@relayflows/sdk 2.0.26 → 2.0.28

package/src/preflight.ts

@@ -395,7 +395,9 @@ function unknownModelDiagnostics(
       stepId: step.id,
       ...(resolution === undefined ? {} : { cli: resolution.cli }),
       model,
-      message: unknownModelMessage(step.id, model, resolution?.cli, options.modelRegistryPath),
+      message: unknownModelMessage(
+        step.id, model, resolution?.cli, options.modelRegistryPath, resolution?.modelSource,
+      ),
     });
   }
 
@@ -418,15 +420,46 @@ function isKnownModel(model: string, models: readonly string[] | undefined): boo
   return models?.includes(model) === true;
 }
 
+/**
+ * Attribute an effective model to where its value actually came from. Only a
+ * `step` value was written on the step; saying "declares" about an adapter
+ * default sends the reader looking for a `model:` key that is not there.
+ */
+function describeEffectiveModel(
+  stepId: string,
+  model: string,
+  cli: string,
+  modelSource: CliModelSource | undefined,
+): string {
+  if (modelSource === 'adapter') {
+    return `Step "${stepId}" declares no model; the default for CLI "${cli}" is "${model}"`;
+  }
+  if (modelSource === 'named') {
+    return `Step "${stepId}" uses model "${model}" from its named agent for CLI "${cli}"`;
+  }
+  return `Step "${stepId}" declares model "${model}" for CLI "${cli}"`;
+}
+
 function unknownModelMessage(
   stepId: string,
   model: string,
   cli: string | undefined,
   registryPath: string | undefined,
+  modelSource: CliModelSource | undefined,
 ): string {
   const source = registryPath === undefined
     ? 'the nearest project config (no model registry was found)'
     : `project model registry "${registryPath}"`;
+  if (modelSource === 'adapter' && cli !== undefined) {
+    // Registry policy still governs a default — it is the model that will run
+    // — but the remedy has to name the value the author never typed, and the
+    // second way out: declaring a model the registry already allows.
+    const add = registryPath === undefined
+      ? 'add the exact model'
+      : `add the exact model to "models" in "${registryPath}"`;
+    return `${describeEffectiveModel(stepId, model, cli, modelSource)}, which is not listed in ${source}; `
+      + `${add} only after verifying that project is allowed to use it, or declare an allowed model on the step.`;
+  }
   const cliContext = cli === undefined ? '' : ` for CLI "${cli}"`;
   return `Step "${stepId}" declares model "${model}"${cliContext}, but it is not listed in ${source}; add the exact model only after verifying that project is allowed to use it.`;
 }
@@ -545,7 +578,9 @@ function probeResolvedCli(
       stepId: resolution.stepId,
       cli: resolution.cli,
       model: resolution.model,
-      message: `Step "${resolution.stepId}" declares model "${resolution.model}" for CLI "${resolution.cli}", but its model-scoped "${result.modelCommand ?? `${resolution.cli} auth status`}" probe exited non-zero; verify the model name and this credential's access.`,
+      message: describeEffectiveModel(resolution.stepId, resolution.model, resolution.cli, resolution.modelSource)
+        + `, but its model-scoped "${result.modelCommand ?? `${resolution.cli} auth status`}" probe exited non-zero;`
+        + ` verify the model name and this credential's access.`,
     });
   }
 }

