@stigmer/runner 3.12.2 → 3.12.4

package/src/activities/call-llm.ts

@@ -31,6 +31,7 @@ import {
 import { computeLlmCostMicros, ensureLoaded as ensurePricingLoaded } from "../shared/model-pricing.js";
 import { resolveToApiModelId } from "../shared/model-registry.js";
 import { buildChatModel } from "../shared/model-client.js";
+import { getRunnerSecret } from "../shared/runner-credential-store.js";
 import { checkDirectCredentials } from "../shared/llm-backend.js";
 import { classifyModelCallError } from "../shared/model-error.js";
 
@@ -41,7 +42,25 @@ export interface LlmCallConfig {
   readonly response_schema?: Record<string, unknown>;
   readonly temperature?: number;
   readonly max_tokens?: number;
+  /**
+   * Author-declared call budget in seconds (proto: LlmCallTaskConfig.timeout,
+   * 1-600). Bounds the provider request via buildChatModel's timeout seam;
+   * a breach fails non-retryably with LLM_TIMEOUT (#686). The engine widens
+   * the activity's startToClose to fit values above the default 5m.
+   */
   readonly timeout?: number;
+  /**
+   * Schema-validation policy (proto: LlmCallTaskConfig.on_invalid). The
+   * retry/fallback ORCHESTRATION lives in the workflow engine
+   * (call-function.ts, mirroring call-agent.ts); this activity only reads
+   * it to pick the failure channel: soft policies get a `parse_error`
+   * result the engine can act on, the default throws LLM_SCHEMA_VALIDATION.
+   */
+  readonly on_invalid?: string;
+  /** Engine-owned (see on_invalid); accepted here so config passes through. */
+  readonly max_retries?: number;
+  /** Engine-owned (see on_invalid); accepted here so config passes through. */
+  readonly fallback_task?: string;
 }
 
 export interface LlmCallResult {
@@ -142,6 +161,18 @@ function classifyAndThrowLlmError(
   );
 }
 
+/**
+ * Matches the request-timeout errors the provider SDKs raise when
+ * buildChatModel's timeout bound fires (OpenAI: APIConnectionTimeoutError
+ * "Request timed out."; Anthropic mirrors the shape). Only consulted when
+ * the task declared an explicit `timeout`, so the loose message match
+ * cannot reclassify errors on unbudgeted calls.
+ */
+function isRequestTimeoutError(err: unknown): boolean {
+  if (!(err instanceof Error)) return false;
+  return err.name === "APIConnectionTimeoutError" || /timed?\s*out/i.test(err.message);
+}
+
 export async function callLlmAction(
   config: LlmCallConfig,
   runtimeEnv: Record<string, unknown>,
@@ -162,7 +193,10 @@ export async function callLlmAction(
   await ensurePricingLoaded().catch(() => {});
 
   const proxyEndpoint = process.env.STIGMER_PROXY_ENDPOINT;
-  const stigmerToken = process.env.STIGMER_TOKEN;
+  // Per-call store read: rotation (manager updateToken / static renewal)
+  // must be visible to in-flight workers, exactly like the env read it
+  // replaced (#508).
+  const stigmerToken = getRunnerSecret("STIGMER_TOKEN");
   const proxyActive = !!(proxyEndpoint && stigmerToken);
 
   console.log(
@@ -185,6 +219,12 @@ export async function callLlmAction(
   // Anthropic requires an explicit maxTokens; preserve the 4096 default here
   // (buildChatModel intentionally imposes none). resolvedModel is already an
   // API id, so buildChatModel's resolve step is a no-op for it.
+  //
+  // maxRetries: 0 — Temporal owns retries for this activity (callProxy
+  // retries up to 5x). LangChain's default retry loop underneath would
+  // multiply that, and it also blind-retries schema-validation failures:
+  // before this was pinned to 0, one non-conforming structured response
+  // burned ~7 identical model calls before surfacing (#686).
   const { model } = await buildChatModel({
     modelName: resolvedModel,
     proxyEndpoint: proxyActive ? proxyEndpoint : undefined,
@@ -192,6 +232,10 @@ export async function callLlmAction(
     headerScope: { workflowExecutionId: executionId },
     temperature: config.temperature,
     maxTokens: provider === "anthropic" ? (config.max_tokens ?? 4096) : config.max_tokens,
+    // The author's per-call budget rides the same seam as the operator's
+    // STIGMER_LLM_REQUEST_TIMEOUT_MS (#468); an explicit value wins there.
+    timeoutMs: config.timeout ? config.timeout * 1000 : undefined,
+    maxRetries: 0,
   });
 
