agents 0.17.0 → 0.17.3

package/dist/chat-sdk/index.d.ts

@@ -2,7 +2,7 @@ import {
   O as Agent,
   ct as SubAgentClass,
   lt as SubAgentStub
-} from "../agent-tool-types-Cd1TZPfB.js";
+} from "../agent-tool-types-CNyE1iz_.js";
 import { Lock, QueueEntry, StateAdapter } from "chat";
 
 //#region src/chat-sdk/agent.d.ts

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { O as Agent } from "./agent-tool-types-Cd1TZPfB.js";
+import { O as Agent } from "./agent-tool-types-CNyE1iz_.js";
 import {
   ClientParameters,
   Method,

package/dist/{index-CcbnKkNh.d.ts → index-BRnybD6X.d.ts}

@@ -176,6 +176,15 @@ type AgentObservabilityEvent =
         type: string;
       }
     >
+  | BaseEvent<
+      "alarm:memory_limit_reset",
+      {
+        strikes: number;
+        limit: number;
+        sealed: boolean;
+        error: string;
+      }
+    >
   | BaseEvent<
       "queue:create",
       {
@@ -935,4 +944,4 @@ export {
   MCPObservabilityEvent as s,
   ChannelEventMap as t
 };
-//# sourceMappingURL=index-CcbnKkNh.d.ts.map
+//# sourceMappingURL=index-BRnybD6X.d.ts.map

package/dist/index.d.ts

@@ -81,13 +81,14 @@ import {
   x as ChatCapableAgentClass,
   y as AgentToolStoredChunk,
   z as EmailRoutingOptions
-} from "./agent-tool-types-Cd1TZPfB.js";
+} from "./agent-tool-types-CNyE1iz_.js";
 import { n as camelCaseToKebabCase } from "./utils-CGtGDSgA.js";
 import {
-  i as isPlatformTransientError,
+  a as isPlatformTransientError,
   n as isDurableObjectCodeUpdateReset,
+  r as isDurableObjectMemoryLimitReset,
   t as RetryOptions
-} from "./retries-CwlpAGet.js";
+} from "./retries-CvHJwSuh.js";
 import {
   n as AgentsOAuthProvider,
   r as DurableObjectOAuthClientProvider,
@@ -179,6 +180,7 @@ export {
   getCurrentAgent,
   getSubAgentByName,
   isDurableObjectCodeUpdateReset,
+  isDurableObjectMemoryLimitReset,
   isPlatformTransientError,
   normalizeServerId,
   parseSubAgentPath,

