@namzu/sdk 58.1.1 → 60.0.0

package/src/provider/model-window-suffix.ts

@@ -0,0 +1,84 @@
+/**
+ * Keeps the `[1m]` window marker off the wire.
+ *
+ * A model id ending in `[1m]` declares a one-million-token window to Namzu
+ * (see `splitModelWindowSuffix`). The marker belongs to the person and the UI,
+ * not to the vendor, so every driver and every request sees the bare id. This
+ * wraps a provider once, where it is built, so no caller that holds the marked
+ * id (a main model, a sub-agent, a side-job model, a fallback chain member)
+ * has to remember to strip it.
+ */
+
+import { stripModelWindowSuffix } from '../compaction/context-window.js'
+import type { LLMProvider } from '../types/provider/interface.js'
+
+/** Provider methods whose first argument is a model id. */
+const MODEL_FIRST_METHODS: ReadonlySet<string> = new Set([
+	'supportsHostedWebSearchFor',
+	'supportsImageInputFor',
+	'reasoningEffortLevelsFor',
+	'reasoningEffortDefaultFor',
+	'effortLevelsFor',
+	'resolveContextWindow',
+	'healthCheck',
+	'doctorCheck',
+])
+
+function stripParams(params: unknown): unknown {
+	if (typeof params !== 'object' || params === null) return params
+	const model = (params as { model?: unknown }).model
+	if (typeof model !== 'string') return params
+	const bare = stripModelWindowSuffix(model)
+	return bare === model ? params : { ...params, model: bare }
+}
+
+const WRAPPED = Symbol.for('namzu.modelWindowSuffixStripped')
+
+type AnyMethod = (...args: unknown[]) => unknown
+
+function wrapMethod(name: string, method: AnyMethod): AnyMethod | undefined {
+	if (name === 'chatStream' || name === 'chat') {
+		return function (this: unknown, params: unknown, ...rest: unknown[]) {
+			return method.call(this, stripParams(params), ...rest)
+		}
+	}
+	if (MODEL_FIRST_METHODS.has(name)) {
+		return function (this: unknown, model: unknown, ...rest: unknown[]) {
+			return method.call(
+				this,
+				typeof model === 'string' ? stripModelWindowSuffix(model) : model,
+				...rest,
+			)
+		}
+	}
+	return undefined
+}
+
+/**
+ * The same provider, now stripping the marker from every model it is handed.
+ * The instance is patched in place (not proxied) so a host that keys state on
+ * the provider object keeps finding it; wrapping twice changes nothing.
+ */
+export function withModelWindowSuffixStripped<T extends LLMProvider>(provider: T): T {
+	const target = provider as unknown as Record<PropertyKey, unknown>
+	if (target[WRAPPED] === true) return provider
+	if (!Object.isExtensible(provider)) {
+		return new Proxy(provider, {
+			get(object, property) {
+				const value: unknown = Reflect.get(object, property, object)
+				if (typeof value !== 'function') return value
+				const wrapped =
+					typeof property === 'string' ? wrapMethod(property, value as AnyMethod) : undefined
+				return (wrapped ?? (value as AnyMethod)).bind(object)
+			},
+		})
+	}
+	for (const name of ['chatStream', 'chat', ...MODEL_FIRST_METHODS]) {
+		const method = target[name]
+		if (typeof method !== 'function') continue
+		const wrapped = wrapMethod(name, method as AnyMethod)
+		if (wrapped) target[name] = wrapped
+	}
+	Object.defineProperty(provider, WRAPPED, { value: true, enumerable: false })
+	return provider
+}

package/src/provider/token-budget.ts

@@ -29,9 +29,14 @@ function rejectedBeforeGeneration(error: unknown): boolean {
 			[400, 401, 403, 404, 413, 422, 429].includes(classified.status))
 	return (
 		explicitRejection &&
-		['auth', 'rate_limit', 'context_length_exceeded', 'invalid_request', 'not_found'].includes(
-			classified.code,
-		)
+		[
+			'auth',
+			'rate_limit',
+			'usage_limit',
+			'context_length_exceeded',
+			'invalid_request',
+			'not_found',
+		].includes(classified.code)
 	)
 }
 
