@superblocksteam/vite-plugin-file-sync 2.0.170-next.1 → 2.0.171-next.0

package/dist/ai-service/index.js

@@ -11,6 +11,7 @@ import { npmRegistryEmitter } from "@superblocksteam/telemetry";
 import { applyTestApiDenialSideEffects, buildMigrationTestApiDenialContinuationPrompt, } from "../migration/mark-api-testing-denied.js";
 import { buildTranslationPrompt } from "../migration/translation-prompt.js";
 import { POLICY_GATE_RUN_IN_PROGRESS_ERROR, policyGateRunRegistry, } from "../policy-gate-run-registry.js";
+import { GenerationWaitTimeoutError } from "../util/generation-wait-timeout-error.js";
 import { getErrorMeta, getLogger, setDefaultLogger } from "../util/logger.js";
 import { OperationQueue } from "../util/operation-queue.js";
 import { composeSecurityAgentPrompt, } from "./agent/prompts/build-security-scan-prompt.js";
@@ -41,6 +42,7 @@ import { ChatSessionStore } from "./chat/chat-session-store.js";
 import { normalizeTextAttachmentForModel } from "./chat/utils.js";
 import { API_MIGRATION_ORIGINS, cancelPolicyRemediation, seedPolicyRemediationChecklist, isApiMigrationOrigin, readPersistedChecklist, readRemediationRun, updateChecklistItem, advancePolicyRemediationTurn, MAX_REMEDIATION_TURNS, failPolicyRemediationDispatch, } from "./checklist/persisted-checklist-store.js";
 import { fetchRemediationFindings } from "./checklist/remediation-findings-client.js";
+import { recordDeferredContextClear, registerPendingContextClearSource, } from "./context-clear-metrics.js";
 import { downloadContextFromBucketeer, downloadLatestContextFromBucketeer, restoreContextFromCheckpoint, } from "./context-download.js";
 import { restoreConversationToCheckpoint, } from "./context-restore.js";
 import { uploadContextToBucketeer } from "./context-upload.js";
@@ -68,6 +70,7 @@ import { adoptLegacyPerUserContextDirs } from "./llm/context-v2/storage/legacy-c
 import { LocalContextStorageV2 } from "./llm/context-v2/storage/local.js";
 import { buildRestoredContextUsageSnapshot } from "./llm/context-v2/token-tracker.js";
 import { toJsonValue, } from "./llm/context-v2/types.js";
+import { sanitizeFilename } from "./llm/context-v2/uniquify-filenames.js";
 import { createLLMProvider, setSpanError } from "./llm/provider.js";
 import { createAbortReason } from "./llm/stream/abort-reason.js";
 import { getJwtTraceTags, traceLLM } from "./llmobs/helpers.js";
@@ -108,7 +111,8 @@ import { finalizePolicyGateUsageMetrics, policyGateFailureFromStream, recordPoli
 import { finalizePromptBillingMetrics } from "./state-machine/helpers/prompt-billing-metrics.js";
 import { setPromptDegradationMetricIdentity } from "./state-machine/helpers/prompt-degradation-metrics.js";
 import { paywallStopAdvice } from "./state-machine/helpers/prompt-failure.js";
-import { CLARK_USAGE_ORIGIN, promptFailureFromStreamAbort, promptFailurePaywall, promptFailurePlatform, promptFailureUserCanceled, PROMPT_ATTEMPT_ENTRYPOINT, recordBaseCommitResolutionFailed, recordPromptAttempt, recordPromptEntryRejection, recordPromptOutcome, recordAwaitingUserHandoffDismissed, resolvePromptMetricLabels, resolvePromptOutcomeDedupeKey, resolvePromptRequestDedupeKey, setPromptRequestMetricIdentity, } from "./state-machine/helpers/prompt-request-metrics.js";
+import { orgClaimsFromJwt } from "./state-machine/helpers/prompt-org-claims.js";
+import { CLARK_USAGE_ORIGIN, promptFailureFromStreamAbort, promptFailurePaywall, promptFailurePlatform, promptFailureUserCanceled, PROMPT_ATTEMPT_ENTRYPOINT, recordBaseCommitResolutionFailed, recordPromptAttempt, recordPromptEntryRejection, recordPromptOutcome, recordAwaitingUserHandoffDismissed, resolvePromptMetricLabels, resolvePromptOutcomeDedupeKey, resolvePromptRequestDedupeKey, setPromptOrgClaims, setPromptRequestMetricIdentity, } from "./state-machine/helpers/prompt-request-metrics.js";
 import { catchBackgroundPeerDisconnect, StablePeer, } from "./state-machine/helpers/stable-peer.js";