package/dist/index.js

@@ -5,7 +5,7 @@ import { camelCaseToKebabCase, isInternalJsStubProp } from "./utils.js";
 import { createHeaderBasedEmailResolver, signAgentHeaders } from "./email.js";
 import { i as _classPrivateFieldInitSpec, n as _classPrivateFieldSet2, t as _classPrivateFieldGet2 } from "./classPrivateFieldGet2-DZBYAB34.js";
 import { SUB_PREFIX, getSubAgentByName, parseSubAgentPath, routeSubAgentRequest } from "./sub-routing.js";
-import { isDurableObjectCodeUpdateReset, isErrorRetryable, isPlatformTransientError, tryN, validateRetryOptions } from "./retries.js";
+import { isDurableObjectCodeUpdateReset, isDurableObjectMemoryLimitReset, isErrorRetryable, isPlatformTransientError, tryN, validateRetryOptions } from "./retries.js";
 import { a as MCPConnectionState, c as RPC_DO_PREFIX, i as normalizeServerId, l as DisposableStore, n as MCP_SERVER_ID_MAX_LENGTH, t as MCPClientManager } from "./client-BZ-B3NhC.js";
 import { DurableObjectOAuthClientProvider } from "./mcp/do-oauth-client-provider.js";
 import { genericObservability } from "./observability/index.js";
@@ -327,7 +327,16 @@ const DEFAULT_AGENT_STATIC_OPTIONS = {
 	*/
 	agentToolReattachMaxWindowMs: DEFAULT_AGENT_TOOL_REATTACH_MAX_WINDOW_MS,
 	detachedMaxBudgetMs: DEFAULT_DETACHED_MAX_BUDGET_MS,
-	detachedNoProgressBudgetMs: DEFAULT_DETACHED_NO_PROGRESS_BUDGET_MS
+	detachedNoProgressBudgetMs: DEFAULT_DETACHED_NO_PROGRESS_BUDGET_MS,
+	/**
+	* Consecutive alarm invocations that may end in a Durable Object memory-limit
+	* reset (the isolate exceeded its 128 MB limit) before the alarm-boundary
+	* circuit breaker stops the platform's auto-retry loop and seals the looping
+	* work (#1825). A small budget tolerates a genuinely transient memory spike;
+	* a deterministic OOM (the work's footprint, not the platform, is the cause)
+	* is bounded here regardless of whether the in-DO recovery budgets could run.
+	*/
+	maxAlarmMemoryLimitStrikes: 3
 };
 /**
 * Parse the raw `retry_options` TEXT column from a SQLite row into a
@@ -454,7 +463,8 @@ var Agent = class Agent extends Server {
 			agentToolReattachNoProgressTimeoutMs: ctor.options?.agentToolReattachNoProgressTimeoutMs ?? DEFAULT_AGENT_STATIC_OPTIONS.agentToolReattachNoProgressTimeoutMs,
 			agentToolReattachMaxWindowMs: ctor.options?.agentToolReattachMaxWindowMs ?? DEFAULT_AGENT_STATIC_OPTIONS.agentToolReattachMaxWindowMs,
 			detachedMaxBudgetMs: ctor.options?.detachedMaxBudgetMs ?? DEFAULT_AGENT_STATIC_OPTIONS.detachedMaxBudgetMs,
-			detachedNoProgressBudgetMs: ctor.options?.detachedNoProgressBudgetMs ?? DEFAULT_AGENT_STATIC_OPTIONS.detachedNoProgressBudgetMs
+			detachedNoProgressBudgetMs: ctor.options?.detachedNoProgressBudgetMs ?? DEFAULT_AGENT_STATIC_OPTIONS.detachedNoProgressBudgetMs,
+			maxAlarmMemoryLimitStrikes: ctor.options?.maxAlarmMemoryLimitStrikes ?? DEFAULT_AGENT_STATIC_OPTIONS.maxAlarmMemoryLimitStrikes
 		};
 		return this._cachedOptions;
 	}
@@ -3248,6 +3258,7 @@ var Agent = class Agent extends Server {
 			const isOneShotSchedule = row.type === "delayed" || row.type === "scheduled";
 			const shouldDeferReset = (error) => isOneShotSchedule && isDurableObjectCodeUpdateReset(error);
 			const shouldDeferOnExhaustion = (error) => isOneShotSchedule && isPlatformTransientError(error);
+			const shouldDeferMemoryLimit = (error) => isOneShotSchedule && isDurableObjectMemoryLimitReset(error);
 			try {
 				this._emit("schedule:execute", {
 					callback: row.callback,
@@ -3275,6 +3286,10 @@ var Agent = class Agent extends Server {
 					console.warn(`Deferring scheduled callback "${row.callback}" after exhausting in-process retries on a transient platform error; the one-shot row is preserved and the alarm will re-run once the platform recovers.`);
 					throw e;
 				}
+				if (shouldDeferMemoryLimit(e)) {
+					console.warn(`Deferring scheduled callback "${row.callback}" to the alarm memory-limit circuit breaker after a Durable Object memory-limit reset; the one-shot row is preserved so the breaker can bound the retry loop and seal it (#1825).`);