@@ -96,6 +101,7 @@ export function withTokenBudget(provider: LLMProvider, budget: SessionTokenBudge
 					![
 						'auth',
 						'rate_limit',
+						'usage_limit',
 						'context_length_exceeded',
 						'invalid_request',
 						'not_found',

package/src/public-runtime.ts

@@ -24,11 +24,17 @@ export { WorkerCodeRuntime } from './execution/code-runtime/worker.js'
 // interpreter above, with `agent()` as its only host call.
 export {
 	FileWorkflowJournal,
+	formatWorkflowJournalLine,
+	loadWorkflowResume,
 	parseWorkflowMeta,
+	readWorkflowJournalChecked,
 	resolveWorkflowLimits,
 	summarizeWorkflowPhases,
 	WorkflowRuntime,
 	WorkflowScriptError,
+	workflowCallKey,
+	workflowJournalLineHash,
+	workflowJournalSeed,
 } from './execution/workflow/index.js'
 
 export {
@@ -608,7 +614,7 @@ export { resolveSessionLogReplay } from './types/session/log-cursor.js'
 
 // Commands a HOST offers its operator. Deliberately NOT tools: no
 // descriptor reaches a provider and no dispatch path reaches the model — a
-// `/tasks` readout is a question the operator asked, and making it callable
+// `/skills` readout is a question the operator asked, and making it callable
 // would let the model spend a turn on it and record the output as a finding.
 export {
 	HostCommandNameCollisionError,
@@ -1109,6 +1115,7 @@ export { wrapProviderWithProbes } from './provider/instrumentation.js'
 export type { ProviderInstrumentationOptions } from './provider/instrumentation.js'
 export type { ResolvedProviderCapabilities } from './provider/capabilities.js'
 export { collectChatCompletion } from './provider/collect-chat-completion.js'
+export { withModelWindowSuffixStripped } from './provider/model-window-suffix.js'
 
 // Old spellings of renamed exports, still live for one deprecation window.
 // The file explains why each is a `const`+`type` pair rather than a
@@ -1591,7 +1598,18 @@ export {
 // consumer (`SpanProcessorLike`, then `CompactNowInput` and `CompactionResult`).
 // The gate is the reason this is a list rather than a fourth accident.
 export type { ResolvedContextWindow } from './compaction/context-window.js'
-export { resolveTriggerThreshold } from './compaction/context-window.js'
+export {
+	AUTO_COMPACT_WINDOW_MAX_TOKENS,
+	AUTO_COMPACT_WINDOW_MIN_TOKENS,
+	ONE_MILLION_WINDOW_TOKENS,
+	oneMillionWindowDisabled,
+	parseAutoCompactWindow,
+	resolveAutoCompactWindowSetting,
+	resolveTriggerThreshold,
+	splitModelWindowSuffix,
+	stripModelWindowSuffix,
+} from './compaction/context-window.js'
+export type { AutoCompactWindowParse } from './compaction/context-window.js'
 // What the context window is made of, for a host that draws the answer to
 // "where did my context go".
 export {
@@ -1744,6 +1762,7 @@ export {
 	ChildSessionMetaSchema,
 	CompactionRecordSchema,
 	ExternalRefSchema,
+	IgnorableRecordSchema,
 	MessageRecordSchema,
 	MessageReplacedRecordSchema,
 	OriginSchema,
@@ -1869,6 +1888,23 @@ export {
 	udsPeerAddress,
 	writePeerRecord,
 } from './peers/index.js'
+export {
+	ACCOUNTS_FILE_NAME,
+	ACCOUNTS_FILE_VERSION,
+	AccountLockError,
+	AccountRegistryError,
+	CredentialWithdrawnError,
+	DEFAULT_ACCOUNT_LABEL,
+	accountBoundPayload,
+	accountId,
+	codexRefreshLockPath,
+	createAccountRegistry,
+	parseAccountId,
+	resolveBoundAccount,
+	withAccountLock,
+	withAccountLockSync,
+	withAccountRefreshLock,
+} from './account/index.js'
 export { DiskPalStore, PalConflictError } from './pals/store.js'
 export { PalRuntime, PalUnavailableError } from './pals/runtime.js'
 export { buildPalSystemPrompt, palConversationGreeting } from './pals/prompt.js'

