@tt-a1i/openpi 0.4.0 → 0.5.0

package/extensions/workflows/prompt.ts

@@ -1,8 +1,8 @@
-import { sanitizeTerminalText } from "../shared/terminal-text.ts";
 import {
   allocateResultBudgets,
   type ParentContextUsage,
 } from "../shared/result-budget.ts";
+import { sanitizeTerminalText } from "../shared/terminal-text.ts";
 import { projectText } from "../shared/text-projection.ts";
 import {
   countStates,
@@ -18,15 +18,15 @@ export const WORKFLOW_PARAMETER_DESCRIPTIONS = {
     "JavaScript workflow script. May start with `export const meta = {...}`, then use phase(), agent(), parallel(), args, and a final `return`.",
   args: "Optional JSON string exposed to the script as `args` (parsed when valid JSON, otherwise passed through as the raw string).",
   background:
-    "Deprecated compatibility alias: true means wait=false; false means wait=true. Do not provide both background and wait.",
+    "Deprecated compatibility alias for published callers only; new calls must use wait. Replace true with wait=false and false with wait=true. Do not provide both fields. The alias will be removed in the next announced breaking release.",
   wait: "Wait for the final result in this tool call. Interactive sessions default to false and deliver completion later; print/automation defaults to true. Interrupting the wait does not cancel the workflow.",
   resumeFromRunId:
     "Optional prior run id or unique suffix for safe read-only replay. See the workflows Skill for matching rules.",
 };
 
-/** Describes stopping a running background workflow, mirroring subagent_cancel/bg_kill. */
+/** Describes stopping a running workflow, mirroring subagent_cancel/bg_kill. */
 export const WORKFLOW_STOP_TOOL_DESCRIPTION =
-  "Cancel a running background workflow by its run id (from the workflow launch result). This aborts its remaining agents and settles the run; partial results and artifacts are preserved. Only background runs need this — a blocking workflow is already cancelled by interrupting the turn.";
+  "Cancel a running workflow by its run id (from the workflow launch result). This aborts its remaining agents and settles the run; partial results and artifacts are preserved.";
 
 /** Model-facing schema description for the workflow run id to stop. */
 export const WORKFLOW_STOP_PARAMETER_DESCRIPTIONS = {
@@ -214,6 +214,16 @@ export function buildProjectedWorkflowCompletionBatch(
   }[],
   usage?: ParentContextUsage | null,
 ) {
+  const deliveryFacts = JSON.stringify(
+    entries.map(({ deliveryId, details, runDir }) => ({
+      deliveryId,
+      runId: details.runId,
+      evidence: shortenHome(runDir),
+    })),
+  );
+  const manifest =
+    "Workflow completion delivery facts (stable across retries; deduplicate by deliveryId):\n" +
+    deliveryFacts;
   const full = entries.map(({ deliveryId, details, runDir }) =>
     buildBackgroundWorkflowFollowUp({
       runId: details.runId,
@@ -223,18 +233,30 @@ export function buildProjectedWorkflowCompletionBatch(
     }),
   );
   const separatorBytes = Math.max(0, entries.length - 1) * 2;
+  const manifestSeparatorBytes = entries.length > 0 ? 2 : 0;
+  const fixedBytes =
+    Buffer.byteLength(manifest, "utf8") +
+    separatorBytes +
+    manifestSeparatorBytes;
+  const bodyBudget = 48 * 1024 - fixedBytes;
+  if (bodyBudget < 0) {
+    throw new Error(
+      "Workflow completion delivery facts exceed the transport payload limit",
+    );
+  }
   const allocation = allocateResultBudgets(
     full.map((message) => Buffer.byteLength(message, "utf8")),
     usage,
     {
-      maxBatchBytes: 48 * 1024 - separatorBytes,
+      maxBatchBytes: bodyBudget,
       maxResultBytes: 48 * 1024,
       minResultBytes: 1024,
       headroomShare: 0.25,
       estimatedBytesPerToken: 4,
+      fixedBytes,
     },
   );
-  return full
+  const projected = full
     .map((message, index) =>
       projectText(message, {
         maxBytes: allocation.budgets[index] ?? 1024,
@@ -243,6 +265,44 @@ export function buildProjectedWorkflowCompletionBatch(
       }),
     )
     .join("\n\n");
+  return projected ? `${manifest}\n\n${projected}` : manifest;
+}
+
+/** Split transport batches so every manifest and projected body fit together. */
+export function buildProjectedWorkflowCompletionBatches(
+  entries: readonly {
+    deliveryId: string;
+    details: WorkflowDetails;
+    runDir: string;
+  }[],
+  usage?: ParentContextUsage | null,
+) {
+  const batches: Array<{
+    entries: (typeof entries)[number][];
+    content: string;
+  }> = [];
+  let current: (typeof entries)[number][] = [];
+  for (const entry of entries) {
+    const candidate = [...current, entry];
+    try {
+      buildProjectedWorkflowCompletionBatch(candidate, usage);
+      current = candidate;
+    } catch (error) {
+      if (current.length === 0) throw error;
+      batches.push({
+        entries: current,
+        content: buildProjectedWorkflowCompletionBatch(current, usage),
+      });
+      current = [entry];
+    }
+  }
+  if (current.length > 0) {
+    batches.push({
+      entries: current,
+      content: buildProjectedWorkflowCompletionBatch(current, usage),
+    });
+  }
+  return batches;
 }
 
