@timqi/pier 0.0.29 → 0.1.1

package/dist/tasks/agent.js

@@ -1,18 +1,15 @@
-// A run that *is* a Pi session: which session it opens (fresh or reused),
-// what the child is told before the prompt, and how many may run at once. The
-// concurrency caps are here rather than in execution.ts because they bound
-// agents specifically — a bash run costs a process, an agent run costs a
-// model's context and someone's rate limit.
+// A run that *is* a Pi session: which session it opens, what the child is told
+// before the prompt, and how many may run at once (an agent run costs a
+// model's context and someone's rate limit, so the caps are here).
 import { quietLabel, splitReply } from "../core/reply.js";
-import { Router } from "../core/router.js";
+import { logger } from "../log.js";
 import { runSource } from "./callbacks.js";
-import { TaskMessenger } from "./messages.js";
-import { TaskStore } from "./store.js";
-const MAX_ACTIVE_AGENTS = 4;
-/** What a child cannot know unless told. Every session gets the chat-surface
- * contract (<pier>/AGENTS.md), task runs included — so the delegation prompt
- * says which of it does not apply here, and a supervised run how to reach the
- * agent that is waiting on it. Skipped on resume: the session already saw it. */
+// Agent runs are I/O-bound: the cap is there for API pressure and runaway
+// fan-out, not for this machine's CPU.
+const MAX_ACTIVE_AGENTS = 6;
+const log = logger("tasks");
+/** Every session gets the chat-surface contract, task runs included, so the
+ *  delegation prompt says which of it does not apply. Skipped on resume. */
 const preamble = (run) => {
     // A cron/watch task with a session callback is read by an agent too.
     const audience = run.invokedBySessionId
@@ -44,40 +41,37 @@ export class AgentTaskRunner {
         this.changed = changed;
     }
     async execute(run, action, signal, start) {
-        await this.acquireSlot(run, signal);
-        try {
-            const session = await this.resolveSession(run, action);
-            return await this.withSession(session.id, async () => {
+        // Reserve reuse order before resolving the session: a slow resume must not
+        // let a later run pass it. Fresh runs each have their own queue key.
+        return this.withSession(run.targetSessionId ?? run.id, signal, async () => {
+            const reused = run.targetSessionId ? await this.resolveSession(run, action, signal) : undefined;
+            if (reused)
+                await this.waitUntilIdle(reused, signal);
+            await this.acquireSlot(run, signal);
+            try {
+                const session = reused ?? await this.resolveSession(run, action, signal);
+                // A reused session may have become busy while we waited for a slot.
                 await this.waitUntilIdle(session, signal);
-                // Task requests come seconds apart — the 1h Anthropic cache-write premium
-                // never earns its 2× back, so task runs use the 5m TTL. Set here, not in
-                // resolveSession: this covers create, reuse and resume alike, on
-                // every attempt — and only after the session is idle, so a reused
-                // interactive session's in-flight turn keeps its 1h writes.
+                signal.throwIfAborted();
+                // Task requests come seconds apart, so the 1h cache-write premium never
+                // earns back; after idle, so a reused session's in-flight turn keeps its 1h.
                 session.setCacheRetention("short");
                 start();
-                // No input is no block: `<task_input>\nnull\n</task_input>` is four
-                // lines telling the agent nothing, on every run that has no input.
-                // Compact for the same reason tool results are (agent/pi.ts), and
-                // `<\/` is the same JSON — a value cannot close the fence early.
+                // No input is no block. `<\/` is the same JSON, so a value cannot close
+                // the fence early.
                 const input = run.input === undefined || run.input === null
                     ? ""
                     : `\n\n<task_input>\n${JSON.stringify(run.input).replaceAll("</task_input>", "<\\/task_input>")}\n</task_input>`;
                 const prompt = run.context.resumePrompt ?? `${preamble(run)}${action.prompt}${input}`;
                 run.context.sessionId = session.id;
                 run.context.model = session.model;
-                // The level the session settled on, not the one the task asked for:
-                // an unspecified effort inherits the caller's, and the card in the
-                // subagent's own transcript should say which one that was.
