@loicngr/kobo 1.11.16 → 1.11.17

package/dist/server/services/agent/engines/claude-code/engine.js

@@ -2,6 +2,8 @@ import { query, } from '@anthropic-ai/claude-agent-sdk';
 import { nanoid } from 'nanoid';
 import { isWorkspacePermissionAllowed } from '../../../workspace-permission-policy-service.js';
 import { createStreamingBatcher } from '../../streaming-batcher.js';
+import { createTurnLiveness } from '../../turn-liveness.js';
+import { AGENT_NO_LONGER_RUNNING_TEXT, } from '../types.js';
 import { CLAUDE_CODE_CAPABILITIES } from './capabilities.js';
 import { createMapperState, mapSdkMessage, QUOTA_PATTERN, tryEmitQuota } from './event-mapper.js';
 import { buildClaudeOptions } from './options-builder.js';
@@ -16,10 +18,14 @@ import { buildStopHookOutput } from './stop-hook.js';
  * and auto-loop are not frozen forever.
  */
 const RESULT_DRAIN_TIMEOUT_MS = 15_000;
-// Claude may occasionally leave its async iterator open after its final text
-// without producing a result message. Keep a separate, conservative guard for
-// that shape; active tool/message traffic always cancels and re-arms it.
-const TEXT_IDLE_TIMEOUT_MS = 120_000;
+/**
+ * Deadline for a stream that stops reporting ANY activity. The former
+ * text-only guard was re-armed solely on a message with text and no tool call
+ * — the minority shape — so a run frozen mid-tool-call had no timer at all,
+ * `isAlive()` kept answering true, and the workspace stayed `executing`
+ * forever with zero trace. Exported so tests never hard-code the value.
+ */
+export const CLAUDE_STREAM_IDLE_TIMEOUT_MS = 120_000;
 // Safety net for a subagent whose terminal `task_notification` carries a
 // status outside the mapper's known-terminal set (SDK schema drift) — it
 // never clears `activeSubagentToolCallIds`, which otherwise blocks
@@ -119,9 +125,9 @@ export function createClaudeCodeEngine() {
                 return new Promise((resolve, reject) => {
                     const resolver = { resolve, input, requestKind };
                     pendingResolvers.set(toolCallId, resolver);
-                    // A user decision is intentional inactivity. The text-only watchdog
-                    // must never end this session while the permission card is visible.
-                    clearTextIdleWatchdog();
+                    // A user decision is intentional inactivity — suspend the deadline
+                    // rather than cancel it, so it resumes the moment the card is answered.
+                    turnLiveness.pause();
                     const onAbort = () => {
                         if (pendingResolvers.get(toolCallId) === resolver) {
                             pendingResolvers.delete(toolCallId);
@@ -270,21 +276,13 @@ export function createClaudeCodeEngine() {
             // background subagent is active is not terminal: the SDK can still emit
             // its task notification and an automatic continuation turn.
             let resultDrainTimer;
-            let textIdleTimer;
-            const clearTextIdleWatchdog = () => {
-                if (!textIdleTimer)
-                    return;
-                clearTimeout(textIdleTimer);
-                textIdleTimer = undefined;
-            };
-            const armTextIdleWatchdog = () => {
-                clearTextIdleWatchdog();
-                textIdleTimer = setTimeout(() => {
-                    if (pendingResolvers.size > 0) {
-                        textIdleTimer = undefined;
-                        return;
-                    }
-                    console.warn(`[claude-engine] SDK stream inactive ${TEXT_IDLE_TIMEOUT_MS}ms after a text-only response — forcing session:ended`);
+            // D2 — one shared liveness module for both engines. Armed before the
+            // first SDK message, re-armed on EVERY message, suspended while a human
+            // decision or a background subagent is outstanding, stopped in `finally`.
+            const turnLiveness = createTurnLiveness({
+                timeoutMs: CLAUDE_STREAM_IDLE_TIMEOUT_MS,
+                onTimeout() {
+                    console.warn(`[claude-engine] SDK stream reported no activity for ${CLAUDE_STREAM_IDLE_TIMEOUT_MS}ms — forcing session:ended`);
                     if (userInterrupted)
                         emitSessionEnded('killed', null);
                     else if (mapperState.sawErrorResult)
@@ -292,9 +290,8 @@ export function createClaudeCodeEngine() {
                     else
                         emitSessionEnded('watchdog', null);
                     abortController.abort();
-                }, TEXT_IDLE_TIMEOUT_MS);
-                textIdleTimer.unref?.();
-            };
+                },
+            });
             const armResultDrainWatchdog = () => {
                 if (resultDrainTimer)
                     return;
@@ -347,6 +344,7 @@ export function createClaudeCodeEngine() {
             };
             const iteratorPromise = (async () => {
                 iteratorRunning = true;
+                turnLiveness.start();
                 try {
                     for await (const msg of q) {
                         const events = mapSdkMessage(msg, mapperState);
@@ -374,15 +372,17 @@ export function createClaudeCodeEngine() {
                                 discoveredSessionId = ev.engineSessionId;
                             safeEmit(ev);
                         }
-                        // A plain final response is normally followed by `result`. If the
-                        // SDK instead leaves the iterator parked, release the workspace
-                        // after a conservative quiet period. Tool activity never arms it.
-                        clearTextIdleWatchdog();
-                        if (events.some((ev) => ev.kind === 'message:text') && !events.some((ev) => ev.kind === 'tool:call')) {
-                            armTextIdleWatchdog();
-                        }
+                        // Any SDK message is proof of life — re-arm on EVERY message, not
+                        // only on a text-without-tool-call one.
+                        turnLiveness.activity();
+                        // A background subagent or a pending permission card can stay
+                        // legitimately quiet for minutes; their own dedicated watchdogs
+                        // own those windows, so suspend the turn deadline meanwhile.
+                        if (activeSubagentTaskIds.size > 0 || pendingResolvers.size > 0)
+                            turnLiveness.pause();
+                        else
+                            turnLiveness.resume();
                         if (msg.type === 'result') {
-                            clearTextIdleWatchdog();
                             completedResponses++;
                             emitTurnCompletedIfSettled();
                             // A queued forced message starts the next response on this same SDK stream.
@@ -438,7 +438,7 @@ export function createClaudeCodeEngine() {
                         clearTimeout(resultDrainTimer);
                         resultDrainTimer = undefined;
                     }
-                    clearTextIdleWatchdog();
+                    turnLiveness.stop();
                     clearSubagentStallWatchdog();
                     // Drain any callback still pending (SDK terminated while awaiting an
                     // answer). canUseTool's abort path covers signalled stops; this
@@ -468,7 +468,7 @@ export function createClaudeCodeEngine() {
                 },
                 sendMessage(text) {
                     if (!iteratorRunning)
-                        throw new Error('Claude agent is no longer running');
+                        throw new Error(`Claude ${AGENT_NO_LONGER_RUNNING_TEXT}`);
                     inputStream.send(text);
                 },
                 interrupt() {
@@ -524,6 +524,10 @@ export function createClaudeCodeEngine() {
                     if (!resolver)
                         return false;
                     pendingResolvers.delete(toolCallId);
+                    // Only resume the deadline once every outstanding card is answered —
+                    // a sibling request may still be waiting on a human.
+                    if (pendingResolvers.size === 0)
+                        turnLiveness.resume();
                     if (response.kind === 'question') {
                         // Echo the original questions array + answers so the SDK
                         // reconstructs the AskUserQuestion tool input.

