@peakflo/agent-harness 0.2.10-rc.1 → 0.2.10-rc.3

package/dist/runtime/session-runner.js

@@ -21,6 +21,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionRunner = void 0;
+exports.approvalTimeoutMs = approvalTimeoutMs;
 exports.qualifiedModelId = qualifiedModelId;
 exports.describeProviderError = describeProviderError;
 exports.withoutGatewayForVendorBackend = withoutGatewayForVendorBackend;
@@ -43,10 +44,36 @@ const permission_mode_1 = require("./permission-mode");
 const projection_1 = require("./projection");
 const space_files_1 = require("./space-files");
 const task_files_1 = require("./task-files");
+/** The virtual key keeps spend out of URLs and logs. */
+async function readGatewaySpend(baseUrl, key) {
+    try {
+        const response = await fetch(new URL('/key/info', baseUrl), {
+            headers: { Authorization: `Bearer ${key}` },
+            signal: AbortSignal.timeout(5_000)
+        });
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        const spend = data.info?.spend;
+        return typeof spend === 'number' && Number.isFinite(spend) && spend >= 0
+            ? spend
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** A missing Pi consumption event must not hold the lease open for its full RPC timeout. */
 const FINAL_STEER_ACK_WAIT_MS = 5_000;
 /** How often the runner asks the adapter for new output when nothing pushes. */
 const POLL_INTERVAL_MS = 2_000;
+const DEFAULT_APPROVAL_TIMEOUT_MS = 30 * 60_000;
+function approvalTimeoutMs(value) {
+    const minutes = Number(value);
+    return Number.isFinite(minutes) && minutes > 0
+        ? Math.min(minutes * 60_000, 24 * 60 * 60_000)
+        : DEFAULT_APPROVAL_TIMEOUT_MS;
+}
 /**
  * How long an idle status must persist before the turn is considered over.
  *
@@ -576,6 +603,7 @@ class SessionRunner {
     openApproval = null;
     /** The transcript identity of an ordinary agent question, if one is open. */
     openQuestionPartId = null;
+    openQuestionStartedAt = null;
     /**
      * Expiry of the model token THIS RUNNING BACKEND is holding, when the
      * control plane reported one — see `LeaseResponse.modelTokenExpiresAt`.
@@ -649,6 +677,7 @@ class SessionRunner {
         let partsProduced = 0;
         let stopReason = 'completed';
         let error;
+        let gatewaySpendBefore = null;
         let repositoryStatuses = [];
         /** True when the backend session was resumed rather than created. */
         let resumed = false;
@@ -680,6 +709,11 @@ class SessionRunner {
             const refusal = modelGatewayRefusal(lease);
             if (refusal)
                 throw new Error(refusal);
+            if (session.agent.model.gatewayUrl && lease.modelToken) {
+                gatewaySpendBefore = await readGatewaySpend(session.agent.model.gatewayUrl, lease.modelToken);
+                if (gatewaySpendBefore === null)
+                    this.logger.warn(`[coding-agent] Gateway spend start unavailable for turn ${session.turnId}; this turn cannot be debited from gateway usage`);
+            }
             // The catalogue is advisory. Fetch it while the independent workspace
             // is prepared. Pi can start with the selected lease model while this
             // request fills the cache for a later turn. OpenCode still waits for
@@ -1199,6 +1233,10 @@ class SessionRunner {
                     }
                 ]);
             }
+            else if (drained.approvalTimedOut) {
+                stopReason = 'approval_timeout';
+                error = drained.approvalTimedOutMessage;
+            }
             else if (drained.timedOut) {
                 // THE LAST-LINE CEILING, and only reached when an operator has
                 // actually configured `CODING_AGENT_MAX_TURN_MINUTES` — the default
@@ -1318,6 +1356,16 @@ class SessionRunner {
              * that cannot remember the previous sentence.
