@rynx-ai/runtime 0.1.11-beta.2 → 0.1.11-beta.20

package/dist/runner/manager.d.ts

@@ -15,8 +15,8 @@
  * transport drops in here later without touching `ConversationRuntime` or any
  * channel.
  */
-import { spawn as nodeSpawn } from "node:child_process";
-import { type AgentCapabilities, type AgentRuntimeId, type AppConfig, type CapabilityResult, type ModelListResponse, type ResolvedExecutionSnapshot, type RuntimeUserInput, type SessionInteractionResolution, type SessionEvent, type SessionWorkspaceSnapshot, type ThreadGoal } from "@rynx-ai/core";
+import { spawn as nodeSpawn, type ChildProcess } from "node:child_process";
+import { type AdmissionReservation, type AgentCapabilities, type AgentRuntimeId, type AppConfig, type CapabilityResult, type ModelListResponse, type ResolvedExecutionSnapshot, type RuntimeUserInput, type SessionInteractionResolution, type SessionEvent, type SessionWorkspaceSnapshot, type ThreadGoal } from "@rynx-ai/core";
 import { type CodexSessionStore } from "../host.js";
 import type { ResolveInteractionResult } from "../interactions.js";
 import { type InjectOutcome, type TerminalOpenErrorCode, type TerminalRole } from "./protocol.js";
@@ -43,6 +43,9 @@ export interface RunnerManagerOptions {
     runnerEntry?: string;
     /** Idle TTL (ms) after which an unused runner is reaped. */
     idleTtlMs?: number;
+    /** Maximum time without user/control activity that an active response may
+     * protect a detached runner from idle reaping. */
+    staleActiveTtlMs?: number;
     /** Background reap sweep interval (ms); `0` disables the timer (tests). */
     reapIntervalMs?: number;
     /** Grace period between SIGTERM and SIGKILL during runner shutdown. */
@@ -53,8 +56,25 @@ export interface RunnerManagerOptions {
     liveStartTimeoutMs?: number;
     /** Max wait for a Provider-native thread to become ready. */
     liveReadyTimeoutMs?: number;
+    /** Claude SessionStart deadline. Codex/Traex use `liveStartTimeoutMs` for the
+     * pane/observer acknowledgement; their thread discovery is asynchronous. */
+    nativeLiveStartTimeoutMs?: number;
+    /** Max wait for a native interrupt acknowledgement before reporting it
+     * unproven. Callers may then use the explicit force-stop path. */
+    liveInterruptTimeoutMs?: number;
+    /** Max wait for an accepted owner TUI submission to become observable as a
+     * mirrored response or a published native rotation. */
+    terminalInputHandoffTimeoutMs?: number;
+    /** Initial exponential backoff for retrying unproven terminal cleanup. */
+    terminalInputCleanupRetryMs?: number;
     /** Injected for tests. */
     spawn?: typeof nodeSpawn;
+    /** Injected for tests. Defaults to signaling the whole POSIX process group
+     * created for the runner child, with direct-child fallback. */
+    signalChild?: (child: ChildProcess, signal: NodeJS.Signals, processGroup: boolean) => void;
+    /** Injected for tests. Kills and verifies the deterministic private tmux
+     * server owned by a Session runner. */
+    terminateTerminalServer?: (terminalName: string) => boolean | Promise<boolean>;
     now?: () => number;
     /** Extra env merged into every spawned runner child — e.g. the control-plane
      *  URL + token so a claude-native PermissionRequest hook can POST back. */
@@ -62,6 +82,13 @@ export interface RunnerManagerOptions {
     /** Optional lifecycle context for Session runners. The shared `__cap__`
      * runner never opens one. */
     sessionContextProvider?: RunnerSessionContextProvider;
+    /** Dynamic process-wide admission fence. Existing cancellation and read-only
+     * inspection remain available; every path that may spawn or attach execution
+     * checks this immediately before admission. */
+    admissionOpen?: () => boolean;
+    /** Atomically reserves one work-producing admission while it crosses the
+     * asynchronous boundary into an observable live runner/turn. */
+    admissionReserve?: () => AdmissionReservation | undefined;
 }
 /** A session rotation reported by a runner child (claude `/clear`·`/fork`): the
  *  new session `to` is now aliased to `from`'s runner; carries meta to carry over. */
@@ -115,9 +142,12 @@ export declare class RunnerManager implements AgentCapabilities {
     private readonly sessionStore;
     private readonly runnerEntry;
     private readonly idleTtlMs;
+    private readonly staleActiveTtlMs;
     private readonly spawn;
     private readonly childEnv;
     private readonly sessionContextProvider;
+    private readonly admissionOpen;
+    private readonly admissionReserve;
     private readonly now;
     private readonly defaultRuntime;
     private readonly handles;
@@ -127,8 +157,14 @@ export declare class RunnerManager implements AgentCapabilities {
     private readonly reapTimer;
     private readonly shutdownGraceMs;
     private readonly shutdownKillGraceMs;
+    private readonly signalChild;
+    private readonly terminateTerminalServer;
     private readonly liveStartTimeoutMs;
     private readonly liveReadyTimeoutMs;
+    private readonly nativeLiveStartTimeoutMs;
+    private readonly liveInterruptTimeoutMs;
+    private readonly terminalInputHandoffTimeoutMs;
+    private readonly terminalInputCleanupRetryMs;
     private stopping;
     private stopPromise;
     /** Sink for mirrored {@link SessionEvent}s from every session's forwarder. */
@@ -154,6 +190,9 @@ export declare class RunnerManager implements AgentCapabilities {
     private readonly forkOperations;
     private readonly forkBufferedMessages;
     private readonly forkBufferedTerminalInputs;
+    /** Owner TUI submissions accepted by the parent but not yet represented by a
+     * mirrored response or a durably published native rotation. */
+    private readonly terminalInputHandoffs;
     constructor(opts: RunnerManagerOptions);
     /**
      * Open a live terminal on the session's runner child (spawning it if needed).
