@themoltnet/agent-daemon 0.3.0 → 0.4.0

package/dist/main.js

@@ -6324,6 +6324,25 @@ function buildPromptForTask(task, ctx) {
 //#endregion
 //#region ../../libs/agent-runtime/src/reporters/api.ts
 /**
+* True when an error looks like the Keto "tuple lagged the read API"
+* race: HTTP 403 plus a server message starting with "Not authorized".
+* Used to gate the first-append retry to the narrow recoverable case.
+*
+* The server's task.service.ts returns errors of the form
+*   `Not authorized to <verb> ...`
+* for every claimant-relation check (append messages, list messages,
+* heartbeat, complete, fail). Other Fastify 403s — auth-plugin
+* rejection, route-level guards — use different message shapes and
+* are not consistency-window flakes; retrying them just delays the
+* permanent failure surfacing.
+*/
+function isKetoConsistencyLag403(err) {
+	if (!err || typeof err !== "object") return false;
+	if (err.statusCode !== 403) return false;
+	const message = err.message ?? "";
+	return /Not authorized/i.test(message);
+}
+/**
 * TaskReporter backed by the Tasks API via the SDK's TasksNamespace.
 *
 * - `open()` fires an immediate heartbeat (satisfies DBOS recv('started', 300s))
@@ -6349,6 +6368,15 @@ var ApiTaskReporter = class {
 	* failures are never silently dropped by the batching layer.
 	*/
 	pendingError = null;
+	/**
+	* Flips to `true` after the first successful `appendMessages` call.
+	* Used to gate the 403-retry window in `flush` to the very first
+	* append (the only point where the Keto `Task:claimant#Agent` tuple
+	* can lag the read API). Once any append has succeeded, Keto is
+	* known consistent for this task and a 403 thereafter is a real
+	* authorization failure that should surface immediately.
+	*/
+	firstAppendSucceeded = false;
 	cancelController = new AbortController();
 	observedCancelReason = null;
 	maxBatchSize;
@@ -6376,6 +6404,7 @@ var ApiTaskReporter = class {
 		}
 		this.taskId = ctx.taskId;
 		this.attemptN = ctx.attemptN;
+		this.firstAppendSucceeded = false;
 		await this.sendInitialHeartbeat();
 		const intervalMs = this.opts.heartbeatIntervalMs ?? 6e4;
 		if (intervalMs > 0) this.heartbeatTimer = setInterval(() => {
@@ -6421,7 +6450,8 @@ var ApiTaskReporter = class {
 		const batch = this.buffer.splice(0, this.buffer.length);
 		this.inFlight = (async () => {
 			try {
-				await this.opts.tasks.appendMessages(this.taskId, this.attemptN, { messages: batch });
+				await this.appendWithFirstCallRetry(batch);
+				this.firstAppendSucceeded = true;
 			} catch (err) {
 				const overflowCap = this.maxBatchSize * 3;
 				const restoredCount = batch.length;
@@ -6498,18 +6528,53 @@ var ApiTaskReporter = class {
 	async sendInitialHeartbeat() {
 		const maxAttempts = 5;
 		const baseDelayMs = 100;
-		let lastErr;
 		for (let attempt = 1; attempt <= maxAttempts; attempt += 1) try {
 			await this.sendHeartbeat();
 			return;
 		} catch (err) {
-			lastErr = err;
 			if ((err && typeof err === "object" && "statusCode" in err ? err.statusCode : void 0) !== 403 || attempt === maxAttempts) throw err;
 			await new Promise((resolve) => {
 				setTimeout(resolve, baseDelayMs * attempt);
 			});
 		}
-		throw lastErr;
+	}
+	/**
+	* Wrap `tasks.appendMessages` with a bounded 403-retry on the first
+	* call only. Mirrors `sendInitialHeartbeat` — the same Keto
+	* `Task:claimant#Agent` tuple race covers both endpoints, and a
+	* batched-up first flush triggered immediately after `open()` (e.g.
+	* a fast executor that records a `task_started` info message before
+	* any heartbeat round-trip completes) can hit a 403 even though the
+	* heartbeat itself eventually succeeds.
+	*
+	* Once `firstAppendSucceeded` is set we know Keto is consistent for
+	* this task and any subsequent 403 is a real authorization failure
+	* (e.g. another agent stole the claim) that must surface immediately.
