comisai 1.0.37 → 1.0.41

package/node_modules/@comis/agent/dist/executor/prompt-runner/retry-loop.js

@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Model retry orchestration — wraps `runWithModelRetry` and layers on
+ * stuck-session detection plus the silent-failure detection cascade
+ * (signed-replay self-heal, rate-limit short-circuit, client-request
+ * short-circuit, default strip-and-retry, LKW auth-failure fallback).
+ *
+ * The four silent-failure branches live in `./silent-failure-handlers.js`;
+ * this module owns the entry control flow and the stuck-session guard.
+ *
+ * Imports types only from `./prompt-runner-types.js` — never from
+ * `./prompt-runner.js` (one-directional dependency graph).
+ *
+ * @module
+ */
+import { formatSessionKey } from "@comis/core";
+import { fromPromise } from "@comis/shared";
+import { runWithModelRetry } from "../model-retry.js";
+import { classifyError } from "../error-classifier.js";
+import { getVisibleAssistantText } from "../phase-filter.js";
+import { handleClientRequest, handleRateLimited, handleSignedReplay, handleSilentRetryDefault, declareSilentTerminalFailure, } from "./silent-failure-handlers.js";
+/**
+ * Execute the model retry pipeline + silent-failure detection.
+ *
+ * When `skipPrompt` is true the function returns `{ promptSucceeded: true,
+ * stuckSessionDetected: false }` without invoking the model — matching the
+ * pre-split bypass for standalone /commands.
+ */
+export async function runRetryLoop(params, messageText, promptImages, skipPrompt) {
+    const { session, agentId, bridge, deps } = params;
+    const retryState = {
+        promptSucceeded: skipPrompt,
+        promptError: undefined,
+    };
+    // Redact LLM input -- log only character count, never user
+    // message text, canary tokens, or system prompt content.
+    deps.logger.debug({ inputChars: messageText.length }, "LLM input");
+    // Bind the model-retry invocation so the silent-failure branches share
+    // the deps wiring without re-threading every dependency.
+    const invokeRetry = (msgText, images) => invokeModelRetry(params, msgText, images);
+    if (!skipPrompt) {
+        const retryResult = await invokeRetry(messageText, promptImages);
+        retryState.promptSucceeded = retryResult.succeeded;
+        retryState.promptError = retryResult.error;
+        // Record successful model for last-known-working tracker
+        if (retryResult.succeeded && retryResult.effectiveModel) {
+            deps.lastKnownModel?.recordSuccess(agentId ?? "default", retryResult.effectiveModel.provider, retryResult.effectiveModel.model);
+        }
+    }
+    // Detect zero-LLM-call stuck session.
+    // When session.prompt() succeeds but the agent loop made zero LLM calls
+    // and zero tool steps (completing in <1s), the session is corrupt --
+    // typically from a race condition where an exec tool outlived the previous
+    // agent run, leaving a trailing tool result that orphaned-message repair
+    // converted into a synthetic assistant message the SDK treats as "done."
+    if (retryState.promptSucceeded && !skipPrompt) {
+        const stuckCheck = bridge.getResult();
+        if ((stuckCheck.llmCalls ?? 0) === 0 && (stuckCheck.stepsExecuted ?? 0) === 0) {
+            deps.logger.warn({
+                finishReason: stuckCheck.finishReason,
+                hint: "Session stuck: prompt returned with zero LLM calls; session will be reset",
+                errorKind: "internal",
+            }, "Zero-LLM-call execution detected");
+            return { promptSucceeded: false, promptError: undefined, stuckSessionDetected: true };
+        }
+    }
+    // Detect empty response from silent LLM failure.
+    // When the SDK retries internally on overloaded_error (up to 4 attempts)
+    // and all fail, session.prompt() resolves without throwing. The event
+    // bridge captures turn_end with stopReason: "error" and content: [],
+    // but runWithModelRetry only catches exceptions. Detect this case by
+    // checking for empty response + evidence of LLM calls in the bridge.
+    // Exception: In multi-turn agentic loops, text may be emitted in an
+    // intermediate turn (e.g., before a tool call). If the bridge recorded
+    // any text_delta events (textEmitted=true), an empty final turn is
+    // expected behavior, not a silent failure.
