAT_MS);
+            timer.unref?.();
+        },
+        update() {
+            write();
+        },
+        stop() {
+            if (timer)
+                clearInterval(timer);
+            timer = undefined;
+            try {
+                if (existsSync(file))
+                    unlinkSync(file);
+            }
+            catch {
+                /* a stale file is told apart by its heartbeat anyway */
+            }
+        },
+    };
+}
+/** Read one manifest back; null when it is not one. */
+export function readSurfaceManifest(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        if (parsed.kind !== "buzz" || !Array.isArray(parsed.relays) || typeof parsed.heartbeatAt !== "string")
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/turn.d.ts

@@ -3,6 +3,27 @@ import { type FetchedMedia, type MediaRef } from "./media.js";
 import { SessionStore } from "./sessions.js";
 /** Five minutes without an eve event or acknowledgement is treated as a stalled turn. */
 export declare const DEFAULT_AGENT_SILENCE_TIMEOUT_MS: number;
+/**
+ * How long a turn may run once the agent has acknowledged it.
+ *
+ * eve's response stream is quiet while the agent works: a long tool call or a
+ * delegated subagent produces no events until it returns. Reading that quiet
+ * as a stall killed every real piece of work over five minutes the day the
+ * silence watchdog shipped (a repository study, a delegation that cloned and
+ * read a codebase), while the stall it was built for happened BEFORE the
+ * first event: no run was ever created. So the short bound stays on the
+ * phases where silence is a fault (unread drain, acknowledgements) and the
+ * response stream gets this ceiling instead. Sixty minutes covers the longest
+ * genuine turn seen on a deployment (44 minutes) with room.
+ */
+export declare const DEFAULT_AGENT_WORK_TIMEOUT_MS: number;
+/** The two bounds a watchdog applies, chosen by phase. */
+export interface AgentTimeouts {
+    /** Silence before the first event of a request: drain, send/create acknowledgement. */
+    readonly silenceMs: number;
+    /** Silence between events once the response stream is open: the agent is working. */
+    readonly workMs: number;
+}
 export type AgentSilencePhase = "unread drain" | "send acknowledgement" | "response stream" | "create acknowledgement" | "create response stream";
 /** A caller-owned inactivity timeout. Aborting the transport does not cancel the eve session. */
 export declare class AgentSilenceTimeoutError extends Error {
@@ -62,7 +83,7 @@ export declare function describeSilentTurn(failures: readonly TurnFailure[]): st
 /** Convert one inbound Buzz message into an eve-compatible turn. */
 export declare function composeMessage(text: string, attachments: MediaRef[], fetchAttachment: (ref: MediaRef) => Promise<FetchedMedia>, log?: (message: string) => void): Promise<TurnMessage>;
 /** Continue a channel's existing conversation, replacing it only when it is explicitly stale. */
-export declare function answerTurn(client: Client, sessions: SessionStore, channel: string, message: TurnMessage, community: string, log?: (message: string) => void, agentSilenceTimeoutMs?: number): Promise<TurnOutcome>;
+export declare function answerTurn(client: Client, sessions: SessionStore, channel: string, message: TurnMessage, community: string, log?: (message: string) => void, agentSilenceTimeoutMs?: number, agentWorkTimeoutMs?: number): Promise<TurnOutcome>;
 /** What the room is told when eve refuses the turn itself. */
 /**
  * The two answers from eve that mean the stored session cannot carry another

package/dist/turn.js

@@ -2,6 +2,21 @@ import { ClientError, createDataUrlFilePart, } from "eve/client";
 import { isImage } from "./media.js";
 /** Five minutes without an eve event or acknowledgement is treated as a stalled turn. */
 export const DEFAULT_AGENT_SILENCE_TIMEOUT_MS = 5 * 60_000;
+/**
+ * How long a turn may run once the agent has acknowledged it.
+ *
+ * eve's response stream is quiet while the agent works: a long tool call or a
+ * delegated subagent produces no events until it returns. Reading that quiet
+ * as a stall killed every real piece of work over five minutes the day the
+ * silence watchdog shipped (a repository study, a delegation that cloned and
+ * read a codebase), while the stall it was built for happened BEFORE the
+ * first event: no run was ever created. So the short bound stays on the
+ * phases where silence is a fault (unread drain, acknowledgements) and the
+ * response stream gets this ceiling instead. Sixty minutes covers the longest
+ * genuine turn seen on a deployment (44 minutes) with room.