package/src/public-types.ts

@@ -35,6 +35,7 @@ export type * from './types/job/index.js'
 export type * from './execution/workflow/types.js'
 export type { PhaseAgentView, PhaseRecord } from './execution/workflow/phases.js'
 export type { WorkflowRuntimeOptions } from './execution/workflow/runtime.js'
+export type { WorkflowCallIdentity } from './execution/workflow/resume.js'
 export type { WorkerCodeRuntimeOptions } from './execution/code-runtime/worker.js'
 export type {
 	CodeRunOutcome,
@@ -800,6 +801,21 @@ export type {
 	ResolvePeerRuntimeDirOptions,
 } from './peers/dir.js'
 export type { PeerRecord } from './peers/record.js'
+export type { AccountBoundRecord } from './types/session/records.js'
+export type {
+	Account,
+	AccountBoundReason,
+	AccountCredentialReaders,
+	AccountId,
+	AccountLockOptions,
+	AccountLockSyncOptions,
+	AccountRegistry,
+	AccountRegistryOptions,
+	AccountSource,
+	BoundAccount,
+	NewAccount,
+	ResolvedAccountCredential,
+} from './account/index.js'
 export type {
 	ListLivePeersOptions,
 	PeerLivenessOptions,

package/src/registry/command/kernel-commands.ts

@@ -12,14 +12,13 @@ import type { GoalRef, SessionGoal } from '../../types/goal/index.js'
 import type { SessionId, TenantId } from '../../types/ids/index.js'
 import type { Skill } from '../../types/skills/index.js'
 import { isInvocableBy, skillInvocation } from '../../types/skills/index.js'
-import type { TaskStore } from '../../types/task/index.js'
 
 /**
  * The commands whose facts the kernel already owns.
  *
  * A registry with nothing in it is a declaration, and this repo has a rule
  * about those. These are facts a host would otherwise have to reach into
- * kernel internals to answer: the current Session goal, tracked work,
+ * kernel internals to answer: the current Session goal,
  * operator-invocable skills, and the agents this turn may delegate to. Each is
  * computed or owned here and should not acquire a second host-specific source.
  *
@@ -31,8 +30,6 @@ import type { TaskStore } from '../../types/task/index.js'
  */
 
 export interface KernelCommandOptions {
-	/** Absent is a real state — not every turn tracks tasks. */
-	readonly taskStore?: TaskStore
 	readonly allowedAgentIds?: readonly string[]
 	/**
 	 * The turn's skills, for the operator-facing half of the listing.
@@ -263,34 +260,6 @@ export function kernelHostCommands(options: KernelCommandOptions): HostCommandDe
 			hint: GOAL_ARGUMENTS,
 			handler: async ({ args }) => await runGoalCommand(options.goal, args),
 		},
-		{
-			name: 'tasks',
-			description: 'List the work this turn is tracking.',
-			hint: 'id, status, owner and subject for every task in the store',
-			async handler() {
-				// REFUSED rather than an empty report. "There are no tasks" and
-				// "this turn has no task store" are different answers, and a host
-				// that shows the first for the second gives an operator a
-				// confident zero nobody computed.
-				if (!options.taskStore) {
-					return {
-						kind: 'refused',
-						reason: 'This turn has no task store, so there is nothing to list.',
-					}
-				}
-				const tasks = await options.taskStore.list()
-				return {
-					kind: 'report',
-					title: 'Tasks',
-					rows: tasks.map((task) => ({
-						id: task.id,
-						status: task.status,
-						owner: task.owner ?? null,
-						subject: task.subject,
-					})),
-				}
-			},
-		},
 		{
 			name: 'skills',
 			description: 'List the skills an operator may invoke.',

package/src/runtime/jobs/awaited-jobs.ts

@@ -327,6 +327,17 @@ export class AwaitedJobs {
 		this.exits = []
 	}
 
+	/**
+	 * Say that a tool result has handed the model this job's exit and output.
+	 * Its entry goes, so a hold is not opened for a result the model has read;
+	 * the notice for the same exit is withdrawn by the caller.
+	 */
+	collected(id: string): void {
+		this.outstanding.delete(id)
+		this.exits = this.exits.filter((job) => job.id !== id)
+		for (const wake of [...this.arrivals]) wake()
+	}
+
 	/**
 	 * Take the recorded exits together with the text that delivers them, or
 	 * take neither.