+                // The level the session settled on: an unspecified effort inherits the caller's.
                 run.context.thinking = session.thinkingLevel;
                 run.context.renderedPrompt = prompt;
                 this.store.saveRun(run);
                 let text = "";
-                // Not only what the turn said but how it ended: a provider outage ends
-                // it with an empty reply, and a run that settles on that reports "no
-                // reply" — the one wording for a turn that *chose* to say nothing, so
-                // the outage arrives at the caller looking like an answer (§5b). Pi has
-                // already retried by the time this lands; the run only reports.
+                // How it ended, too: a provider outage ends with an empty reply, which
+                // would otherwise report as a turn that chose to say nothing (§5).
                 let failure;
                 const unsubscribe = session.subscribe((event) => {
                     if (event.type === "turn-end") {
@@ -85,22 +79,16 @@ export class AgentTaskRunner {
                         failure = event.error;
                     }
                 });
-                // The race below also settles this attempt if Pi ignores the abort:
-                // a hung turn must not hold one of the 4 slots (and its waiters)
-                // forever — the same guard execution.ts gives task-type children.
-                let rejectAborted = () => { };
-                const abortedTurn = new Promise((_, reject) => { rejectAborted = reject; });
-                abortedTurn.catch(() => { }); // handled via the race; never unhandled
+                // Cancel the SDK turn, but release our wait even if its abort hangs.
                 const abort = () => {
-                    void session.abort();
-                    rejectAborted(new Error("cancelled"));
+                    void Promise.resolve().then(() => session.abort())
+                        .catch((error) => log.warn(`run ${run.id} session abort failed`, error));
                 };
                 signal.addEventListener("abort", abort, { once: true });
-                // A pre-aborted signal never fires the listener: check before the
-                // prompt starts or a cancelled run would hang until its timeout.
-                if (signal.aborted)
-                    throw new Error("cancelled");
                 try {
+                    // Pre-abort does not fire a newly registered listener; keep the check
+                    // inside finally's scope so it also restores retention/subscriptions.
+                    signal.throwIfAborted();
                     const turn = session.systemInput(prompt, {
                         kind: "task-delegation",
                         taskId: run.taskId,
@@ -110,54 +98,49 @@ export class AgentTaskRunner {
                     }, "prompt");
                     await Promise.resolve();
                     this.messages.deliverPendingControls(run);
-                    await Promise.race([turn, abortedTurn]);
+                    await this.untilAborted(turn, signal);
                     if (signal.aborted)
                         throw new Error("cancelled");
-                    // Before the fallback below: on a reused session that reads the
-                    // *previous* turn's answer back out of history and reports it as
-                    // this run's result.
+                    // Before the fallback: on a reused session it would read the previous
+                    // turn's answer back as this run's result.
                     if (failure)
                         throw new Error(failure);
                     if (!text) {
-                        const history = await session.history();
+                        const history = await this.untilAborted(session.history(), signal);
                         text = [...history].reverse().find((turn) => turn.role === "assistant")?.text ?? "";
                     }
-                    // The chat contract is injected into task sessions too, so a child's
-                    // reply may carry chat-only markup. The result is read by a
-                    // supervisor or the Console, never a chat renderer: buttons are
-                    // dropped, and a turn that said nothing names which kind of nothing
-                    // it was (principle 5b) instead of storing an empty result.
+                    // The result is read by a supervisor, never a chat renderer: buttons
+                    // are dropped, and an empty turn names which kind of nothing (§5).
                     const reply = splitReply(text);
                     return { type: "agent", text: reply.text || quietLabel(reply.silence), sessionId: session.id };
                 }
                 finally {
-                    // The run is what earns "short"; a reused interactive session goes
-                    // back to chat afterwards. For task-created sessions this is moot —
-                    // idle until the next run downgrades them again.
+                    // A reused interactive session goes back to chat afterwards.
                     session.setCacheRetention("long");
                     signal.removeEventListener("abort", abort);
                     unsubscribe();
                 }
-            });
-        }
-        finally {
-            this.releaseSlot(run.id);
-        }
+            }
+            finally {
+                this.releaseSlot(run.id);
+            }
+        });
     }
-    async resolveSession(run, action) {
+    async resolveSession(run, action, signal) {
+        signal.throwIfAborted();
         if (run.targetSessionId) {
-            return this.router.ensure({ channelId: "task", conversationId: run.targetSessionId });
+            return this.untilAborted(this.router.ensure({ channelId: "task", conversationId: run.targetSessionId }), signal);
         }
         const policy = action.session;
-        // Definitions stored before fork was removed still say `"fork"`. Refused by
-        // name: every directory this could pick instead is a guess at what the
-        // author meant, and a child in the wrong tree edits real files.