+ */
+export const DEFAULT_AGENT_WORK_TIMEOUT_MS = 60 * 60_000;
+const isWorkPhase = (phase) => phase.endsWith("response stream");
 /** A caller-owned inactivity timeout. Aborting the transport does not cancel the eve session. */
 export class AgentSilenceTimeoutError extends Error {
     phase;
@@ -121,7 +136,7 @@ export async function composeMessage(text, attachments, fetchAttachment, log = (
     }
     return parts;
 }
-function silenceWatchdog(intervalMs) {
+function silenceWatchdog(timeouts) {
     const controller = new AbortController();
     let timer;
     let timeout;
@@ -130,6 +145,7 @@ function silenceWatchdog(intervalMs) {
         arm(phase) {
             if (timer)
                 clearTimeout(timer);
+            const intervalMs = isWorkPhase(phase) ? timeouts.workMs : timeouts.silenceMs;
             timer = setTimeout(() => {
                 timeout = new AgentSilenceTimeoutError(phase, intervalMs);
                 controller.abort(timeout);
@@ -146,8 +162,8 @@ function silenceWatchdog(intervalMs) {
         },
     };
 }
-async function drainUnread(stream, intervalMs) {
-    const watchdog = silenceWatchdog(intervalMs);
+async function drainUnread(stream, timeouts) {
+    const watchdog = silenceWatchdog(timeouts);
     let unread = 0;
     watchdog.arm("unread drain");
     try {
@@ -169,33 +185,84 @@ async function drainUnread(stream, intervalMs) {
         watchdog.dispose();
     }
 }
-async function collectResponse(response, watchdog, phase, streamIndex) {
+const isTurnBoundary = (type) => type === "session.waiting" || type === "session.completed" || type === "session.failed";
+async function collectResponse(response, watchdog, phase, streamIndex, continueStream, log = () => { }) {
     let message = "";
     let status = "completed";
-    const inputRequests = [];
-    const failures = [];
+    let inputRequests = [];
+    let failures = [];
+    let sawTurnStart = false;
+    let endedAtOwnBoundary = false;
+    let staleBoundaryFirst = false;
+    let seen = 0;
+    /**
+     * One event of this turn, or of the turn before it.
+     *
+     * The client ends a send's stream at the first session boundary after the
+     * cursor. When the send itself ends an earlier, still-running turn (a person
+     * asks again while a twenty-minute delegation is under way), that earlier
+     * turn's `session.waiting` is the first thing on the wire, before this
+     * turn's `turn.started`. Read as ours it made an empty answer, and the
+     * abandoned stream then closed the request, which cancelled the real turn
+     * five minutes into its work. So: nothing counts until this turn has
+     * started, and a boundary only ends the collection once it has.
+     */
+    const consume = (event) => {
+        watchdog.arm(phase);
+        seen += 1;
+        // A boundary as the very first event, before anything of this turn, is the
+        // earlier turn's. Anything else is treated as ours (a stream without
+        // turn.started still answers as before).