package/src/promise-ancestry.ts

@@ -0,0 +1,98 @@
+/**
+ * Which of a fixed set of `targets` each of `starts` can reach by following
+ * `edgesOf` — the batch form of asking `dependsOn(start, target)` for every
+ * pair, with the same answer (a node reaches itself).
+ *
+ * The completion gate used to ask that pair-by-pair, re-walking each start's
+ * whole ancestry every time: operations × combinator members × tracked
+ * promises. A flow of ~110 steps whose agents ran for twenty minutes produced
+ * enough tracked promises (journal polling while each step waited) that the
+ * gate ran for three minutes without yielding, starving the root's lease
+ * renewal until the run was reaped as crashed.
+ *
+ * Here the upward closure of every start is visited once, cycles (a promise
+ * resolved from a context created after it) are condensed with an iterative
+ * Tarjan pass, and target sets flow as bitsets from ancestors to descendants
+ * in the order Tarjan emits components. Cost is O((V + E) · ⌈T / 32⌉) for the
+ * visited subgraph, whatever the number of starts.
+ */
+export function reachableTargets(
+  starts: readonly number[],
+  targets: readonly number[],
+  edgesOf: (node: number) => readonly number[],
+): Map<number, ReadonlySet<number>> {
+  const bit = new Map<number, number>();
+  for (const target of targets) if (!bit.has(target)) bit.set(target, bit.size);
+  const words = Math.max(1, Math.ceil(bit.size / 32));
+
+  const index = new Map<number, number>();
+  const low = new Map<number, number>();
+  const onStack = new Set<number>();
+  const stack: number[] = [];
+  const component = new Map<number, number>();
+  const labels: Uint32Array[] = [];
+
+  const closeComponent = (root: number): void => {
+    const label = new Uint32Array(words);
+    const members: number[] = [];
+    let member: number;
+    do {
+      member = stack.pop()!;
+      onStack.delete(member);
+      members.push(member);
+    } while (member !== root);
+    const id = labels.length;
+    for (const node of members) component.set(node, id);
+    for (const node of members) {
+      const own = bit.get(node);
+      if (own !== undefined) label[own >>> 5]! |= 1 << (own & 31);
+      // Every edge leaving the component points at one Tarjan already closed.
+      for (const edge of edgesOf(node)) {
+        const target = component.get(edge);
+        if (target === undefined || target === id) continue;
+        const inherited = labels[target]!;
+        for (let word = 0; word < words; word++) label[word]! |= inherited[word]!;
+      }
+    }
+    labels.push(label);
+  };
+
+  // Iterative Tarjan: a deep promise chain must not overflow the JS stack.
+  for (const start of starts) {
+    if (index.has(start)) continue;
+    const frames: Array<{ node: number; edges: readonly number[]; next: number }> = [];
+    const open = (node: number): void => {
+      index.set(node, index.size);
+      low.set(node, index.get(node)!);
+      stack.push(node);
+      onStack.add(node);
+      frames.push({ node, edges: edgesOf(node), next: 0 });
+    };
+    open(start);
+    while (frames.length > 0) {
+      const frame = frames.at(-1)!;
+      if (frame.next < frame.edges.length) {
+        const edge = frame.edges[frame.next++]!;
+        if (!index.has(edge)) open(edge);
+        else if (onStack.has(edge)) low.set(frame.node, Math.min(low.get(frame.node)!, index.get(edge)!));
+        continue;
+      }
+      frames.pop();
+      const parent = frames.at(-1);
+      if (parent !== undefined) low.set(parent.node, Math.min(low.get(parent.node)!, low.get(frame.node)!));
+      if (low.get(frame.node) === index.get(frame.node)) closeComponent(frame.node);
+    }
+  }
+
+  const reached = new Map<number, ReadonlySet<number>>();
+  for (const start of starts) {
+    if (reached.has(start)) continue;
+    const label = labels[component.get(start)!]!;
+    const found = new Set<number>();
+    for (const [target, position] of bit) {
+      if ((label[position >>> 5]! & (1 << (position & 31))) !== 0) found.add(target);
+    }
+    reached.set(start, found);
+  }
+  return reached;
+}

package/src/validate.ts

@@ -486,6 +486,13 @@ class Validator {
     }
     this.validateCli(st.cli, at);
     this.validateModel(st.model, at);
+    // The kernel refuses a relative cwd at run.start; refuse it here so `flows
+    // check` and the run agree. Not resolved against the checking directory:
+    // that would make the compiled spec (and its hash) depend on where the
+    // check ran. `f.agent` resolves before compiling, so it never lands here.
+    if (st.cwd !== undefined && (!isNonEmptyString(st.cwd) || !st.cwd.startsWith('/'))) {
+      this.fail(`${at}.cwd: expected an absolute path (got ${JSON.stringify(st.cwd)})`);
+    }
     if (st.surfaces !== undefined) this.validateSurfaces(st.surfaces, `${at}.surfaces`);
     if (st.permissions !== undefined) this.validatePermissions(st.permissions, `${at}.permissions`);
   }