 import { transitionFrom } from "./state-machine/helpers/transition.js";
 import { resolveUserPreferences } from "./state-machine/helpers/user-preferences.js";
@@ -116,7 +120,7 @@ import { createUserResponseMessage } from "./state-machine/helpers/user-response
 import { isTaskAccessibleTo, registerBackgroundTaskTypes, resyncActiveTaskStatusesToPeer, TaskStore, wireTaskStatusPushToPeer, } from "./tasks/index.js";
 import { TemplateRenderer } from "./template-renderer.js";
 import { describeMigrationInferenceJwt, isUsableMigrationInferenceJwt, } from "./util/inference-jwt.js";
-import { buildModelConfigAttributes, processLLMConfig, } from "./util/llm-config-utils.js";
+import { buildModelConfigAttributes, processLLMConfig, processOneShotLLMConfig, } from "./util/llm-config-utils.js";
 import { parseJwt } from "./util/parse-jwt.js";
 import { PERMISSION_PROMPT_DELIVERY_TIMEOUT_MS } from "./util/rpc-timeout.js";
 import { getToolCallSignature } from "./util/tool-signature.js";
@@ -512,6 +516,21 @@ export class AiService extends TracedEventEmitter {
     activeGenerationTrace;
     currentGenerationId;
     generationStarting = false;
+    /**
+     * The context, and why, that a busy editor disconnect or connection reset
+     * left to be cleared once the turn settles (see `releaseEditorContext`).
+     * `deferredAt` is the epoch ms when the clear was deferred, logged as
+     * `pendingMs` and reported by the pending-age gauge, so a deferral that
+     * never resolves stands out from a long turn. `departedPeerId` is the
+     * editor whose departure deferred it. It is logged on every lifecycle
+     * event for correlation, not compared against the rebinding peer: the
+     * browser mints a new peerId on every page load, so inequality cannot
+     * tell a reload from a different user.
+     * Plain state rather than a per-disconnect listener:
+     * `TracedEventEmitter.on` wraps listeners, so `off`/`once` cannot remove
+     * them.
+     */
+    pendingContextClear;
     /** JWT-derived userId of the currently-authenticated peer, set by
      * `notifyAuthenticatedRpc` and cleared on disconnect / peer swap.
      * Only trusted while `authenticatedPeerId` still matches the bound
@@ -773,6 +792,8 @@ export class AiService extends TracedEventEmitter {
             organizationId: config.organizationId,
         });
         this.startLiveEditEventForwarding();
+        this.on("generationSettled", (generationId) => this.runPendingContextClear(generationId));
+        registerPendingContextClearSource(() => this.pendingContextClear?.deferredAt);
         // Store the wrapped logger so getLogger() can return it
         // The wrapped logger forwards logs to the browser console when Clark logs are enabled
         this._logger = getLogger();
@@ -2680,6 +2701,9 @@ export class AiService extends TracedEventEmitter {
     }
     async handleAiGenerate(request, inputSource, remediationContinuationSignal) {
         this.getLogger().info(`[ai-service] handleAiGenerate: peerId=${this.stablePeer.peerId ?? "unknown"}`);
+        // Before the first rejection below: a rejected prompt is an attempt and an
+        // outcome too, and carries this request's plan, not an earlier prompt's.
+        setPromptOrgClaims(orgClaimsFromJwt(request.jwt));
         this.storeMigrationTurnCredentials(request.jwt, request.llmConfig);
         if (this.clark.state === ClarkStateNames.Dead) {
             recordPromptEntryRejection({
@@ -2742,8 +2766,14 @@ export class AiService extends TracedEventEmitter {
                     return;
                 }
             }
-            const remediation = request.policyGateRemediation?.batched === true
-                ? request.policyGateRemediation
+            // Checklist batching needs review findings. Dependency-scan attribution
+            // (inbox CVE Fix with Clark) can carry batched from the feature flag but
+            // has no reviewFindingIds, so keep billing metadata without seeding.
