@retaw106/mmc-oc 2.2.1 → 2.3.0

package/src/shared/storage-file-mutex.ts

@@ -0,0 +1,130 @@
+import { execFileSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { readdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { isPidAlive, readProcessStartTime } from "./rpc-utils";
+import {
+    ensurePrivateStorageDirectorySync,
+    writeStorageFileAtomicSync,
+    writeStorageFileSync,
+} from "./storage-permissions";
+
+interface Ticket {
+    choosing: boolean;
+    number: number;
+    birth: string | null;
+    checksum: string;
+}
+const ticketChecksum = (name: string, ticket: Ticket) =>
+    createHash("sha256")
+        .update(JSON.stringify([name, ticket.choosing, ticket.number, ticket.birth]))
+        .digest("hex");
+function processBirth(pid: number): string | null {
+    if (process.platform === "linux") {
+        try {
+            const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+            const ticks = stat
+                .slice(stat.lastIndexOf(")") + 2)
+                .trim()
+                .split(/\s+/)[19];
+            if (!ticks || !/^\d+$/.test(ticks)) return null;
+            return `${readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim()}:${ticks}`;
+        } catch {
+            return null;
+        }
+    }
+    if (process.platform === "darwin") {
+        try {
+            return (
+                execFileSync("ps", ["-p", String(pid), "-o", "lstart="], {
+                    encoding: "utf8",
+                    timeout: 1000,
+                    windowsHide: true,
+                    env: { ...process.env, TZ: "UTC", LC_ALL: "C" },
+                    stdio: ["ignore", "pipe", "pipe"],
+                }).trim() || null
+            );
+        } catch {
+            return null;
+        }
+    }
+    const start = readProcessStartTime(pid);
+    return start === null ? null : String(start);
+}
+const pause = new Int32Array(new SharedArrayBuffer(4));
+
+/**
+ * Lamport's bakery mutex using unique contender files on a local filesystem.
+ * Exclusive creation and atomic replacement work on POSIX and Windows. A dead
+ * owner is removed by PID/start-time evidence, never by age: a paused live
+ * publisher must not lose its lock. Uncertain liveness refuses after the budget.
+ * Unique names mean reclaiming a dead ticket cannot unlink a successor's lock.
+ */
+export function withStorageFileMutex<T>(directory: string, work: () => T, timeoutMs = 1000): T {
+    ensurePrivateStorageDirectorySync(directory);
+    const name = `${process.pid}-${randomUUID()}.lock`;
+    const ownPath = join(directory, name);
+    const birth = processBirth(process.pid);
+    const ticket: Ticket = { choosing: true, number: 0, birth, checksum: "" };
+    const encodedTicket = () =>
+        JSON.stringify({ ...ticket, checksum: ticketChecksum(name, ticket) });
+    writeStorageFileSync(ownPath, encodedTicket(), { flag: "wx", forcePrivate: true });
+    const deadline = performance.now() + timeoutMs;
+    const peers = (): [string, Ticket | null][] => {
+        const found: [string, Ticket | null][] = [];
+        for (const other of readdirSync(directory)) {
+            if (other === name || !/^\d+-[\da-f-]+\.lock$/.test(other)) continue;
+            const pid = Number(other.split("-")[0]);
+            const otherPath = join(directory, other);
+            let value: Ticket | null = null;
+            try {
+                const parsed = JSON.parse(readFileSync(otherPath, "utf8")) as Ticket;
+                if (
+                    typeof parsed.choosing === "boolean" &&
+                    Number.isSafeInteger(parsed.number) &&
+                    parsed.number >= 0 &&
+                    (parsed.birth === null || typeof parsed.birth === "string") &&
+                    parsed.checksum === ticketChecksum(other, parsed)
+                )
+                    value = parsed;
+            } catch (error) {
+                if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
+            }
+            const alive = isPidAlive(pid);
+            const actualBirth = alive === "alive" && value?.birth ? processBirth(pid) : null;
+            if (
+                alive === "dead" ||
+                (actualBirth !== null && value?.birth && actualBirth !== value.birth)
+            ) {
+                rmSync(otherPath, { force: true });
+                continue;
+            }
+            found.push([other, value]);
+        }
+        return found;
+    };
+    try {
+        ticket.number = 1 + Math.max(0, ...peers().map(([, value]) => value?.number ?? 0));
+        ticket.choosing = false;
+        writeStorageFileAtomicSync(ownPath, encodedTicket(), true);
+        while (
+            peers().some(
+                ([other, value]) =>
+                    !value ||
+                    value.choosing ||
+                    value.number < ticket.number ||
+                    (value.number === ticket.number && other < name),
+            )
+        ) {
+            if (performance.now() >= deadline)
+                throw new Error("Storage safety publication lock is unavailable");
+            Atomics.wait(pause, 0, 0, 10);
+        }
+        const result = work();
+        if (result && typeof (result as { then?: unknown }).then === "function")
+            throw new TypeError("Storage publication mutex requires synchronous work");
+        return result;
+    } finally {
+        rmSync(ownPath, { force: true });
+    }
+}

package/src/shared/storage-permissions.ts

@@ -10,6 +10,7 @@ import {
     chmodSync,
     closeSync,
     createWriteStream,
+    fsyncSync,
     lstatSync,
     mkdirSync,
     openSync,
@@ -54,6 +55,15 @@ export function ensureStorageDirectorySync(
     });
 }
 
