@superjackfruitlabs/salaam 0.0.3 → 0.0.5

package/dist/src/rate-limit-retries.js

@@ -0,0 +1,62 @@
+/**
+ * A provider 429 on a step is retried as a fresh admitted attempt of that step, after a backoff,
+ * up to RATE_LIMIT_MAX_FAILURES rate-limited attempts in all. Each retry is a new attempt with its
+ * own admission and budget charge, never a replay of the refused request. After the last one the
+ * task stops with RATE_LIMIT_STOP, a block the stopped-run recovery can prove and settle.
+ */
+export const RATE_LIMIT_MAX_FAILURES = 3;
+export const RATE_LIMIT_BACKOFF_MS = [30_000, 60_000, 120_000];
+export const RATE_LIMIT_STOP = 'Provider rate limit reached';
+export class RateLimitRetries {
+    store;
+    constructor(store) {
+        this.store = store;
+        store.db.exec(`CREATE TABLE IF NOT EXISTS task_rate_limits(
+      task_id TEXT NOT NULL,
+      step_id TEXT NOT NULL,
+      attempt_id TEXT NOT NULL UNIQUE,
+      failures INTEGER NOT NULL,
+      retry_at INTEGER NOT NULL,
+      PRIMARY KEY(task_id, step_id, failures))`);
+    }
+    /** Whether this attempt failed because the provider rate-limited it. */
+    rateLimited(attempt) {
+        const row = this.store.db.prepare('SELECT state,outcome FROM attempts WHERE id=?').get(attempt);
+        if (!row || row.state !== 'failed' || typeof row.outcome !== 'string')
+            return false;
+        try {
+            return JSON.parse(row.outcome)?.failure?.kind === 'rate_limit';
+        }
+        catch {
+            return false;
+        }
+    }
+    /** What the driver does with a task whose step failed. Records each rate-limited attempt once. */
+    decide(task, now = Date.now()) {
+        const failed = task.steps.filter((s) => ['failed', 'interrupted', 'cancelled'].includes(s.state));
+        const step = failed[0];
+        if (failed.length !== 1 || !step || step.state !== 'failed' || !step.attempt_id)
+            return { action: 'none' };
+        if (!this.rateLimited(step.attempt_id))
+            return { action: 'none' };
+        let row = this.store.db
+            .prepare('SELECT failures,retry_at FROM task_rate_limits WHERE attempt_id=?')
+            .get(step.attempt_id);
+        if (!row) {
+            const prior = Number(this.store.db
+                .prepare('SELECT count(*) AS n FROM task_rate_limits WHERE task_id=? AND step_id=?')
+                .get(task.id, step.id).n);
+            const failures = prior + 1;
+            const retry_at = now + (RATE_LIMIT_BACKOFF_MS[failures - 1] ?? RATE_LIMIT_BACKOFF_MS.at(-1));
+            this.store.db
+                .prepare('INSERT INTO task_rate_limits VALUES (?,?,?,?,?)')
+                .run(task.id, step.id, step.attempt_id, failures, retry_at);
+            row = { failures, retry_at };
+        }
+        if (row.failures >= RATE_LIMIT_MAX_FAILURES)
+            return { action: 'stop', reason: RATE_LIMIT_STOP };
+        if (now < row.retry_at)
+            return { action: 'wait' };
+        return { action: 'retry', step: step.id, n: row.failures };
+    }
+}

package/dist/src/recurring-work.js

@@ -110,6 +110,7 @@ export class RecurringWork {
                     checks,
                 })),
                 acceptance: task.acceptance,
+                ...(task.completion_gate ? { completion_gate: task.completion_gate } : {}),
                 deliverables: task.deliverables,
                 limits: task.limits,
             };

package/dist/src/repository-snapshots.js

@@ -54,9 +54,12 @@ export class RepositorySnapshots {
     }
     read(binding, args) {
         const tree = this.tree(binding), action = string(args.action, 'action', 32), offset = integer(args.offset ?? 0, 'offset');
+        // A snapshot-only reviewer (the critic) has no workspace; leave those fields out rather than
+        // undefined, since every read result is digested into the journal (card_5dcbd5d9be5c4183).
         const identity = {
-            workspace_id: binding.workspace?.id,
-            revision: binding.workspace?.revision,
+            ...(binding.workspace
+                ? { workspace_id: binding.workspace.id, revision: binding.workspace.revision }
+                : {}),
             digest: binding.repository.digest,
             artifact_id: binding.repository.artifact_id,
         };

package/dist/src/run-grants.js

@@ -0,0 +1,62 @@
+import { randomUUID } from 'node:crypto';
+export const runGrantPrefix = (runId) => /^run_[A-Za-z0-9]{6,}$/.test(runId) ? `runs/${runId}/` : null;
+/** Whether a station patch's arguments are a write a grant for this prefix may answer. */
+export function runGrantCovers(prefix, args) {
+    if (args.action !== 'patch' || typeof args.content !== 'string')
+        return false;
+    const path = args.path;
+    if (typeof path !== 'string' || !path.startsWith(prefix) || path.length === prefix.length)
+        return false;
+    return path.split('/').every((s) => s !== '' && s !== '.' && s !== '..' && !s.startsWith('.'));
+}
+export class RunGrants {
+    store;
+    constructor(store) {
+        this.store = store;
+        store.db.exec(`CREATE TABLE IF NOT EXISTS run_grants(
+      id TEXT PRIMARY KEY NOT NULL,
+      session_id TEXT NOT NULL,
+      task_id TEXT NOT NULL,
+      plan_revision INTEGER NOT NULL,
+      binding_digest TEXT NOT NULL,
+      path_prefix TEXT NOT NULL,
+      approval_id TEXT NOT NULL UNIQUE,
+      granted_by TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      revoked_at TEXT)`);
+    }
+    /** Within the caller's transaction, next to the decision that granted it. Idempotent per approval. */
+    createInTransaction(input) {
+        if (!this.store.db.isTransaction)
+            throw Error('A run grant is created with its decision');
+        const saved = this.store.db
+            .prepare('SELECT * FROM run_grants WHERE approval_id=?')
+            .get(input.approval_id);
+        if (saved)
+            return saved;
+        const grant = {
+            ...input,
+            id: randomUUID(),
+            created_at: new Date().toISOString(),
+            revoked_at: null,
+        };
+        this.store.db
+            .prepare('INSERT INTO run_grants VALUES (?,?,?,?,?,?,?,?,?,?)')
+            .run(grant.id, grant.session_id, grant.task_id, grant.plan_revision, grant.binding_digest, grant.path_prefix, grant.approval_id, grant.granted_by, grant.created_at, null);
+        this.store.event(grant.session_id, 'run_grant.created', {
+            grant_id: grant.id,
+            approval_id: grant.approval_id,
+            task_id: grant.task_id,
+            path_prefix: grant.path_prefix,
+        });
+        return grant;
+    }
+    /** The live grant for exactly this session, task, plan revision and binding, if any. */
+    active(scope) {
+        if (['cancelled', 'succeeded', 'succeeded_with_exception'].includes(scope.task_state))
+            return null;
+        return (this.store.db
+            .prepare('SELECT * FROM run_grants WHERE session_id=? AND task_id=? AND plan_revision=? AND binding_digest=? AND revoked_at IS NULL ORDER BY created_at DESC LIMIT 1')
+            .get(scope.session_id, scope.task_id, scope.plan_revision, scope.binding_digest) ?? null);
+    }
+}