@visual-z/xeno 0.8.2 → 0.8.4

package/src/core/work-state.ts

@@ -50,6 +50,10 @@ export function scopedWorkId(namespace: string, requested: string, items: readon
     ? requested : `${namespace}:${requested}`;
 }
 
+function unknownWork(id: string): string {
+  return `unknown work_id ${id}; create it with a next note (kind=next) first`;
+}
+
 export function workChangeError(items: readonly WorkItem[], event: LogEvent): string | null {
   if (!("work_id" in event) || event.work_id === undefined) return null;
   const item = items.find(item => item.id === event.work_id);
@@ -57,9 +61,10 @@ export function workChangeError(items: readonly WorkItem[], event: LogEvent): st
     const error = dependencyError(items, event.work_id, event.depends_on);
     if (error) return error;
   }
-  if (event.t === "work_dependencies" && !item) return `unknown work_id ${event.work_id}`;
+  // Every unknown-id rejection names the way to make the id exist, or the model retries the same call.
+  if (event.t === "work_dependencies" && !item) return unknownWork(event.work_id);
   if (event.t === "work_owner") {
-    if (!item) return `unknown work_id ${event.work_id}`;
+    if (!item) return unknownWork(event.work_id);
     if (event.operation === "release") return item.owner === event.owner ? null : "only the recorded owner can release work";
     const ready = workReadiness(items, item.id, event.owner);
     return ready.ready ? null : `work ${item.id} is ${ready.reason}; cannot claim it`;

package/src/core/working-set.ts

@@ -7,9 +7,17 @@ import { estimateTokens } from "./tokens.ts";
 import { RECOVERY_SECTIONS, recoverySources, type RecoveryNodes, type RecoveryRanges, type RecoveryReference } from "./recovery-sources.ts";
 import { recoveryInstructions } from "./prompt-policy.ts";
 
+/**
+ * The cut format new sessions record. Live cuts, cold replay and interrupted-cut
+ * repair all select through `carriedHandoff`, so this is only the default for
+ * cuts not yet written; a recorded version is never reinterpreted.
+ */
+export const CURRENT_WORKING_SET_VERSION = 3;
+
 export type WorkingSet = {
-  version: 1 | 2; source: NodeRef;
-  work: (Pick<WorkItem, "id" | "what" | "status" | "next_action" | "reason" | "depends_on" | "owner"> & { readiness?: WorkReadiness })[];
+  version: 1 | 2 | 3; source: NodeRef;
+  /** v3 omits `what`, `next_action` and `reason` when the carried `state.work_items` holds the same item. */
+  work: (Pick<WorkItem, "id" | "status" | "next_action" | "reason" | "depends_on" | "owner"> & { what?: string; readiness?: WorkReadiness })[];
   references: ({ node?: number; event: string; kind: string; work?: string } & Partial<Omit<RecoveryReference, "node" | "event" | "kind" | "work">>)[];
   omitted: { work: number; references: number };
   recovery_sections?: RecoveryRanges;
@@ -50,20 +58,40 @@ export function workingSet(full: Handoff, budget: number): WorkingSet | null {
 
