arisa 5.1.68 → 5.2.17

package/src/core/config/config-defaults.js

@@ -19,7 +19,17 @@ export const daemonConfigDefaults = Object.freeze({
 export const toolExecutionConfigDefaults = Object.freeze({
   defaultCapacity: 2,
   maxQueuedPerClass: 100,
-  capacities: Object.freeze({ orchestrator: 1 })
+  maxWorkerRssMb: 384,
+  maxSwapUsedPercent: 95,
+  initialToolMemoryMb: 384,
+  minimumToolMemoryMb: 128,
+  maximumToolMemoryMb: 4096,
+  systemReserveMb: 128,
+  coreReserveMb: 384,
+  toolHeapPercent: 65,
+  toolMemoryHighPercent: 85,
+  toolSwapMaxMb: 128,
+  capacities: Object.freeze({ browser: 1, orchestrator: 1 })
 });
 
 export const telegramConfigDefaults = Object.freeze({
@@ -58,6 +68,34 @@ export const taskConfigDefaults = Object.freeze({
 export const piConfigDefaults = Object.freeze({
   thinkingLevel: "medium",
   speed: 1,
+  sessionCache: Object.freeze({
+    maxSessions: 3,
+    maxPersistedBytes: 48 * 1024 * 1024
+  }),
+  sessionRotation: Object.freeze({
+    enabled: true,
+    compactAtPersistedBytes: 24 * 1024 * 1024,
+    maxPersistedBytes: 32 * 1024 * 1024
+  }),
+  heapCircuitBreaker: Object.freeze({
+    enabled: true,
+    softPercent: 70,
+    criticalPercent: 82,
+    waitMs: 15_000,
+    pollMs: 500
+  }),
+  toolFanout: Object.freeze({
+    enabled: true,
+    maxConcurrent: 2,
+    pressureConcurrent: 1,
+    serializePercent: 60
+  }),
+  turnCoordinator: Object.freeze({
+    enabled: true,
+    backgroundQueueTtlMs: 10 * 60_000,
+    interactiveQueueTtlMs: 0,
+    maxQueued: 100
+  }),
   compaction: Object.freeze({
     enabled: true,
     reserveTokens: 120_000,
@@ -108,6 +146,26 @@ export function applyConfigDefaults(config) {
     pi: {
       ...piConfigDefaults,
       ...configuredPi,
+      sessionCache: {
+        ...piConfigDefaults.sessionCache,
+        ...(configuredPi.sessionCache || {})
+      },
+      sessionRotation: {
+        ...piConfigDefaults.sessionRotation,
+        ...(configuredPi.sessionRotation || {})
+      },
+      heapCircuitBreaker: {
+        ...piConfigDefaults.heapCircuitBreaker,
+        ...(configuredPi.heapCircuitBreaker || {})
+      },
+      toolFanout: {
+        ...piConfigDefaults.toolFanout,
+        ...(configuredPi.toolFanout || {})
+      },
+      turnCoordinator: {
+        ...piConfigDefaults.turnCoordinator,
+        ...(configuredPi.turnCoordinator || {})
+      },
       compaction: {
         ...piConfigDefaults.compaction,
         ...(configuredPi.compaction || {})

package/src/core/config/config-store.js

@@ -1,6 +1,6 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { configFile } from "../../runtime/paths.js";
+import { configFile } from "../../platform/paths.js";
 import { applyConfigDefaults } from "./config-defaults.js";
 
 export function prepareConfigForSave(config) {

package/src/core/conversation/session-seed-store.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import {
   getChatLegacyConversationHistoryFile,
   getChatSessionSeedFile
-} from "../../runtime/paths.js";
+} from "../../platform/paths.js";
 
 function parseRecords(contents) {
   return String(contents || "")

