@remnic/core 10.0.35 → 10.0.37

package/src/storage-buffer-sessions.test.ts

@@ -0,0 +1,369 @@
+/**
+ * Per-session buffer persistence (storage layer).
+ *
+ * The legacy buffer persistence rewrote the WHOLE state/buffer.json — every
+ * session's turns — on every buffer save, which on long-running daemons meant
+ * serializing 100+ MB per observe. These tests pin the replacement contract:
+ *
+ *   - one file per session under `<memoryDir>/state/buffer/`,
+ *   - incremental `saveBufferSession` / `deleteBufferSession` for the hot path,
+ *   - whole-state `saveBuffer` as a full reconcile (used at correctness
+ *     boundaries and by legacy callers),
+ *   - one-time migration from the legacy single-file format, safe when a crash
+ *     lands mid-migration (per-session file wins over the legacy snapshot),
+ *   - per-session writes do NOT run the heavyweight `ensureDirectories()`
+ *     pass (the realpath/lstat storm) — they mkdir only what the write needs.
+ */
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, readdir, readFile, rm, stat, symlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { SecureStoreDecryptError } from "./secure-store/secure-fs.js";
+import { StorageManager } from "./storage.js";
+import { bufferSessionFileName } from "./storage/buffer-session-files.js";
+import type { BufferEntryState, BufferState } from "./types.js";
+
+async function tempRoot(prefix: string): Promise<string> {
+  return mkdtemp(path.join(os.tmpdir(), `${prefix}-`));
+}
+
+function makeEntry(turnContent: string, extractionCount = 0): BufferEntryState {
+  return {
+    turns: [
+      {
+        role: "user",
+        content: turnContent,
+        timestamp: "2026-10-29T12:00:00.000Z",
+        sessionKey: "session-a",
+      },
+    ],
+    lastExtractionAt: extractionCount > 0 ? "2026-10-29T12:01:00.000Z" : null,
+    extractionCount,
+  };
+}
+
+test("saveBufferSession writes one file per session and loadBuffer reads it back", async () => {
+  const root = await tempRoot("bufio-sessions");
+  try {
+    const storage = new StorageManager(root);
+    await storage.saveBufferSession("session-a", makeEntry("alpha fact"));
+
+    const bufferDir = path.join(root, "state", "buffer");
+    const names = await readdir(bufferDir);
+    assert.equal(names.length, 1, `expected exactly one session file, got ${names.join(",")}`);
+
+    const state = await storage.loadBuffer();
+    assert.equal(state.entries?.["session-a"]?.turns.length, 1);
+    assert.equal(state.entries?.["session-a"]?.turns[0]?.content, "alpha fact");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("saving session B leaves session A's file byte-identical", async () => {
+  const root = await tempRoot("bufio-isolation");
+  try {
+    const storage = new StorageManager(root);
+    await storage.saveBufferSession("session-a", makeEntry("alpha fact"));
+    const dir = path.join(root, "state", "buffer");
+    const [aName] = await readdir(dir);
+    const before = await readFile(path.join(dir, aName));
+    const beforeStat = await stat(path.join(dir, aName));
+
+    await storage.saveBufferSession("session-b", makeEntry("beta fact"));
+    const after = await readFile(path.join(dir, aName));
+    const afterStat = await stat(path.join(dir, aName));
+    assert.deepEqual(after, before, "session A file content changed when session B was saved");
+    assert.equal(afterStat.mtimeMs, beforeStat.mtimeMs, "session A file was rewritten when session B was saved");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("deleteBufferSession removes the file and loadBuffer drops the session", async () => {
+  const root = await tempRoot("bufio-delete");
+  try {
+    const storage = new StorageManager(root);
+    await storage.saveBufferSession("session-a", makeEntry("alpha fact"));
+    await storage.deleteBufferSession("session-a");
+    const state = await storage.loadBuffer();
+    assert.equal(state.entries?.["session-a"], undefined);
+    // Deleting an absent session is a no-op, not a throw (idempotent cleanup).
+    await storage.deleteBufferSession("session-a");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("legacy state/buffer.json migrates to per-session files exactly once", async () => {
+  const root = await tempRoot("bufio-migrate");
+  try {
+    const stateDir = path.join(root, "state");
+    await mkdir(stateDir, { recursive: true });
+    const legacy: BufferState = {
+      turns: [{ role: "user", content: "default turn", timestamp: "2026-10-29T12:00:00.000Z", sessionKey: "default" }],
+      lastExtractionAt: null,
+      extractionCount: 2,
+      entries: {
+        default: {
+          turns: [{ role: "user", content: "default turn", timestamp: "2026-10-29T12:00:00.000Z", sessionKey: "default" }],
+          lastExtractionAt: null,
+          extractionCount: 2,
+        },
+        "session-a": makeEntry("alpha fact"),
+      },
+    };
+    await writeFile(path.join(stateDir, "buffer.json"), JSON.stringify(legacy), "utf8");
+
+    const storage = new StorageManager(root);
+    const loaded = await storage.loadBuffer();
+    assert.equal(loaded.entries?.["session-a"]?.turns[0]?.content, "alpha fact");
+    assert.equal(loaded.entries?.default?.extractionCount, 2);
+
+    // Migration is materialized: per-session files exist, the legacy file is gone.