+            const reviewFindingIds = request.policyGateRemediation?.reviewFindingIds;
+            const remediation = request.policyGateRemediation?.batched === true &&
+                reviewFindingIds != null &&
+                reviewFindingIds.length > 0
+                ? { ...request.policyGateRemediation, reviewFindingIds }
                 : undefined;
             if (!remediation &&
                 !request.responseMetadata &&
@@ -3049,7 +3079,7 @@ export class AiService extends TracedEventEmitter {
                     thinkingEnabled: false,
                 }
                 : undefined;
-            const { providerOptions, headers } = processLLMConfig(llmConfig, 5000, `AI Summarize API Usage (${request.apiName})`);
+            const { providerOptions, headers } = processOneShotLLMConfig(llmConfig, 5000, `AI Summarize API Usage (${request.apiName})`);
             const llmProviderSettings = this.getLLMProviderSettings(llmConfig);
             const llmProvider = createLLMProvider(llmProviderSettings, () => this.requireProvidedInferenceJwt(request.jwt, "live-edit request"), llmConfig, () => helperSystemAiAttributes({
                 applicationId: this.config.applicationId,
@@ -3156,7 +3186,7 @@ export class AiService extends TracedEventEmitter {
                     thinkingEnabled: false,
                 }
                 : undefined;
-            const { providerOptions, headers } = processLLMConfig(llmConfig, 2000, `AI Summarize Error`);
+            const { providerOptions, headers } = processOneShotLLMConfig(llmConfig, 2000, `AI Summarize Error`);
             const llmProviderSettings = this.getLLMProviderSettings(llmConfig);
             const llmProvider = createLLMProvider(llmProviderSettings, () => this.requireProvidedInferenceJwt(request.jwt, "live-edit request"), llmConfig, () => helperSystemAiAttributes({
                 applicationId: this.config.applicationId,
@@ -3246,7 +3276,7 @@ export class AiService extends TracedEventEmitter {
                     thinkingEnabled: false,
                 }
                 : undefined;
-            const { providerOptions, headers } = processLLMConfig(llmConfig, 2000, `AI Summarize Destructive Migration`);
+            const { providerOptions, headers } = processOneShotLLMConfig(llmConfig, 2000, `AI Summarize Destructive Migration`);
             const llmProviderSettings = this.getLLMProviderSettings(llmConfig);
             const llmProvider = createLLMProvider(llmProviderSettings, () => this.requireProvidedInferenceJwt(request.jwt, "live-edit request"), llmConfig, () => helperSystemAiAttributes({
                 applicationId: this.config.applicationId,
@@ -3414,15 +3444,24 @@ export class AiService extends TracedEventEmitter {
                 type: "file",
                 data,
                 mediaType,
-                filename: resolveAttachmentFileName({
+                // Labeling skips uniquifyFilePartFilenames (stateless generateObject).
+                // Bedrock still rejects the original filename on document.name.
+                filename: sanitizeFilename(resolveAttachmentFileName({
                     fileName: attachment.fileName,
                     mediaType,
                     type: attachment.type,
-                }),
+                })),
             };
         }
         if (isUploadedAttachment(attachment)) {
-            return toUploadedAttachmentContentPart(attachment);
+            const uploaded = toUploadedAttachmentContentPart(attachment);
+            if (uploaded.type === "file" && typeof uploaded.filename === "string") {
+                const filename = sanitizeFilename(uploaded.filename);
+                if (filename !== uploaded.filename) {
+                    return { ...uploaded, filename };
+                }
+            }
+            return uploaded;
         }
         const normalizedTextAttachment = normalizeTextAttachmentForModel(attachment);
         if (normalizedTextAttachment) {
@@ -3666,6 +3705,9 @@ export class AiService extends TracedEventEmitter {
      */
     async handleAiGenerateWithQueue(request, mode, inputSource) {
         this.getLogger().info(`[ai-service] handleAiGenerateWithQueue: peerId=${this.stablePeer.peerId ?? "unknown"}, mode=${mode}`);
+        // Covers the dead rejection here and the paywall rejection on the
+        // interrupt path; the not-busy path sets it again in handleAiGenerate.
+        setPromptOrgClaims(orgClaimsFromJwt(request.jwt));
         if (this.clark.state === ClarkStateNames.Dead) {
             recordPromptEntryRejection({
                 dedupeKey: resolvePromptRequestDedupeKey(request),
@@ -4025,6 +4067,7 @@ export class AiService extends TracedEventEmitter {
                 return;
             }
             this.clark.updateContext({ promptOutcomeDedupeKey });
+            setPromptOrgClaims(orgClaimsFromJwt(this.clark.context.jwt));
             recordPromptAttempt({
                 coreModel: this.clark.context.llmConfig?.coreModel,
                 entrypoint: PROMPT_ATTEMPT_ENTRYPOINT.tool_permission_continuation,
@@ -4490,6 +4533,14 @@ export class AiService extends TracedEventEmitter {
         // inner (and peerId) here. Any queued calls accumulated while
         // disconnected flush in order as part of setInner.
         this.stablePeer.setInner({ liveness, peer, peerId });
+        // A rebind means a disconnect that deferred clearing the live context
+        // (because the turn was still busy) no longer applies: this session
+        // keeps reading/writing the same cached instance, so a later turn-settle
+        // must not dispose it out from under it.
