agent-nuvira 3.3.9 → 3.3.11

package/dist/web-dashboard/server.js

@@ -28,7 +28,7 @@ import { getAutoRouter } from '../learning/auto-router.js';
 import { readRecallHits } from '../context/session-recall.js';
 import { getRouterPromotion } from '../learning/router-promotion.js';
 import { AUTH_CLEAR_THRESHOLD } from '../learning/key-hygiene.js';
-import { ACTION_LOG_FILENAME, aggregateActionTelemetry, readActionTelemetryFile, getModelRegistry, } from '../learning/model-registry.js';
+import { ACTION_LOG_FILENAME, DEFAULT_STALE_MS, aggregateActionTelemetry, readActionTelemetryFile, getModelRegistry, } from '../learning/model-registry.js';
 import { classifyModelEntitlement } from '../inference/model-entitlement.js';
 import { listUnattendedJobs } from '../learning/unattended-job.js';
 import { AdminSessions, countAdminRoleUsers, isAdminConfigured, listAdminUsers, mustChangePasswordFor, removeAdminUser, roleForUser, verifyAdmin, writeAdminUser, MIN_ADMIN_PASSWORD_LENGTH, } from './src/admin-auth.js';
@@ -1212,6 +1212,48 @@ async function readModelsHealth() {
         registryVerified,
     };
 }
+/**
+ * The ONE source of truth for the model/provider counts every page shows.
+ *
+ * Two pairs, deliberately distinct and always LABELLED:
+ *   - `tracked*` — the Model Availability Registry (what routing consults).
+ *   - `listed*`  — the live provider probe (what each provider says it offers).
+ *
+ * These are different questions and their answers legitimately differ (a
+ * provider lists ids the router can never use, and the registry tracks pairs
+ * that no provider currently advertises). Showing them together, from here,
+ * is what stops Overview / Timeline / Models from each headlining a different
+ * number under one ambiguous word like "models".
+ *
+ * The live probe is EXPENSIVE (one HTTP call per provider), so its result is
+ * cached for a minute and shared by all three pages rather than re-probed per
+ * page. `listingAt` is returned so a page can say when the listing was taken.
+ */
+let modelListingCache = null;
+const MODEL_LISTING_TTL_MS = 60_000;
+async function readModelCounts() {
+    const registry = readModelRegistryData();
+    const trackedModels = registry.total ?? 0;
+    const trackedProviders = Array.isArray(registry.providers) ? registry.providers.length : 0;
+    const now = Date.now();
+    if (!modelListingCache || now - modelListingCache.at >= MODEL_LISTING_TTL_MS) {
+        try {
+            const health = await readModelsHealth();
+            modelListingCache = { at: now, models: health.totalModels, providers: health.providers.length };
+        }
+        catch {
+            // A failed probe keeps the previous listing rather than zeroing it:
+            // "we could not reach the providers just now" is not "you have none".
+        }
+    }
+    return {
+        trackedModels,
+        trackedProviders,
+        listedModels: modelListingCache?.models ?? 0,
+        listedProviders: modelListingCache?.providers ?? 0,
+        listingAt: modelListingCache?.at ?? 0,
+    };
+}
 /** Check local Ollama provider — no rate limits to parse */
 async function checkLocalProvider() {
     const result = {
@@ -1463,6 +1505,8 @@ function readJSON(filePath) {
 function readCostData() {
     const data = readJSON(join(MEMORY_DIR, 'cost-tracker.json'));
     if (!data?.entries) {
+        // The empty state deliberately omits `recent` entirely (the dashboard reads
+        // a missing list as "nothing recorded"), matching the other zero counters.
         return { totalRequests: 0, totalCost: 0, byProvider: {}, byModel: {} };
     }
     const entries = data.entries;
@@ -1471,10 +1515,17 @@ function readCostData() {
     const byProvider = {};
     const byModel = {};
     const byProviderMeasured = {};
+    const byProviderReported = {};
     let measuredCalls = 0;
     let estimatedCalls = 0;
     let measuredCost = 0;
     let estimatedCost = 0;
+    // Provider-REPORTED cost (costReported): the exact figure the endpoint billed
+    // (e.g. OpenRouter's `usage.cost`), as opposed to a locally-priced figure. It
+    // is a SUBSET of measured spend — reported cost always rides on measured
+    // tokens — so the UI labels it "of which" rather than a third partition.
+    let reportedCalls = 0;
+    let reportedCost = 0;
     for (const e of entries) {
         const cost = typeof e.costUsd === 'number' ? e.costUsd : 0;
         if (e.provider)
@@ -1493,6 +1544,13 @@ function readCostData() {
             estimatedCalls += 1;
             estimatedCost += cost;
         }
+        // Reported-cost split: the provider told us the exact bill for this call.