+    const names = await readdir(path.join(stateDir, "buffer"));
+    assert.equal(names.filter((n) => n.endsWith(".json")).length, 2, "expected one file per legacy entry");
+    await assert.rejects(stat(path.join(stateDir, "buffer.json")), { code: "ENOENT" });
+
+    // Second load reads purely from the per-session files.
+    const reloaded = await storage.loadBuffer();
+    assert.equal(reloaded.entries?.["session-a"]?.turns[0]?.content, "alpha fact");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("crash mid-migration: existing per-session file wins over the legacy snapshot", async () => {
+  const root = await tempRoot("bufio-migrate-crash");
+  try {
+    const stateDir = path.join(root, "state");
+    await mkdir(path.join(stateDir, "buffer"), { recursive: true });
+    // Session A was already migrated (with a NEWER turn) before the crash;
+    // the legacy file still holds the older snapshot for both sessions.
+    await storage_writeSession(stateDir, "session-a", makeEntry("alpha fact NEW"));
+    const legacy: BufferState = {
+      turns: [],
+      lastExtractionAt: null,
+      extractionCount: 0,
+      entries: {
+        "session-a": makeEntry("alpha fact OLD"),
+        "session-b": makeEntry("beta fact"),
+      },
+    };
+    await writeFile(path.join(stateDir, "buffer.json"), JSON.stringify(legacy), "utf8");
+
+    const storage = new StorageManager(root);
+    const loaded = await storage.loadBuffer();
+    assert.equal(loaded.entries?.["session-a"]?.turns[0]?.content, "alpha fact NEW");
+    assert.equal(loaded.entries?.["session-b"]?.turns[0]?.content, "beta fact");
+    await assert.rejects(stat(path.join(stateDir, "buffer.json")), { code: "ENOENT" });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+async function storage_writeSession(stateDir: string, key: string, entry: BufferEntryState): Promise<void> {
+  // Written directly (pre-migration crash simulation) using the same file naming
+  // the storage layer derives; the storage instance is created after setup.
+  await writeFile(
+    path.join(stateDir, "buffer", bufferSessionFileName(key)),
+    JSON.stringify({ key, ...entry }),
+    "utf8",
+  );
+}
+
+test("whole-state saveBuffer reconciles per-session files (writes, deletes stale)", async () => {
+  const root = await tempRoot("bufio-reconcile");
+  try {
+    const storage = new StorageManager(root);
+    await storage.saveBufferSession("session-a", makeEntry("alpha fact"));
+    await storage.saveBufferSession("session-gone", makeEntry("stale fact"));
+
+    await storage.saveBuffer({
+      turns: [],
+      lastExtractionAt: null,
+      extractionCount: 0,
+      entries: { "session-a": makeEntry("alpha fact v2") },
+    });
+
+    const state = await storage.loadBuffer();
+    assert.equal(state.entries?.["session-a"]?.turns[0]?.content, "alpha fact v2");
+    assert.equal(state.entries?.["session-gone"], undefined, "stale session file survived a whole-state reconcile");
+    const names = await readdir(path.join(root, "state", "buffer"));
+    // Reconcile materializes the "default" entry too (legacy semantics: the
+    // top-level state IS the default session), so expect exactly those two.
+    assert.deepEqual(
+      names.filter((n) => n.endsWith(".json")).sort(),
+      [bufferSessionFileName("session-a"), bufferSessionFileName("default")].sort(),
+    );
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("a corrupt per-session file is skipped; the rest of the buffer loads", async () => {
+  const root = await tempRoot("bufio-corrupt-file");
+  try {
+    const storage = new StorageManager(root);
+    await storage.saveBufferSession("session-a", makeEntry("alpha fact"));
+    await storage.saveBufferSession("session-b", makeEntry("beta fact"));
+    const dir = path.join(root, "state", "buffer");
+    const names = (await readdir(dir)).filter((n) => n === bufferSessionFileName("session-b"));
+    await writeFile(path.join(dir, names[0]), "{not json", "utf8");
+
+    const state = await storage.loadBuffer();
+    assert.equal(state.entries?.["session-a"]?.turns[0]?.content, "alpha fact");
+    assert.equal(state.entries?.["session-b"], undefined);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("a corrupt session file is replaced by the legacy snapshot during migration", async () => {
+  const root = await tempRoot("bufio-corrupt-plus-legacy");
+  try {
+    const stateDir = path.join(root, "state");
+    await mkdir(path.join(stateDir, "buffer"), { recursive: true });
+    await writeFile(
+      path.join(stateDir, "buffer", bufferSessionFileName("session-a")),
+      "{not json",
+      "utf8",
+    );
+    const legacy: BufferState = {
+      turns: [],
+      lastExtractionAt: null,
+      extractionCount: 0,
+      entries: { "session-a": makeEntry("alpha fact") },
+    };
+    await writeFile(path.join(stateDir, "buffer.json"), JSON.stringify(legacy), "utf8");
+
+    const storage = new StorageManager(root);
+    const loaded = await storage.loadBuffer();
+    assert.equal(loaded.entries?.["session-a"]?.turns[0]?.content, "alpha fact");
+    await assert.rejects(stat(path.join(stateDir, "buffer.json")), { code: "ENOENT" });
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("corrupt legacy buffer.json with no session files still throws (reset path preserved)", async () => {
+  const root = await tempRoot("bufio-corrupt-legacy");
+  try {
+    const stateDir = path.join(root, "state");
+    await mkdir(stateDir, { recursive: true });
+    await writeFile(path.join(stateDir, "buffer.json"), "{not json", "utf8");
+    const storage = new StorageManager(root);
+    await assert.rejects(() => storage.loadBuffer());
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("per-session save does not run the heavyweight ensureDirectories pass", async () => {
+  const root = await tempRoot("bufio-light-save");
+  try {
+    const storage = new StorageManager(root);
+    await storage.saveBufferSession("session-a", makeEntry("alpha fact"));
+    // ensureDirectories() materializes facts/, entities/, questions/, ... — a
+    // per-session buffer write must only need state/buffer/.