+        if (seen === 1 && isTurnBoundary(event.type) && !sawTurnStart)
+            staleBoundaryFirst = true;
+        if (event.type === "turn.started") {
+            sawTurnStart = true;
+            message = "";
+            status = "completed";
+            inputRequests = [];
+            failures = [];
+            return false;
+        }
+        const failure = failureFromEvent(event);
+        if (failure)
+            failures.push(failure);
+        if (event.type === "message.completed" && event.data.finishReason !== "tool-calls") {
+            message = event.data.message ?? "";
+        }
+        else if (event.type === "input.requested") {
+            inputRequests.push(...event.data.requests);
+        }
+        else if (event.type === "session.waiting") {
+            status = "waiting";
+        }
+        else if (event.type === "session.failed") {
+            status = "failed";
+        }
+        else if (event.type === "session.completed") {
+            status = "completed";
+        }
+        if (isTurnBoundary(event.type) && !staleBoundaryFirst) {
+            endedAtOwnBoundary = true;
+            return true;
+        }
+        if (isTurnBoundary(event.type) && staleBoundaryFirst && sawTurnStart) {
+            endedAtOwnBoundary = true;
+            return true;
+        }
+        return false;
+    };
     watchdog.arm(phase);
     try {
         try {
             for await (const event of response) {
-                watchdog.arm(phase);
-                const failure = failureFromEvent(event);
-                if (failure)
-                    failures.push(failure);
-                if (event.type === "message.completed" && event.data.finishReason !== "tool-calls") {
-                    message = event.data.message ?? "";
-                }
-                else if (event.type === "input.requested") {
-                    inputRequests.push(...event.data.requests);
-                }
-                else if (event.type === "session.waiting") {
-                    status = "waiting";
-                }
-                else if (event.type === "session.failed") {
-                    status = "failed";
-                }
-                else if (event.type === "session.completed") {
-                    status = "completed";
+                if (consume(event))
+                    break;
+            }
+            if (staleBoundaryFirst && !endedAtOwnBoundary && continueStream) {
+                log("the stream ended on an earlier turn's boundary before this turn started; following the session until this turn ends");
+                for await (const event of continueStream(watchdog.signal)) {
+                    if (consume(event))
+                        break;
                 }
             }
         }
@@ -217,8 +284,8 @@ async function collectResponse(response, watchdog, phase, streamIndex) {
         watchdog.dispose();
     }
 }
-async function sendExisting(responsePromise, streamIndex, intervalMs) {
-    const watchdog = silenceWatchdog(intervalMs);
+async function sendExisting(responsePromise, streamIndex, timeouts, continueStream, log = () => { }) {
+    const watchdog = silenceWatchdog(timeouts);
     watchdog.arm("send acknowledgement");
     try {
         let response;
@@ -230,15 +297,18 @@ async function sendExisting(responsePromise, streamIndex, intervalMs) {
             throw error;
         }
         watchdog.throwIfTimedOut();
-        return await collectResponse(response, watchdog, "response stream", streamIndex);
+        return await collectResponse(response, watchdog, "response stream", streamIndex, continueStream, log);
     }
     finally {
         watchdog.dispose();
     }
 }
 /** Continue a channel's existing conversation, replacing it only when it is explicitly stale. */
-export async function answerTurn(client, sessions, channel, message, community, log = () => { }, agentSilenceTimeoutMs = DEFAULT_AGENT_SILENCE_TIMEOUT_MS) {
-    const intervalMs = validateAgentSilenceTimeoutMs(agentSilenceTimeoutMs);
+export async function answerTurn(client, sessions, channel, message, community, log = () => { }, agentSilenceTimeoutMs = DEFAULT_AGENT_SILENCE_TIMEOUT_MS, agentWorkTimeoutMs = DEFAULT_AGENT_WORK_TIMEOUT_MS) {
+    const intervalMs = {
+        silenceMs: validateAgentSilenceTimeoutMs(agentSilenceTimeoutMs),
+        workMs: validateAgentSilenceTimeoutMs(agentWorkTimeoutMs),
+    };
     const existing = sessions.get(community, channel);
     if (existing) {
         try {
@@ -258,7 +328,7 @@ export async function answerTurn(client, sessions, channel, message, community,
             const result = await sendExisting((signal) => session.send(message, {
                 clientContext: { buzzCommunity: community, buzzChannel: channel },
                 signal,
-            }), () => session.state.streamIndex, intervalMs);
+            }), () => session.state.streamIndex, intervalMs, (signal) => session.stream({ follow: true, startIndex: session.state.streamIndex, signal }), log);
             sessions.set(community, channel, {
                 id: existing.id,
                 streamIndex: session.state.streamIndex,
@@ -293,7 +363,7 @@ export async function answerTurn(client, sessions, channel, message, community,
             throw error;
         }
         watchdog.throwIfTimedOut();
-        const result = await collectResponse(created.response, watchdog, "create response stream", () => created.session.state.streamIndex);
+        const result = await collectResponse(created.response, watchdog, "create response stream", () => created.session.state.streamIndex, (signal) => created.session.stream({ follow: true, startIndex: created.session.state.streamIndex, signal }), log);
         sessions.set(community, channel, {
             id: created.session.state.sessionId,
             streamIndex: created.session.state.streamIndex,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/buzz",
-  "version": "0.9.5",
+  "version": "0.9.8",
   "description": "Put an eve agent in a Buzz workspace as a member: per-speaker verified identity resolved through the control plane, self-service identity linking, presence, typing and seen signals.",
   "license": "Apache-2.0",
   "type": "module",