+        if (e.costReported === true) {
+            reportedCalls += 1;
+            reportedCost += cost;
+            if (e.provider)
+                byProviderReported[e.provider] = (byProviderReported[e.provider] || 0) + cost;
+        }
     }
     const recent = entries.slice(-50).reverse().map((e) => ({
         provider: e.provider,
@@ -1501,6 +1559,7 @@ function readCostData() {
         totalTokens: e.totalTokens,
         timestamp: e.timestamp,
         measured: e.measured === true,
+        reported: e.costReported === true,
     }));
     return {
         totalRequests: entries.length,
@@ -1509,10 +1568,13 @@ function readCostData() {
         byProvider,
         byModel,
         byProviderMeasured,
+        byProviderReported,
         measuredCalls,
         estimatedCalls,
         measuredCost: Math.round(measuredCost * 100000) / 100000,
         estimatedCost: Math.round(estimatedCost * 100000) / 100000,
+        reportedCalls,
+        reportedCost: Math.round(reportedCost * 100000) / 100000,
         recent,
     };
 }
@@ -1825,10 +1887,21 @@ function readModelRegistryData() {
         };
     }).sort((a, b) => a.provider.localeCompare(b.provider));
     const allModels = providers.flatMap((p) => p.models);
+    // Two DIFFERENT questions, two numbers. `verifiedRoutable` = proven to work
+    // (status verified, not parked); `routableNow` adds the staleness gate the
+    // router itself applies (`isUsable`). They diverge the moment a proof ages
+    // past 7 days, and reporting only the first under a "routable" label is what
+    // let the Overview contradict the Discovery Timeline's "routable now".
+    const routableNow = allModels.filter((m) => {
+        const verifiedAt = Number(m.lastVerifiedAt ?? 0);
+        return m.status === 'verified' && !m.parked && now - verifiedAt <= DEFAULT_STALE_MS;
+    }).length;
     return {
         enabled: providers.length > 0,
         total: allModels.length,
         verified: allModels.filter((m) => m.status === 'verified' && !m.parked).length,
+        /** The staleness-gated subset of `verified` — see the comment above. */
+        routableNow,
         unverified: allModels.filter((m) => m.status === 'unverified').length,
         unavailable: allModels.filter((m) => m.status === 'unavailable').length,
         parked: allModels.filter((m) => m.parked).length,
@@ -2902,8 +2975,18 @@ function readLargeJsonBody(req) {
 }
 /** Send a JSON response (the admin routes' single writer). */
 function writeJson(res, status, data) {
-    res.writeHead(status, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(data));
+    // The client may have gone away (a chat turn that outlives a page reload now
+    // finishes and writes its response to a socket nobody is holding). Writing
+    // there is a no-op, not an error — and it must never throw into the turn.
+    if (res.writableEnded || res.destroyed)
+        return;
+    try {
+        res.writeHead(status, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(data));
+    }
+    catch {
+        /* client disconnected mid-write — nothing to do */
+    }
 }
 /**
  * Turn a refused process-environment value into something a user can act on.
@@ -4725,6 +4808,15 @@ function handleRequest(req, res) {
         });
         return;
     }
+    // The SHARED model/provider counts every page (Overview, Timeline, Models)
+    // renders — one endpoint, so the three cannot disagree. `tracked*` is the
+    // registry (routing's truth), `listed*` is the cached live provider probe.
+    if (pathname === '/api/model-counts' && req.method === 'GET') {
+        readModelCounts()
+            .then((counts) => writeJson(res, 200, counts))
+            .catch(() => writeJson(res, 500, { error: 'Failed to read model counts' }));
+        return;
+    }
     if (pathname === '/api/model-registry') {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(readModelRegistryData()));
@@ -4894,6 +4986,28 @@ function handleRequest(req, res) {
         res.end(JSON.stringify(readRoutingInsights()));
         return;
     }
+    // ── The two size limits the composer needs BEFORE it reads a file ──────
+    // The browser blocks an over-cap file client-side, so it cannot discover the
+    // cap from a refusal (the file never leaves the page). This is the one place
+    // it can ask, and it keeps the client and the server from disagreeing about
+    // the limit — the same class of bug the Process Environment page fixes for
+    // the switches. Open, like the other read paths: it exposes a number, no data.
+    if (pathname === '/api/limits') {
+        void (async () => {
+            const { resolveExtractMaxChars, resolveAttachmentMaxBytes, DEFAULT_EXTRACT_MAX_CHARS, DEFAULT_ATTACHMENT_MAX_BYTES } = await import('../config/limits.js');
+            const attachmentMaxBytes = resolveAttachmentMaxBytes();
+            writeJson(res, 200, {
+                attachmentMaxBytes,
+                attachmentMaxKb: Math.round(attachmentMaxBytes / 1024),
+                extractMaxChars: resolveExtractMaxChars(),
+                defaults: {
+                    attachmentMaxBytes: DEFAULT_ATTACHMENT_MAX_BYTES,
+                    extractMaxChars: DEFAULT_EXTRACT_MAX_CHARS,
+                },
+            });
+        })();
+        return;
+    }
     if (pathname === '/api/all') {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
@@ -6106,7 +6220,10 @@ function handleRequest(req, res) {
             writeJson(res, 404, { ok: false, error: 'No such session.' });
             return;
         }
-        writeJson(res, 200, { ok: true, session: { id, ...rec } });
+        // `busy` lets a client that reloaded mid-turn know the answer is still being
+        // produced, so it can keep the bubble alive and poll instead of showing a
+        // finished-looking thread.