package/src/core/tasks/task-runner.js

@@ -18,7 +18,8 @@ export function createTaskRunner({ taskStore, dispatch, laneKey = (task) => task
   async function reportTerminalFailure(task, updated, error) {
     const isTerminal = updated?.status === "failed"
       || updated?.status === "outcome_uncertain"
-      || updated?.terminalFailure === true;
+      || updated?.terminalFailure === true
+      || updated?.authBlockedNew === true;
     if (!isTerminal || typeof onTerminalFailure !== "function") return;
     try {
       await onTerminalFailure({ task, result: updated, error });
@@ -37,9 +38,12 @@ export function createTaskRunner({ taskStore, dispatch, laneKey = (task) => task
       logger?.log("tasks", `task ${task.id} completed after confirmed execution`);
       return { taskId: task.id, status: "completed" };
     } catch (error) {
-      const retryOptions = { retryable: error?.retryable !== false };
-      if (error?.outcomeUncertain === true) retryOptions.outcomeUncertain = true;
-      const updated = await taskStore.retryOrFail(task.id, error, retryOptions);
+      const updated = error?.authBlocked === true
+        ? await taskStore.blockAuth(task.id, error, error.authResolution)
+        : await taskStore.retryOrFail(task.id, error, {
+            retryable: error?.retryable !== false,
+            ...(error?.outcomeUncertain === true ? { outcomeUncertain: true } : {})
+          });
       const status = updated?.status || "missing";
       logger?.log("tasks", `task ${task.id} ${status}: ${errorMessage(error)}`);
       await reportTerminalFailure(task, updated, error);

package/src/core/tasks/task-store.js

@@ -1,7 +1,7 @@
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import crypto from "node:crypto";
-import { tasksFile } from "../../runtime/paths.js";
+import { tasksFile } from "../../platform/paths.js";
 
 const DEFAULT_RETRY = Object.freeze({
   maxAttempts: 3,
@@ -170,6 +170,16 @@ function retryDelayMs(task) {
   return Math.max(1, Math.round(seconds * 1000));
 }
 
+function normalizeAuthResolution(resolution = {}) {
+  const value = resolution && typeof resolution === "object" && !Array.isArray(resolution) ? resolution : {};
+  const retryAfterSeconds = Math.max(300, boundedPositiveNumber(value.retryAfterSeconds, 3_600, 86_400));
+  const probeArgs = value.probeArgs && typeof value.probeArgs === "object" && !Array.isArray(value.probeArgs)
+    ? structuredClone(value.probeArgs)
+    : {};
+  if (JSON.stringify(probeArgs).length > 4_096) throw new Error("Authentication probe arguments are too large");
+  return { retryAfterSeconds, probeArgs };
+}
+
 function failTask(task, error) {
   const failedAt = new Date().toISOString();
   task.status = "failed";
@@ -232,7 +242,7 @@ export class TaskStore {
     return this.mutate(async (tasks) => {
       const now = Date.now();
       const due = tasks
-        .filter((task) => task.status === "pending"
+        .filter((task) => ["pending", "blocked_auth"].includes(task.status)
           && task.runAt
           && !Number.isNaN(Date.parse(task.runAt))
           && Date.parse(task.runAt) <= now)
@@ -275,7 +285,7 @@ export class TaskStore {
         if (task.status === "running") {
           const interruptedAt = new Date(now).toISOString();
           if (task.claimedAt && !task.executionStartedAt) {
-            task.status = "pending";
+            task.status = task.authBlock ? "blocked_auth" : "pending";
             task.attempts = Math.max(0, Number(task.attempts || 0) - 1);
             task.lastError = "execution interrupted before start";
             task.lastFailedAt = interruptedAt;
@@ -294,8 +304,11 @@ export class TaskStore {
           delete task.claimedAt;
           delete task.executionStartedAt;
           if (task.kind === "poll_tool") {
-            task.status = "pending";
-            task.runAt = new Date(now + retryDelayMs(task)).toISOString();
+            task.status = task.authBlock ? "blocked_auth" : "pending";
+            const delayMs = task.authBlock
+              ? Number(task.authBlock.retryAfterSeconds || 3_600) * 1_000
+              : retryDelayMs(task);
+            task.runAt = new Date(now + delayMs).toISOString();
             delete task.startedAt;
           } else {
             const nextRunAt = computeNextRunAt(task, now);
@@ -337,6 +350,7 @@ export class TaskStore {
       delete task.error;
       delete task.lastOutcome;
       delete task.consecutiveFailures;
+      delete task.authBlock;
       delete task.claimedAt;
       delete task.executionStartedAt;
       if (nextRunAt) {
@@ -354,6 +368,35 @@ export class TaskStore {
     });
   }
 