+        // Stored definitions may still say `"fork"`. Refused by name: any directory
+        // picked instead is a guess, and a child in the wrong tree edits real files.
         if (run.sessionMode === "fork" || policy.mode === "fork") {
             throw new Error(`task "${run.context.definition.name}" uses the removed fork session mode; recreate it with {"mode":"fresh","cwd":"/abs/path"}`);
         }
         const cwd = policy.mode === "fresh"
             ? policy.cwd
-            : (await this.factory.find(policy.sessionId))?.cwd ?? "";
+            : (await this.untilAborted(this.factory.find(policy.sessionId), signal))?.cwd ?? "";
+        signal.throwIfAborted();
         if (!cwd)
             throw new Error("could not resolve child working directory");
         const opts = {
@@ -169,33 +152,50 @@ export class AgentTaskRunner {
                 (run.sourceSessionId ? this.router.modelOf(run.sourceSessionId) : undefined),
             thinking: action.launch?.thinking,
         };
-        const session = await this.factory.create(opts);
-        run.targetSessionId = session.id;
-        run.context.sessionId = session.id;
-        run.context.cwd = cwd;
-        this.store.saveRun(run);
-        this.router.attach({ channelId: "task", conversationId: session.id }, session);
-        this.changed(run);
+        const opening = this.factory.create(opts).then(async (session) => {
+            // SDK creation cannot be cancelled; a late session still belongs to this
+            // run. Cancellation's final save can race this callback, so both records get it.
+            run.targetSessionId = session.id;
+            run.context.sessionId = session.id;
+            run.context.cwd = cwd;
+            const owner = signal.aborted ? this.store.getRun(run.id) ?? run : run;
+            owner.targetSessionId = run.targetSessionId;
+            owner.context = run.context;
+            try {
+                this.store.saveRun(owner);
+                this.changed(owner);
+            }
+            finally {
+                if (signal.aborted)
+                    await session.dispose();
+                else
+                    this.router.attach({ channelId: "task", conversationId: session.id }, session);
+            }
+            return session;
+        });
+        // A late rejection cannot reach execute's already-cancelled race.
+        void opening.catch((error) => {
+            if (signal.aborted)
+                log.warn(`session creation for cancelled run ${run.id} failed`, error);
+        });
+        const session = await this.untilAborted(opening, signal);
+        signal.throwIfAborted();
         return session;
     }
     async acquireSlot(run, signal) {
         while (this.active.size >= MAX_ACTIVE_AGENTS) {
-            if (signal.aborted)
-                throw new Error("cancelled");
-            await new Promise((resolve, reject) => {
-                const wake = () => {
-                    signal.removeEventListener("abort", abort);
-                    this.slotWaiters.delete(wake);
-                    resolve();
-                };
-                const abort = () => {
-                    this.slotWaiters.delete(wake);
-                    reject(new Error("cancelled"));
-                };
-                this.slotWaiters.add(wake);
-                signal.addEventListener("abort", abort, { once: true });
-            });
+            let wake = () => { };
+            try {
+                await this.untilAborted(new Promise((resolve) => {
+                    wake = resolve;
+                    this.slotWaiters.add(wake);
+                }), signal);
+            }
+            finally {
+                this.slotWaiters.delete(wake);
+            }
         }
+        signal.throwIfAborted();
         this.active.add(run.id);
     }
     releaseSlot(id) {
@@ -203,43 +203,58 @@ export class AgentTaskRunner {
         for (const wake of this.slotWaiters)
             wake();
     }
-    async withSession(sessionId, fn) {
+    async untilAborted(promise, signal) {
+        let abort = () => { };
+        const cancelled = new Promise((_, reject) => {
+            abort = () => reject(new Error("cancelled"));
+            signal.addEventListener("abort", abort, { once: true });
+            if (signal.aborted)
+                abort();
+        });
+        try {
+            return await Promise.race([promise, cancelled]);
+        }
+        finally {
+            signal.removeEventListener("abort", abort);
+        }
+    }
+    async withSession(sessionId, signal, fn) {
+        signal.throwIfAborted();
         const previous = this.sessionTails.get(sessionId) ?? Promise.resolve();
         let release = () => { };
         const gate = new Promise((resolve) => { release = resolve; });
         const tail = previous.then(() => gate);
         this.sessionTails.set(sessionId, tail);
-        await previous;
+        // Even if this waiter is cancelled, its tail still includes its predecessor.