   const messages: (HumanMessage | SystemMessage)[] = [];
@@ -200,6 +244,14 @@ export async function callLlmAction(
   }
   messages.push(new HumanMessage(config.prompt));
 
+  // Soft schema-failure channel: when the engine will orchestrate
+  // ON_INVALID_RETRY / ON_INVALID_FALLBACK, a validation miss is a signal
+  // (parse_error result), not a failure — the engine re-prompts or
+  // branches. ON_INVALID_FAIL (and unset) keeps the throwing contract.
+  const softSchemaFailure =
+    config.on_invalid === "ON_INVALID_RETRY" ||
+    config.on_invalid === "ON_INVALID_FALLBACK";
+
   let result: LlmCallResult;
 
   try {
@@ -231,7 +283,31 @@ export async function callLlmAction(
       };
     }
   } catch (err) {
-    classifyAndThrowLlmError(err, modelId, provider, proxyActive);
+    if (softSchemaFailure && err instanceof z.ZodError) {
+      // Usage is unrecoverable here — the structured runnable throws
+      // before exposing the raw response (same loss as the throwing path).
+      result = {
+        input_tokens: 0,
+        output_tokens: 0,
+        result: undefined,
+        model: modelId,
+        provider,
+        parse_error: err.errors
+          .map((e) => `${e.path.join(".")}: ${e.message}`)
+          .join("; "),
+      };
+    } else if (config.timeout && isRequestTimeoutError(err)) {
+      // The author declared this budget in the task config; breaching it is
+      // a task failure they can catch, not a transient to retry — Temporal
+      // re-running the same over-budget call 5x would multiply the wait.
+      throw ApplicationFailure.nonRetryable(
+        `LLM call for model "${modelId}" timed out after ${config.timeout}s (task timeout)`,
+        "LLM_TIMEOUT",
+        { timeoutSeconds: config.timeout },
+      );
+    } else {
+      classifyAndThrowLlmError(err, modelId, provider, proxyActive);
+    }
   }
 
   const costMicros = computeLlmCostMicros(config.model, result.input_tokens, result.output_tokens);

