@yeaft/webchat-agent 1.0.47 → 1.0.49

package/connection/upgrade.js

@@ -377,6 +377,17 @@ function spawnWindowsUpgradeScript(pkgName, installDir, isGlobalInstall, latestV
  * (`getServiceName` / `getLaunchdPlistPath`), so a named instance restarts
  * `yeaft-agent@<id>` instead of the bare `yeaft-agent` default.
  *
+ * On systemd the script pins XDG_RUNTIME_DIR / DBUS_SESSION_BUS_ADDRESS (the
+ * detached upgrade shell may not inherit them, and `systemctl --user` needs
+ * them to reach the user manager) and logs + retries a failed restart instead
+ * of failing silently.
+ *
+ * The env-pin is systemd-specific: launchd reaches its manager via the
+ * inherited Mach bootstrap port and PM2 via a fixed named pipe, so neither
+ * needs these vars. NOTE this is only about the *env* asymmetry — the launchd
+ * branch does NOT yet have the same restart-failure logging/retry hardening;
+ * that resilience gap is deferred, not "launchd is already safe".
+ *
  * @param {object} opts
  * @param {string} opts.pkgName        npm package name
  * @param {string} opts.installDir     install dir (local install) — used as cwd
@@ -438,6 +449,18 @@ export function buildUnixUpgradeScript({
   // 停止服务管理器的自动重启
   if (isSystemd) {
     shLines.push(
+      // `systemctl --user` locates the user manager via XDG_RUNTIME_DIR (and
+      // its bus via DBUS_SESSION_BUS_ADDRESS). The agent normally inherits both
+      // from its systemd-managed environment, but the detached upgrade shell
+      // cannot rely on that always being populated — if either is missing,
+      // `systemctl --user` fails with "Failed to connect to bus" and BOTH the
+      // stop and the restart silently no-op, stranding the agent offline after
+      // upgrade. Pin per-user defaults (keeping any inherited value) before the
+      // first systemctl call so the whole sequence can reach the manager.
+      'YEAFT_UID="$(id -u)"',
+      'export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$YEAFT_UID}"',
+      'export DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=/run/user/$YEAFT_UID/bus}"',
+      '',
       '# Stop systemd service to prevent restart loop',
       `systemctl --user stop "${serviceName}" 2>/dev/null`,
       'sleep 1',
@@ -472,9 +495,22 @@ export function buildUnixUpgradeScript({
   // 重新启动服务
   if (isSystemd) {
     shLines.push(
-      '# Restart systemd service',
-      `systemctl --user start "${serviceName}"`,
-      'echo "[Upgrade] Service restarted via systemd"',
+      '# Restart systemd service. Capture failure explicitly: a silent',
+      '# `systemctl start` failure here is exactly what strands the agent',
+      '# offline, so log the exit code + reason and retry once before giving up.',
+      `if systemctl --user start "${serviceName}"; then`,
+      '  echo "[Upgrade] Service restarted via systemd"',
+      'else',
+      '  START_RC=$?',
+      `  echo "[Upgrade] systemctl start failed (rc=$START_RC); retrying after reload..."`,
+      '  systemctl --user daemon-reload || true',
+      '  sleep 2',
+      `  if systemctl --user start "${serviceName}"; then`,
+      '    echo "[Upgrade] Service restarted via systemd (after retry)"',
+      '  else',
+      `    echo "[Upgrade] ERROR: systemctl start still failing (rc=$?). Manual start required: systemctl --user start ${serviceName}"`,
+      '  fi',
+      'fi',
     );
   } else if (isLaunchd) {
     shLines.push(
@@ -492,7 +528,9 @@ export function buildUnixUpgradeScript({
 
 function spawnUnixUpgradeScript(pkgName, installDir, isGlobalInstall, latestVersion, instanceId = DEFAULT_INSTANCE_ID) {
   const configDir = getConfigDir(instanceId);
-  mkdirSync(configDir, { recursive: true });
+  // Create logs/ too: the generated script's `exec > "$LOGFILE" 2>&1` aborts
+  // the whole upgrade silently if that directory is missing.
+  mkdirSync(join(configDir, 'logs'), { recursive: true });
   const shPath = join(configDir, 'upgrade.sh');
 
   const script = buildUnixUpgradeScript({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.47",
+  "version": "1.0.49",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/yeaft/llm/adapter.js