+        // Only delete after that tail drains, or a new arrival could skip the queue.
+        void tail.then(() => {
+            if (this.sessionTails.get(sessionId) === tail)
+                this.sessionTails.delete(sessionId);
+        });
         try {
+            await this.untilAborted(previous, signal);
+            signal.throwIfAborted();
             return await fn();
         }
         finally {
             release();
-            if (this.sessionTails.get(sessionId) === tail)
-                this.sessionTails.delete(sessionId);
         }
     }
     async waitUntilIdle(session, signal) {
         // The session's own event stream is the only busy/idle signal — no polling.
         while (session.state === "streaming") {
-            if (signal.aborted)
-                throw new Error("cancelled");
-            await new Promise((resolve, reject) => {
-                const settle = (error) => {
-                    unsubscribe();
-                    signal.removeEventListener("abort", onAbort);
-                    if (error)
-                        reject(error);
-                    else
-                        resolve();
-                };
-                const onAbort = () => settle(new Error("cancelled"));
-                const unsubscribe = session.subscribe((event) => {
-                    if (event.type === "state" && event.state === "idle")
-                        settle();
-                });
-                signal.addEventListener("abort", onAbort, { once: true });
-            });
+            let unsubscribe = () => { };
+            try {
+                await this.untilAborted(new Promise((resolve) => {
+                    unsubscribe = session.subscribe((event) => {
+                        if (event.type === "state" && event.state === "idle")
+                            resolve();
+                    });
+                }), signal);
+            }
+            finally {
+                unsubscribe();
+            }
         }
     }
 }

package/dist/tasks/callbacks.js

@@ -1,17 +1,10 @@
 // What a finished run says to the session that delegated it. Delivery itself
 // belongs to outbox.ts; this file owns the run vocabulary and the batching.
-import { Router } from "../core/router.js";
 import { Outbox } from "./outbox.js";
-import { TaskStore } from "./store.js";
-/** How a run is named to the session that gets its result: the run id, and the
- *  session that did the work — a relayer's next move is a deep link to it
- *  (`#/session/<id>`), and without this line that costs a second tool call.
- *  Shared with the group callback, which has always carried both. */
+/** The run id and the session that did the work: a relayer's next move is a
+ *  deep link to it, and without this that costs a second tool call. */
 export const runRef = (run) => `Run: ${run.id}${run.targetSessionId ? ` / Session: ${run.targetSessionId}` : ""}`;
-/** What the card in the recipient's transcript says the input came from. Part
- *  of the run vocabulary for the same reason `runRef` is: the callback, the
- *  subagent messages and the delegation prompt all name a run, and three
- *  spellings of "which task, on what model" would be three cards. */
+/** What the card in the recipient's transcript says the input came from. */
 export const runSource = (run) => ({
     taskName: run.context.definition.name,
     ...(run.context.model ? { model: run.context.model } : {}),
@@ -28,7 +21,7 @@ export function runResultText(run) {
     if (run.result?.type === "watch")
         result = "Watch condition did not match";
     if (result.length > 8000)
-        result = `${result.slice(0, 8000)}\n[truncated — task tool get run_id ${run.id} returns the full text]`;
+        result = `${result.slice(0, 8000)}\n[truncated — task tool recover run_id ${run.id} with a reason returns the full text]`;
     return result;
 }
 export class TaskCallbacks {
@@ -49,15 +42,13 @@ export class TaskCallbacks {
                     runId: runs[0].id,
                     sourceSessionId: runs[0].targetSessionId,
                     runIds: runs.map((run) => run.id),
-                    // Only when the input is about one run: a batch is several tasks in
-                    // one delivery, and the first one's name and model as the card's
-                    // caption would attribute every other result to it. The text names
-                    // each run; the card says nothing rather than something false.