+    assert.equal(await exists(path.join(root, "entities")), false, "entities dir created by a buffer session save");
+    assert.equal(await exists(path.join(root, "questions")), false, "questions dir created by a buffer session save");
+    const state = await storage.loadBuffer();
+    assert.equal(state.entries?.["session-a"]?.turns[0]?.content, "alpha fact");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+async function exists(p: string): Promise<boolean> {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+test("session file names round-trip awkward buffer keys", async () => {
+  const root = await tempRoot("bufio-awkward-keys");
+  try {
+    const storage = new StorageManager(root);
+    const keys = ["default", "agent:main:abc123", "weird /slash/key", "__proto__", "unicode-ключ-🔑"];
+    for (const [i, key] of keys.entries()) {
+      await storage.saveBufferSession(key, makeEntry(`fact-${i}`));
+    }
+    const state = await storage.loadBuffer();
+    for (const [i, key] of keys.entries()) {
+      assert.equal(state.entries?.[key]?.turns[0]?.content, `fact-${i}`, `key ${key} did not round-trip`);
+    }
+    const names = await readdir(path.join(root, "state", "buffer"));
+    assert.equal(names.filter((n) => n.endsWith(".json")).length, keys.length, "two keys collided into one file");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("session file names do not collide on case-insensitive filesystems", () => {
+  const keys = ["Session-A", "session-a", "SESSION-A", "h" + "0".repeat(64), "x".repeat(400), "x".repeat(401)];
+  const folded = new Set(keys.map((key) => bufferSessionFileName(key).toLowerCase()));
+  assert.equal(folded.size, keys.length, "two keys fold to the same file name");
+});
+
+test("a symlinked buffer directory is refused and nothing is written through it", async () => {
+  const root = await tempRoot("bufio-symlink-dir");
+  const outside = await tempRoot("bufio-outside");
+  try {
+    const storage = new StorageManager(root);
+    await mkdir(path.join(root, "state"), { recursive: true });
+    await symlink(outside, path.join(root, "state", "buffer"));
+
+    await assert.rejects(storage.saveBufferSession("session-a", makeEntry("secret")), /symlink/);
+    await assert.rejects(storage.deleteBufferSession("session-a"), /symlink/);
+    await assert.rejects(storage.loadBuffer(), /symlink/);
+    assert.deepEqual(await readdir(outside), [], "nothing may be written outside the memory root");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+    await rm(outside, { recursive: true, force: true });
+  }
+});
+
+test("a symlinked session file is never followed when loading", async () => {
+  const root = await tempRoot("bufio-symlink-file");
+  const outside = await tempRoot("bufio-outside-file");
+  try {
+    const storage = new StorageManager(root);
+    await storage.saveBufferSession("session-a", makeEntry("alpha fact"));
+    const target = path.join(outside, "stolen.json");
+    await writeFile(target, JSON.stringify({ key: "session-evil", ...makeEntry("evil fact") }), "utf8");
+    await symlink(target, path.join(root, "state", "buffer", "s-planted.json"));
+
+    const state = await storage.loadBuffer();
+
+    assert.equal(state.entries?.["session-a"]?.turns[0]?.content, "alpha fact");
+    assert.equal(state.entries?.["session-evil"], undefined, "the symlink target must not be read");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+    await rm(outside, { recursive: true, force: true });
+  }
+});
+
+test("loading with the wrong secure-store key rejects instead of reading an empty buffer", async () => {
+  const root = await tempRoot("bufio-wrong-key");
+  try {
+    const writer = new StorageManager(root);
+    writer.setSecureStoreKey(Buffer.alloc(32, 1), true);
+    await writer.saveBufferSession("session-a", makeEntry("sealed turn"));
+
+    const reader = new StorageManager(root);
+    reader.setSecureStoreKey(Buffer.alloc(32, 2), true);
+
+    await assert.rejects(reader.loadBuffer(), SecureStoreDecryptError);
+    // The encrypted file must survive: a rejected load must not let later saves replace it.