@@ -117,6 +117,117 @@ export class LLMAbortError extends Error {
   }
 }
 
+/**
+ * Default cap on a single un-terminated SSE line. A well-formed SSE stream
+ * terminates every `data:` line with `\n`, so the live buffer never exceeds
+ * one event. A malfunctioning gateway can instead emit a multi-megabyte run
+ * with no newline; without a cap, the buffer grows unbounded and (before the
+ * incremental scan below) the parse went quadratic, freezing the event loop
+ * long enough to starve the WS heartbeat and drop the agent offline. 64 MiB
+ * is far above any legitimate single SSE event yet bounds the damage.
+ */
+export const DEFAULT_SSE_MAX_LINE_BYTES = 64 * 1024 * 1024;
+
+/**
+ * Incremental, O(n) line splitter for SSE byte streams.
+ *
+ * The previous per-adapter pattern was `buffer += chunk; lines =
+ * buffer.split('\n'); buffer = lines.pop()`. When a single line spans many
+ * chunks (no `\n` yet), each chunk re-scanned and re-split the entire growing
+ * buffer — O(n²) total, which on a multi-MiB un-terminated line blocks the
+ * main thread for tens of seconds to minutes (measured: ~35 s at 40 MiB),
+ * freezing every event-loop task including the heartbeat `setInterval` and the
+ * `ws.on('pong')` handler. The agent then sees "No pong" and terminates its
+ * own healthy connection.
+ *
+ * This buffer scans only each newly-arrived chunk for `\n` and holds the
+ * still-incomplete trailing line as an array of fragments (joined only when a
+ * newline finally completes it), so total work is linear in bytes received
+ * regardless of how a line is chunked. It also enforces `maxLineBytes`: a
+ * single line that exceeds the cap with no terminator is treated as a
+ * malformed stream — `push()` throws a retryable LLMServerError (which the
+ * adapter's stream loop propagates through classifyFetchError) rather than
+ * accumulating without bound.
+ *
+ * Note: the cap is measured in JS string `.length` (UTF-16 code units), not
+ * exact UTF-8 bytes. It is a coarse upper-bound guard against unbounded
+ * growth, not a precise byte accountant.
+ */
+export class SseLineBuffer {
+  /** @param {{ maxLineBytes?: number }} [opts] */
+  constructor({ maxLineBytes = DEFAULT_SSE_MAX_LINE_BYTES } = {}) {
+    this.maxLineBytes = Number.isFinite(maxLineBytes) && maxLineBytes > 0
+      ? Math.floor(maxLineBytes)
+      : DEFAULT_SSE_MAX_LINE_BYTES;
+    /**
+     * Fragments of the current (incomplete) line, in arrival order. Kept as an
+     * array — NOT a concatenated string — because `string += chunk` reallocates
+     * and copies the whole growing tail every call, which is itself O(n²) on a
+     * long un-terminated line even with an incremental newline scan. Pushing a
+     * fragment is O(1); we only `join` when a newline actually completes a line.
+     * @type {string[]}
+     */
+    this._frags = [];
+    /** Running byte length of `_frags` — avoids re-summing to enforce the cap. */
+    this._pendingLen = 0;
+  }
+
+  /**
+   * Append a chunk and return every newly-completed line (newline stripped),
+   * in order. The trailing incomplete line stays buffered for the next call.
+   * Lines may be empty strings (SSE uses blank lines as event separators);
+   * callers filter as needed.
+   *
+   * @param {string} chunk
+   * @returns {string[]}
+   * @throws {LLMServerError} when an un-terminated line exceeds `maxLineBytes`
+   */
+  push(chunk) {
+    if (!chunk) return [];
+    const lines = [];
+    let start = 0;
+    // Scan only THIS chunk for newlines. Bytes before the first newline finish
+    // the buffered partial line; bytes between newlines are whole lines; bytes
+    // after the last newline become the new partial. Work is linear in chunk
+    // length, and the buffered tail is never concatenated until a newline lands.
+    let nl;
+    while ((nl = chunk.indexOf('\n', start)) !== -1) {
+      const segment = chunk.slice(start, nl);
+      if (this._frags.length > 0) {
+        this._frags.push(segment);
+        lines.push(this._frags.join(''));
+        this._frags = [];
+        this._pendingLen = 0;
+      } else {
+        lines.push(segment);
+      }
+      start = nl + 1;
+    }
+    // Trailing fragment after the last newline (or the whole chunk if none):
+    // buffer it as an O(1) push rather than a string concat.
+    if (start < chunk.length) {
+      const tail = start === 0 ? chunk : chunk.slice(start);
+      this._frags.push(tail);
+      this._pendingLen += tail.length;
+      if (this._pendingLen > this.maxLineBytes) {
+        // LLMServerError is retryable by class (engine.js retries on
+        // `instanceof LLMServerError`), matching the sibling throws in the
+        // adapters — no `.retryable` flag needed on the throw path.
+        throw new LLMServerError(
+          `SSE line exceeded ${this.maxLineBytes} bytes without a newline — treating as malformed stream`,
+          0,
+        );
+      }
+    }
+    return lines;
+  }
+
+  /** The unconsumed trailing partial line (no newline yet). */
+  get pending() {
+    return this._frags.length === 1 ? this._frags[0] : this._frags.join('');
+  }
+}
+
 /**
  * Read one chunk from a Fetch stream with a silence timeout. This is not a
  * total request deadline: every received chunk gets a fresh budget. A caller