+    if (retryState.promptSucceeded && !skipPrompt) {
+        const candidateResponse = getVisibleAssistantText(session);
+        if (candidateResponse === "") {
+            const earlyBridgeResult = bridge.getResult();
+            // Only flag as silent failure if LLM was called AND no text
+            // was emitted in ANY turn. In multi-turn agentic loops, the model may
+            // produce visible text in an intermediate turn (stopReason: "toolUse")
+            // then return an empty final turn after a bookkeeping tool call.
+            // The textEmitted flag from the bridge tracks all text_delta events.
+            if ((earlyBridgeResult.llmCalls ?? 0) > 0 && !earlyBridgeResult.textEmitted) {
+                // Single-entry by construction: detectSilentFailure is called at most
+                // once per runPrompt invocation (the surrounding `if (promptSucceeded
+                // && !skipPrompt)` cannot re-enter this branch). The
+                // `silentRetryAttempted` parameter on detectSilentFailure is the
+                // pre-split file's gate-close shape — preserved for the defensive
+                // invariant the helper documents, threaded in as `false` here.
+                await detectSilentFailure(params, messageText, promptImages, earlyBridgeResult, retryState, invokeRetry, false);
+            }
+        }
+    }
+    return {
+        promptSucceeded: retryState.promptSucceeded,
+        promptError: retryState.promptError,
+        stuckSessionDetected: false,
+    };
+}
+/**
+ * Convert a stuck-session retry outcome into the final PromptRunResult shape
+ * (the orchestrator early-returns this rather than calling output-escalation).
+ */
+export function stuckSessionResult() {
+    return {
+        promptSucceeded: false,
+        promptError: undefined,
+        escalationAttempted: false,
+        stuckSessionDetected: true,
+    };
+}
+// ---------------------------------------------------------------------------
+// Private helpers
+// ---------------------------------------------------------------------------
+/** Wraps `runWithModelRetry` with the standard deps wiring used in 3 call sites. */
+async function invokeModelRetry(params, messageText, promptImages) {
+    const { session, config, sessionKey, agentId, effectiveTimeout, resolvedModel, deps, onResetTimer, } = params;
+    return runWithModelRetry({
+        session,
+        messageText,
+        promptImages,
+        config: { provider: config.provider, model: config.model },
+        resolvedModel: resolvedModel ? `${resolvedModel.provider}:${resolvedModel.id}` : undefined,
+        timeoutConfig: {
+            promptTimeoutMs: effectiveTimeout.promptTimeoutMs,
+            retryPromptTimeoutMs: effectiveTimeout.retryPromptTimeoutMs,
+        },
+        deps: {
+            eventBus: deps.eventBus,
+            logger: deps.logger,
+            authRotation: deps.authRotation,
+            fallbackModels: deps.fallbackModels,
+            modelRegistry: deps.modelRegistry,
+            agentId,
+            sessionKey: formatSessionKey(sessionKey),
+            providerHealth: deps.providerHealth,
+            lastKnownModel: deps.lastKnownModel,
+            onResetTimer: (fn) => { onResetTimer(fn); },
+            clock: deps.clock,
+            timers: deps.timers,
+        },
+    });
+}
+/**
+ * Orchestrate the silent-failure detection cascade. Returns the updated
+ * silentRetryAttempted flag (always `true` after this function runs).
+ *
+ *   1. followUp("(continued)") — Gemini thinking-only recovery
+ *   2. classify the bridge's recorded LLM error → branch:
+ *        a. client_request_signed_replay  → scrub + retry (signed-replay self-heal)
+ *        b. rate_limited                  → short-circuit (window can't roll)
+ *        c. client_request                → short-circuit (deterministic failure)
+ *        d. default                       → strip empty turns + retry + LKW fallback
+ */
+async function detectSilentFailure(params, messageText, promptImages, earlyBridgeResult, retryState, invokeRetry, silentRetryAttempted) {
+    const { session, deps } = params;
+    // Before declaring failure, attempt a single continuation
+    // when the model stopped normally but only produced thinking blocks
+    // (no visible text). Common with Gemini thinking-only responses.