 /** R9: a new projection version keeps the original v1 ordering byte-stable. */
 export function recoveryWorkingSet(full: Handoff, nodes: RecoveryNodes, budget: number, tools?: readonly string[]): WorkingSet | null {
+  return sourceView(full, nodes, { version: 2, users: true,
+    fits: view => estimateTokens.count([], emitYaml(view)) <= budget,
+    recovery: tools === undefined ? "Read original user messages before continuing: history(node=source.node,recovery=users,offset=0). Other pages: failures, environment, next_actions; event=ID reads one original. Abandoned messages are cancelled; annotations are not user instructions. Observations are historical: recheck resource, host and current permissions before acting. history(work_id=ID) recovers work." : recoveryInstructions(tools) });
+}
+
+/**
+ * v3 shares v2's source ordering. Two things differ, both decided by the caller
+ * that owns the whole carried handoff: `fits` measures the view inside that
+ * handoff rather than standalone, and `users: false` leaves user sources out
+ * because the carried `user_turns` already hold every one verbatim.
+ */
+export function recoveryWorkingSetV3(full: Handoff, nodes: RecoveryNodes, options: {
+  users: boolean; recovery: string; fits: (view: WorkingSet) => boolean;
+}): WorkingSet | null {
+  return sourceView(full, nodes, { version: 3, ...options });
+}
+
+function sourceView(full: Handoff, nodes: RecoveryNodes, options: {
+  version: 2 | 3; users: boolean; recovery: string; fits: (view: WorkingSet) => boolean;
+}): WorkingSet | null {
   const legacy = workingSet(full, Infinity);
   if (!legacy) return null;
   const sources = recoverySources(nodes);
-  const view: WorkingSet = { version: 2, source: legacy.source, work: [], references: [],
+  const view: WorkingSet = { version: options.version, source: legacy.source, work: [], references: [],
     omitted: { work: legacy.work.length, references: legacy.references.length + RECOVERY_SECTIONS.reduce((sum, section) => sum + sources[section].length, 0) },
     recovery_sections: Object.fromEntries(RECOVERY_SECTIONS.map(section => [section, { total: sources[section].length, omitted: sources[section].length }])) as RecoveryRanges,
-    recovery: tools === undefined ? "Read original user messages before continuing: history(node=source.node,recovery=users,offset=0). Other pages: failures, environment, next_actions; event=ID reads one original. Abandoned messages are cancelled; annotations are not user instructions. Observations are historical: recheck resource, host and current permissions before acting. history(work_id=ID) recovers work." : recoveryInstructions(tools) };
-  const fits = () => estimateTokens.count([], emitYaml(view)) <= budget;
+    recovery: options.recovery };
+  const fits = () => options.fits(view);
   if (!fits()) return null;
   const queues = RECOVERY_SECTIONS.map(section => ({ section, items: [...sources[section]], at: 0 }));
   // The latest and first live user messages anchor correction and initial scope;
   // remaining user sources are newest first. Cancelled turns stay pageable.
   const live = sources.users.filter(ref => !ref.abandoned), first = live.at(-1);
-  queues[0]!.items = [...live.slice(0, 1), ...(first && first !== live[0] ? [first] : []),
+  queues[0]!.items = !options.users ? [] : [...live.slice(0, 1), ...(first && first !== live[0] ? [first] : []),
     ...live.slice(1, -1), ...sources.users.filter(ref => ref.abandoned)];
   const takeReference = (reference: WorkingSet["references"][number], section?: keyof RecoveryRanges) => {
     view.references.push(reference); view.omitted.references--;

package/src/runtime/connection-reuse.ts

@@ -0,0 +1,40 @@
+/**
+ * Whether a provider may keep reusing pooled connections.
+ *
+ * A socket that a proxy, NAT or server dropped while it sat in the pool fails
+ * the next request the same way -- Horizyn 2026-10-12 lost the first request
+ * after "continue" to it. Claude Code answers by turning keep-alive off for
+ * the rest of the process once a connection dies; this does the same per
+ * provider instance, so tests sharing a process cannot leak state into each
+ * other and a fresh session starts from the cheap path again
+ * (feat-fresh-connection-after-drop).
+ *
+ * Bun honours `keepalive: false` by opening a new socket per request
+ * (measured on 1.3.10: three default fetches share one socket, three with
+ * keepalive:false open three). The cost is a TLS handshake per request,
+ * negligible next to a model call. Google, Vertex and Bedrock go through
+ * pi-ai's native HTTP with no fetch hook, so this cannot reach them.
+ */
+import { connectionFailure } from "./retry.ts";
+
+export class ConnectionReuse {
+  private fresh = false;
+
+  /**
+   * Called with every failed attempt, retried or final. Only a connection
+   * that existed and died counts: one that never opened left nothing stale
+   * in the pool.
+   */
+  note(error: unknown): void {
+    if (connectionFailure(error) === "stale") this.fresh = true;
+  }
+
+  init(init: RequestInit | undefined): RequestInit | undefined {
+    return this.fresh ? { ...init, keepalive: false } : init;
+  }
+
+  /** A fetch that opens fresh connections once one has died. */
+  wrap(fetchImpl: typeof fetch): typeof fetch {
+    return Object.assign((input: RequestInfo | URL, init?: RequestInit) => fetchImpl(input, this.init(init)), { preconnect: fetchImpl.preconnect });
+  }
+}