              */
         }
+        let costUsd;
+        if (gatewaySpendBefore !== null &&
+            session.agent.model.gatewayUrl &&
+            lease.modelToken) {
+            const spendAfter = await readGatewaySpend(session.agent.model.gatewayUrl, lease.modelToken);
+            if (spendAfter === null)
+                this.logger.warn(`[coding-agent] Gateway spend end unavailable for turn ${session.turnId}; this turn cannot be debited from gateway usage`);
+            else
+                costUsd = Math.max(0, spendAfter - gatewaySpendBefore);
+        }
         const turn = {
             turnId: session.turnId,
             startedAt,
@@ -1325,6 +1373,7 @@ class SessionRunner {
             model: session.agent.model.model,
             stopReason,
             error,
+            costUsd,
             repositories: repositoryStatuses.length > 0 ? repositoryStatuses : undefined,
             // The checkpoint travels on the final ingest because the final ingest is
             // the ONE message guaranteed to be sent — it is what releases the lease,
@@ -1485,6 +1534,8 @@ class SessionRunner {
         let timedOut = false;
         let idleTimedOut = false;
         let idleTimedOutMessage;
+        let approvalTimedOut = false;
+        let approvalTimedOutMessage;
         const seenMessageIds = new Set();
         const seenPartIds = new Set(alreadySeenPartIds);
         const partContentLengths = new Map();
@@ -1529,6 +1580,61 @@ class SessionRunner {
         try {
             while (!signal.aborted) {
                 const now = Date.now();
+                const approvalLimitMs = approvalTimeoutMs(process.env.CODING_AGENT_APPROVAL_TIMEOUT_MINUTES);
+                if (this.openApproval &&
+                    this.approvalWaitStartedAt !== null &&
+                    now - this.approvalWaitStartedAt >= approvalLimitMs) {
+                    const open = this.openApproval;
+                    const capable = adapter;
+                    // Close first so a late answer cannot approve the timed-out action.
+                    this.closeApproval(session.sessionId);
+                    let denialTimer;
+                    try {
+                        if (capable.respondToApproval) {
+                            await Promise.race([
+                                capable.respondToApproval(backendSessionId, false),
+                                new Promise((resolveTimeout) => {
+                                    denialTimer = setTimeout(resolveTimeout, 5_000);
+                                })
+                            ]);
+                        }
+                    }
+                    catch (approvalError) {
+                        this.logger.warn(`[SessionRunner] approval timeout denial failed for ${session.sessionId}: ${String(approvalError)}`);
+                    }
+                    finally {
+                        if (denialTimer)
+                            clearTimeout(denialTimer);
+                    }
+                    approvalTimedOut = true;
+                    approvalTimedOutMessage = `Approval denied after ${formatMinutes(approvalLimitMs)} without an answer. Turn stopped.`;
+                    this.record(session.sessionId, [
+                        {
+                            id: `answer-${open.toolCallId}`,
+                            role: 'system',
+                            partType: 'text',
+                            content: `Denied: ${approvalTimedOutMessage}`
+                        }
+                    ]);
+                    break;
+                }
+                if (this.openQuestionPartId &&
+                    this.openQuestionStartedAt !== null &&
+                    now - this.openQuestionStartedAt >= approvalLimitMs) {
+                    const questionId = this.openQuestionPartId;
+                    this.closeQuestion(session.sessionId);
+                    approvalTimedOut = true;
+                    approvalTimedOutMessage = `Question closed after ${formatMinutes(approvalLimitMs)} without an answer. Turn stopped.`;
+                    this.record(session.sessionId, [
+                        {
+                            id: `answer-${questionId.replace(/^question-/, '')}`,
+                            role: 'system',
+                            partType: 'text',
+                            content: approvalTimedOutMessage
+                        }
+                    ]);
+                    break;
+                }
                 // Historical approval wait PLUS whatever approval is open right now.
                 // Added to both the hard deadline and, below, the idle window — a
                 // turn stopped to ask a person something is blocked on them, not
@@ -1644,7 +1750,8 @@ class SessionRunner {
                     // Last one wins: a retry that also fails should report its own reason.
                     providerError = status.message;
                 }
-                const quiet = status.type === 'idle' || status.type === 'error';
+                const quiet = (status.type === 'idle' || status.type === 'error') &&
+                    !this.isAwaitingApproval();
                 idleSeen = quiet ? idleSeen + 1 : 0;
                 if (idleSeen >= IDLE_CONFIRMATIONS) {
                     break;
@@ -1667,20 +1774,16 @@ class SessionRunner {
                  * and the turn cut as `no_progress` in the same tick, before the
                  * person it was raised for ever sees it.
                  *
-                 * TODO(approval TTL): an approval left open suppresses BOTH this
-                 * guard and the hard ceiling for as long as it stays open — by
-                 * design, since a slow human must never read as a hung backend, but
-                 * that means an approval nobody ever answers can hold a turn open
-                 * indefinitely today. Pre-existing behaviour (unrelated to the LONG
-                 * TURNS fix), not changed here; a bounded approval wait — after
-                 * which the turn ends on its own rather than waiting forever — is a
-                 * real follow-up, not implemented in this PR.
+                 * Approval time is excluded from the idle and hard limits. The
+                 * separate approval limit above ends an unanswered request.