+    let silent02Recovered = false;
+    if (earlyBridgeResult.finishReason === "stop") {
+        deps.logger.info({
+            llmCalls: earlyBridgeResult.llmCalls,
+            stepsExecuted: earlyBridgeResult.stepsExecuted,
+            hint: "Model produced no visible text; nudging continuation",
+            errorKind: "transient",
+        }, "Attempting continuation after thinking-only final turn");
+        const followUpResult = await fromPromise(session.followUp("(continued from previous message)"));
+        if (followUpResult.ok) {
+            const recoveredText = getVisibleAssistantText(session);
+            if (recoveredText !== "") {
+                silent02Recovered = true;
+                retryState.promptSucceeded = true;
+                deps.logger.info({ recoveredLength: recoveredText.length }, "Continuation recovered visible text");
+            }
+        }
+        else {
+            deps.logger.debug({ err: followUpResult.error }, "followUp call failed; falling through to");
+        }
+    }
+    if (!silent02Recovered && !silentRetryAttempted) {
+        // Classify the bridge's recorded LLM error to pick the correct path.
+        const llmErrSource = earlyBridgeResult.lastLlmErrorMessage ?? "";
+        const earlyClassification = classifyError(new Error(llmErrSource));
+        if (earlyClassification.category === "client_request_signed_replay") {
+            await handleSignedReplay(params, messageText, promptImages, earlyBridgeResult, retryState, invokeRetry);
+        }
+        else if (earlyClassification.category === "rate_limited") {
+            handleRateLimited(params, earlyBridgeResult, retryState);
+        }
+        else if (earlyClassification.category === "client_request") {
+            handleClientRequest(params, earlyBridgeResult, retryState);
+        }
+        else {
+            await handleSilentRetryDefault(params, messageText, promptImages, earlyBridgeResult, retryState, invokeRetry);
+        }
+        // Close the gate so this branch cannot be re-entered within the
+        // same runPrompt invocation (defends against future refactors that
+        // might reach this region twice).
+        return true;
+    }
+    else if (!silent02Recovered) {
+        declareSilentTerminalFailure(params, earlyBridgeResult, retryState);
+    }
+    return silentRetryAttempted;
+}

package/node_modules/@comis/agent/dist/executor/prompt-runner/silent-failure-handlers.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Silent-failure detection branches — the four distinct recovery paths the
+ * pre-split prompt runner took when the SDK resolved `session.prompt()`
+ * without throwing but emitted a content-less assistant turn:
+ *
+ *   1. signed-replay self-heal (scrub thinking state + retry once with 1s settle)
+ *   2. rate-limit short-circuit (window can't roll; declare terminal failure)
+ *   3. client-request short-circuit (deterministic provider validation; do not retry)
+ *   4. default strip-and-retry + LKW (last-known-working) auth-failure fallback
+ *
+ * Imports types only from `./prompt-runner-types.js` — never from
+ * `./prompt-runner.js` (avoids circular dependency).