+        this.cancelPendingContextClear({
+            reason: "editor_rebound",
+            reboundPeerId: peerId,
+        });
         this.getLogger().info(`[ai-service] Peer set: ${peerId}`);
         // A replacement (or freshly reconnecting) peer must re-prove its
         // identity via `notifyAuthenticatedRpc` before live task pushes
@@ -4773,14 +4824,19 @@ export class AiService extends TracedEventEmitter {
             isBusy: this.isBusy(),
             peerId,
         });
-        if (contextId) {
-            this.contextManagerV2.clearContext(contextId);
+        // A surviving editor takes over the running turn and keeps writing to
+        // the live context, so a busy handoff schedules no clear at all.
+        const survivor = replacement && (replacement.peerId !== peerId || liveness)
+            ? replacement
+            : undefined;
+        if (contextId && !(survivor && this.isBusy())) {
+            this.releaseEditorContext(contextId, "editor_disconnect", peerId);
         }
-        if (replacement && (replacement.peerId !== peerId || liveness)) {
-            this.getLogger().info(`[ai-service] Rebinding peer ${peerId} to surviving editor ${replacement.peerId}`);
+        if (survivor) {
+            this.getLogger().info(`[ai-service] Rebinding peer ${peerId} to surviving editor ${survivor.peerId}`);
             // Same door a fresh tab comes through, so the survivor gets the state
             // resync and re-auth a newly bound peer is owed.
-            this.handleUserConnected(replacement.peer, replacement.peerId, replacement.liveness);
+            this.handleUserConnected(survivor.peer, survivor.peerId, survivor.liveness);
             return;
         }
         this.clearPeerConnection();
@@ -4794,8 +4850,9 @@ export class AiService extends TracedEventEmitter {
     resetEditorConnection() {
         try {
             const contextId = this.getContextId();
-            if (contextId)
-                this.contextManagerV2.clearContext(contextId);
+            if (contextId) {
+                this.releaseEditorContext(contextId, "editor_connection_reset", this.stablePeer.peerId);
+            }
         }
         finally {
             this.pendingTaskResyncPeerIds.clear();
@@ -4805,6 +4862,115 @@ export class AiService extends TracedEventEmitter {
             this.stablePeer.closeAndRejectPendingRequests();
         }
     }
+    /**
+     * The single place that decides what happens to the context when its
+     * editor goes away. Idle: clear now, replacing any clear still pending
+     * from an earlier disconnect. Busy: defer until the turn settles, so the
+     * still-running turn keeps writing to the live `ContextV2` instance
+     * instead of having it disposed out from under it.
+     */
+    releaseEditorContext(contextId, cause, departedPeerId) {
+        if (this.isBusy()) {
+            this.scheduleDeferredContextClear(contextId, cause, departedPeerId);
+            return;
+        }
+        this.contextManagerV2.clearContext(contextId, cause);
+        this.cancelPendingContextClear({ reason: "cleared_immediately" });
+    }
+    /**
+     * `contextId` is the one captured when the editor went away, not
+     * re-derived at settle time: `getContextId()` depends on session/app state
+     * that New Chat and checkpoint restore clear through their own paths, so
+     * re-reading it could resolve a different context than the one the turn
+     * was writing to. A second busy release before the first settles keeps the
+     * first pending clear: the context cannot change without a rebind, and a
+     * rebind cancels it.
+     */
+    scheduleDeferredContextClear(contextId, cause, departedPeerId) {
+        if (this.pendingContextClear) {
+            return;
+        }
+        this.getLogger().info("[ai-service] Deferring Clark context clear until the turn settles", {
+            cause,
+            contextId,
+            departedPeerId,
+            event: "clark_stream.context_clear_deferred",
+        });
+        this.pendingContextClear = {
+            cause,
+            contextId,
+            deferredAt: Date.now(),
+            departedPeerId,
+        };
+        recordDeferredContextClear("deferred", cause);
+    }
+    /**
+     * Runs on every `generationSettled`. That event also fires for superseded
+     * generation IDs, so a settle that arrives while `isBusy()` is still true
+     * leaves the clear pending. Whether an editor rebound in the meantime is
+     * decided once, in `handleUserConnected`, which cancels the pending clear.