+    const names = await readdir(path.join(root, "state", "buffer"));
+    assert.deepEqual(names, [bufferSessionFileName("session-a")]);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/storage.ts

@@ -142,9 +142,11 @@ import {
   type TombstoneStats,
 } from "./lifecycle/tombstones.js";
 import { supersessionKeysForFact } from "./temporal-supersession.js";
+import { BufferSessionFiles } from "./storage/buffer-session-files.js";
 import { runSupersessionSideEffects, type SupersessionAuditOptions } from "./storage/supersession-side-effects.js";
 import type {
   AccessTrackingEntry,
+  BufferEntryState,
   BufferState,
   ConfidenceTier,
   ContinuityIncidentCloseInput,
@@ -5508,23 +5510,16 @@ export class StorageManager extends TombstoneBlockedCaptureIndexHost {
     return deleted;
   }
 
-  async loadBuffer(): Promise<BufferState> {
-    const bufferPath = path.join(this.stateDir, "buffer.json");
-    try {
-      const raw = await this.readStorageSecureFile(bufferPath);
-      return JSON.parse(raw) as BufferState;
-    } catch (err) {
-      if (err instanceof SecureStoreLockedError) throw err;
-      if (!isErrnoCode(err, "ENOENT")) throw err;
-      return { turns: [], lastExtractionAt: null, extractionCount: 0 };
-    }
-  }
-
-  async saveBuffer(state: BufferState): Promise<void> {
-    await this.ensureDirectories();
-    const bufferPath = path.join(this.stateDir, "buffer.json");
-    await this.writeStorageSecureFile(bufferPath, JSON.stringify(state, null, 2));
+  // Buffer persistence: one file per session (storage/buffer-session-files.ts).
+  private bufferFiles?: BufferSessionFiles;
+  private bufferSessionFiles(): BufferSessionFiles {
+    const io = { read: (p: string) => this.readStorageSecureFile(p), write: (p: string, c: string) => this.writeStorageSecureFile(p, c) };
+    return (this.bufferFiles ??= new BufferSessionFiles(this.stateDir, io));
   }
+  async loadBuffer(): Promise<BufferState> { return this.bufferSessionFiles().load(); }
+  async saveBuffer(state: BufferState): Promise<void> { await this.bufferSessionFiles().reconcile(state); }
+  async saveBufferSession(key: string, entry: BufferEntryState): Promise<void> { await this.bufferSessionFiles().save(key, entry); }
+  async deleteBufferSession(key: string): Promise<void> { await this.bufferSessionFiles().remove(key); }
 
   async loadMeta(): Promise<MetaState> {
     const metaPath = path.join(this.stateDir, "meta.json");

package/dist/chunk-JUXOTY6J.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/local-llm-transport.ts"],"sourcesContent":["import { Agent, getGlobalDispatcher } from \"undici\";\n\nimport { log } from \"./logger.js\";\n\n/**\n * Wire transport for local LLM chat completions.\n *\n * Split out of `local-llm.ts` so the client module keeps prompt and\n * response semantics while connection budgets live in one place.\n */\n\nexport interface ChatCompletionRequest {\n  url: string;\n  headers: Record<string, string>;\n  body: string;\n  signal: AbortSignal;\n  /**\n   * Ceiling for this endpoint, i.e. `localLlmTimeoutMs`. Sizes the\n   * connection's inactivity budgets. Per-request budgets below the ceiling\n   * stay enforced by `signal`.\n   */\n  budgetMs: number;\n}\n\n/**\n * Is this undici's stock pooling `Agent` — the transport we may widen?\n *\n * `instanceof` alone is not enough: Node's global fetch is backed by its\n * OWN bundled copy of undici, so the dispatcher parked on the well-known\n * global symbol is an `Agent` from a different copy than the one we import,\n * and cross-copy `instanceof` is false. Fall back to the constructor name,\n * which is stable across copies and still distinguishes `ProxyAgent` and\n * `MockAgent` from the stock pool.\n */\nfunction isPlainPoolingAgent(dispatcher: unknown): boolean {\n  if (dispatcher instanceof Agent) return true;\n  if (!dispatcher || typeof dispatcher !== \"object\") return false;\n  const ctor = (dispatcher as { constructor?: unknown }).constructor;\n  if (!ctor || typeof ctor !== \"function\") return false;\n  return ctor.name === \"Agent\";\n}\n\n/**\n * Connection pool whose header/body inactivity budgets track the configured\n * request budget.