+/** Replay-authorizing files require a private real directory, even after a permissive restore. */
+export function ensurePrivateStorageDirectorySync(directory: string): void {
+    ensureStorageDirectorySync(directory, true);
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error("Private storage directory is not a real directory");
+    if (process.platform !== "win32") chmodSync(directory, 0o700);
+}
+
 /** Create or replace a storage file using a private mode from the first byte. */
 export function writeStorageFileSync(
     filePath: string,
@@ -85,6 +95,42 @@ export function writeStorageFileAtomicSync(
     }
 }
 
+/** Flush the namespace containing a safety-critical sidecar (POSIX only). */
+export function syncStorageDirectorySync(directory: string): void {
+    const fd = openSync(directory, "r");
+    try {
+        fsyncSync(fd);
+    } finally {
+        closeSync(fd);
+    }
+}
+
+/** Publish a safety record only after both its bytes and directory entry are durable. */
+export function writeStorageFileDurableAtomicSync(
+    filePath: string,
+    content: string,
+    afterTempSync?: () => void,
+): void {
+    const directory = dirname(filePath);
+    ensurePrivateStorageDirectorySync(directory);
+    const tempPath = `${filePath}.${process.pid}.${randomBytes(12).toString("hex")}.tmp`;
+    let fd: number | undefined;
+    try {
+        fd = openStorageFileSync(tempPath, "wx", true);
+        writeFileSync(fd, content, "utf8");
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        afterTempSync?.();
+        renameSync(tempPath, filePath);
+        syncStorageDirectorySync(directory);
+        syncStorageDirectorySync(dirname(directory));
+    } finally {
+        if (fd !== undefined) closeSync(fd);
+        rmSync(tempPath, { force: true });
+    }
+}
+
 export function copyStorageFileSync(
     sourcePath: string,
     destinationPath: string,

package/src/shared/subagent-temperature.ts

@@ -0,0 +1,110 @@
+import { __catalogTest, catalogTemperature } from "./models-dev-temperature";
+
+export type TemperatureMetadata = {
+    temperature?: boolean;
+    capabilities?: { temperature?: boolean };
+    compat?: { supportsTemperature?: boolean; supportsSamplingParams?: boolean };
+};
+
+const loggedDecisions = new Set<string>();
+
+export function temperatureCapability(metadata: unknown): boolean | undefined {
+    if (!metadata || typeof metadata !== "object") return undefined;
+    const model = metadata as TemperatureMetadata;
+    const supported =
+        model.capabilities?.temperature ??
+        model.temperature ??
+        model.compat?.supportsTemperature ??
+        model.compat?.supportsSamplingParams;
+    return typeof supported === "boolean" ? supported : undefined;
+}
+
+/**
+ * Where a temperature decision came from: the host's own model metadata, the models.dev
+ * catalog OpenCode caches on disk, or nothing (which omits temperature).
+ */
+export type TemperatureSource = "host" | "catalog" | "none";
+
+export interface TemperatureDecision {
+    supported: boolean | undefined;
+    source: TemperatureSource;
+    /** The models.dev entry (`provider/model`) when the catalog decided. */
+    entry?: string;
+}
+
+/**
+ * Host metadata wins whenever it states a boolean. Only when the host is silent do we
+ * consult the cached models.dev catalog, matched by provider and model id.
+ */
+export function resolveTemperatureCapability(
+    model: string,
+    metadata: unknown,
+): TemperatureDecision {
+    const host = temperatureCapability(metadata);
+    if (host !== undefined) return { supported: host, source: "host" };
+    const catalog = catalogTemperature(model);
+    if (catalog) return { supported: catalog.temperature, source: "catalog", entry: catalog.entry };
+    return { supported: undefined, source: "none" };
+}
+
+export function describeTemperatureDecision(model: string, decision: TemperatureDecision): string {
+    const verdict = decision.supported === true ? "sent" : "omitted";
+    const answer = decision.supported === true ? "yes" : "no";
+    const reason =
+        decision.source === "host"
+            ? `host model metadata says ${answer}`
+            : decision.source === "catalog"
+              ? `models.dev cache entry ${decision.entry ?? "unknown"} says ${answer}`
+              : "no host or models.dev metadata";
+    return `Subagent temperature ${verdict} for ${model}: ${reason}`;
+}
+
+/** Log each model's decision once per process, and again only if the decision changes. */
+export function logTemperatureDecision(
+    model: string,
+    decision: TemperatureDecision,
+    log: (message: string, decision: TemperatureDecision) => void,
+): void {
+    const key = `${model}\u0000${decision.source}\u0000${decision.supported}\u0000${decision.entry ?? ""}`;
+    if (loggedDecisions.has(key)) return;
+    loggedDecisions.add(key);
+    log(describeTemperatureDecision(model, decision), decision);
+}
+
+/** Only a positive capability permits sampling; reasoning alone is not evidence. */
+export function subagentTemperature(
+    model: string,
+    metadata: unknown,
+    temperature: number | undefined,
+    log: (message: string, decision: TemperatureDecision) => void,
+): number | undefined {
+    if (temperature === undefined) return undefined;
+    const decision = resolveTemperatureCapability(model, metadata);
+    logTemperatureDecision(model, decision, log);
+    return decision.supported === true ? temperature : undefined;
+}
+
+/** OpenCode 1 computes agent sampling before chat.params resolves the final model. */
+export function applyHiddenSubagentTemperature(
+    input: { agent: string; model?: TemperatureMetadata & { providerID?: string; id?: string } },
+    output: { temperature?: number },
+    log: (message: string) => void,
+): void {
+    if (!/^(?:historian(?:-|$)|dreamer(?:-|$)|smart-note-compiler$)/.test(input.agent)) return;
+    const temperature = subagentTemperature(
+        `${input.model?.providerID ?? "unknown"}/${input.model?.id ?? "unknown"}`,
+        input.model,
+        output.temperature,
+        // Host loggers treat a second argument as structured data; the message says it all.
+        (message) => log(message),
+    );
+    if (temperature === undefined) delete output.temperature;
+    else output.temperature = temperature;
+}
+
+export const __temperatureTest = {
+    reset(): void {
+        loggedDecisions.clear();
+        __catalogTest.reset();
+    },
+};