package/src/activities/execute-cursor/__tests__/agent-session-cache.test.ts

@@ -0,0 +1,220 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  cacheSessionAgent,
+  closeAllCachedAgents,
+  computeAgentFingerprint,
+  evictSessionAgent,
+  takeCachedAgent,
+  _parkedAgentCountForTests,
+  _resetAgentSessionCacheForTests,
+  type CacheableAgent,
+} from "../agent-session-cache.js";
+
+function makeAgent(agentId = "agent-1"): CacheableAgent & { close: ReturnType<typeof vi.fn> } {
+  return { agentId, close: vi.fn() };
+}
+
+const FP = "fingerprint-a";
+const OTHER_FP = "fingerprint-b";
+
+describe("agent-session-cache", () => {
+  beforeEach(() => {
+    _resetAgentSessionCacheForTests();
+    delete process.env.STIGMER_CURSOR_AGENT_CACHE_TTL_MS;
+  });
+
+  afterEach(() => {
+    _resetAgentSessionCacheForTests();
+    vi.useRealTimers();
+  });
+
+  describe("checkout semantics", () => {
+    it("park then take returns the same agent without closing it", () => {
+      const agent = makeAgent();
+      cacheSessionAgent("ses-1", agent, FP);
+
+      const taken = takeCachedAgent("ses-1", FP, "agent-1");
+
+      expect(taken).toBe(agent);
+      expect(agent.close).not.toHaveBeenCalled();
+    });
+
+    it("checkout is exclusive — a second take misses", () => {
+      cacheSessionAgent("ses-1", makeAgent(), FP);
+
+      expect(takeCachedAgent("ses-1", FP, "agent-1")).toBeDefined();
+      expect(takeCachedAgent("ses-1", FP, "agent-1")).toBeUndefined();
+    });
+
+    it("an empty expectedAgentId (first-execution shape) still matches", () => {
+      const agent = makeAgent();
+      cacheSessionAgent("ses-1", agent, FP);
+
+      expect(takeCachedAgent("ses-1", FP, "")).toBe(agent);
+    });
+
+    it("misses for a different session", () => {
+      cacheSessionAgent("ses-1", makeAgent(), FP);
+
+      expect(takeCachedAgent("ses-2", FP, "agent-1")).toBeUndefined();
+      expect(_parkedAgentCountForTests()).toBe(1);
+    });
+  });
+
+  describe("reuse guards", () => {
+    it("fingerprint drift closes the parked agent and misses", () => {
+      const agent = makeAgent();
+      cacheSessionAgent("ses-1", agent, FP);
+
+      const taken = takeCachedAgent("ses-1", OTHER_FP, "agent-1");
+
+      expect(taken).toBeUndefined();
+      expect(agent.close).toHaveBeenCalledTimes(1);
+      expect(_parkedAgentCountForTests()).toBe(0);
+    });
+
+    it("agentId mismatch (harnessStateId replaced elsewhere) closes and misses", () => {
+      const agent = makeAgent("agent-old");
+      cacheSessionAgent("ses-1", agent, FP);
+
+      const taken = takeCachedAgent("ses-1", FP, "agent-new");
+
+      expect(taken).toBeUndefined();
+      expect(agent.close).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("lifetime bounds", () => {
+    it("re-parking a session closes the displaced agent", () => {
+      const first = makeAgent("agent-1");
+      const second = makeAgent("agent-2");
+      cacheSessionAgent("ses-1", first, FP);
+      cacheSessionAgent("ses-1", second, FP);
+
+      expect(first.close).toHaveBeenCalledTimes(1);
+      expect(takeCachedAgent("ses-1", FP, "agent-2")).toBe(second);
+    });
+
+    it("idle TTL evicts and closes", () => {
+      vi.useFakeTimers();
+      process.env.STIGMER_CURSOR_AGENT_CACHE_TTL_MS = "1000";
+      const agent = makeAgent();
+      cacheSessionAgent("ses-1", agent, FP);
+
+      vi.advanceTimersByTime(1001);
+
+      expect(agent.close).toHaveBeenCalledTimes(1);
+      expect(_parkedAgentCountForTests()).toBe(0);
+    });
+
+    it("checkout before the TTL fires disarms the eviction timer", () => {
+      vi.useFakeTimers();
+      process.env.STIGMER_CURSOR_AGENT_CACHE_TTL_MS = "1000";