+	*
+	* Retry budget is intentionally tight: the documented Keto
+	* consistency window is "tens of milliseconds," so 100 ms + 200 ms
+	* (3 attempts total) covers the realistic window with margin without
+	* adding meaningful latency to the permanent-failure path (wrong
+	* task ID, claim revoked, etc.). We also string-match the server's
+	* `Not authorized` message to avoid retrying 403s that mean
+	* something else (Fastify routes can 403 for non-auth reasons too).
+	*/
+	async appendWithFirstCallRetry(batch) {
+		if (this.firstAppendSucceeded) {
+			await this.opts.tasks.appendMessages(this.taskId, this.attemptN, { messages: batch });
+			return;
+		}
+		const maxAttempts = 3;
+		const baseDelayMs = 100;
+		for (let attempt = 1; attempt <= maxAttempts; attempt += 1) try {
+			await this.opts.tasks.appendMessages(this.taskId, this.attemptN, { messages: batch });
+			return;
+		} catch (err) {
+			if (attempt === maxAttempts || !isKetoConsistencyLag403(err)) throw err;
+			await new Promise((resolve) => {
+				setTimeout(resolve, baseDelayMs * attempt);
+			});
+		}
 	}
 	async sendHeartbeat() {
 		const body = this.opts.leaseTtlSec ? { leaseTtlSec: this.opts.leaseTtlSec } : {};
@@ -14792,7 +14857,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 					correlationId: task.correlationId ?? null
 				})
 			});
-			const piAuthDir = join(homedir(), ".pi", "agent");
+			const piAuthDir = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
 			const modelHandle = getModel(opts.provider, opts.model);
 			const piOtelExtension = createPiOtelExtension({
 				agentName: opts.agentName,
@@ -15607,6 +15672,26 @@ async function runOnce(argv) {
 		sandbox: sandbox.path,
 		taskId
 	}, "agent-daemon.starting");
+	let runtime = null;
+	const onSignal = (sig) => {
+		rootLogger.warn({
+			signal: sig,
+			taskId
+		}, "agent-daemon.draining");
+		runtime?.stop();
+		ctx.agent.tasks.cancel(taskId, { reason: `runner_${sig.toLowerCase()}` }).catch((err) => {
+			rootLogger.warn({
+				err: err instanceof Error ? err.message : String(err),
+				taskId
+			}, "agent-daemon.cancel_on_signal_failed");
+		});
+	};
+	process.on("SIGINT", () => {
+		onSignal("SIGINT");
+	});
+	process.on("SIGTERM", () => {
+		onSignal("SIGTERM");
+	});
 	try {
 		const executeTask = createPiTaskExecutor({
 			agentName: opts.agent,
@@ -15619,7 +15704,7 @@ async function runOnce(argv) {
 			gh: createGhCliClient(),
 			logger: rootLogger
 		});
-		const [output] = await new AgentRuntime({
+		runtime = new AgentRuntime({
 			logger: rootLogger,
 			source: new ApiTaskSource({
 				agent: ctx.agent,
@@ -15639,7 +15724,8 @@ async function runOnce(argv) {
 				log: (msg, err) => rootLogger.warn({ err }, msg)
 			}),
 			executeTask
-		}).start();
+		});
+		const [output] = await runtime.start();
 		if (!output) {
 			rootLogger.error({}, "agent-daemon.no_output");
 			return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "MoltNet agent daemon — claims and executes tasks (fulfill_brief, assess_brief) from the MoltNet task-service via Pi-headless. CLI: moltnet-agent.",
@@ -22,7 +22,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@earendil-works/gondolin": "^0.7.0",
+    "@earendil-works/gondolin": "^0.9.1",
     "@earendil-works/pi-ai": "^0.74.0",
     "@earendil-works/pi-coding-agent": "^0.74.0",
     "@opentelemetry/api": "^1.9.0",
@@ -33,9 +33,9 @@
     "@opentelemetry/semantic-conventions": "^1.39.0",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "@themoltnet/agent-runtime": "0.10.0",
-    "@themoltnet/pi-extension": "0.13.3",
-    "@themoltnet/sdk": "0.99.0"
+    "@themoltnet/agent-runtime": "0.11.0",
+    "@themoltnet/sdk": "0.99.0",
+    "@themoltnet/pi-extension": "0.13.5"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
@@ -43,9 +43,9 @@
     "vite": "^8.0.0",
     "vitest": "^3.0.0",
     "@moltnet/bootstrap": "0.1.0",
-    "@moltnet/crypto-service": "0.1.0",
     "@moltnet/database": "0.1.0",
-    "@moltnet/tasks": "0.1.0"
+    "@moltnet/tasks": "0.1.0",
+    "@moltnet/crypto-service": "0.1.0"
   },
   "nx": {
     "tags": [