@@ -181,11 +220,24 @@ export declare class RunnerManager implements AgentCapabilities {
     /** Register the sink for session rotations (claude `/clear`·`/fork`): the server
      *  records the new session's meta (carry-over agent/model/title). */
     onRotate(listener: (rotation: RotateInfo) => void | Promise<void>): void;
+    /** Accepted TUI submissions that have not crossed into an observable runtime
+     * state. The daemon folds this into runningTurns after closing admission. */
+    pendingTerminalInputCount(): number;
+    private beginTerminalInputHandoffs;
+    private settleTerminalInputHandoff;
+    private settleTerminalRotationHandoff;
+    private currentTerminalSessionId;
+    private finishTerminalInputHandoff;
+    private finishAllTerminalInputHandoffs;
+    private preserveTerminalInputHandoffsAsActivity;
+    private scheduleTerminalInputCleanupRetry;
+    private expireTerminalInputHandoffs;
     /**
      * Eagerly bring up a session's codex-native live view (persistent forwarder +
      * detached `codex --remote` TUI) in its runner child, spawning the runner if
-     * needed. Idempotent. Resolves true once the codex thread is bound; false for a
-     * non-codex / non-live session (the caller then uses the normal run path).
+     * needed. Idempotent. For Codex-lineage fresh sessions, resolves after the
+     * app-server/observer and pane are launched; thread discovery continues in
+     * parallel with injection. Other providers retain their readiness gate.
      */
     ensureLiveSession(localThreadId: string, opts: {
         workspace: SessionWorkspaceSnapshot;
@@ -211,6 +263,7 @@ export declare class RunnerManager implements AgentCapabilities {
      * the session has no live forwarder (caller falls back to the run path).
      */
     injectMessage(localThreadId: string, input: RuntimeUserInput | string): Promise<InjectOutcome>;
+    private injectMessageAdmitted;
     /**
      * Interrupt a session's active live turn — the web Stop button (codex
      * `turn/interrupt`, claude Escape). Best-effort: resolves false with NO spawn
@@ -243,13 +296,19 @@ export declare class RunnerManager implements AgentCapabilities {
     }): Promise<import("../host.js").CodexRuntimeStatus>;
     /** Stop the runner bound to one session (if any), rejecting its in-flight work. */
     stopRunner(localThreadId: string): void;
+    /** Force-stop and join the runner bound to one Session. Unlike stopRunner,
+     * completion proves that the child process has exited. */
+    terminateLiveSession(localThreadId: string): Promise<boolean>;
     /** Stop every runner and join all child exits. Idempotent across concurrent calls. */
     stop(): Promise<void>;
+    private handleForCleanup;
     /** Forward a capability to a runner child. Session-less caps (listModels/status)
      *  use the shared `CAP_KEY` child; per-thread caps pass the session's key so they
      *  run on that session's child (which owns its private CODEX_HOME). */
     private forwardCap;
     private getOrSpawn;
+    private assertAdmissionOpen;
+    private reserveAdmission;
     private performManagedFork;
     private performClaudeManagedFork;
     private bufferForkTargetMessage;
@@ -262,5 +321,14 @@ export declare class RunnerManager implements AgentCapabilities {
     private failHandle;
     private terminateHandle;
     private reapIdle;
+    /** Close server-side runtime state before fencing a Provider that stayed
+     * active past its hard inactivity deadline. The child transport is closed by
+     * terminateHandle immediately afterwards, so these are the final events for
+     * the abandoned responses. */
+    private failStaleActiveResponses;
+    private failActiveResponses;
+    /** Track only response lifecycle, not output volume. Output deltas from a
+     * runaway TUI/Provider must not refresh the stale-active deadline. */
+    private observeHandleRuntimeEvent;
     private openSessionContext;
 }