package/src/worker-cli.ts

@@ -1,5 +1,5 @@
 import { realpathSync } from 'node:fs';
-import { resolve, sep } from 'node:path';
+import { basename, dirname, join, resolve, sep } from 'node:path';
 import { diffWorkspaceFiles, snapshotWorkspaceFiles } from './agent-artifacts.js';
 import { claudeResultOutcome, decodeProviderResult, decodeWrapperResult, requirePricedUsage } from './worker-usage.js';
 import { openSidechannel, type SidechannelContext } from './pty-sidechannel.js';
@@ -121,7 +121,7 @@ export async function runAgentCli(
   const artifactRoot = mode === 'agent' ? resolve(cwd ?? process.cwd()) : undefined;
   return artifactRoot === undefined
     ? execute()
-    : serializedByDirectory(artifactRoot, async () => {
+    : serializedByDirectory(canonicalTree(artifactRoot), async () => {
       const before = await snapshotWorkspaceFiles(artifactRoot);
       const result = await execute();
       const kernelData = sidechannel === undefined ? undefined : realPath(resolve(sidechannel.dataDir));
@@ -214,20 +214,52 @@ function under(path: string | undefined, directory: string | undefined): boolean
   return path === directory || path.startsWith(directory.endsWith(sep) ? directory : directory + sep);
 }
 
+/**
+ * Symlink-free form of an absolute path that may not exist yet: the deepest
+ * existing ancestor is resolved and the missing tail is kept. A plain
+ * `realPath` fallback would leave `/link/new` unresolved while `/link`
+ * resolves, and the overlap check would then treat them as disjoint trees.
+ */
+export function canonicalTree(path: string): string {
+  const missing: string[] = [];
+  let current = path;
+  for (;;) {
+    try {
+      return join(realpathSync(current), ...missing.reverse());
+    } catch {
+      const parent = dirname(current);
+      if (parent === current) return path;
+      missing.push(basename(current));
+      current = parent;
+    }
+  }
+}
+
 /** Symlink-free form of a path, or the path itself when it cannot be resolved. */
 function realPath(path: string | undefined): string | undefined {
   if (path === undefined) return undefined;
   try { return realpathSync(path); } catch { return path; }
 }
 
-/** One agent at a time per canonical working directory, for the artifact interval. */
-const directoryQueues = new Map<string, Promise<unknown>>();
+/**
+ * One agent at a time per overlapping working tree, for the artifact interval.
+ *
+ * `directory` must be canonical (symlink-free): `/repo` and a `/tmp/link` to it
+ * are one tree. Two trees overlap when one contains the other, because the
+ * snapshot walks the whole subtree — an agent in `/repo` would otherwise be
+ * credited with files an agent in `/repo/.wt/api` wrote meanwhile. Disjoint
+ * trees (sibling worktrees) run side by side. Each run waits for every
+ * earlier-registered overlapping run, so order within an overlap is arrival.
+ */
+const directoryRuns = new Set<{ readonly directory: string; readonly settled: Promise<void> }>();
 function serializedByDirectory<T>(directory: string, task: () => Promise<T>): Promise<T> {
-  const previous = directoryQueues.get(directory) ?? Promise.resolve();
-  const run = previous.then(task, task);
-  const settled = run.then(() => undefined, () => undefined);
-  directoryQueues.set(directory, settled);
-  void settled.then(() => { if (directoryQueues.get(directory) === settled) directoryQueues.delete(directory); });
+  const blockers = [...directoryRuns]
+    .filter(other => under(other.directory, directory) || under(directory, other.directory))
+    .map(other => other.settled);
+  const run = Promise.all(blockers).then(task);
+  const entry = { directory, settled: run.then(() => undefined, () => undefined) };
+  directoryRuns.add(entry);
+  void entry.settled.then(() => { directoryRuns.delete(entry); });
   return run;
 }
 