 /** Builds the background-launch result and tells the parent model how to inspect or stop the run. */

package/extensions/workflows/replay-safety.ts

@@ -423,13 +423,44 @@ function canonicalPath(value: string) {
   return fs.realpathSync.native(value);
 }
 
-function repositoryFingerprint(cwd: string) {
+function deadlineBoundGitRunner() {
+  // One budget per fingerprint call: every git invocation shares a single
+  // deadline.
   const deadline = Date.now() + REPLAY_IDENTITY_TIMEOUT_MS;
-  const git = (gitCwd: string, args: readonly string[]) =>
+  return (gitCwd: string, args: readonly string[]) =>
     boundedGit(gitCwd, args, deadline);
-  const root = canonicalPath(git(cwd, ["rev-parse", "--show-toplevel"]).trim());
-  const head = git(root, ["rev-parse", "--verify", "HEAD"]).trim();
-  const diff = git(root, [
+}
+
+export function repositoryFingerprint(
+  cwd: string,
+  runGit: (
+    gitCwd: string,
+    args: readonly string[],
+  ) => string = deadlineBoundGitRunner(),
+) {
+  const root = canonicalPath(
+    runGit(cwd, ["rev-parse", "--show-toplevel"]).trim(),
+  );
+  const assertNoIgnoredFiles = () => {
+    // Ignored files are observable to a read-capable child but are commonly
+    // too large or secret-bearing to hash (node_modules, .env, build output).
+    // A complete identity cannot pretend they do not exist, so disable replay.
+    const ignoredOutput = runGit(root, [
+      "ls-files",
+      "--others",
+      "--ignored",
+      "--exclude-standard",
+      "--directory",
+      "-z",
+    ]);
+    if (ignoredOutput.length > 0) {
+      throw new Error("ignored files make the replay identity incomplete");
+    }
+  };
+  // The common disqualifying case exits before the expensive binary diff.
+  assertNoIgnoredFiles();
+  const head = runGit(root, ["rev-parse", "--verify", "HEAD"]).trim();
+  const diff = runGit(root, [
     "diff",
     "--no-ext-diff",
     "--no-textconv",
@@ -437,7 +468,7 @@ function repositoryFingerprint(cwd: string) {
     "HEAD",
     "--",
   ]);
-  const trackedModes = git(root, ["ls-files", "-s", "-z"]);
+  const trackedModes = runGit(root, ["ls-files", "-s", "-z"]);
   // Tracked symlinks can expose changing content outside Git, while gitlinks
   // can expose submodule state absent from the parent diff. Neither has a
   // complete bounded identity here, so execute instead of replaying.
@@ -450,21 +481,11 @@ function repositoryFingerprint(cwd: string) {
   ) {
     throw new Error("symlinks and gitlinks make replay identity incomplete");
   }
-  // Ignored files are observable to a read-capable child but are commonly too
-  // large or secret-bearing to hash (node_modules, .env, build output). A
-  // complete identity cannot pretend they do not exist, so disable replay.
-  const ignoredOutput = git(root, [
-    "ls-files",
-    "--others",
-    "--ignored",
-    "--exclude-standard",
-    "--directory",
-    "-z",
-  ]);
-  if (ignoredOutput.length > 0) {
-    throw new Error("ignored files make the replay identity incomplete");
-  }
-  const untrackedOutput = git(root, [
+  // Preserve the original post-diff safety observation: an ignored file can
+  // appear while the synchronous diff is running, including from another
+  // process. The early check is only an optimization, never the final gate.
+  assertNoIgnoredFiles();
+  const untrackedOutput = runGit(root, [
     "ls-files",
     "--others",
     "--exclude-standard",

package/extensions/workflows/result-delivery.ts

@@ -1,4 +1,8 @@
 import type { WorkflowDetails } from "./model.ts";
+import type {
+  DurableResultDeliveryQueue,
+  DurableResultDeliveryReceipt,
+} from "../shared/result-delivery.ts";
 
 export interface WorkflowCompletionEnvelope {
   deliveryId: string;
@@ -6,19 +10,13 @@ export interface WorkflowCompletionEnvelope {
   details: WorkflowDetails;
 }
 