package/src/runtime/exec-sessions.ts

@@ -46,6 +46,19 @@ export function yieldWait(value: unknown): { ms: number; note: string } {
   const ms = Math.min(MAX_YIELD_MS, Math.max(MIN_YIELD_MS, requested));
   return { ms, note: ms === requested ? "" : ` · yield_time_ms ${requested} clamped to ${ms}` };
 }
+/**
+ * Bounds on one owned empty wait's window, copied from Codex's empty
+ * `write_stdin` (MIN_EMPTY_YIELD_TIME_MS, DEFAULT_MAX_BACKGROUND_TERMINAL_TIMEOUT_MS),
+ * not measured. The floor is what stops a chatty process from waking the
+ * model every line: below it, a 100 ms request brings the per-line wakeups back.
+ */
+export const MIN_EMPTY_YIELD_MS = 5_000;
+export const MAX_EMPTY_YIELD_MS = 300_000;
+export function emptyYieldWait(value: unknown): { ms: number; note: string } {
+  const requested = typeof value === "number" && Number.isFinite(value) ? value : DEFAULT_YIELD_MS;
+  const ms = Math.min(MAX_EMPTY_YIELD_MS, Math.max(MIN_EMPTY_YIELD_MS, requested));
+  return { ms, note: ms === requested ? "" : ` · yield_time_ms ${requested} clamped to ${ms}` };
+}
 /**
  * Concurrent sessions. An assumption, not a measurement: comfortably above a
  * server + watcher + REPL, low enough that a runaway loop of starts is refused
@@ -61,6 +74,12 @@ export const CLOSED_RECEIPT_AGE_MS = 10 * 60_000;
 type TakenOutput = {
   stored: ArchivedObservation; receipt: ProcessReceipt; wallMs: number;
   exit: number | null; stopped?: "timeout" | "cancelled";
+  /**
+   * Input that arrived after the process exited and was not written:
+   * "control" for interrupt/EOF, whose intent the exit already satisfied;
+   * "refused" for real input, which the caller must report as not sent.
+   */
+  unsent?: "control" | "refused";
 };
 type ClosedSession = { owner?: string; id: number; endedAt: number; receipt: ProcessReceipt };
 
@@ -79,7 +98,6 @@ interface Session {
   spoolPath: string;
   queue: Promise<unknown>;
   operations: Promise<unknown>;
-  outputListeners: Set<() => void>;
   final?: TakenOutput;
   captureError?: string;
   written: number;
@@ -151,7 +169,6 @@ function append(session: Session, chunk: Uint8Array): void {
       if (bytesWritten < 1) throw new Error("process output spool made no write progress");
       offset += bytesWritten; session.written += bytesWritten;
     }
-    for (const notify of session.outputListeners) notify();
   }).catch(error => {
     session.captureError = `process output capture failed: ${String(error)}`;
     stopSession(session, "cancelled");
@@ -177,7 +194,7 @@ export async function startSession(input: {
   const exited = new Promise<void>((resolve) => { resolveExit = resolve; });
   const session = {
     id: nextId++, ...(input.owner === undefined ? {} : { owner: input.owner }), command: input.command, cwd: input.cwd, tty: input.tty, source: input.source, started: performance.now(),
-    spool, spoolPath, queue: Promise.resolve(), operations: Promise.resolve(), outputListeners: new Set<() => void>(), written: 0, read: 0,
+    spool, spoolPath, queue: Promise.resolve(), operations: Promise.resolve(), written: 0, read: 0,
     exit: null, timeoutMs: input.timeoutMs, exited, drained: Promise.resolve(),
     ...(input.artifactObserver ? { artifactObserver: input.artifactObserver } : {}),
   } as Omit<Session, "pid" | "write" | "kill" | "timer"> as Session;
@@ -302,26 +319,42 @@ export interface ObservationWait {
   /** Steering releases this observation wait without cancelling the owned command. */
   wake?: AbortSignal;
   onWaiting?: (active: boolean) => void;
+  /** One window; output is delivered at a window's end, never as it arrives. */
+  windowMs: number;
 }
 