+        writeJson(res, 200, { ok: true, session: { id, ...rec, busy: chatConsole.isBusy(id) } });
         return;
     }
     // GET /api/continuity — the stored session snapshots + the semantic recall
@@ -6332,15 +6449,20 @@ function handleRequest(req, res) {
                     return;
                 }
             }
-            // P4 — the dashboard's Cancel button aborts the POST fetch: the server
-            // sees the request close and cancels the in-flight turn (the engine
-            // aborts the provider request — quota is not spent on a cancelled turn).
-            // Guarded: after the response is written (writableEnded) this never
-            // fires, and chatConsole.abort is a no-op once the turn finished.
-            // The client-disconnect signal is res 'close' (fires when the response
-            // stream closes): for an ABORTED fetch the response never completes, so
-            // writableEnded stays false and the turn is cancelled; after a normal
-            // completion writableEnded is true and this is a no-op.
+            // P4 (revised) — a client DISCONNECT no longer cancels the turn. It used
+            // to: the server treated `res` close as an abort, which meant a page
+            // reload or a closed browser tab killed the in-flight turn and discarded
+            // its answer. Reloading mid-turn is common, and "my question just
+            // vanished" is worse than a turn that keeps running. So the turn now runs
+            // to completion and PERSISTS (chat-console records it), and a reloaded
+            // client resumes the same session id and finds the answer there.
+            //
+            // Cancel is therefore EXPLICIT: the Cancel button calls
+            // `POST /api/chat/cancel`, which invokes chatConsole.abort. There is no
+            // longer any ambiguity between "the user cancelled" and "the connection
+            // dropped" — they are different signals because they are now different
+            // requests. The one cost: a turn whose client vanishes and is never
+            // cancelled keeps spending provider quota until it finishes.
             // A pending retry offer is answered HERE, before any turn runs: the reply
             // belongs to the offer, not to the composer's next request. A message that
             // is neither yes nor no falls through to normal handling.
@@ -6357,11 +6479,6 @@ function handleRequest(req, res) {
                 });
                 return;
             }
-            const onResClose = () => {
-                if (!res.writableEnded)
-                    chatConsole.abort(sessionId);
-            };
-            res.on('close', onResClose);
             // Mark the failover log BEFORE the turn so a failure can report which
             // models were actually tried (same contract as the gateway).
             const attemptMark = markFailoverAttempts();
@@ -6375,9 +6492,6 @@ function handleRequest(req, res) {
                 ...(keepWorktree === undefined ? {} : { keepWorktree }),
                 ...(resume === undefined ? {} : { resume }),
             });
-            // The response is written below — remove the disconnect listener so a
-            // post-completion close can never touch the console again.
-            res.off('close', onResClose);
             if (!result.ok) {
                 writeJson(res, 400, {
                     ok: false,
@@ -6447,6 +6561,31 @@ function handleRequest(req, res) {
         })();
         return;
     }
+    // POST /api/chat/cancel — cancel a session's IN-FLIGHT turn { sessionId }.
+    // Cancel is explicit since a dropped connection no longer means "cancel" (see
+    // the chat handler): only this endpoint aborts the running turn.
+    if (pathname === '/api/chat/cancel' && req.method === 'POST') {
+        void (async () => {
+            const session = adminSessions.validate(bearerToken(req));
+            if (!session) {
+                writeJson(res, 401, { ok: false, error: 'Not authenticated — log in first.' });
+                return;
+            }
+            if (!roleCan(session.role, 'routing.operate')) {
+                writeJson(res, 403, { ok: false, error: `Access denied — role '${session.role}' cannot chat with the agent (requires admin or operator).` });
+                return;
+            }
+            const body = await readJsonBody(req);
+            const sessionId = typeof body?.sessionId === 'string' ? body.sessionId : '';
+            if (!sessionId) {
+                writeJson(res, 400, { ok: false, error: 'Missing sessionId.' });
+                return;
+            }
+            const cancelled = chatConsole.abort(sessionId);
+            writeJson(res, 200, { ok: true, cancelled });
+        })();
+        return;
+    }
     // POST /api/chat/reset — forget a session's history { sessionId }.
     if (pathname === '/api/chat/reset' && req.method === 'POST') {
         void (async () => {