+  async blockAuth(taskId, error, resolution = {}) {
+    return this.mutate(async (tasks) => {
+      const task = tasks.find((item) => item.id === taskId);
+      if (!task) return { result: null, changed: false };
+      const now = Date.now();
+      const checkedAt = new Date(now).toISOString();
+      const normalized = normalizeAuthResolution(resolution);
+      const wasBlocked = Boolean(task.authBlock);
+      task.status = "blocked_auth";
+      task.runAt = new Date(now + (normalized.retryAfterSeconds * 1_000)).toISOString();
+      task.attempts = 0;
+      task.authBlock = {
+        firstBlockedAt: task.authBlock?.firstBlockedAt || checkedAt,
+        lastCheckedAt: checkedAt,
+        ...normalized
+      };
+      task.lastError = error instanceof Error ? error.message : String(error);
+      task.lastFailedAt = checkedAt;
+      task.updatedAt = checkedAt;
+      if (task.claimedAt) task.lastClaimedAt = task.claimedAt;
+      if (task.executionStartedAt) task.lastExecutionStartedAt = task.executionStartedAt;
+      delete task.startedAt;
+      delete task.claimedAt;
+      delete task.executionStartedAt;
+      delete task.error;
+      return { result: { ...structuredClone(task), authBlockedNew: !wasBlocked } };
+    });
+  }
+
   async retryOrFail(taskId, error, { retryable = true, outcomeUncertain = false } = {}) {
     return this.mutate(async (tasks) => {
       const task = tasks.find((item) => item.id === taskId);

package/src/core/tools/daemon-client.js

@@ -0,0 +1,180 @@
+import crypto from "node:crypto";
+import net from "node:net";
+import { mkdir, readFile } from "node:fs/promises";
+import { daemonPaths, readJson, writeJson } from "./daemon-processes.js";
+import { loadDaemonPolicy } from "./daemon-policy.js";
+import {
+  DAEMON_CONTROL_FIELD,
+  DAEMON_PROTOCOL_VERSION,
+  daemonJobPaths,
+  daemonTerminalResult,
+  validateDaemonEvent
+} from "./daemon-protocol.js";
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function readCapability(paths) {
+  const token = (await readFile(paths.capabilityFile, "utf8")).trim();
+  if (!token) throw new Error(`Invalid daemon capability for ${paths.toolName}`);
+  return token;
+}
+
+export async function connectDaemon(paths, request, { timeoutMs, onEvent, maxFrameBytes }) {
+  const startedAt = Date.now();
+  const token = await readCapability(paths);
+  let lastError;
+  while (Date.now() - startedAt < timeoutMs) {
+    try {
+      return await new Promise((resolve, reject) => {
+        const socket = net.createConnection(paths.socketFile);
+        let buffer = "";
+        let sequence = 0;
+        let terminalSeen = false;
+        let settled = false;
+        let submitted = false;
+        let timeoutTriggered = false;
+        let observerChain = Promise.resolve();
+        const remainingMs = Math.max(1, timeoutMs - (Date.now() - startedAt));
+        let cancelTimer;
+        const timeoutError = Object.assign(
+          new Error(`${paths.toolName} daemon job timed out after ${timeoutMs}ms`),
+          { code: "DAEMON_JOB_TIMEOUT" }
+        );
+        const timer = setTimeout(() => {
+          timeoutTriggered = true;
+          if (submitted && !socket.destroyed && socket.writable) {
+            const frame = `${JSON.stringify({
+              version: DAEMON_PROTOCOL_VERSION,
+              type: "cancel",
+              jobId: request.jobId,
+              capabilityToken: token
+            })}\n`;
+            socket.end(frame, () => finish(reject, timeoutError));
+            cancelTimer = setTimeout(() => finish(reject, timeoutError), 50);
+            cancelTimer.unref?.();
+            return;
+          }
+          finish(reject, timeoutError);
+        }, remainingMs);
+        timer.unref?.();
+
+        function finish(fn, value) {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          clearTimeout(cancelTimer);
+          socket.destroy();
+          fn(value);
+        }
+
+        socket.setEncoding("utf8");
+        socket.once("connect", () => {
+          if (timeoutTriggered) return;
+          submitted = true;
+          socket.write(`${JSON.stringify({
+            version: DAEMON_PROTOCOL_VERSION,
+            type: "submit",
+            jobId: request.jobId,
+            capabilityToken: token
+          })}\n`);
+        });
+        socket.on("data", (chunk) => {
+          buffer += chunk;
+          if (Buffer.byteLength(buffer, "utf8") > maxFrameBytes && !buffer.includes("\n")) {
+            finish(reject, new Error(`Daemon IPC frame exceeds ${maxFrameBytes} bytes`));
+            return;
+          }
+          let newlineIndex = buffer.indexOf("\n");
+          while (newlineIndex !== -1) {
+            const line = buffer.slice(0, newlineIndex).trim();
+            buffer = buffer.slice(newlineIndex + 1);
+            newlineIndex = buffer.indexOf("\n");
+            if (!line) continue;
+            let frame;
+            try {
+              frame = JSON.parse(line);
+              const validated = validateDaemonEvent(frame, {
+                jobId: request.jobId,
+                previousSequence: sequence,
+                terminalSeen
+              });
+              sequence = validated.sequence;
+              terminalSeen = validated.terminal;
+            } catch (error) {
+              finish(reject, error);
+              return;
+            }
+            observerChain = observerChain.then(() => onEvent?.(frame));
+            if (terminalSeen) {
+              observerChain.then(() => {
+                if (timeoutTriggered) {
+                  finish(reject, timeoutError);
+                  return;
+                }
+                try {
+                  finish(resolve, daemonTerminalResult(frame));
+                } catch (error) {
+                  finish(reject, error);
+                }
+              }, (error) => finish(reject, timeoutTriggered ? timeoutError : error));
+            }
+          }
+        });
+        socket.once("error", (error) => finish(reject, error));
+        socket.once("close", () => {
+          if (!settled) finish(reject, timeoutTriggered
+            ? timeoutError
+            : new Error("Daemon IPC connection closed before terminal result"));
+        });
+      });
+    } catch (error) {
+      lastError = error;
+      if (!["ENOENT", "ECONNREFUSED"].includes(error?.code)) throw error;
+      await sleep(Math.min(25, Math.max(1, timeoutMs - (Date.now() - startedAt))));
+    }
+  }
+  const error = new Error(`${paths.toolName} daemon IPC was unavailable after ${timeoutMs}ms`);
+  error.code = lastError?.code || "DAEMON_IPC_UNAVAILABLE";
+  throw error;
+}
+
+export async function enqueueDaemonJob(paths, payload, {
+  control = false,
+  timeoutMs,
+  onEvent,
+  jobId,
+  maxFrameBytes
+} = {}) {
+  await mkdir(paths.commandsDir, { recursive: true });
+  const id = jobId || `${control ? "control" : "job"}-${crypto.randomUUID()}`;
+  const files = daemonJobPaths(paths, id);
+  const existingResult = await readJson(files.result, null);
+  if (existingResult?.terminal) {
+    await onEvent?.(existingResult.terminal);
+    return daemonTerminalResult(existingResult.terminal);
+  }
+  const existingRequest = await readJson(files.request, null);
+  const existingAccepted = await readJson(files.processing, null);
+  if (!existingRequest && !existingAccepted) {
+    await writeJson(files.request, {
+      id,
+      status: "queued",
+      queuedAt: new Date().toISOString(),
+      payload
+    });
+  }
+  return connectDaemon(paths, { jobId: id }, { timeoutMs, onEvent, maxFrameBytes });
+}
+
+export async function submitDaemonControl(record, operation, { timeoutMs, onEvent } = {}) {
+  const paths = daemonPaths({ toolName: record.toolName, scope: record.scope });
+  const policy = await loadDaemonPolicy();
+  return enqueueDaemonJob(paths, { [DAEMON_CONTROL_FIELD]: { operation } }, {
+    control: true,
+    timeoutMs: timeoutMs ?? policy.healthTimeoutMs,
+    onEvent,
+    maxFrameBytes: policy.ipcFrameBytes || 1_048_576
+  });
+}