-/** OMP's job owner pattern: no paid model turn merely to observe elapsed time. */
+/**
+ * OMP's job owner pattern: no paid model turn merely to observe elapsed time.
+ * Exit, timeout, cancellation and steering end the wait at once. Output does
+ * not: it is collected until the window ends, and a window with nothing new
+ * rolls into the next. Waking per byte made a process that prints a warning
+ * every few seconds cost one model request per line (session mv4wyiyg-lebu,
+ * fix-owned-wait-coalesce-output); Codex collects to the deadline the same way.
+ */
 async function waitForObservation(session: Session, signal: AbortSignal | undefined, wait: ObservationWait): Promise<void> {
   await session.queue;
-  let notify!: () => void;
-  const changed = new Promise<void>(resolve => { notify = resolve; });
-  session.outputListeners.add(notify);
-  signal?.addEventListener("abort", notify, { once: true });
-  wait.wake?.addEventListener("abort", notify, { once: true });
-  const pending = session.exit === null && session.read === session.written && !signal?.aborted && !wait.wake?.aborted;
+  let interrupt!: () => void;
+  const interrupted = new Promise<void>(resolve => { interrupt = resolve; });
+  signal?.addEventListener("abort", interrupt, { once: true });
+  wait.wake?.addEventListener("abort", interrupt, { once: true });
+  const ended = () => session.exit !== null || signal?.aborted === true || wait.wake?.aborted === true;
+  const pending = !ended();
+  let timer: ReturnType<typeof setTimeout> | undefined;
   try {
     if (pending) {
       wait.onWaiting?.(true);
-      await Promise.race([session.exited, changed]);
+      while (!ended()) {
+        const deadline = new Promise<void>(resolve => { timer = setTimeout(resolve, wait.windowMs); });
+        await Promise.race([session.exited, interrupted, deadline]);
+        clearTimeout(timer);
+        await session.queue;
+        if (session.written > session.read) break;
+      }
     }
   } finally {
-    session.outputListeners.delete(notify);
-    signal?.removeEventListener("abort", notify);
-    wait.wake?.removeEventListener("abort", notify);
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", interrupt);
+    wait.wake?.removeEventListener("abort", interrupt);
     if (pending) wait.onWaiting?.(false);
   }
   if (signal?.aborted) stopSession(session, "cancelled");
@@ -371,6 +404,17 @@ async function takeOutput(session: Session, outputStore: string, previewBytes: n
   return taken;
 }
 
