@remnic/core 9.63.0 → 9.63.1

package/src/qmd-process-group.test.ts

@@ -0,0 +1,125 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { runCommandWithTimeoutForTest } from "./qmd.js";
+
+// Regression for issue #2456: on timeout/abort the bounded qmd subprocess
+// launcher must be killed together with its descendants. The launcher runs
+// detached (own process group) so a negative-pid signal reaches grandchildren
+// the old child.kill("SIGKILL") left behind. POSIX only — Windows falls back
+// to a direct child kill by design.
+//
+// Real timers by design: this suite kills real OS processes, so the timeout
+// trigger and the exit polls run against the platform clock. Fake timers
+// cannot deliver signals to a spawned `sleep`. Every poll awaits a condition
+// (pid file exists, process gone), never a fixed sleep.
+const isPosix = process.platform !== "win32";
+
+function isAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code === "EPERM";
+  }
+}
+
+async function waitForExit(pid: number, deadlineMs = 10_000): Promise<boolean> {
+  const deadline = Date.now() + deadlineMs;
+  while (Date.now() < deadline) {
+    if (!isAlive(pid)) return true;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  return !isAlive(pid);
+}
+
+async function setupFakeLauncher(): Promise<{ script: string; pidFile: string; dir: string }> {
+  const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "remnic-qmd-kill-"));
+  const script = path.join(dir, "fake-qmd");
+  const pidFile = path.join(dir, "grandchild.pid");
+  // Launcher spawns a grandchild that outlives it, then hangs until killed.
+  await fs.promises.writeFile(
+    script,
+    `#!/bin/sh\nsleep 30 &\necho $! > "${pidFile}"\nsleep 30\n`,
+    { mode: 0o755 },
+  );
+  return { script, pidFile, dir };
+}
+
+async function readPidFile(pidFile: string, deadlineMs = 5_000): Promise<number> {
+  const deadline = Date.now() + deadlineMs;
+  for (;;) {
+    try {
+      const text = await fs.promises.readFile(pidFile, "utf8");
+      const pid = Number.parseInt(text.trim(), 10);
+      assert.ok(Number.isInteger(pid) && pid > 0, `bad grandchild pid: ${text}`);
+      return pid;
+    } catch (err) {
+      if (Date.now() >= deadline) throw err;
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+  }
+}
+
+async function cleanupSurvivors(pids: Array<number | undefined>, dir?: string): Promise<void> {
+  for (const pid of pids) {
+    if (pid === undefined || !isAlive(pid)) continue;
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+      // Already gone.
+    }
+  }
+  if (dir) await fs.promises.rm(dir, { recursive: true, force: true });
+}
+
+test(
+  "timeout kills qmd launcher process group including grandchildren",
+  { skip: isPosix ? false : "POSIX process groups do not exist on Windows" },
+  async () => {
+    const { script, pidFile, dir } = await setupFakeLauncher();
+    let grandchildPid: number | undefined;
+    try {
+      await assert.rejects(
+        runCommandWithTimeoutForTest(script, [], { timeoutMs: 500, label: "qmd fake" }),
+        (err: Error & { timedOut?: boolean }) => err.timedOut === true,
+      );
+      grandchildPid = await readPidFile(pidFile);
+      assert.ok(
+        await waitForExit(grandchildPid),
+        `grandchild ${grandchildPid} survived the group kill`,
+      );
+    } finally {
+      await cleanupSurvivors([grandchildPid], dir);
+    }
+  },
+);
+
+test(
+  "abort kills qmd launcher process group including grandchildren",
+  { skip: isPosix ? false : "POSIX process groups do not exist on Windows" },
+  async () => {
+    const { script, pidFile, dir } = await setupFakeLauncher();
+    let grandchildPid: number | undefined;
+    const controller = new AbortController();
+    try {
+      const run = runCommandWithTimeoutForTest(script, [], {
+        timeoutMs: 60_000,
+        signal: controller.signal,
+        label: "qmd fake",
+      });
+      setTimeout(() => controller.abort(), 300);
+      await assert.rejects(run, /aborted/);
+      grandchildPid = await readPidFile(pidFile);
+      assert.ok(
+        await waitForExit(grandchildPid),
+        `grandchild ${grandchildPid} survived the group kill`,
+      );
+    } finally {
+      await cleanupSurvivors([grandchildPid], dir);
+    }
+  },
+);