\n *\n * Node's global fetch runs on undici, which applies a default\n * `headersTimeout` and `bodyTimeout` of 300s. A non-streaming completion\n * sends its response headers only once generation finishes, so any\n * completion slower than 300s died with a bare `fetch failed` no matter how\n * high `localLlmTimeoutMs` was set — the configured budget was dead letter\n * past five minutes (issue #2148).\n *\n * One pool per client is enough: it is keyed on the ceiling and rebuilt when\n * that changes.\n */\nexport class ChatTransport {\n  private agent: Agent | null = null;\n  private agentBudgetMs: number | null = null;\n  private warnedAboutCustomDispatcher = false;\n\n  /**\n   * The widened pool, or `undefined` when the process installed its own\n   * transport that we must not displace.\n   *\n   * A deployment can route the local endpoint through a process-wide\n   * dispatcher — a `ProxyAgent` for an HTTP proxy, or a custom\n   * connect/TLS/DNS dispatcher. Swapping in our own pool would bypass the\n   * proxy entirely and break the request, so those are left alone. A\n   * `MockAgent` is excluded by the same check, so test transports keep\n   * working. The trade-off is explicit: on those setups the 300s cap stands,\n   * because only the dispatcher's owner knows how to rebuild it.\n   */\n  dispatcherFor(budgetMs: number): Agent | undefined {\n    if (!isPlainPoolingAgent(getGlobalDispatcher())) {\n      if (!this.warnedAboutCustomDispatcher) {\n        this.warnedAboutCustomDispatcher = true;\n        log.debug(\n          \"local LLM: a custom global dispatcher is installed; leaving it in place. \" +\n            \"localLlmTimeoutMs above that dispatcher's headersTimeout will not take effect.\",\n        );\n      }\n      return undefined;\n    }\n    const normalized = Number.isFinite(budgetMs) ? Math.max(0, budgetMs) : 0;\n    if (this.agent && this.agentBudgetMs === normalized) return this.agent;\n    void this.agent?.close().catch(() => {\n      /* pool teardown is best-effort */\n    });\n    this.agent = new Agent({\n      headersTimeout: normalized,\n      bodyTimeout: normalized,\n    });\n    this.agentBudgetMs = normalized;\n    return this.agent;\n  }\n\n  async post(request: ChatCompletionRequest): Promise<Response> {\n    const init: RequestInit & { dispatcher?: Agent } = {\n      method: \"POST\",\n      headers: request.headers,\n      body: request.body,\n      signal: request.signal,\n    };\n    const dispatcher = this.dispatcherFor(request.budgetMs);\n    if (dispatcher) init.dispatcher = dispatcher;\n    return await fetch(request.url, init);\n  }\n}\n"],"mappings":";;;;;AAAA,SAAS,OAAO,2BAA2B;AAkC3C,SAAS,oBAAoB,YAA8B;AACzD,MAAI,sBAAsB,MAAO,QAAO;AACxC,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO;AAC1D,QAAM,OAAQ,WAAyC;AACvD,MAAI,CAAC,QAAQ,OAAO,SAAS,WAAY,QAAO;AAChD,SAAO,KAAK,SAAS;AACvB;AAgBO,IAAM,gBAAN,MAAoB;AAAA,EACjB,QAAsB;AAAA,EACtB,gBAA+B;AAAA,EAC/B,8BAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EActC,cAAc,UAAqC;AACjD,QAAI,CAAC,oBAAoB,oBAAoB,CAAC,GAAG;AAC/C,UAAI,CAAC,KAAK,6BAA6B;AACrC,aAAK,8BAA8B;AACnC,YAAI;AAAA,UACF;AAAA,QAEF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,UAAM,aAAa,OAAO,SAAS,QAAQ,IAAI,KAAK,IAAI,GAAG,QAAQ,IAAI;AACvE,QAAI,KAAK,SAAS,KAAK,kBAAkB,WAAY,QAAO,KAAK;AACjE,SAAK,KAAK,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAErC,CAAC;AACD,SAAK,QAAQ,IAAI,MAAM;AAAA,MACrB,gBAAgB;AAAA,MAChB,aAAa;AAAA,IACf,CAAC;AACD,SAAK,gBAAgB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAM,KAAK,SAAmD;AAC5D,UAAM,OAA6C;AAAA,MACjD,QAAQ;AAAA,MACR,SAAS,QAAQ;AAAA,MACjB,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,IAClB;AACA,UAAM,aAAa,KAAK,cAAc,QAAQ,QAAQ;AACtD,QAAI,WAAY,MAAK,aAAa;AAClC,WAAO,MAAM,MAAM,QAAQ,KAAK,IAAI;AAAA,EACtC;AACF;","names":[]}

package/dist/chunk-MLED254J.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/local-llm-helpers.ts"],"sourcesContent":["import type { ResponseFormatJSONSchema } from \"openai/resources/shared\";\nimport { log } from \"./logger.js\";\nimport type { LocalLlmRequestPriority } from \"./local-llm.js\";\n\nexport interface LocalLlmChatCompletionOptions {\n  temperature?: number;\n  maxTokens?: number;\n  responseFormat?: { type: string } | ResponseFormatJSONSchema;\n  timeoutMs?: number;\n  operation?: string;\n  forceDisableThinking?: boolean;\n  disableThinking?: boolean;\n  priority?: LocalLlmRequestPriority;\n  signal?: AbortSignal;\n  redactProviderErrors?: boolean;\n  /** Per-request model; defaults to config.localLlmModel. */\n  model?: string;\n  /**\n   * Optional out-box for the terminal failure cause (issue #2891): on a\n   * failed request the client records the last provider error here so\n   * callers can classify it (e.g. HTTP 429 → rate-limited) in memory\n   * instead of seeing only null. Never logged.