package/dist/server/services/agent/engines/codex/client.js

@@ -1,4 +1,13 @@
 import { createJsonRpcPeer } from './jsonrpc/peer.js';
+/**
+ * A handshake that never answers is a broken install (missing binary, expired
+ * token, protocol drift), not a model thinking — fail fast and loudly.
+ */
+export const CODEX_HANDSHAKE_TIMEOUT_MS = 20_000;
+/** Thread creation/resume can touch disk and the network; give it more room. */
+export const CODEX_THREAD_TIMEOUT_MS = 30_000;
+/** An interrupt that is not acknowledged must never block the escalation path. */
+export const CODEX_INTERRUPT_TIMEOUT_MS = 10_000;
 export function createAppServerClient(opts) {
     const peer = createJsonRpcPeer({
         stdin: opts.stdin,
@@ -15,22 +24,25 @@ export function createAppServerClient(opts) {
                 clientInfo: opts.clientInfo,
                 capabilities: { experimentalApi: true },
             };
-            return peer.request('initialize', params);
+            return peer.request('initialize', params, CODEX_HANDSHAKE_TIMEOUT_MS);
         },
         startThread(params) {
-            return peer.request('thread/start', params);
+            return peer.request('thread/start', params, CODEX_THREAD_TIMEOUT_MS);
         },
         resumeThread(params) {
-            return peer.request('thread/resume', params);
+            return peer.request('thread/resume', params, CODEX_THREAD_TIMEOUT_MS);
         },
         startTurn(params) {
+            // Default deadline: starting a turn is the model's own latency budget.
             return peer.request('turn/start', params);
         },
         steerTurn(params) {
+            // Same budget. Steering requests are chained, so a request left pending
+            // here used to block every later message of the workspace for good.
             return peer.request('turn/steer', params);
         },
         async interruptTurn(params) {
-            await peer.request('turn/interrupt', params);
+            await peer.request('turn/interrupt', params, CODEX_INTERRUPT_TIMEOUT_MS);
         },
         close() {
             peer.close();