-export interface WorkflowDeliveryReceipt {
-  deliveryId: string;
-  delivered: boolean;
-  error?: string;
-}
-
 export interface WorkflowResultDeliveryOptions {
   isIdle: () => boolean;
   persist: (details: WorkflowDetails) => void;
   deliver: (
     envelopes: readonly WorkflowCompletionEnvelope[],
     wake: boolean,
-  ) => Promise<readonly WorkflowDeliveryReceipt[]>;
+  ) => Promise<readonly DurableResultDeliveryReceipt[]>;
 }
 
 function errorText(error: unknown) {
@@ -38,6 +36,8 @@ export function createWorkflowResultDelivery(
 ) {
   const pending = new Map<string, WorkflowCompletionEnvelope>();
   let flushing: Promise<void> | undefined;
+  let flushRequested = false;
+  let wakeRequested = false;
 
   const persistState = (
     details: WorkflowDetails,
@@ -61,63 +61,113 @@ export function createWorkflowResultDelivery(
     pending.set(envelope.deliveryId, envelope);
   };
 
+  const retainPending = (
+    envelope: WorkflowCompletionEnvelope,
+    patch: Partial<NonNullable<WorkflowDetails["delivery"]>>,
+    persistenceFailure: string,
+  ) => {
+    // Memory owns the retry before persistence is attempted. A broken disk
+    // must not make this envelope, or any sibling after it, disappear from the
+    // current process.
+    enqueue(envelope);
+    try {
+      persistState(envelope.details, "pending", patch);
+    } catch (error) {
+      const delivery = envelope.details.delivery;
+      if (delivery) {
+        envelope.details.delivery = {
+          ...delivery,
+          state: "pending",
+          updatedAt: Date.now(),
+          lastError: `${persistenceFailure}: ${errorText(error)}`,
+        };
+      }
+    }
+  };
+
   const flush = async (wake: boolean) => {
-    if (flushing) return flushing;
+    if (flushing) {
+      flushRequested = true;
+      wakeRequested ||= wake;
+      return flushing;
+    }
     if (pending.size === 0) return;
-    const envelopes = [...pending.values()];
-    for (const envelope of envelopes) pending.delete(envelope.deliveryId);
 
     flushing = (async () => {
-      let receipts: readonly WorkflowDeliveryReceipt[];
-      try {
-        receipts = await options.deliver(envelopes, wake);
-      } catch (error) {
-        const message = errorText(error);
+      let passWake = wake;
+      while (pending.size > 0) {
+        flushRequested = false;
+        wakeRequested = false;
+        const envelopes = [...pending.values()];
         for (const envelope of envelopes) {
-          enqueue(envelope);
-          persistState(envelope.details, "pending", {
-            attempts: (envelope.details.delivery?.attempts ?? 0) + 1,
-            lastError: message,
-          });
+          pending.delete(envelope.deliveryId);
         }
-        return;
-      }
 