\n   */\n  failureDiag?: { lastError?: unknown };\n}\n\nexport interface LocalLlmChatCompletionResult {\n  content: string;\n  usage?: { promptTokens: number; completionTokens: number; totalTokens: number };\n}\nexport function isAbortError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const maybe = err as { name?: string; message?: string };\n  return (\n    maybe.name === \"AbortError\" ||\n    maybe.message === \"This operation was aborted\" ||\n    maybe.message === \"The operation was aborted\"\n  );\n}\n\nexport function waitForRetryBackoff(backoffMs: number, signal?: AbortSignal): Promise<boolean> {\n  return new Promise((resolve) => {\n    let settled = false;\n    let timer: NodeJS.Timeout | undefined;\n    const onAbort = (): void => {\n      if (settled) return;\n      settled = true;\n      if (timer) clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve(false);\n    };\n    const onTimer = (): void => {\n      if (settled) return;\n      settled = true;\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve(true);\n    };\n    timer = setTimeout(onTimer, backoffMs);\n    if (signal) {\n      if (signal.aborted) onAbort();\n      else signal.addEventListener(\"abort\", onAbort, { once: true });\n    }\n  });\n}\n\nexport function normalizeBackendTripReason(reason: string): string {\n  const cleaned = reason.replace(/\\s+/g, \" \").replace(/^[-:–—\\s]+/, \"\").trim();\n  if (!cleaned) return \"unknown local backend failure\";\n  return cleaned.length > 160 ? `${cleaned.slice(0, 157)}...` : cleaned;\n}\n\nexport function extractNonRecoverableBackendReason(reason: string): string | null {\n  const match = reason.match(\n    /Failed to load model|Library not loaded|different Team IDs|code signature|llm_engine_mlx_amphibian/i,\n  );\n  return match?.[0] ?? null;\n}\n\nexport function extractNonRecoverableBackendReasonFromErrorText(errorText: string): string | null {\n  const directReason = extractNonRecoverableBackendReason(errorText);\n  if (directReason) return directReason;\n  try {\n    const parsed = JSON.parse(errorText) as { error?: { message?: string } };\n    return extractNonRecoverableBackendReason(parsed?.error?.message ?? \"\");\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Flatten a fetch rejection into one line, including the `cause` undici hides\n * the real reason behind (`fetch failed` alone says nothing).\n */\nexport function describeFetchFailure(err: unknown): string {\n  const name = err instanceof Error ? err.name : \"\";\n  const message = err instanceof Error ? err.message : String(err);\n  const cause: unknown = err instanceof Error ? (err as Error & { cause?: unknown }).cause : undefined;\n  const causeText = cause instanceof Error\n    ? ` (cause: ${cause.name}: ${cause.message}${\n      typeof (cause as Error & { code?: unknown }).code === \"string\"\n        ? ` [${String((cause as Error & { code?: unknown }).code)}]`\n        : \"\"\n    })`\n    : cause === undefined\n      ? \"\"\n      : ` (cause: ${String(cause)})`;\n  return `${name ? `${name}: ` : \"\"}${message}${causeText}`;\n}\n\n/**\n * What to record when every availability probe failed.\n *\n * A probe that TIMED OUT is not evidence the backend is down: the budget is a\n * fixed 2s and a busy event loop can burn it before the socket is scheduled,\n * so the backend looks dead while it answers other callers in single-digit ms.\n * Caching that verdict took extraction offline for a whole health-check\n * interval at a time (issue #2210), so a timeout leaves availability UNKNOWN —\n * this call fails, the next one re-probes instead of reading a stale false.\n *\n * A backend that ANSWERED and said no is a real verdict and stays cached, or\n * the daemon re-probes a known-bad endpoint on every request.