+     *
+     * There is deliberately no timeout. Every way `isBusy()` turns false emits
+     * a later settle: the FSM sets its state before running the Idle,
+     * AwaitingUser, or Dead handler that emits it, and a generation that never
+     * starts emits it after resetting `generationStarting`. A clear that stays
+     * pending therefore means a turn is still running, and clearing then is
+     * exactly the post-disconnect write loss this deferral prevents. A turn
+     * that never settles shows up as a growing
+     * `superblocks.clark.context_clear.pending_age`.
+     */
+    runPendingContextClear(generationId) {
+        const pending = this.pendingContextClear;
+        if (!pending) {
+            return;
+        }
+        if (this.isBusy()) {
+            this.getLogger().info("[ai-service] Clark context clear still deferred: a turn is running", {
+                cause: pending.cause,
+                contextId: pending.contextId,
+                departedPeerId: pending.departedPeerId,
+                event: "clark_stream.context_clear_still_deferred",
+                generationId,
+                pendingMs: Date.now() - pending.deferredAt,
+            });
+            return;
+        }
+        this.pendingContextClear = undefined;
+        this.getLogger().info("[ai-service] Running deferred Clark context clear after the turn settled", {
+            cause: pending.cause,
+            contextId: pending.contextId,
+            departedPeerId: pending.departedPeerId,
+            event: "clark_stream.context_clear_ran",
+            generationId,
+            pendingMs: Date.now() - pending.deferredAt,
+        });
+        recordDeferredContextClear("ran", pending.cause);
+        this.contextManagerV2.clearContext(pending.contextId, pending.cause);
+    }
+    /**
+     * Drops a deferred clear scheduled by {@link scheduleDeferredContextClear}
+     * without running it: on a rebind, so the live `ContextV2` instance the
+     * reconnecting editor reads/writes stays in use, or when an idle release
+     * clears the context immediately instead. Any rebind cancels, whoever the
+     * user is: contexts are app-scoped, so a different user rebinding reads
+     * and writes the same context.
+     */
+    cancelPendingContextClear(cancellation) {
+        const pending = this.pendingContextClear;
+        if (!pending) {
+            return;
+        }
+        this.pendingContextClear = undefined;
+        recordDeferredContextClear(cancellation.reason, pending.cause);
+        this.getLogger().info("[ai-service] Cancelled deferred Clark context clear", {
+            ...cancellation,
+            cause: pending.cause,
+            contextId: pending.contextId,
+            departedPeerId: pending.departedPeerId,
+            event: "clark_stream.context_clear_cancelled",
+            pendingMs: Date.now() - pending.deferredAt,
+        });
+    }
     /**
      * The bound editor's transport is gone, but a reconnect for the same peer
      * is already open and on its way to proving its authorization. The
@@ -5567,7 +5733,7 @@ export class AiService extends TracedEventEmitter {
             (await this.chatSessionStore.getLatestCommitId());
         await this.chatSessionStore.newChat();
         try {
-            await this.contextManagerV2.clearAllContexts();
+            await this.contextManagerV2.clearAllContexts("new_chat");
             // Persist an empty context locally and upload it to Bucketeer so
             // the remote restore fallback downloads an empty conversation
             // instead of the one the user just cleared (APPS-4407).
@@ -5635,7 +5801,7 @@ export class AiService extends TracedEventEmitter {
         this.clark.updateContext({ resumeAfterAuthFailure: undefined });
         this.clark.clearLastContextUsage?.();
         const contextId = getContextId(this.clark, this.config);
-        await this.contextManagerV2.clearAllContexts();
+        await this.contextManagerV2.clearAllContexts("clear_all");
         if (contextId) {
             await this.contextManagerV2.persistEmptyContext(contextId);
         }
@@ -5877,7 +6043,6 @@ export class AiService extends TracedEventEmitter {
         }
     }
     async handleApiUpdate(update) {
-        void this.appContext.handleApiUpdate(update.payload);
         if (update.author === "clark") {
             return;
         }
@@ -5968,7 +6133,7 @@ export class AiService extends TracedEventEmitter {
                 if (!this.generationCompleteWaiters.delete(complete)) {
                     return;
                 }
-                const error = new Error(`generation completion wait timed out after ${GENERATION_COMPLETION_WAIT_TIMEOUT_MS}ms`);
+                const error = new GenerationWaitTimeoutError(GENERATION_COMPLETION_WAIT_TIMEOUT_MS);
                 this.getLogger().warn(`[ai-service] ${error.message}`);
                 reject(error);
             }, GENERATION_COMPLETION_WAIT_TIMEOUT_MS);