package/src/worker-slots.ts

@@ -0,0 +1,92 @@
+/** The local agent worker's default concurrency, and the ceiling `--agent-capacity` accepts. */
+export const DEFAULT_LOCAL_AGENT_CAPACITY = 4;
+export const MAX_LOCAL_AGENT_CAPACITY = 32;
+
+/** A positive integer no larger than the ceiling; anything else is not a capacity. */
+export function isAgentCapacity(value: unknown): value is number {
+  return Number.isInteger(value) && (value as number) >= 1 && (value as number) <= MAX_LOCAL_AGENT_CAPACITY;
+}
+
+/**
+ * First-come admission to a worker that holds `capacity` dispatches at once.
+ *
+ * The kernel never queues a step for a busy worker: an attempt with no worker
+ * below capacity parks the run ("no worker is attached for step type …"). An
+ * authored body opens one child run per `f.agent`/`f.llm`, so `Promise.all`
+ * over more calls than the worker holds would park the overflow. Holding the
+ * overflow here, before `run.start`, keeps the kernel's admission exact and
+ * turns "too many at once" into "wait for a slot".
+ */
+export class WorkerSlots {
+  private held = 0;
+  private readonly waiting: Array<{ resolve: () => void; reject: (reason: unknown) => void }> = [];
+  private closed: { readonly reason: unknown } | undefined;
+
+  constructor(readonly capacity: number) {
+    if (!isAgentCapacity(capacity)) throw new RangeError(`worker capacity must be an integer from 1 to ${MAX_LOCAL_AGENT_CAPACITY} (got ${capacity})`);
+  }
+
+  async run<T>(work: () => Promise<T>): Promise<T> {
+    if (this.closed !== undefined) throw this.closed.reason;
+    if (this.held < this.capacity) this.held++;
+    // A released slot is handed straight to the next waiter, so `held` never
+    // dips below capacity while anyone is queued and no later caller can jump it.
+    else {
+      await new Promise<void>((resolve, reject) => this.waiting.push({ resolve, reject }));
+      // Woken with the slot, but the body may have failed in between (see release).
+      const closed = this.closedReason();
+      if (closed !== undefined) {
+        this.release();
+        throw closed.reason;
+      }
+    }
+    try {
+      return await work();
+    } finally {
+      this.release();
+    }
+  }
+
+  /** Read through a call so a check after an `await` is not narrowed away. */
+  private closedReason(): { readonly reason: unknown } | undefined {
+    return this.closed;
+  }
+
+  /**
+   * Hand the slot to the next waiter on a later macrotask, not synchronously.
+   * When the work that held it rejected and that rejection fails the body, the
+   * failure reaches `close` through microtasks only (operation → Promise.all →
+   * body → executor). Waking the waiter synchronously let it admit a child run
+   * before `close` could refuse it; deferring lets the teardown land first.
+   */
+  private release(): void {
+    const next = this.waiting.shift();
+    if (next === undefined) {
+      this.held--;
+      return;
+    }
+    setImmediate(() => {
+      if (this.closed === undefined) {
+        next.resolve();
+        return;
+      }
+      // Closed meanwhile. `close` could not see this waiter (already taken off
+      // the queue), so refuse it here, and pass the slot on instead of leaking it.
+      next.reject(this.closed.reason);
+      this.release();
+    });
+  }
+
+  /**
+   * Refuse every queued and future admission with `reason`; work already
+   * holding a slot is not interrupted. The authored body calls this when it
+   * fails: a queued call is already `running` as an operation, so operation
+   * cancellation cannot reach it, and without this it would still be admitted
+   * and run after the flow had failed.
+   */
+  close(reason: unknown): void {
+    if (this.closed !== undefined) return;
+    this.closed = { reason };
+    for (const waiter of this.waiting.splice(0)) waiter.reject(reason);
+  }
+}