package/src/runtime/jobs/host-exit-finalizer.ts

@@ -0,0 +1,67 @@
+import { killTrees } from '../../process/kill-tree.js'
+
+/**
+ * What the host's exit has to stop: a job's process, and how to signal it.
+ */
+export interface HostExitTarget {
+	readonly child: { readonly pid?: number | undefined }
+	/** The spawner's own kill, when it gave one; otherwise the process group is signalled. */
+	readonly kill?: (signal: NodeJS.Signals) => void
+}
+
+const live = new Set<HostExitTarget>()
+let installed = false
+
+/**
+ * Runs when the host process is about to end, by whatever road: `process.exit`,
+ * an uncaught exception, the event loop emptying. It is synchronous on purpose.
+ * An `exit` listener cannot await, so it starts no promise and no timer, signals
+ * each live job with SIGKILL (its own kill when it gave one, then its process
+ * group and any descendant found by the environment tag), and does not wait for any of them
+ * to stop or claim that they have. A job that was already stopped has been
+ * untracked and is not touched.
+ *
+ * It does not cover a SIGKILL of the host itself, which no listener can see.
+ */
+function finalizeAtHostExit(): void {
+	const children: HostExitTarget['child'][] = []
+	for (const target of live) {
+		children.push(target.child)
+		try {
+			target.kill?.('SIGKILL')
+		} catch {
+			// The process is already gone; the host is exiting either way.
+		}
+	}
+	live.clear()
+	try {
+		// One pass over the machine's processes for all the jobs, not one each.
+		// Every job goes through it, whether or not it has a kill of its own, so
+		// a descendant that left the process group is found in both cases.
+		killTrees(children, 'SIGKILL')
+	} catch {
+		// As above.
+	}
+}
+
+/**
+ * Track a running job so the host's exit stops it. Returns the untrack, to be
+ * called once the job has ended. The listener is installed once per process, on
+ * the first job, and is put first so a later listener that throws cannot
+ * keep it from running.
+ */
+export function stopAtHostExit(target: HostExitTarget): () => void {
+	live.add(target)
+	if (!installed) {
+		installed = true
+		process.prependListener('exit', finalizeAtHostExit)
+	}
+	return () => {
+		live.delete(target)
+	}
+}
+
+/** Jobs the host's exit would stop. For tests. */
+export function trackedForHostExit(): number {
+	return live.size
+}