+ *
+ * @module
+ */
+import { type ModelRetryResult } from "../model-retry.js";
+import type { ImageContent } from "@earendil-works/pi-ai";
+import type { RunPromptParams } from "./prompt-runner-types.js";
+/** Mutable state threaded through the silent-failure branches. */
+export interface RetryState {
+    promptSucceeded: boolean;
+    promptError: unknown;
+}
+/** Snapshot of the bridge state captured once at the start of silent-failure detection. */
+export type BridgeSnapshot = ReturnType<RunPromptParams["bridge"]["getResult"]>;
+/** Callback that runs the model retry pipeline (provided by retry-loop.ts to share the deps wiring). */
+export type InvokeRetry = (messageText: string, promptImages: ImageContent[] | undefined) => Promise<ModelRetryResult>;
+/** Signed-replay self-heal: scrub stored signed thinking state, retry once with a 1s settle. */
+export declare function handleSignedReplay(params: RunPromptParams, messageText: string, promptImages: ImageContent[] | undefined, earlyBridgeResult: BridgeSnapshot, retryState: RetryState, invokeRetry: InvokeRetry): Promise<void>;
+/** Rate-limit short-circuit: window can't roll within this invocation; emit terminal failure. */
+export declare function handleRateLimited(params: RunPromptParams, earlyBridgeResult: BridgeSnapshot, retryState: RetryState): void;
+/** Client-request short-circuit: deterministic provider validation rejection; do not retry. */
+export declare function handleClientRequest(params: RunPromptParams, earlyBridgeResult: BridgeSnapshot, retryState: RetryState): void;
+/** Default silent-failure path: strip empty assistant turns + 3s settle + re-enter retry + LKW fallback. */
+export declare function handleSilentRetryDefault(params: RunPromptParams, messageText: string, promptImages: ImageContent[] | undefined, earlyBridgeResult: BridgeSnapshot, retryState: RetryState, invokeRetry: InvokeRetry): Promise<void>;
+/** Terminal silent-failure branch when the gate is closed or follow-up didn't recover. */
+export declare function declareSilentTerminalFailure(params: RunPromptParams, earlyBridgeResult: BridgeSnapshot, retryState: RetryState): void;
+/**
+ * Strip trailing assistant messages with no visible text content. Walks
+ * backward from the end, removing assistant messages where every content
+ * block is thinking-only or has no visible text. Stops at the last
+ * non-assistant message (user or toolResult).
+ */
+export declare function stripTrailingEmptyAssistantTurns(session: RunPromptParams["session"]): void;

package/node_modules/@comis/agent/dist/executor/prompt-runner/silent-failure-handlers.js

@@ -0,0 +1,272 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Silent-failure detection branches — the four distinct recovery paths the
+ * pre-split prompt runner took when the SDK resolved `session.prompt()`
+ * without throwing but emitted a content-less assistant turn:
+ *
+ *   1. signed-replay self-heal (scrub thinking state + retry once with 1s settle)
+ *   2. rate-limit short-circuit (window can't roll; declare terminal failure)
+ *   3. client-request short-circuit (deterministic provider validation; do not retry)
+ *   4. default strip-and-retry + LKW (last-known-working) auth-failure fallback
+ *
+ * Imports types only from `./prompt-runner-types.js` — never from
+ * `./prompt-runner.js` (avoids circular dependency).
+ *
+ * @module
+ */
+import { formatSessionKey } from "@comis/core";
+import { isAuthError } from "../model-retry.js";
+import { normalizeModelId } from "../../provider/model-id-normalize.js";
+import { withPromptTimeout } from "../prompt-timeout.js";
+import { scrubSignedReplayStateInPlace } from "../signature-block-scrubber.js";
+import { getVisibleAssistantText } from "../phase-filter.js";
+/** Signed-replay self-heal: scrub stored signed thinking state, retry once with a 1s settle. */
+export async function handleSignedReplay(params, messageText, promptImages, earlyBridgeResult, retryState, invokeRetry) {
+    const { session, sessionKey, agentId, bridge, deps } = params;
+    const llmErrSource = earlyBridgeResult.lastLlmErrorMessage ?? "";
+    // Provider-agnostic signed-replay self-heal. Scrub stored signed
+    // thinking / reasoning state in place, then re-enter the full
+    // model retry pipeline once. Mirrors the silent-retry shape but
+    // with a 1s settle (vs 3s for transient overload) since the
+    // failure cause is deterministic state on disk, not a transient
+    // provider condition.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const msgs = session.messages ?? [];
+    const { blocksRemoved, thoughtSignaturesStripped } = scrubSignedReplayStateInPlace(msgs);
+    deps.logger.info({
+        blocksRemoved,
+        thoughtSignaturesStripped,
+        providerError: llmErrSource,
+        hint: "Signed-replay rejection detected; scrubbing thinking state and retrying once",
+        errorKind: "transient",
+    }, "Signed-replay self-heal: scrubbing and retrying");
+    // Brief settle before retry. Distinct from the 3s silent-retry
+    // delay because signed-replay is a deterministic state error,
+    // not a transient provider condition.