package/src/qmd.ts

@@ -562,6 +562,11 @@ function runCommandWithTimeout(
     const child = launchProcess(command, args, {
       env: mergeEnv({ NO_COLOR: "1", ...options.env }),
       stdio: ["ignore", "pipe", "pipe"],
+      // POSIX: own process group so a timeout/abort kill can take down qmd's
+      // grandchildren too (launcher scripts spawn workers that outlive the
+      // launcher itself). Issue #2456. Windows ignores this option here —
+      // kill falls back to a direct child.kill.
+      detached: process.platform !== "win32",
     });
     if (!child.stdout || !child.stderr) {
       reject(new Error(`${label} failed to open stdio pipes`));
@@ -575,7 +580,7 @@ function runCommandWithTimeout(
     const timer = setTimeout(() => {
       settled = true;
       cleanup();
-      child.kill("SIGKILL");
+      killBoundedChild(child);
       // Flag the deadline breach so classifyProbeFailure can tell a genuine
       // timeout from a non-zero-exit error whose message merely embeds stderr.
       reject(
@@ -589,7 +594,7 @@ function runCommandWithTimeout(
       settled = true;
       clearTimeout(timer);
       cleanup();
-      child.kill("SIGKILL");
+      killBoundedChild(child);
       reject(abortError(`${label} aborted`));
     };
     const cleanup = () => {
@@ -636,6 +641,29 @@ function runProcessCommand(
   });
 }
 
+// Kill a bounded subprocess and its descendants. On POSIX the child runs
+// detached (own process group), so a negative-pid signal reaches the whole
+// tree. Fall back to a direct kill on Windows, missing pid, or when the
+// group is already gone. Never throws — callers use it on best-effort paths.
+function killBoundedChild(child: CommandChildProcess): void {
+  const pid = child.pid;
+  if (pid !== undefined && process.platform !== "win32") {
+    try {
+      process.kill(-pid, "SIGKILL");
+      return;
+    } catch {
+      // Group already reaped or never became a leader — fall through.
+    }
+  }
+  try {
+    child.kill("SIGKILL");
+  } catch {
+    // Already exited between the check and the kill.
+  }
+}
+
+export { runCommandWithTimeout as runCommandWithTimeoutForTest };
+
 // ---------------------------------------------------------------------------
 // QMD Stdio Daemon Session (MCP over stdio child process)
 // ---------------------------------------------------------------------------