package/src/runtime/jobs/liveness.ts

@@ -0,0 +1,144 @@
+/**
+ * What a host can say about one running item, from three facts it reads
+ * itself: where it is, when it last made progress, and whether it is alive.
+ *
+ * Pure: no clock, no process probe. The caller passes `now` and the probe's
+ * answer, so the same table of cases runs under a fake clock. The kinds
+ * (background job, monitor, delegated agent, workflow run) share one verdict
+ * so the outstanding-work note and every status read print the same words.
+ */
+
+/** Silence shorter than this still reads as progress. */
+export const LIVENESS_QUIET_MS = 30_000
+
+/**
+ * Silence from an item that is alive and has no known reason to wait. The
+ * same number `wait_for_job` uses for its idle bound, so there is one
+ * threshold to explain.
+ */
+export const LIVENESS_STALLED_MS = 2 * 60 * 1000
+
+export type LivenessKind = 'job' | 'monitor' | 'agent' | 'workflow'
+
+export type LivenessVerdict = 'progressing' | 'waiting' | 'stalled' | 'dead' | 'finished'
+
+export interface LivenessInput {
+	readonly kind: LivenessKind
+	readonly id: string
+	/** Short name the person would recognise: a command, a description, a workflow name. */
+	readonly label: string
+	/** Where it is: the last output line, the current tool, the phase. One line, already bounded. */
+	readonly where?: string
+	readonly startedAt: number
+	/** When it last made progress (epoch ms). Absent means it has not yet: the start counts. */
+	readonly lastProgressAt?: number
+	/** The probe's answer: is the process or run still there. */
+	readonly alive: boolean
+	/** A result or an end has arrived. */
+	readonly finished?: boolean
+	/** What it is known to be waiting on, when it is waiting for a reason (a tool, a free slot). */
+	readonly waitingOn?: string
+	readonly waitingSince?: number
+}
+
+export interface Liveness {
+	readonly kind: LivenessKind
+	readonly id: string
+	readonly label: string
+	readonly where?: string
+	readonly verdict: LivenessVerdict
+	/** Whole seconds since the last progress (or the start). */
+	readonly idleSeconds: number
+	/** Whole seconds since it started. */
+	readonly ageSeconds: number
+	/** Present when the verdict is `waiting` with a reason. */
+	readonly waitingOn?: string
+	readonly waitingSeconds?: number
+}
+
+export interface LivenessThresholds {
+	readonly quietMs?: number
+	readonly stalledMs?: number
+}
+
+const seconds = (ms: number): number => Math.max(0, Math.floor(ms / 1000))
+
+/** Decide the verdict. Order matters: a result beats everything, then death, then the reason to wait. */
+export function judgeLiveness(
+	input: LivenessInput,
+	now: number,
+	thresholds: LivenessThresholds = {},
+): Liveness {
+	const quietMs = thresholds.quietMs ?? LIVENESS_QUIET_MS
+	const stalledMs = thresholds.stalledMs ?? LIVENESS_STALLED_MS
+	const last = Math.max(input.startedAt, input.lastProgressAt ?? input.startedAt)
+	const idle = Math.max(0, now - last)
+	let verdict: LivenessVerdict
+	if (input.finished) verdict = 'finished'
+	else if (!input.alive) verdict = 'dead'
+	else if (input.waitingOn !== undefined) verdict = 'waiting'
+	else if (idle >= stalledMs) verdict = 'stalled'
+	else if (idle >= quietMs) verdict = 'waiting'
+	else verdict = 'progressing'
+	const waitingOn =
+		verdict === 'waiting' && input.waitingOn !== undefined ? input.waitingOn : undefined
+	const waitingSince = input.waitingSince ?? last
+	return {
+		kind: input.kind,
+		id: input.id,
+		label: input.label,
+		...(input.where !== undefined ? { where: input.where } : {}),
+		verdict,
+		idleSeconds: seconds(idle),
+		ageSeconds: seconds(now - input.startedAt),
+		...(waitingOn !== undefined ? { waitingOn, waitingSeconds: seconds(now - waitingSince) } : {}),
+	}
+}
+
+/** `45s`, `3m 05s`, `1h 02m`: short, for a line a person or the model reads. */
+export function formatLivenessAge(totalSeconds: number): string {
+	const s = Math.max(0, Math.floor(totalSeconds))
+	if (s < 60) return `${s}s`
+	const m = Math.floor(s / 60)
+	if (m < 60) return `${m}m ${String(s % 60).padStart(2, '0')}s`
+	return `${Math.floor(m / 60)}h ${String(m % 60).padStart(2, '0')}m`
+}
+
+function oneLine(text: string, max: number): string {
+	const flat = text.replace(/\s+/g, ' ').trim()
+	return flat.length <= max ? flat : `${flat.slice(0, max - 1)}…`
+}
+
+const LABEL_MAX = 80
+const WHERE_MAX = 120
+
+/**
+ * One line per item, the same for the note and for the list reads:
+ * `job b1a2 "npm test" - progressing - last progress 4s ago - at: compiling`.
+ * Everything free-form is clipped and flattened; the line carries data, not
+ * instructions.
+ */
+export function formatLivenessLine(item: Liveness): string {
+	const parts = [`${item.kind} ${item.id} "${oneLine(item.label, LABEL_MAX)}"`]
+	if (item.verdict === 'waiting' && item.waitingOn !== undefined) {
+		parts.push(
+			`waiting on ${oneLine(item.waitingOn, LABEL_MAX)} for ${formatLivenessAge(item.waitingSeconds ?? item.idleSeconds)}`,
+		)
+	} else if (item.verdict === 'finished') {
+		parts.push(`finished after ${formatLivenessAge(item.ageSeconds)}`)
+	} else if (item.verdict === 'dead') {
+		parts.push(
+			`dead: gone without a result after ${formatLivenessAge(item.ageSeconds)}, last progress ${formatLivenessAge(item.idleSeconds)} ago`,
+		)
+	} else {
+		parts.push(item.verdict)
+		parts.push(
+			item.idleSeconds === 0
+				? 'last progress just now'
+				: `last progress ${formatLivenessAge(item.idleSeconds)} ago`,
+		)
+	}
+	if (item.where !== undefined && item.where.length > 0)
+		parts.push(`at: ${oneLine(item.where, WHERE_MAX)}`)
+	return parts.join(' - ')
+}