+    await new Promise(r => { const h = deps.timers.setTimeout(() => r(), 1_000); void h; });
+    const retryResult = await invokeRetry(messageText, promptImages);
+    retryState.promptSucceeded = retryResult.succeeded;
+    retryState.promptError = retryResult.error;
+    // Re-check for empty response after retry; mirror the
+    // silent-retry post-check semantics so the recovery event
+    // reports a faithful succeeded flag.
+    let recovered = retryState.promptSucceeded;
+    if (retryState.promptSucceeded) {
+        const retryText = session.getLastAssistantText?.() ?? "";
+        if (retryText === "") {
+            const retryBridgeResult = bridge.getResult();
+            if ((retryBridgeResult.llmCalls ?? 0) > 0 && !retryBridgeResult.textEmitted) {
+                recovered = false;
+                retryState.promptSucceeded = false;
+                const llmDetail = retryBridgeResult.lastLlmErrorMessage
+                    ? ` — ${retryBridgeResult.lastLlmErrorMessage}`
+                    : "";
+                retryState.promptError = new Error(`Signed-replay self-heal failed: ${retryBridgeResult.llmCalls} LLM call(s) produced empty response after retry (finishReason: ${retryBridgeResult.finishReason ?? "unknown"})${llmDetail}`);
+            }
+        }
+    }
+    deps.eventBus.emit("execution:signed_replay_recovered", {
+        agentId: agentId ?? "default",
+        sessionKey: formatSessionKey(sessionKey),
+        blocksRemoved,
+        thoughtSignaturesStripped,
+        succeeded: recovered,
+        timestamp: deps.clock.now(),
+    });
+    if (recovered) {
+        deps.logger.info({ blocksRemoved, thoughtSignaturesStripped, recovered: true }, "Signed-replay self-heal succeeded");
+    }
+    else {
+        deps.logger.warn({
+            blocksRemoved,
+            thoughtSignaturesStripped,
+            hint: "Signed-replay self-heal retry also failed; declaring terminal failure",
+            errorKind: "dependency",
+        }, "Signed-replay self-heal retry failed");
+    }
+}
+/** Rate-limit short-circuit: window can't roll within this invocation; emit terminal failure. */
+export function handleRateLimited(params, earlyBridgeResult, retryState) {
+    const { deps } = params;
+    const llmErrSource = earlyBridgeResult.lastLlmErrorMessage ?? "";
+    // Provider-side time-based throttle (429/529). Retrying within the
+    // same runPrompt invocation cannot succeed — the rate-limit window
+    // hasn't rolled. The model-retry layer's cache-aware short retry
+    // (model-retry.ts:261-294) is the correct retry point for 429 with
+    // a parseable Retry-After header < SHORT_RETRY_THRESHOLD_MS. If we
+    // got here, that retry was either skipped (no Retry-After) or
+    // exhausted, AND the SDK didn't throw the 429 out (caught inside
+    // pi-ai's stream wrapper, surfaced as empty response). Re-entering
+    // runWithModelRetry from this layer would do another N retries that
+    // all hit the same rate-limit window — observed in production as
+    // 1 user message → 8 LLM calls (daemon.1.log:23:35:06-23:35:52,
+    // OpenRouter qwen/qwen3-coder:free 8 RPM cap). Short-circuit.
+    deps.logger.warn({
+        llmCalls: earlyBridgeResult.llmCalls,
+        finishReason: earlyBridgeResult.finishReason,
+        providerError: llmErrSource,
+        hint: "Provider returned a rate-limit error; retrying within the same window cannot succeed — surfacing terminal failure to caller",
+        errorKind: "rate_limited",
+    }, "Rate-limit error — skipping silent-retry and declaring terminal failure");
+    retryState.promptSucceeded = false;
+    const llmDetail = llmErrSource ? ` — ${llmErrSource}` : "";
+    retryState.promptError = new Error(`Rate limit exceeded: ${earlyBridgeResult.llmCalls} LLM call(s) produced empty response (finishReason: ${earlyBridgeResult.finishReason ?? "unknown"})${llmDetail}`);
+}
+/** Client-request short-circuit: deterministic provider validation rejection; do not retry. */
+export function handleClientRequest(params, earlyBridgeResult, retryState) {
+    const { deps } = params;
+    const llmErrSource = earlyBridgeResult.lastLlmErrorMessage ?? "";
+    // Plain client_request: deterministic failure (e.g. unprocessable_entity,
+    // bare "cannot be modified" without signature noun). Retrying would
+    // reproduce the same failure. Short-circuit before the strip+retry
+    // block to avoid wasting tokens.