+					throw e;
+				}
 				console.error(`error executing callback "${row.callback}" after ${maxAttempts} attempts`, e);
 				this._emit("schedule:error", {
 					callback: row.callback,
@@ -3386,6 +3401,20 @@ var Agent = class Agent extends Server {
 			await this.destroy();
 			return;
 		}
+		try {
+			await this._cf_runAlarmBody();
+			await this._cf_clearAlarmMemoryLimitStrikes();
+		} catch (error) {
+			if (!isDurableObjectMemoryLimitReset(error)) throw error;
+			await this._cf_handleAlarmMemoryLimitReset(error);
+		}
+	}
+	/**
+	* The alarm body: PartyServer init + due-schedule processing + housekeeping +
+	* next-alarm arm. Extracted from {@link alarm} so the memory-limit circuit
+	* breaker can wrap it at the outermost frame (see {@link alarm}).
+	*/
+	async _cf_runAlarmBody() {
 		await super.alarm();
 		const now = Math.floor(Date.now() / 1e3);
 		const result = this.sql`
@@ -3436,7 +3465,9 @@ var Agent = class Agent extends Server {
 					continue;
 				}
 				else {
+					this._cf_executingScheduleRowId = row.id;
 					await this._executeScheduleCallback(row);
+					this._cf_executingScheduleRowId = void 0;
 					executed = true;
 				}
 				if (this._destroyed) return;
@@ -3462,6 +3493,105 @@ var Agent = class Agent extends Server {
 		await this._scheduleNextAlarm();
 	}
 	/**
+	* The schedule-callback names whose alarm rows drive a recovery loop that can
+	* deterministically OOM. The base agent has none; chat hosts (`Think`,
+	* `AIChatAgent`) override this to return their recovery continuation callbacks
+	* so the circuit breaker can surgically back them off / purge them WITHOUT
+	* disturbing unrelated scheduled tasks. See {@link _cf_handleAlarmMemoryLimitReset}.
+	*/
+	_cf_recoveryAlarmCallbacks() {
+		return [];
+	}
+	/**
+	* Hook for a host to terminalize ("seal") any in-flight recovery work as an
+	* out-of-memory exhaustion when the alarm circuit breaker trips at its strike
+	* budget (#1825). Runs at the outermost alarm frame (post-unwind, so writes
+	* can land). Default: no-op. Chat hosts override to fire `onExhausted` + the
+	* terminal banner and persist the sealed incident.
+	*/
+	async _cf_sealMemoryLimitedRecovery() {}
+	/**
+	* Clear the durable memory-limit strike counter after a clean alarm so the
+	* circuit breaker counts CONSECUTIVE resets rather than lifetime ones
+	* (#1825). Reads first (cheap, usually cached) and only writes when a strike
+	* is actually recorded, so the common no-strike path costs no write.
+	* Best-effort: a stale strike only costs one extra tolerated spike later.
+	*/
+	async _cf_clearAlarmMemoryLimitStrikes() {
+		try {
+			const prior = await this.ctx.storage.get(Agent._CF_OOM_ALARM_STRIKES_KEY);
+			if (typeof prior === "number" && prior > 0) await this.ctx.storage.delete(Agent._CF_OOM_ALARM_STRIKES_KEY);
+		} catch {}
+	}
+	/**
+	* Alarm-boundary circuit breaker for Durable Object memory-limit resets
+	* (#1825). The in-DO recovery budgets (`chatRecovery.maxOomRetries` /
+	* `maxRecoveryWork`) only engage if their code runs AND its writes land; a
+	* severe OOM can defeat both — thrown before the budget runs (boot hydration),
+	* or its own small writes also OOM under memory pressure. In that case the
+	* error reaches {@link alarm} and, unhandled, the platform auto-retries the
+	* alarm indefinitely (re-running the doomed, billable turn each cycle).
+	*
+	* This runs at the OUTERMOST frame: the heavy turn has unwound and GC has
+	* reclaimed its footprint, so the small writes here can land where mid-turn
+	* ones (e.g. give-up's incident read) OOMed. A durable strike counter tolerates
+	* a few resets (a transient spike may clear), backing off the recovery rows so
+	* the retry is not a hot loop. At the `maxAlarmMemoryLimitStrikes` budget it