package/src/core/tools/daemon-processes.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import crypto from "node:crypto";
-import { closeSync, openSync } from "node:fs";
+import { closeSync, existsSync, openSync } from "node:fs";
 import { chmod, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import {
@@ -9,7 +9,7 @@ import {
   getDaemonInstanceId,
   normalizeDaemonScope,
   toolStateDir
-} from "../../runtime/paths.js";
+} from "../../platform/paths.js";
 import { loadDaemonPolicy } from "./daemon-policy.js";
 
 export const DAEMON_STATES = Object.freeze([
@@ -22,6 +22,21 @@ export const DAEMON_STATES = Object.freeze([
   "failed"
 ]);
 
+export function daemonProcessInvocation(entryPath, {
+  platform = process.platform,
+  nodePath = process.execPath,
+  oomAdjustAvailable = existsSync("/usr/bin/choom")
+} = {}) {
+  if (platform !== "linux" || !oomAdjustAvailable) {
+    return { command: nodePath, args: [entryPath, "daemon"], oomProtected: false };
+  }
+  return {
+    command: "/usr/bin/choom",
+    args: ["-n", "500", "--", nodePath, entryPath, "daemon"],
+    oomProtected: true
+  };
+}
+
 function daemonIdentity(toolNameOrOptions, scope) {
   if (typeof toolNameOrOptions === "string") {
     return { toolName: toolNameOrOptions, scope: normalizeDaemonScope(scope) };
@@ -265,6 +280,13 @@ export async function unregisterManagedDaemon(toolNameOrOptions, { scope } = {})
   return { toolName: paths.toolName, scope: paths.scope, instanceId: paths.instanceId };
 }
 