package/src/shared/tag-owner-id.ts

@@ -13,6 +13,19 @@
 
 export const TEXT_TAG_IDENTITY_MARKER = ":mc-text-v1:";
 
+// SQLite LIKE folds ASCII case, but its binary ownership indexes cannot seek
+// that prefix. Enumerate the 32 spellings so range seeks retain LIKE's matches
+// without building a second index over every persisted tag.
+export const PI_FALLBACK_PREFIXES_JSON = JSON.stringify(
+    [..."pi-msg-"].reduce<string[]>(
+        (prefixes, char) =>
+            prefixes.flatMap((prefix) =>
+                /[a-z]/.test(char) ? [prefix + char, prefix + char.toUpperCase()] : [prefix + char],
+            ),
+        [""],
+    ),
+);
+
 const POSITIONAL_CONTENT_SUFFIX = /:(?:p|file)\d+$/;
 const CONTENT_DERIVED_TEXT_SUFFIX = /:mc-text-v1:[0-9a-f]+:[0-9a-f]+:o\d+$/;
 

package/src/shared/tag-transcript.ts

@@ -55,6 +55,7 @@ import {
     updateTagTokenCount,
 } from "../features/magic-context/storage-tags";
 import { makeToolCompositeKey, type Tagger } from "../features/magic-context/tagger";
+import type { TagEntry } from "../features/magic-context/types";
 import { droppedInputMarker } from "../hooks/magic-context/dropped-input-guard";
 import { applyEditMarkerToInput } from "../hooks/magic-context/edit-marker";
 import { estimateImageTokensFromDataUrl } from "../hooks/magic-context/image-token-estimate";
@@ -121,6 +122,122 @@ export interface TagTranscriptResult {
     targets: Map<number, TagTarget>;
 }
 