+	* seals the recovery work and purges the looping rows so the loop — and the
+	* bill — stops. Each step is best-effort: even these tiny writes can OOM, but
+	* swallowing (not re-throwing) still halts the platform's auto-retry, and a
+	* later wake re-arms legitimate schedules.
+	*/
+	async _cf_handleAlarmMemoryLimitReset(error) {
+		const key = Agent._CF_OOM_ALARM_STRIKES_KEY;
+		let strikes = 1;
+		try {
+			const prior = await this.ctx.storage.get(key);
+			strikes = (typeof prior === "number" ? prior : 0) + 1;
+			await this.ctx.storage.put(key, strikes);
+		} catch {}
+		const limit = this._resolvedOptions.maxAlarmMemoryLimitStrikes;
+		const sealed = strikes >= limit;
+		const recoveryCallbacks = this._cf_recoveryAlarmCallbacks();
+		const executingRowId = this._cf_executingScheduleRowId;
+		this._cf_executingScheduleRowId = void 0;
+		console.error(`Alarm hit a Durable Object memory-limit reset (strike ${strikes}/${limit}${sealed ? ", sealing recovery" : ", will retry with backoff"}). Breaking the platform alarm-retry loop (#1825).`, error instanceof Error ? error.message : String(error));
+		if (sealed) {
+			for (const cb of recoveryCallbacks) try {
+				this.sql`DELETE FROM cf_agents_schedules WHERE callback = ${cb}`;
+			} catch {}
+			if (executingRowId) try {
+				this.sql`DELETE FROM cf_agents_schedules WHERE id = ${executingRowId}`;
+			} catch {}
+			try {
+				await this._cf_sealMemoryLimitedRecovery();
+			} catch {}
+			try {
+				await this.ctx.storage.delete(key);
+			} catch {}
+		} else {
+			const backoffSeconds = Math.min(300, 30 * strikes);
+			const nextTime = Math.floor(Date.now() / 1e3) + backoffSeconds;
+			for (const cb of recoveryCallbacks) try {
+				this.sql`UPDATE cf_agents_schedules SET time = ${nextTime} WHERE callback = ${cb} AND time <= ${nextTime}`;
+			} catch {}
+			if (executingRowId) try {
+				this.sql`UPDATE cf_agents_schedules SET time = ${nextTime} WHERE id = ${executingRowId} AND time <= ${nextTime}`;
+			} catch {}
+		}
+		try {
+			this._emit("alarm:memory_limit_reset", {
+				strikes,
+				limit,
+				sealed,
+				error: error instanceof Error ? error.message : String(error)
+			});
+		} catch {}
+		try {
+			await this._scheduleNextAlarm();
+		} catch {}
+	}
+	/**
 	* Intercept incoming HTTP/WS requests whose URL contains a
 	* `/sub/{child-class}/{child-name}` marker and forward them to
 	* the facet. The `onBeforeSubAgent` hook fires first (authorize,
@@ -6808,6 +6938,7 @@ var Agent = class Agent extends Server {
 	}
 };
 Agent.options = { hibernate: true };
+Agent._CF_OOM_ALARM_STRIKES_KEY = "cf_agents:oom_alarm_strikes";
 const wrappedClasses = /* @__PURE__ */ new Set();
 /**
 * Route a request to the appropriate Agent
@@ -6986,6 +7117,6 @@ var StreamingResponse = class {
 	}
 };
 //#endregion
-export { AGENT_TOOL_MILESTONE_PART, AGENT_TOOL_PROGRESS_PART, Agent, DEFAULT_AGENT_STATIC_OPTIONS, DurableObjectOAuthClientProvider, MCP_SERVER_ID_MAX_LENGTH, MessageType, SUB_PREFIX, SqlError, StreamingResponse, __DO_NOT_USE_WILL_BREAK__agentContext, callable, camelCaseToKebabCase, createHeaderBasedEmailResolver, getAgentByName, getCurrentAgent, getSubAgentByName, isDurableObjectCodeUpdateReset, isPlatformTransientError, normalizeServerId, parseSubAgentPath, routeAgentEmail, routeAgentRequest, routeSubAgentRequest, unstable_callable };
+export { AGENT_TOOL_MILESTONE_PART, AGENT_TOOL_PROGRESS_PART, Agent, DEFAULT_AGENT_STATIC_OPTIONS, DurableObjectOAuthClientProvider, MCP_SERVER_ID_MAX_LENGTH, MessageType, SUB_PREFIX, SqlError, StreamingResponse, __DO_NOT_USE_WILL_BREAK__agentContext, callable, camelCaseToKebabCase, createHeaderBasedEmailResolver, getAgentByName, getCurrentAgent, getSubAgentByName, isDurableObjectCodeUpdateReset, isDurableObjectMemoryLimitReset, isPlatformTransientError, normalizeServerId, parseSubAgentPath, routeAgentEmail, routeAgentRequest, routeSubAgentRequest, unstable_callable };
 
 //# sourceMappingURL=index.js.map