+                    // Only for one run: a batch's caption would attribute every result
+                    // to the first run's name and model.
                     ...(runs.length === 1 ? { source: runSource(runs[0]), state: runs[0].state } : {}),
                 },
             }),
-            describe: (run) => `the result of "${run.context.definition.name}"`,
-        }, unreachable);
+            abandoned: (run, sessionId, why) => unreachable(sessionId, `the result of "${run.context.definition.name}"`, why),
+        });
     }
     target(callback, origin) {
         if (callback.type === "session")
@@ -77,8 +68,7 @@ export class TaskCallbacks {
         if (!first?.callbackSessionId || (first.callbackState !== "pending" && first.callbackState !== "failed"))
             return;
         const sessionId = first.callbackSessionId;
-        // Retry due-times are ignored when sweeping the batch: once one callback is
-        // deliverable, everything pending for the session rides along.
+        // Once one callback is deliverable, everything pending for the session rides along.
         const batch = this.store.listPendingCallbacks(Number.MAX_SAFE_INTEGER)
             .filter((run) => run.callbackSessionId === sessionId);
         if (!batch.some((run) => run.id === first.id))

package/dist/tasks/command.js

@@ -5,6 +5,7 @@ import { spawn } from "node:child_process";
 import { logger } from "../log.js";
 const log = logger("tasks");
 const OUTPUT_LIMIT = 1024 * 1024;
+const KILL_GRACE_MS = 250;
 class CappedOutput {
     chunks = [];
     bytes = 0;
@@ -38,34 +39,52 @@ export function runBash(script, cwd, input, signal) {
         const stdout = new CappedOutput();
         const stderr = new CappedOutput();
         let settled = false;
-        const kill = () => {
+        let killTimer;
+        const kill = (signal) => {
             if (!child.pid)
                 return;
             try {
                 if (process.platform === "win32")
-                    child.kill("SIGTERM");
+                    child.kill(signal);
                 else
-                    process.kill(-child.pid, "SIGTERM");
+                    process.kill(-child.pid, signal);
             }
-            catch {
-                // The process may have exited between the state check and kill.
+            catch (err) {
+                // ESRCH means the owned process group already exited.
+                if (err.code !== "ESRCH")
+                    log.warn(`run ${signal} failed: ${String(err)}`);
             }
         };
-        signal.addEventListener("abort", kill, { once: true });
+        const abort = () => {
+            kill("SIGTERM");
+            killTimer = setTimeout(() => kill("SIGKILL"), KILL_GRACE_MS);
+            killTimer.unref();
+        };
+        const cleanup = () => {
+            clearTimeout(killTimer);
+            signal.removeEventListener("abort", abort);
+        };
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted)
+            abort();
         child.stdout.on("data", (chunk) => stdout.add(chunk));
         child.stderr.on("data", (chunk) => stderr.add(chunk));
         child.on("error", (err) => {
             if (settled)
                 return;
             settled = true;
-            signal.removeEventListener("abort", kill);
+            cleanup();
             reject(err);
         });
         child.on("close", (code) => {
             if (settled)
                 return;
             settled = true;
-            signal.removeEventListener("abort", kill);
+            // A TERM trap may exit the shell while a descendant ignores TERM and
+            // has redirected its pipes. Closing the shell must not spare that group.
+            if (signal.aborted)
+                kill("SIGKILL");
+            cleanup();
             resolve({
                 exitCode: code,
                 stdout: stdout.text(),
@@ -74,12 +93,8 @@ export function runBash(script, cwd, input, signal) {
                 stderrTruncated: stderr.truncated,
             });
         });
-        // A script that never reads stdin is ordinary (`exit 0`, a one-line curl),
-        // and writing the input to a pipe nobody is holding raises EPIPE *here*.
-        // Unhandled, that is an `error` event on a stream, which is an uncaught
-        // exception, which is main.ts exiting the process: one task script could
-        // take every session and every other run down with it. The input not being
-        // wanted is not a failure of the run — anything else still gets said.
+        // A script that never reads stdin raises EPIPE here; unhandled, that is an
+        // uncaught exception that exits the process. Not wanting the input is not a failure.
         child.stdin.on("error", (err) => {
             if (err.code !== "EPIPE")
                 log.warn(`run input could not be written: ${err.message}`);