+/**
+ * Bind durable drops to a saved request without tagging it again. Recovery must
+ * not allocate identities, inject prefixes, or write accounting while the store
+ * is failing. Reuse the normal targets so persisted modes render identically.
+ */
+export function buildPersistedDropTargets(
+    transcript: Transcript,
+    tags: readonly TagEntry[],
+    options: { allowReasoningPrefixRewrite?: boolean } = {},
+): Map<number, TagTarget> {
+    const targets = new Map<number, TagTarget>();
+    const tools = new Map(
+        tags
+            .filter((tag) => tag.type === "tool")
+            .map((tag) => [makeToolCompositeKey(tag.toolOwnerMessageId ?? "", tag.messageId), tag]),
+    );
+    const textTags = new Map(
+        tags.filter((tag) => tag.type !== "tool").map((tag) => [tag.messageId, tag]),
+    );
+    const byNumber = new Map(tags.map((tag) => [tag.tagNumber, tag]));
+    const aggregates = new Map<
+        string,
+        { tag?: TagEntry; occurrences: ToolOccurrence[]; reasoning: boolean }
+    >();
+    const pending = new Map<string, string[]>();
+    const resolved = new Map<string, string>();
+    const ambiguousCalls = new Set<string>();
+    const end = new ConversationEndGuard(transcript.messages);
+    for (const message of transcript.messages) {
+        let ordinal = 0;
+        let resultRun: { callId: string; key: string } | undefined;
+        const parts = message.parts;
+        const reasoning =
+            message.requiresToolArcSkeleton ??
+            (message.info.role === "assistant" && parts.some((part) => part.kind === "thinking"));
+        for (const part of parts) {
+            if (part.kind !== "tool_result") resultRun = undefined;
+            if (part.kind === "text") {
+                const prefix = /^§(\d+)§\s/.exec(part.getText() ?? "");
+                const tag =
+                    (prefix ? byNumber.get(Number(prefix[1])) : undefined) ??
+                    textTags.get(`${message.info.id}:p${ordinal}`);
+                ordinal++;
+                if (tag && tag.type !== "tool")
+                    targets.set(tag.tagNumber, buildTextTarget(part, message, ""));
+            } else if ((part.kind === "tool_use" || part.kind === "tool_result") && part.id) {
+                const open = pending.get(part.id) ?? [];
+                if (open.length > 1) ambiguousCalls.add(part.id);
+                const key =
+                    (part.kind === "tool_result"
+                        ? resultRun?.callId === part.id
+                            ? resultRun.key
+                            : (open.at(-1) ?? resolved.get(part.id))
+                        : undefined) ?? makeToolCompositeKey(message.info.id ?? "", part.id);
+                if (part.kind === "tool_use") open.push(key);
+                else {
+                    const position = open.lastIndexOf(key);
+                    if (position >= 0) open.splice(position, 1);
+                    resultRun = { callId: part.id, key };
+                    resolved.set(part.id, key);
+                }
+                pending.set(part.id, open);
+                let aggregate = aggregates.get(key);
+                if (!aggregate) {
+                    aggregate = {
+                        tag: tools.get(key),
+                        occurrences: [],
+                        reasoning: false,
+                    };
+                    aggregates.set(key, aggregate);
+                }
+                aggregate.occurrences.push({ message, part, kind: part.kind });
+                aggregate.reasoning ||= reasoning;
+            }
+        }
+    }
+    const arcsByCall = new Map<string, number>();
+    for (const { occurrences } of aggregates.values()) {
+        const callId = occurrences[0]?.part.id ?? "";
+        arcsByCall.set(callId, (arcsByCall.get(callId) ?? 0) + 1);
+    }
+    for (const aggregate of aggregates.values()) {
+        const { occurrences, reasoning } = aggregate;
+        const callId = occurrences[0]?.part.id ?? "";
+        if (ambiguousCalls.has(callId)) continue;
+        const tag =
+            aggregate.tag ??
+            (arcsByCall.get(callId) === 1
+                ? tools.get(makeToolCompositeKey("", callId))
+                : undefined);
+        if (tag)
+            targets.set(
+                tag.tagNumber,
+                buildAggregateTarget(tag.tagNumber, occurrences, reasoning, end),
+            );
+    }
+    if (!options.allowReasoningPrefixRewrite) {
+        // This target builder cannot persist removal of thinking. By default,
+        // withhold edits before reasoning rather than invalidate its signature.
+        // The Pi recovery handler opts in only to test edits on a saved copy;
+        // it must compare final request prefixes and refuse unsafe changes.
+        let lastThinking = -1;
+        transcript.messages.forEach((message, index) => {
+            if (message.parts.some((part) => part.kind === "thinking")) lastThinking = index;
+        });
+        const protectedIds = new Set(
+            transcript.messages.slice(0, lastThinking + 1).map((message) => message.info.id),
+        );
+        for (const [number, target] of targets) {
+            if (target.mutationParts?.some(({ message }) => protectedIds.has(message.info.id)))
+                targets.delete(number);
+        }
+    }
+    return targets;
+}
+
 /**
  * Tag eligible parts of a transcript and build TagTargets for them.
  *
@@ -1288,6 +1405,7 @@ function buildAggregateTarget(
             return any ? "truncated" : "absent";
         },
         // Open invocations still belong to the current turn; only complete arcs reclaim.
+        prepareDrop: () => !occurrences.some((occ) => occ.part.canRemove?.() === "defer"),
         canDrop: () => complete() && !occurrences.some((occ) => occ.part.hasUserAnswer?.()),
         requiresToolArcSkeleton,
         // Non-mutating read of the invocation input (the tool_use occurrence