package/dist/server/services/agent/engines/codex/engine.js

@@ -1,13 +1,14 @@
 import { getPackageVersion } from '../../../../utils/paths.js';
 import { isWorkspacePermissionAllowed } from '../../../workspace-permission-policy-service.js';
 import { createStreamingBatcher } from '../../streaming-batcher.js';
+import { createTurnLiveness } from '../../turn-liveness.js';
+import { AGENT_NO_LONGER_RUNNING_TEXT, } from '../types.js';
 import { CODEX_CAPABILITIES } from './capabilities.js';
 import { createAppServerClient } from './client.js';
 import { createMapperState, emitSessionStarted, handleAgentMessageDelta, handleItemCompleted, handleItemStarted, handleRateLimitsUpdated, handleTurnCompleted, QUOTA_PATTERN, tryEmitQuota, } from './event-mapper.js';
 import { buildCodexOptions } from './options-builder.js';
 import { buildResponseForResolve, handleServerRequest } from './server-requests.js';
 import { spawnAppServer } from './spawn.js';
-import { createTurnLiveness } from './turn-liveness.js';
 /** Long enough for normal tool work, short enough to recover a lost turn event. */
 export const CODEX_TURN_IDLE_TIMEOUT_MS = 120_000;
 export const CODEX_GRACEFUL_INTERRUPT_TIMEOUT_MS = 3_000;
@@ -329,6 +330,11 @@ export function createCodexEngine() {
             const iteratorPromise = (async () => {
                 iteratorRunning = true;
                 try {
+                    // Armed BEFORE the handshake (D2). Previously the probe only started
+                    // once `turn/start` had answered, leaving initialize / thread.start /
+                    // turn.start entirely uncovered — the exact window where a broken
+                    // install hangs.
+                    turnLiveness.start();
                     await waitForChild(client.connect());
                     if (isResume && options.resumeFromEngineSessionId) {
                         await waitForChild(client.resumeThread({
@@ -358,7 +364,7 @@ export function createCodexEngine() {
                         collaborationMode,
                     }));
                     activeTurnId = initialTurn.turnId;
-                    turnLiveness.start();
+                    turnLiveness.activity();
                     readySettled = true;
                     resolveReady();
                     await waitForChild(turnDonePromise);
@@ -442,6 +448,21 @@ export function createCodexEngine() {
                 sendMessage(text) {
                     const steer = async () => {
                         await readyPromise;
+                        // `readyPromise` only ever resolves once, on the FIRST turn
+                        // reaching `turn/start` — it says nothing about whether the
+                        // session has since ended. A one-prompt-one-turn session that
+                        // completed naturally (or was stopped) already ran the `finally`
+                        // block below: `client.close()` tore down the JSON-RPC peer and
+                        // `child.kill('SIGTERM')` killed the process. Without this check
+                        // a message typed after that point would either write to an
+                        // already-closed peer or sit for the full 120s JSON-RPC timeout
+                        // before failing — and neither shape was recognised as "resume
+                        // instead of rejecting". Fail fast instead, reusing the same
+                        // substring Claude's engine throws once its stdin is closed, so
+                        // the orchestrator's existing pattern covers this case too.
+                        if (!iteratorRunning) {
+                            throw new Error(`Codex ${AGENT_NO_LONGER_RUNNING_TEXT}`);
+                        }
                         if (!discoveredSessionId || !activeTurnId) {
                             throw new Error('Codex session is not ready to receive a message');
                         }