                  */
                 const approvalWaitSinceProgress = this.approvalWaitMs -
                     approvalWaitAtLastProgress +
                     this.liveApprovalWaitMs();
                 const idleElapsed = Date.now() - lastProgressAt - approvalWaitSinceProgress;
-                if (this.approvalWaitStartedAt === null && idleElapsed > idleLimitMs) {
+                if (this.approvalWaitStartedAt === null &&
+                    this.openQuestionPartId === null &&
+                    idleElapsed > idleLimitMs) {
                     this.logger.warn(`[SessionRunner] session ${session.sessionId} had no progress for ` +
                         `${Math.round(idleElapsed / 1000)}s (limit ${Math.round(idleLimitMs / 1000)}s)`);
                     idleTimedOut = true;
@@ -1720,7 +1823,7 @@ class SessionRunner {
                 await this.flush(session.sessionId, this.pending.splice(0), undefined, false);
             }
         }
-        if (signal.aborted || timedOut || idleTimedOut) {
+        if (signal.aborted || timedOut || idleTimedOut || approvalTimedOut) {
             try {
                 await adapter.abortPrompt(backendSessionId, config);
             }
@@ -1733,7 +1836,9 @@ class SessionRunner {
             providerError,
             timedOut,
             idleTimedOut,
-            idleTimedOutMessage
+            idleTimedOutMessage,
+            approvalTimedOut,
+            approvalTimedOutMessage
         };
     }
     /**
@@ -1783,9 +1888,8 @@ class SessionRunner {
     /* ---------------------------------------------------------------- */
     /** Wall-clock spent in the approval we are in RIGHT NOW, if any. */
     liveApprovalWaitMs() {
-        return this.approvalWaitStartedAt === null
-            ? 0
-            : Date.now() - this.approvalWaitStartedAt;
+        const startedAt = this.approvalWaitStartedAt ?? this.openQuestionStartedAt;
+        return startedAt === null ? 0 : Date.now() - startedAt;
     }
     /**
      * WIRE 2. Turn a pending backend permission into a `question` transcript part.
@@ -1978,7 +2082,11 @@ class SessionRunner {
     }
     closeQuestion(sessionId) {
         if (this.openQuestionPartId) {
+            if (this.openQuestionStartedAt !== null) {
+                this.approvalWaitMs += Date.now() - this.openQuestionStartedAt;
+            }
             this.openQuestionPartId = null;
+            this.openQuestionStartedAt = null;
             this.deps.onApprovalStateChange?.(sessionId, false);
         }
     }
@@ -2158,6 +2266,7 @@ class SessionRunner {
                 part.id !== this.openApproval?.partId &&
                 this.openQuestionPartId !== part.id) {
                 this.openQuestionPartId = part.id;
+                this.openQuestionStartedAt = Date.now();
                 this.deps.onApprovalStateChange?.(sessionId, true);
             }
         }

package/dist/service.d.ts

@@ -0,0 +1,57 @@
+type Platform = NodeJS.Platform;
+type Run = (file: string, args: string[]) => string;
+interface ServiceConfig {
+    startArgs: string[];
+    nodePath: string;
+    cliPath: string;
+    path: string;
+}
+export interface ServiceContext {
+    nodePath: string;
+    cliPath: string;
+    env: NodeJS.ProcessEnv;
+    home?: string;
+    platform?: Platform;
+    uid?: number;
+    run?: Run;
+    output?: (message: string) => void;
+    sleep?: (ms: number) => void;
+    portOccupied?: (port: number) => Promise<boolean>;
+}
+export declare function permanentServiceExitCode(platform: Platform, linuxCode: 2 | 78): number;
+/** Only failures that a restart cannot repair belong in this list. */
+export declare function permanentStartupFailure(error: unknown): string | null;
+/** Existing service files use --stored-credential; new ones also use --service. */
+export declare function isServiceStart(argv: string[]): boolean;
+/** Parse only documented start options. A token can never enter service state. */
+export declare function serviceStartArgs(input: string[], env: NodeJS.ProcessEnv, home: string): string[];
+export declare function renderLaunchAgent(config: ServiceConfig, logDir: string): string;
+export declare function renderSystemdUnit(config: ServiceConfig): string;
+export declare function recordServiceFailure(reason: string, home?: string): void;
+export declare function clearServiceFailure(home?: string): void;
+export declare class ServiceManager {
+    private readonly context;
+    private readonly home;
+    private readonly platform;
+    private readonly run;
+    private readonly output;
+    private readonly stateFile;
+    private readonly serviceFile;
+    private readonly logDir;
+    constructor(context: ServiceContext);
+    private supported;
+    private readConfig;
+    private checkCredential;
+    private writeAndStart;
+    install(input: string[]): Promise<void>;
+    private checkNodeVersion;
+    repair(): void;
+    assertNoDuplicateRunner(options: {
+        workspaceRoot: string;
+        healthPort: number;
+    }): void;
+    status(): void;
+    uninstall(): void;
+}
+export declare function runServiceCommand(args: string[], context: ServiceContext): Promise<void>;
+export {};