+export async function purgeManagedDaemon(toolNameOrOptions, { scope } = {}) {
+  const paths = daemonPaths(toolNameOrOptions, scope);
+  await unregisterManagedDaemon(toolNameOrOptions, { scope });
+  await rm(paths.root, { recursive: true, force: true });
+  return { toolName: paths.toolName, scope: paths.scope, instanceId: paths.instanceId };
+}
+
 export async function stopManagedDaemon(toolNameOrOptions, {
   scope,
   signal = "SIGTERM",
@@ -367,7 +389,8 @@ export async function startManagedDaemon({
     const out = openSync(paths.logFile, "a");
     let child;
     try {
-      child = spawn(process.execPath, [entryPath, "daemon"], {
+      const invocation = daemonProcessInvocation(entryPath);
+      child = spawn(invocation.command, invocation.args, {
         detached: false,
         stdio: ["ignore", out, out],
         env: {

package/src/core/tools/daemon-protocol.js

@@ -0,0 +1,72 @@
+import path from "node:path";
+
+export const DAEMON_PROTOCOL_VERSION = 1;
+export const DAEMON_EVENT_TYPES = Object.freeze(["accepted", "progress", "chunk", "completed", "failed"]);
+export const DAEMON_CONTROL_FIELD = "__daemon";
+
+const TERMINAL_EVENT_TYPES = new Set(["completed", "failed"]);
+
+export function daemonJobPaths(paths, id) {
+  return {
+    request: path.join(paths.commandsDir, `${id}.request.json`),
+    processing: path.join(paths.commandsDir, `${id}.processing.json`),
+    result: path.join(paths.commandsDir, `${id}.result.json`)
+  };
+}
+
+export function daemonFrame(jobId, type, sequence, payload = {}) {
+  return { version: DAEMON_PROTOCOL_VERSION, jobId, type, sequence, payload };
+}
+
+export function daemonTerminalResult(frame) {
+  if (frame.type === "failed") {
+    const error = new Error(frame.payload?.error || "Daemon job failed");
+    if (frame.payload?.code) error.code = frame.payload.code;
+    throw error;
+  }
+  return frame.payload?.output || {};
+}
+
+export function validateDaemonEvent(frame, { jobId, previousSequence = 0, terminalSeen = false } = {}) {
+  if (!frame || frame.version !== DAEMON_PROTOCOL_VERSION || frame.jobId !== jobId) {
+    throw new Error("Invalid daemon event identity or protocol version");
+  }
+  if (!DAEMON_EVENT_TYPES.includes(frame.type)) throw new Error(`Invalid daemon event type: ${frame.type}`);
+  if (!Number.isSafeInteger(frame.sequence) || frame.sequence <= previousSequence) {
+    throw new Error(`Invalid daemon event sequence for ${jobId}: ${frame.sequence}`);
+  }
+  if (terminalSeen) throw new Error(`Daemon job ${jobId} emitted more than one terminal event`);
+  return { sequence: frame.sequence, terminal: TERMINAL_EVENT_TYPES.has(frame.type) };
+}
+
+export async function writeDaemonSocketFrame(socket, frame, {
+  maxFrameBytes = 1_048_576,
+  streamBufferBytes = 1_048_576
+} = {}) {
+  if (socket.destroyed || !socket.writable) return false;
+  const encoded = `${JSON.stringify(frame)}\n`;
+  if (Buffer.byteLength(encoded, "utf8") > maxFrameBytes) {
+    throw new Error(`Daemon IPC frame exceeds ${maxFrameBytes} bytes`);
+  }
+  if (socket.writableLength >= streamBufferBytes) {
+    await waitForWritableSocket(socket);
+    if (socket.destroyed || !socket.writable) return false;
+  }
+  if (socket.write(encoded)) return true;
+  await waitForWritableSocket(socket);
+  return !socket.destroyed;
+}
+
+function waitForWritableSocket(socket) {
+  return new Promise((resolve) => {
+    const finish = () => {
+      socket.off("drain", finish);
+      socket.off("close", finish);
+      socket.off("error", finish);
+      resolve();
+    };
+    socket.once("drain", finish);
+    socket.once("close", finish);
+    socket.once("error", finish);
+  });
+}