+      const agent = makeAgent();
+      cacheSessionAgent("ses-1", agent, FP);
+
+      const taken = takeCachedAgent("ses-1", FP, "agent-1");
+      vi.advanceTimersByTime(5000);
+
+      expect(taken).toBe(agent);
+      expect(agent.close).not.toHaveBeenCalled();
+    });
+
+    it("the LRU cap closes the oldest parked agent", () => {
+      vi.useFakeTimers();
+      const first = makeAgent("agent-0");
+      cacheSessionAgent("ses-0", first, FP);
+      for (let i = 1; i < 32; i++) {
+        vi.advanceTimersByTime(1);
+        cacheSessionAgent(`ses-${i}`, makeAgent(`agent-${i}`), FP);
+      }
+
+      vi.advanceTimersByTime(1);
+      cacheSessionAgent("ses-32", makeAgent("agent-32"), FP);
+
+      expect(first.close).toHaveBeenCalledTimes(1);
+      expect(_parkedAgentCountForTests()).toBe(32);
+    });
+
+    it("an empty sessionId is never parked — the lease releases immediately", () => {
+      const agent = makeAgent();
+      cacheSessionAgent("", agent, FP);
+
+      expect(agent.close).toHaveBeenCalledTimes(1);
+      expect(_parkedAgentCountForTests()).toBe(0);
+    });
+  });
+
+  describe("explicit release", () => {
+    it("evictSessionAgent closes the parked agent", () => {
+      const agent = makeAgent();
+      cacheSessionAgent("ses-1", agent, FP);
+
+      evictSessionAgent("ses-1");
+
+      expect(agent.close).toHaveBeenCalledTimes(1);
+      expect(_parkedAgentCountForTests()).toBe(0);
+    });
+
+    it("closeAllCachedAgents closes everything (worker shutdown)", () => {
+      const a = makeAgent("agent-a");
+      const b = makeAgent("agent-b");
+      cacheSessionAgent("ses-a", a, FP);
+      cacheSessionAgent("ses-b", b, FP);
+
+      closeAllCachedAgents();
+
+      expect(a.close).toHaveBeenCalledTimes(1);
+      expect(b.close).toHaveBeenCalledTimes(1);
+      expect(_parkedAgentCountForTests()).toBe(0);
+    });
+
+    it("a close() that throws never breaks eviction", () => {
+      const agent = makeAgent();
+      agent.close.mockImplementation(() => {
+        throw new Error("already disposed");
+      });
+      cacheSessionAgent("ses-1", agent, FP);
+
+      expect(() => evictSessionAgent("ses-1")).not.toThrow();
+      expect(_parkedAgentCountForTests()).toBe(0);
+    });
+  });
+
+  describe("computeAgentFingerprint", () => {
+    const baseOptions = {
+      apiKey: "sk-secret-key",
+      model: "gpt-5",
+      modelParams: [{ key: "tier", value: "standard" }],
+      workspaceDirs: ["/workspace/app"],
+      mcpServers: { github: { command: "npx", env: { TOKEN: "t-1" } } },
+    };
+
+    it("is stable across key ordering", () => {
+      const reordered = {
+        mcpServers: { github: { env: { TOKEN: "t-1" }, command: "npx" } },
+        workspaceDirs: ["/workspace/app"],
+        modelParams: [{ key: "tier", value: "standard" }],
+        model: "gpt-5",
+        apiKey: "sk-secret-key",
+      };
+      expect(computeAgentFingerprint(baseOptions)).toBe(computeAgentFingerprint(reordered));
+    });
+
+    it("changes when any acquisition input changes", () => {
+      const base = computeAgentFingerprint(baseOptions);
+      expect(computeAgentFingerprint({ ...baseOptions, apiKey: "sk-rotated" })).not.toBe(base);
+      expect(computeAgentFingerprint({ ...baseOptions, model: "gpt-5-mini" })).not.toBe(base);
+      expect(
+        computeAgentFingerprint({
+          ...baseOptions,
+          mcpServers: { github: { command: "npx", env: { TOKEN: "t-2" } } },
+        }),
+      ).not.toBe(base);
+    });
+
+    it("never embeds the raw api key", () => {
+      expect(computeAgentFingerprint(baseOptions)).not.toContain("sk-secret-key");
+    });
+  });
+});