\n */\nexport function resolveUnavailableVerdict(args: {\n  baseUrl: string;\n  sawAbortedProbe: boolean;\n  wasAvailable: boolean | null;\n}): { cacheVerdict: boolean; warning: string | null } {\n  if (args.sawAbortedProbe) {\n    return {\n      cacheVerdict: false,\n      warning:\n        `local LLM availability probe timed out at ${args.baseUrl} (event loop busy?); treating availability as ` +\n        \"unknown and re-probing on the next request rather than marking the backend down\",\n    };\n  }\n  return {\n    cacheVerdict: true,\n    // Surfaced at warn, not debug: extraction stops silently when this flips,\n    // and the daemon emits no debug at all unless configured for it.\n    warning: args.wasAvailable !== false ? `local LLM became unavailable at ${args.baseUrl}` : null,\n  };\n}\n\nexport interface ProbeFetchResult {\n  ok: boolean;\n  data: unknown;\n  status: number | null;\n  /** The probe hit its own budget rather than getting an answer. */\n  aborted?: boolean;\n}\n\n/**\n * One health-probe request.\n *\n * Every failure is logged with its cause: a transport error and a 404 both\n * returned `ok: false` with nothing recorded, so an unreachable backend was\n * indistinguishable from a wrong path and an availability failure had no\n * diagnosable reason at all (§22, issue #2210).\n */\nexport async function probeFetch(\n  url: string,\n  options: { timeoutMs: number; headers: Record<string, string>; signal?: AbortSignal },\n): Promise<ProbeFetchResult> {\n  const controller = new AbortController();\n  const requestSignal = options.signal\n    ? AbortSignal.any([options.signal, controller.signal])\n    : controller.signal;\n  const timeout = setTimeout(() => controller.abort(), options.timeoutMs);\n  try {\n    const response = await fetch(url, { signal: requestSignal, headers: options.headers });\n    clearTimeout(timeout);\n    if (!response.ok) {\n      log.debug(`local LLM probe: ${url} returned HTTP ${response.status}`);\n      return { ok: false, data: null, status: response.status };\n    }\n    const contentType = response.headers.get(\"content-type\");\n    const data = contentType?.includes(\"application/json\") ? await response.json() : await response.text();\n    return { ok: true, data, status: response.status };\n  } catch (err) {\n    clearTimeout(timeout);\n    const aborted = isAbortError(err);\n    log.debug(\n      `local LLM probe: ${url} ${aborted ? `timed out after ${options.timeoutMs}ms` : \"failed\"}: ${describeFetchFailure(err)}`,\n    );\n    return { ok: false, data: null, status: null, aborted };\n  }\n}\n\ninterface PendingProbe {\n  promise: Promise<boolean>;\n  controller: AbortController;\n  /** Callers still awaiting this sequence; at zero the sequence is aborted. */\n  waiters: number;\n}\n\n/**\n * Collapses concurrent probe sequences onto one in-flight run.\n *\n * A timed-out availability probe deliberately caches nothing (issue #2210),\n * which removed the false verdict that used to absorb concurrent callers:\n * every queued request would then run its own full probe sequence, on a host\n * already slow enough to blow the probe budget.\n *\n * Cancellation is refcounted rather than shared: one caller walking away must\n * not abort a sequence the others are still waiting on, so the underlying task\n * is aborted only once every waiter has gone.\n */\nexport class SingleFlightProbe {\n  private pending: PendingProbe | null = null;\n\n  run(task: (signal: AbortSignal) => Promise<boolean>, signal?: AbortSignal): Promise<boolean> {\n    let active = this.pending;\n    if (!active) {\n      const controller = new AbortController();\n      const created: PendingProbe = { promise: Promise.resolve(false), controller, waiters: 0 };\n      created.promise = task(controller.signal).finally(() => {\n        if (this.pending === created) this.pending = null;\n      });\n      this.pending = created;\n      active = created;\n    }\n    const entry = active;\n    entry.waiters += 1;\n    let released = false;\n    const release = () => {\n      if (released) return;\n      released = true;\n      entry.waiters -= 1;\n      if (entry.waiters > 0) return;\n      // Detach BEFORE aborting. `pending` would otherwise still point at this\n      // doomed entry until the task's own `finally` runs a microtask later, and\n      // a caller arriving in that window would join an aborted sequence and\n      // read its `false` as a verdict.