package/src/schemas.test.ts

@@ -0,0 +1,158 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { ConsolidationResultSchema, ExtractionResultSchema } from "./schemas.js";
+
+// Synthetic fixtures only — no real memory content (public repo).
+const validFact = {
+  category: "fact",
+  content: "The API rate limit is 1000 requests per minute.",
+  confidence: 0.8,
+  tags: ["api"],
+};
+
+const validEntity = {
+  name: "acme-corp",
+  type: "company",
+  facts: ["Uses PostgreSQL for the main database."],
+};
+
+const validQuestion = {
+  question: "Which service enforces the rate limit?",
+  context: "The limit shape suggests an upstream gateway.",
+  priority: 0.4,
+};
+
+const validRelationship = {
+  source: "person-jane-doe",
+  target: "acme-corp",
+  label: "works at",
+};
+
+function baseResult() {
+  return {
+    facts: [validFact],
+    profileUpdates: ["Prefers concise status updates."],
+    entities: [validEntity],
+    questions: [validQuestion],
+    relationships: [validRelationship],
+  };
+}
+
+test("ExtractionResultSchema salvages valid facts from a mixed-invalid array (#2455)", () => {
+  const parsed = ExtractionResultSchema.safeParse({
+    ...baseResult(),
+    facts: [
+      validFact,
+      { category: "not-a-category", content: "x", confidence: 0.5, tags: [] },
+      { category: "fact", content: "missing confidence", tags: [] },
+      // procedure facts without steps fail the superRefine — salvage must
+      // respect refinement issues, not just base-shape issues
+      { category: "procedure", content: "Deploy the service.", confidence: 0.9, tags: ["deploy"] },
+      "bare string is not a fact",
+    ],
+  });
+
+  assert.equal(parsed.success, true);
+  assert.deepEqual(parsed.data?.facts, [validFact]);
+});
+
+test("ExtractionResultSchema fails when a non-empty facts array is wholly invalid (#2455)", () => {
+  const parsed = ExtractionResultSchema.safeParse({
+    ...baseResult(),
+    facts: [
+      { category: "not-a-category", content: "x", confidence: 0.5, tags: [] },
+      42,
+    ],
+  });
+
+  assert.equal(parsed.success, false);
+  assert.ok(
+    parsed.error.issues.some((issue) => issue.message.includes("no items matching the schema")),
+  );
+});
+
+test("ExtractionResultSchema keeps explicitly empty arrays valid (#2455)", () => {
+  const parsed = ExtractionResultSchema.safeParse({
+    facts: [],
+    profileUpdates: [],
+    entities: [],
+    questions: [],
+    relationships: [],
+  });
+
+  assert.equal(parsed.success, true);
+  assert.deepEqual(parsed.data?.facts, []);
+  assert.deepEqual(parsed.data?.questions, []);
+});
+
+test("ExtractionResultSchema salvages valid entities from a mixed-invalid array (#2455)", () => {
+  const parsed = ExtractionResultSchema.safeParse({
+    ...baseResult(),
+    entities: [
+      validEntity,
+      { name: "bad-type", type: "organization", facts: ["nope"] },
+      { name: "bad-facts", type: "person", facts: [17] },
+      null,
+    ],
+  });
+
+  assert.equal(parsed.success, true);
+  assert.deepEqual(parsed.data?.entities, [validEntity]);
+});
+
+test("ExtractionResultSchema fails when a non-empty entities array is wholly invalid (#2455)", () => {
+  const parsed = ExtractionResultSchema.safeParse({
+    ...baseResult(),
+    entities: [{ name: "bad-type", type: "organization", facts: ["nope"] }],
+  });
+
+  assert.equal(parsed.success, false);
+});
+
+test("ExtractionResultSchema salvages valid questions from a mixed-invalid array (#2455)", () => {
+  const parsed = ExtractionResultSchema.safeParse({
+    ...baseResult(),
+    questions: [
+      validQuestion,
+      { question: "no context", priority: 0.3 },
+      { question: "bad priority", context: "out of range", priority: 5 },
+    ],
+  });
+
+  assert.equal(parsed.success, true);
+  assert.deepEqual(parsed.data?.questions, [validQuestion]);
+});
+
+test("ExtractionResultSchema salvages valid profileUpdates and relationships (#2455)", () => {
+  const parsed = ExtractionResultSchema.safeParse({
+    ...baseResult(),
+    profileUpdates: ["Prefers concise status updates.", 42, null],
+    relationships: [validRelationship, { source: "jane-doe", label: "missing target" }],
+  });
+
+  assert.equal(parsed.success, true);
+  assert.deepEqual(parsed.data?.profileUpdates, ["Prefers concise status updates."]);
+  assert.deepEqual(parsed.data?.relationships, [validRelationship]);
+});
+
+test("ExtractionResultSchema still accepts null/omitted relationships (#2455)", () => {
+  const nullParsed = ExtractionResultSchema.safeParse({ ...baseResult(), relationships: null });
+  assert.equal(nullParsed.success, true);
+
+  const omitted: Record<string, unknown> = { ...baseResult() };
+  delete omitted.relationships;
+  const omittedParsed = ExtractionResultSchema.safeParse(omitted);
+  assert.equal(omittedParsed.success, true);
+});
+
+test("ConsolidationResultSchema stays strict on mixed-invalid arrays (#2455)", () => {
+  const validItem = { existingId: "fact-1", action: "SKIP", reason: "still accurate" };
+  const parsed = ConsolidationResultSchema.safeParse({
+    items: [validItem, { existingId: "fact-2", action: "DESTROY", reason: "bad enum" }],
+    profileUpdates: [],
+    entityUpdates: [],
+  });
+
+  assert.equal(parsed.success, false);
+});