package/src/activities/execute-cursor/__tests__/service-tier.test.ts

@@ -19,10 +19,10 @@ vi.mock("@cursor/sdk", () => ({
 }));
 
 import {
-  resolveEffectiveServiceTier,
   resolveServiceTierParams,
   resetCatalogCacheForTests,
 } from "../service-tier.js";
+import { resolveEffectiveServiceTier } from "../../../shared/service-tier.js";
 
 const CATALOG = [
   {

package/src/activities/execute-cursor/__tests__/skill-resolver.test.ts

@@ -2,9 +2,17 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { mkdtempSync, readFileSync, existsSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
-import { resolveSkills } from "../skill-resolver.js";
+import { ConnectError, Code } from "@connectrpc/connect";
+import { resolveSkills, downloadArtifact } from "../skill-resolver.js";
 import { buildZip } from "../../../__test-utils__/zip-fixtures.js";
 
+/** A server that predates the transfer lane (#675) answers the mint RPC
+ * with UNIMPLEMENTED — the default posture for these tests, which keeps
+ * every pre-existing case pinned to the unary getSkillArtifact fallback. */
+function unimplementedMint() {
+  return vi.fn().mockRejectedValue(new ConnectError("unimplemented", Code.Unimplemented));
+}
+
 // ─── Helpers ─────────────────────────────────────────────────────────────
 
 function makeTempDir(prefix: string): string {
@@ -73,6 +81,7 @@ describe("resolveSkills — artifact extraction", () => {
     const client = {
       getSkillByReference: vi.fn(),
       getSkillArtifact: vi.fn().mockResolvedValue({ artifact: new Uint8Array(0) }),
+      getSkillArtifactDownloadUrl: unimplementedMint(),
       ...clientOverrides,
     } as any;
 
@@ -380,3 +389,97 @@ describe("resolveSkills — artifact extraction", () => {
     }
   });
 });
+
+// ─── downloadArtifact — transfer lane routing (#675) ─────────────────────
+
+describe("downloadArtifact — transfer lane routing", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  function makeClient(overrides: Record<string, any> = {}) {
+    return {
+      getSkillArtifact: vi.fn().mockResolvedValue({ artifact: new Uint8Array(0) }),
+      getSkillArtifactDownloadUrl: unimplementedMint(),
+      ...overrides,
+    } as any;
+  }
+
+  it("fetches bytes over HTTP when the server mints a download URL", async () => {
+    const bytes = new Uint8Array([1, 2, 3, 4, 5]);
+    const client = makeClient({
+      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
+        url: "http://localhost:7234/v1/skill-artifacts/skills/abc.zip",
+        sizeBytes: 5n,
+        ttlSeconds: 0,
+      }),
+    });
+    const fetchMock = vi.fn().mockResolvedValue({
+      ok: true,
+      arrayBuffer: async () => bytes.buffer,
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    const got = await downloadArtifact(client, "skills/abc.zip");
+
+    expect(got).toEqual(bytes);
+    expect(fetchMock).toHaveBeenCalledWith("http://localhost:7234/v1/skill-artifacts/skills/abc.zip");
+    // The unary lane (10MB-capped) must not be touched when the URL lane works.
+    expect(client.getSkillArtifact).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the unary RPC when the server predates the lane", async () => {
+    const bytes = new Uint8Array([9, 9]);
+    const client = makeClient({
+      getSkillArtifact: vi.fn().mockResolvedValue({ artifact: bytes }),
+    });
+    vi.stubGlobal("fetch", vi.fn()); // must never be called
+
+    const got = await downloadArtifact(client, "skills/abc.zip");
+
+    expect(got).toEqual(bytes);
+    expect(client.getSkillArtifact).toHaveBeenCalledWith("skills/abc.zip");
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it("does NOT fall back on non-Unimplemented mint failures", async () => {
+    const client = makeClient({
+      getSkillArtifactDownloadUrl: vi.fn().mockRejectedValue(
+        new ConnectError("boom", Code.Internal),
+      ),
+    });
+
+    await expect(downloadArtifact(client, "skills/abc.zip")).rejects.toThrow("boom");
+    // Falling back here would mask real server faults behind the capped lane.
+    expect(client.getSkillArtifact).not.toHaveBeenCalled();
+  });
+
+  it("rejects truncated fetches via the minted size", async () => {
+    const client = makeClient({
+      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
+        url: "http://localhost:7234/v1/skill-artifacts/skills/abc.zip",
+        sizeBytes: 100n,
+        ttlSeconds: 0,
+      }),
+    });
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
+      ok: true,
+      arrayBuffer: async () => new Uint8Array([1, 2, 3]).buffer,
+    }));
+
+    await expect(downloadArtifact(client, "skills/abc.zip")).rejects.toThrow(/truncated/);
+  });
+
+  it("surfaces HTTP failures with the status code", async () => {
+    const client = makeClient({
+      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
+        url: "http://localhost:7234/v1/skill-artifacts/skills/gone.zip",
+        sizeBytes: 0n,
+        ttlSeconds: 0,
+      }),
+    });
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false, status: 404 }));
+
+    await expect(downloadArtifact(client, "skills/gone.zip")).rejects.toThrow(/HTTP 404/);
+  });
+});