package/yeaft/llm/anthropic.js

@@ -18,6 +18,7 @@ import {
   readStreamChunkWithIdleTimeout,
   redactRawRequest,
   safeHeaders,
+  SseLineBuffer,
 } from './adapter.js';
 import {
   normalizeEffort,
@@ -302,7 +303,12 @@ export class AnthropicAdapter extends LLMAdapter {
     // Parse SSE stream
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
-    let buffer = '';
+    // Incremental O(n) line splitter (see SseLineBuffer): the old
+    // `buffer += chunk; buffer.split('\n')` pattern went quadratic on a
+    // multi-MiB un-terminated line and froze the event loop long enough to
+    // starve the WS heartbeat. The buffer also caps a single newline-less
+    // line and throws a retryable error on a malformed stream.
+    const sseLines = new SseLineBuffer();
     // task-327d: index-keyed per-block state. Anthropic streams content
     // blocks sequentially today, but the protocol exposes `event.index`
     // precisely because that's not guaranteed. Dispatch in
@@ -333,10 +339,8 @@ export class AnthropicAdapter extends LLMAdapter {
         if (done) break;
 
         const chunkText = decoder.decode(value, { stream: true });
-        buffer += chunkText;
         rawSseBodyChunks.push(chunkText);
-        const lines = buffer.split('\n');
-        buffer = lines.pop() || ''; // Keep incomplete line
+        const lines = sseLines.push(chunkText);
 
         for (const line of lines) {
           if (!line.startsWith('data: ')) continue;

package/yeaft/llm/openai-responses.js

@@ -37,6 +37,7 @@ import {
   readStreamChunkWithIdleTimeout,
   redactRawRequest,
   safeHeaders,
+  SseLineBuffer,
 } from './adapter.js';
 import {
   normalizeEffort,
@@ -315,7 +316,12 @@ export class OpenAIResponsesAdapter extends LLMAdapter {
 
     const reader = response.body.getReader();
     const decoder = new TextDecoder();
-    let buffer = '';
+    // Incremental O(n) line splitter (see SseLineBuffer): the old
+    // `buffer += chunk; buffer.split('\n')` pattern went quadratic on a
+    // multi-MiB un-terminated line and froze the event loop long enough to
+    // starve the WS heartbeat. The buffer also caps a single newline-less
+    // line and throws a retryable error on a malformed stream.
+    const sseLines = new SseLineBuffer();
 
     /** Accumulate tool call arguments by output_index.
      *  Value: { callId, name, arguments } */
@@ -342,12 +348,11 @@ export class OpenAIResponsesAdapter extends LLMAdapter {
         });
         if (done) break;
         const chunkText = decoder.decode(value, { stream: true });
-        buffer += chunkText;
         rawSseBodyChunks.push(chunkText);
 
-        // SSE events are separated by blank lines; split on \n
-        const lines = buffer.split('\n');
-        buffer = lines.pop() || '';
+        // SSE events are separated by blank lines; SseLineBuffer yields each
+        // completed line (newline stripped) in O(n) total.
+        const lines = sseLines.push(chunkText);
 
         for (const rawLine of lines) {
           const line = rawLine.trimEnd();