package/src/schemas.ts

@@ -278,27 +278,51 @@ export const ProactiveExtractionResultSchema = z.object({
     ),
 });
 
+/**
+ * Salvage array for model-produced extraction output (issue #2455).
+ *
+ * Mixed valid+invalid items parse to the valid subset so one malformed
+ * element no longer discards the whole extraction. A non-empty array with
+ * zero valid items still fails, so bounded retry stays effective and wholly
+ * malformed output is never silently accepted as empty. Empty arrays stay
+ * valid. Consolidation schemas intentionally stay strict — do not use this
+ * for them.
+ */
+function salvageArray<T extends z.ZodTypeAny>(itemSchema: T) {
+  return z
+    .array(z.unknown())
+    .transform((items, ctx) => {
+      const valid: z.infer<T>[] = [];
+      for (const raw of items) {
+        const parsed = itemSchema.safeParse(raw);
+        if (parsed.success) {
+          valid.push(parsed.data);
+        }
+      }
+      if (items.length > 0 && valid.length === 0) {
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          message: "array contains no items matching the schema",
+        });
+        return z.NEVER;
+      }
+      return valid;
+    });
+}
+
 export const ExtractionResultSchema = z.object({
-  facts: z
-    .array(ExtractedFactSchema)
-    .describe(
-      "Extracted memories from the conversation. Include facts, preferences, corrections, and decisions. Only extract genuinely new, durable information — skip transient task state.",
-    ),
-  profileUpdates: z
-    .array(z.string())
-    .describe(
-      "Updates to the user's behavioral profile. Each string is a standalone statement about the user's preferences, habits, or personality. Only include genuinely new insights.",
-    ),
-  entities: z
-    .array(EntityMentionSchema)
-    .describe(
-      "Entities mentioned in the conversation with new facts about them.",
-    ),
-  questions: z
-    .array(ExtractedQuestionSchema)
-    .describe(
-      "Zero to three source-grounded questions useful in future sessions. Return an empty array when the conversation supports none.",
-    ),
+  facts: salvageArray(ExtractedFactSchema).describe(
+    "Extracted memories from the conversation. Include facts, preferences, corrections, and decisions. Only extract genuinely new, durable information — skip transient task state.",
+  ),
+  profileUpdates: salvageArray(z.string()).describe(
+    "Updates to the user's behavioral profile. Each string is a standalone statement about the user's preferences, habits, or personality. Only include genuinely new insights.",
+  ),
+  entities: salvageArray(EntityMentionSchema).describe(
+    "Entities mentioned in the conversation with new facts about them.",
+  ),
+  questions: salvageArray(ExtractedQuestionSchema).describe(
+    "Zero to three source-grounded questions useful in future sessions. Return an empty array when the conversation supports none.",
+  ),
   identityReflection: z
     .string()
     .optional()
@@ -311,8 +335,7 @@ export const ExtractionResultSchema = z.object({
     .optional()
     .nullable()
     .describe("A six-to-eight word title for this conversation segment."),
-  relationships: z
-    .array(ExtractedRelationshipSchema)
+  relationships: salvageArray(ExtractedRelationshipSchema)
     .optional()
     .nullable()
     .describe(