+/**
+ * Input made only of Ctrl-C / Ctrl-D. Sent to a process that has already
+ * exited, it asks for something the exit already did (stop, end of input), so
+ * it is answered as a poll rather than refused -- otherwise the exit and the
+ * unread tail wait for a second call the model may never make (ticket session
+ * mv4ugd29, write-stdin-exited card).
+ */
+export function isControlInput(chars: string): boolean {
+  return chars.length > 0 && /^[\u0003\u0004]+$/.test(chars);
+}
+
 /** One lease covers stdin, waiting, archival and cursor commit; cancellation can interrupt a queued wait. */
 export async function pollSession(session: Session, outputStore: string, previewBytes: number, yieldMs: number,
   chars = "", signal?: AbortSignal, wait?: ObservationWait): Promise<TakenOutput> {
@@ -378,16 +422,20 @@ export async function pollSession(session: Session, outputStore: string, preview
   if (signal?.aborted) cancel(); else signal?.addEventListener("abort", cancel, { once: true });
   const result = session.operations.then(async () => {
     if (session.final) {
-      if (chars.length > 0) throw new ToolFault("not_found", "process is closed; input was not sent", NOT_STARTED);
+      if (chars.length > 0 && !isControlInput(chars)) throw new ToolFault("not_found", "process is closed; input was not sent", NOT_STARTED);
       return { ...session.final, receipt: { ...session.final.receipt, replayed: true } };
     }
+    // An exit not yet reported is still delivered with any late input: the
+    // input is never written, but the exit and unread output are not withheld.
+    let unsent: TakenOutput["unsent"];
     if (chars.length > 0) {
-      if (session.exit !== null) throw new ToolFault("not_found", "process has exited; input was not sent; poll with empty chars", NOT_STARTED);
-      session.write(chars);
+      if (session.exit !== null) unsent = isControlInput(chars) ? "control" : "refused";
+      else session.write(chars);
     }
     if (chars.length === 0 && wait) await waitForObservation(session, signal, wait);
     else await waitSession(session, yieldMs, signal);
-    return takeOutput(session, outputStore, previewBytes);
+    const taken = await takeOutput(session, outputStore, previewBytes);
+    return unsent === undefined ? taken : { ...taken, unsent };
   });
   session.operations = result.catch(() => {});
   try { return await result; }

package/src/runtime/history-tools.ts

@@ -2,7 +2,7 @@
 import { join } from "node:path";
 import { deriveHandoff } from "../core/derive.ts";
 import type { Handoff } from "../core/handoff.ts";
-import { HISTORY_SECTIONS, historyPage, type HistorySection } from "../core/history.ts";
+import { HISTORY_SECTIONS, historyPage, userTurnImages, type HistorySection } from "../core/history.ts";
 import { historyEntries, historyHits, historyIndex, queryHistory, type HistoryEntry } from "../core/history-query.ts";
 import { resourceKey } from "../core/evidence-links.ts";
 import { canonicalValue } from "../core/continuation.ts";
@@ -87,7 +87,12 @@ export async function runHistoryTool(logDir: string, currentNode: number, ctx: T
     if (typeof args["event"] === "string") {
       const found = indexed.byEvent.get(args["event"]);
       if (!found) throw new ToolFault("not_found", "event is not readable in the active ancestry", READ_ATTEMPTED);
-      return historyValue(ctx, found);
+      // A carried user turn names its images by digest only (D8). Reading the
+      // original turn reattaches them as a tool result, so their image tokens are
+      // paid once, when asked for, instead of in every later handoff.
+      const original = found.kind === "user" ? history.nodes.flatMap(part => part.events).find(event => event.id === found.event) : undefined;
+      const images = original?.t === "user" ? original.images ?? [] : [];
+      return { ...await historyValue(ctx, found), ...(images.length ? { images } : {}) };
     }
     if (typeof args["query"] === "string" || args["recent"] === true || typeof args["resource"] === "string" || typeof args["work_id"] === "string") {
       const query = typeof args["query"] === "string" ? args["query"] : "";
@@ -144,6 +149,11 @@ export async function runHistoryTool(logDir: string, currentNode: number, ctx: T
       if (part.node === node) break;
     }
     if (full === null) throw new ToolFault("not_found", "empty history", READ_ATTEMPTED);
+    // Pages match a v3 carried suffix: user turns name their images by digest (D8).
+    if (args["section"] === "user_turns") {
+      const at = history.nodes.findIndex(part => part.node === node);
+      full = { ...full, user_turns: userTurnImages(full.user_turns, history.nodes.slice(0, at + 1)) };
+    }
     const page = historyPage(full, args["section"] as HistorySection,
       typeof args["offset"] === "number" ? args["offset"] : 0,
       typeof args["limit"] === "number" ? Math.min(args["limit"], 100) : 20);