\n      if (this.pending === entry) this.pending = null;\n      entry.controller.abort();\n    };\n    if (!signal) return entry.promise.finally(release);\n    return new Promise<boolean>((resolve, reject) => {\n      const onAbort = () => {\n        release();\n        resolve(false);\n      };\n      signal.addEventListener(\"abort\", onAbort, { once: true });\n      entry.promise.then(\n        (value) => {\n          signal.removeEventListener(\"abort\", onAbort);\n          release();\n          resolve(value);\n        },\n        (err: unknown) => {\n          signal.removeEventListener(\"abort\", onAbort);\n          release();\n          reject(err instanceof Error ? err : new Error(String(err)));\n        },\n      );\n    });\n  }\n}\n"],"mappings":";;;;;AA8BO,SAAS,aAAa,KAAuB;AAClD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,QAAQ;AACd,SACE,MAAM,SAAS,gBACf,MAAM,YAAY,gCAClB,MAAM,YAAY;AAEtB;AAEO,SAAS,oBAAoB,WAAmB,QAAwC;AAC7F,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,UAAU;AACd,QAAI;AACJ,UAAM,UAAU,MAAY;AAC1B,UAAI,QAAS;AACb,gBAAU;AACV,UAAI,MAAO,cAAa,KAAK;AAC7B,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ,KAAK;AAAA,IACf;AACA,UAAM,UAAU,MAAY;AAC1B,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ,IAAI;AAAA,IACd;AACA,YAAQ,WAAW,SAAS,SAAS;AACrC,QAAI,QAAQ;AACV,UAAI,OAAO,QAAS,SAAQ;AAAA,UACvB,QAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IAC/D;AAAA,EACF,CAAC;AACH;AAEO,SAAS,2BAA2B,QAAwB;AACjE,QAAM,UAAU,OAAO,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE,EAAE,KAAK;AAC3E,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,SAAS,MAAM,GAAG,QAAQ,MAAM,GAAG,GAAG,CAAC,QAAQ;AAChE;AAEO,SAAS,mCAAmC,QAA+B;AAChF,QAAM,QAAQ,OAAO;AAAA,IACnB;AAAA,EACF;AACA,SAAO,QAAQ,CAAC,KAAK;AACvB;AAEO,SAAS,gDAAgD,WAAkC;AAChG,QAAM,eAAe,mCAAmC,SAAS;AACjE,MAAI,aAAc,QAAO;AACzB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,WAAO,mCAAmC,QAAQ,OAAO,WAAW,EAAE;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,qBAAqB,KAAsB;AACzD,QAAM,OAAO,eAAe,QAAQ,IAAI,OAAO;AAC/C,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,QAAiB,eAAe,QAAS,IAAoC,QAAQ;AAC3F,QAAM,YAAY,iBAAiB,QAC/B,YAAY,MAAM,IAAI,KAAK,MAAM,OAAO,GACxC,OAAQ,MAAqC,SAAS,WAClD,KAAK,OAAQ,MAAqC,IAAI,CAAC,MACvD,EACN,MACE,UAAU,SACR,KACA,YAAY,OAAO,KAAK,CAAC;AAC/B,SAAO,GAAG,OAAO,GAAG,IAAI,OAAO,EAAE,GAAG,OAAO,GAAG,SAAS;AACzD;AAeO,SAAS,0BAA0B,MAIY;AACpD,MAAI,KAAK,iBAAiB;AACxB,WAAO;AAAA,MACL,cAAc;AAAA,MACd,SACE,6CAA6C,KAAK,OAAO;AAAA,IAE7D;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA;AAAA;AAAA,IAGd,SAAS,KAAK,iBAAiB,QAAQ,mCAAmC,KAAK,OAAO,KAAK;AAAA,EAC7F;AACF;AAkBA,eAAsB,WACpB,KACA,SAC2B;AAC3B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,gBAAgB,QAAQ,SAC1B,YAAY,IAAI,CAAC,QAAQ,QAAQ,WAAW,MAAM,CAAC,IACnD,WAAW;AACf,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,QAAQ,SAAS;AACtE,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,eAAe,SAAS,QAAQ,QAAQ,CAAC;AACrF,iBAAa,OAAO;AACpB,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,MAAM,oBAAoB,GAAG,kBAAkB,SAAS,MAAM,EAAE;AACpE,aAAO,EAAE,IAAI,OAAO,MAAM,MAAM,QAAQ,SAAS,OAAO;AAAA,IAC1D;AACA,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,UAAM,OAAO,aAAa,SAAS,kBAAkB,IAAI,MAAM,SAAS,KAAK,IAAI,MAAM,SAAS,KAAK;AACrG,WAAO,EAAE,IAAI,MAAM,MAAM,QAAQ,SAAS,OAAO;AAAA,EACnD,SAAS,KAAK;AACZ,iBAAa,OAAO;AACpB,UAAM,UAAU,aAAa,GAAG;AAChC,QAAI;AAAA,MACF,oBAAoB,GAAG,IAAI,UAAU,mBAAmB,QAAQ,SAAS,OAAO,QAAQ,KAAK,qBAAqB,GAAG,CAAC;AAAA,IACxH;AACA,WAAO,EAAE,IAAI,OAAO,MAAM,MAAM,QAAQ,MAAM,QAAQ;AAAA,EACxD;AACF;AAqBO,IAAM,oBAAN,MAAwB;AAAA,EACrB,UAA+B;AAAA,EAEvC,IAAI,MAAiD,QAAwC;AAC3F,QAAI,SAAS,KAAK;AAClB,QAAI,CAAC,QAAQ;AACX,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,UAAwB,EAAE,SAAS,QAAQ,QAAQ,KAAK,GAAG,YAAY,SAAS,EAAE;AACxF,cAAQ,UAAU,KAAK,WAAW,MAAM,EAAE,QAAQ,MAAM;AACtD,YAAI,KAAK,YAAY,QAAS,MAAK,UAAU;AAAA,MAC/C,CAAC;AACD,WAAK,UAAU;AACf,eAAS;AAAA,IACX;AACA,UAAM,QAAQ;AACd,UAAM,WAAW;AACjB,QAAI,WAAW;AACf,UAAM,UAAU,MAAM;AACpB,UAAI,SAAU;AACd,iBAAW;AACX,YAAM,WAAW;AACjB,UAAI,MAAM,UAAU,EAAG;AAKvB,UAAI,KAAK,YAAY,MAAO,MAAK,UAAU;AAC3C,YAAM,WAAW,MAAM;AAAA,IACzB;AACA,QAAI,CAAC,OAAQ,QAAO,MAAM,QAAQ,QAAQ,OAAO;AACjD,WAAO,IAAI,QAAiB,CAAC,SAAS,WAAW;AAC/C,YAAM,UAAU,MAAM;AACpB,gBAAQ;AACR,gBAAQ,KAAK;AAAA,MACf;AACA,aAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,YAAM,QAAQ;AAAA,QACZ,CAAC,UAAU;AACT,iBAAO,oBAAoB,SAAS,OAAO;AAC3C,kBAAQ;AACR,kBAAQ,KAAK;AAAA,QACf;AAAA,QACA,CAAC,QAAiB;AAChB,iBAAO,oBAAoB,SAAS,OAAO;AAC3C,kBAAQ;AACR,iBAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,QAC5D;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}