-      const byId = new Map(
-        receipts.map((receipt) => [receipt.deliveryId, receipt] as const),
-      );
-      for (const envelope of envelopes) {
-        const receipt = byId.get(envelope.deliveryId);
-        if (receipt?.delivered) {
-          try {
-            persistState(envelope.details, "delivered", {
-              attempts: (envelope.details.delivery?.attempts ?? 0) + 1,
-              deliveredAt: Date.now(),
-              lastError: undefined,
-            });
-          } catch (error) {
-            // The transport already accepted the message, but the durable
-            // receipt did not commit. Retain it for at-least-once recovery;
-            // the visible stable id lets the parent recognize a rare replay.
-            enqueue(envelope);
-            const delivery = envelope.details.delivery;
-            if (delivery) {
-              envelope.details.delivery = {
-                ...delivery,
-                state: "pending",
-                updatedAt: Date.now(),
-                lastError: `Delivery receipt persistence failed: ${errorText(error)}`,
-              };
+        let receipts: readonly DurableResultDeliveryReceipt[] | undefined;
+        try {
+          receipts = await options.deliver(envelopes, passWake);
+        } catch (error) {
+          const message = errorText(error);
+          for (const envelope of envelopes) {
+            retainPending(
+              envelope,
+              {
+                attempts: (envelope.details.delivery?.attempts ?? 0) + 1,
+                lastError: message,
+              },
+              "Pending delivery persistence failed",
+            );
+          }
+        }
+
+        if (receipts !== undefined) {
+          const byId = new Map(
+            receipts.map((receipt) => [receipt.deliveryId, receipt] as const),
+          );
+          for (const envelope of envelopes) {
+            const receipt = byId.get(envelope.deliveryId);
+            if (receipt?.delivered) {
+              try {
+                persistState(envelope.details, "delivered", {
+                  attempts: (envelope.details.delivery?.attempts ?? 0) + 1,
+                  deliveredAt: Date.now(),
+                  lastError: undefined,
+                });
+              } catch (error) {
+                // The transport already accepted the message, but the durable
+                // receipt did not commit. Retain it for at-least-once recovery;
+                // the visible stable id lets the parent recognize a rare replay.
+                enqueue(envelope);
+                const delivery = envelope.details.delivery;
+                if (delivery) {
+                  envelope.details.delivery = {
+                    ...delivery,
+                    state: "pending",
+                    updatedAt: Date.now(),
+                    lastError: `Delivery receipt persistence failed: ${errorText(error)}`,
+                  };
+                }
+              }
+              continue;
             }
+            retainPending(
+              envelope,
+              {
+                attempts: (envelope.details.delivery?.attempts ?? 0) + 1,
+                lastError:
+                  receipt?.error ?? "Completion delivery was not acknowledged",
+              },
+              "Pending delivery persistence failed",
+            );
           }
-          continue;
         }
-        enqueue(envelope);
-        persistState(envelope.details, "pending", {
-          attempts: (envelope.details.delivery?.attempts ?? 0) + 1,
-          lastError:
-            receipt?.error ?? "Completion delivery was not acknowledged",
-        });
+
+        // A completion or lifecycle edge joined this pass while transport was
+        // in flight. Drain once more so that request is not lost. Failures
+        // retained above do not request their own immediate retry, preventing
+        // an unavailable transport from creating a busy loop.
+        if (!flushRequested) break;
+        passWake ||= wakeRequested;
       }
     })().finally(() => {
       flushing = undefined;
@@ -125,7 +175,7 @@ export function createWorkflowResultDelivery(
     return flushing;
   };
 
-  return {
+  const queue = {
     /** Register inline interest before the run starts. */
     holdInline(details: WorkflowDetails) {
       persistState(details, "held-for-inline");
@@ -142,15 +192,21 @@ export function createWorkflowResultDelivery(
 
     /** Abort won the wait/terminal arbitration; deliver the result later. */
     releaseInline(envelope: WorkflowCompletionEnvelope) {
-      persistState(envelope.details, "pending", { lastError: undefined });
-      enqueue(envelope);
+      retainPending(
+        envelope,
+        { lastError: undefined },
+        "Initial delivery persistence failed",
+      );
       if (options.isIdle()) void flush(true);
     },
 
-    /** Queue a detached run after terminal status and pending are persisted. */
+    /** Queue a detached run with in-memory retry ownership before persistence. */
     defer(envelope: WorkflowCompletionEnvelope) {
-      persistState(envelope.details, "pending", { lastError: undefined });
-      enqueue(envelope);
+      retainPending(
+        envelope,
+        { lastError: undefined },
+        "Initial delivery persistence failed",
+      );
       if (options.isIdle()) void flush(true);
     },
 
@@ -161,14 +217,21 @@ export function createWorkflowResultDelivery(
       // A process restart cannot still own the inline waiter. Deterministically
       // reconstruct pending delivery from the terminal artifact.
       if (state === "held-for-inline") {
-        persistState(envelope.details, "pending", {
-          lastError: "Inline waiter was not active after session restart",
-        });
+        retainPending(
+          envelope,
+          { lastError: "Inline waiter was not active after session restart" },
+          "Restored delivery state persistence failed",
+        );
+      } else {
+        enqueue(envelope);
       }
-      enqueue(envelope);
       return true;
     },
 
+    retryPending() {
+      return flush(true) ?? Promise.resolve();
+    },
+
     parentSettled() {
       return flush(true);
     },
@@ -186,4 +249,5 @@ export function createWorkflowResultDelivery(
       pending.clear();
     },
   };
+  return queue satisfies DurableResultDeliveryQueue<WorkflowCompletionEnvelope>;
 }