package/dist/server/services/agent/engines/codex/jsonrpc/peer.js

@@ -1,7 +1,35 @@
 import { createJsonRpcTransport } from './transport.js';
+/**
+ * Default per-request deadline. A live-but-mute app-server used to park a
+ * request forever: the child-exit guard only watches for an exit, the turn
+ * liveness probe was armed after the handshake, and the cleanup block that
+ * would close the connection is never reached while a `try` awaits. The
+ * session hung for good, with no trace and no event.
+ */
+export const DEFAULT_JSONRPC_REQUEST_TIMEOUT_MS = 120_000;
+export class JsonRpcTimeoutError extends Error {
+    method;
+    timeoutMs;
+    constructor(method, timeoutMs) {
+        super(`JSON-RPC request '${method}' timed out after ${timeoutMs}ms`);
+        this.method = method;
+        this.timeoutMs = timeoutMs;
+        this.name = 'JsonRpcTimeoutError';
+    }
+}
 export function createJsonRpcPeer(opts) {
     let nextId = 1;
     const pending = new Map();
+    /** Remove a pending slot and clear its deadline in one place. */
+    const takePending = (id) => {
+        const slot = pending.get(id);
+        if (!slot)
+            return undefined;
+        if (slot.timer)
+            clearTimeout(slot.timer);
+        pending.delete(id);
+        return slot;
+    };
     const transport = createJsonRpcTransport({
         stdin: opts.stdin,
         stdout: opts.stdout,
@@ -9,10 +37,9 @@ export function createJsonRpcPeer(opts) {
         onMessage(msg) {
             // Response to one of our requests
             if (msg.id != null && (msg.result !== undefined || msg.error !== undefined)) {
-                const slot = pending.get(msg.id);
+                const slot = takePending(msg.id);
                 if (!slot)
                     return;
-                pending.delete(msg.id);
                 if (msg.error) {
                     slot.reject(new Error(`JSON-RPC error ${msg.error.code}: ${msg.error.message}`));
                 }
@@ -33,10 +60,19 @@ export function createJsonRpcPeer(opts) {
         },
     });
     return {
-        request(method, params) {
+        request(method, params, timeoutMs) {
             const id = nextId++;
+            const deadlineMs = timeoutMs ?? opts.defaultRequestTimeoutMs ?? DEFAULT_JSONRPC_REQUEST_TIMEOUT_MS;
             return new Promise((resolve, reject) => {
-                pending.set(id, { resolve: (v) => resolve(v), reject });
+                const slot = { resolve: (v) => resolve(v), reject };
+                if (deadlineMs > 0) {
+                    slot.timer = setTimeout(() => {
+                        pending.delete(id);
+                        reject(new JsonRpcTimeoutError(method, deadlineMs));
+                    }, deadlineMs);
+                    slot.timer.unref?.();
+                }
+                pending.set(id, slot);
                 transport.send({ jsonrpc: '2.0', id, method, params });
             });
         },
@@ -52,8 +88,11 @@ export function createJsonRpcPeer(opts) {
         close() {
             transport.close();
             const err = new Error('peer closed');
-            for (const slot of pending.values())
+            for (const slot of pending.values()) {
+                if (slot.timer)
+                    clearTimeout(slot.timer);
                 slot.reject(err);
+            }
             pending.clear();
         },
     };

package/dist/server/services/agent/engines/types.js

@@ -1,3 +1,16 @@
+// ── Engine contract ───────────────────────────────────────────────────────────
+/**
+ * Substring an engine's error message must contain once its session has
+ * fully ended and it can no longer receive a message. The Claude engine
+ * throws `Claude agent is no longer running`; the Codex engine's
+ * post-session-end guard in `codex/engine.ts` reuses this same substring so a
+ * single already-recognized `isAgentUnavailableError` pattern in the
+ * orchestrator covers both engines, instead of growing that list with a
+ * fourth, engine-specific string. Kept here — a module neither engine's
+ * business logic depends on — purely to give the two call sites a shared
+ * anchor; it is not itself part of the `AgentEngine` interface.
+ */
+export const AGENT_NO_LONGER_RUNNING_TEXT = 'agent is no longer running';
 /** Every AgentEvent kind, as a const for exhaustive iteration in tests. */
 export const ALL_AGENT_EVENT_KINDS = [
     'session:started',