+    deps.logger.warn({
+        llmCalls: earlyBridgeResult.llmCalls,
+        finishReason: earlyBridgeResult.finishReason,
+        providerError: llmErrSource,
+        hint: "Anthropic returned a client-side validation error; retrying would reproduce the same failure",
+        errorKind: "client_request",
+    }, "Client-request error — skipping silent-retry and declaring terminal failure");
+    retryState.promptSucceeded = false;
+    const llmDetail = llmErrSource ? ` — ${llmErrSource}` : "";
+    retryState.promptError = new Error(`Client request rejected by provider: ${earlyBridgeResult.llmCalls} LLM call(s) produced empty response (finishReason: ${earlyBridgeResult.finishReason ?? "unknown"})${llmDetail}`);
+}
+/** Default silent-failure path: strip empty assistant turns + 3s settle + re-enter retry + LKW fallback. */
+export async function handleSilentRetryDefault(params, messageText, promptImages, earlyBridgeResult, retryState, invokeRetry) {
+    const { session, bridge, deps } = params;
+    // First silent failure: strip empty assistant turns and re-enter
+    // the full model retry chain (cache-aware short retry, key rotation,
+    // model fallback). Thinking-only messages (encrypted reasoning blocks
+    // with no visible text) poison the conversation for the next attempt.
+    deps.logger.info({
+        llmCalls: earlyBridgeResult.llmCalls,
+        finishReason: earlyBridgeResult.finishReason,
+        hint: "Stripping empty assistant turn and re-entering model retry",
+        errorKind: "transient",
+    }, "Silent failure retry: stripping empty turn and re-entering model retry");
+    stripTrailingEmptyAssistantTurns(session);
+    // Brief delay to let transient provider conditions clear
+    await new Promise(r => { const h = deps.timers.setTimeout(() => r(), 3_000); void h; });
+    // Re-enter the full model retry pipeline
+    const retryResult = await invokeRetry(messageText, promptImages);
+    retryState.promptSucceeded = retryResult.succeeded;
+    retryState.promptError = retryResult.error;
+    // Re-check for empty response after retry
+    if (retryState.promptSucceeded) {
+        const retryText = session.getLastAssistantText?.() ?? "";
+        if (retryText === "") {
+            const retryBridgeResult = bridge.getResult();
+            if ((retryBridgeResult.llmCalls ?? 0) > 0 && !retryBridgeResult.textEmitted) {
+                deps.logger.warn({
+                    llmCalls: retryBridgeResult.llmCalls,
+                    finishReason: retryBridgeResult.finishReason,
+                    hint: "Silent failure persisted after retry; treating as terminal failure",
+                    errorKind: "dependency",
+                }, "Silent LLM failure detected (after retry)");
+                retryState.promptSucceeded = false;
+                const llmDetail = retryBridgeResult.lastLlmErrorMessage
+                    ? ` — ${retryBridgeResult.lastLlmErrorMessage}`
+                    : "";
+                retryState.promptError = new Error(`Silent LLM failure: ${retryBridgeResult.llmCalls} LLM call(s) produced empty response after retry (finishReason: ${retryBridgeResult.finishReason ?? "unknown"})${llmDetail}`);
+                // LKW silent-failure fallback: some providers return 403 as
+                // an empty response (SDK doesn't throw), so model-retry's LKW
+                // block never fires. Detect auth errors here and try the LKW
+                // model as a final attempt before giving up.
+                await attemptLkwFallback(params, messageText, promptImages, retryBridgeResult, retryState);
+            }
+        }
+    }
+}
+/** Terminal silent-failure branch when the gate is closed or follow-up didn't recover. */
+export function declareSilentTerminalFailure(params, earlyBridgeResult, retryState) {
+    const { deps } = params;
+    // Already retried once, or followUp didn't help -- declare terminal failure
+    deps.logger.warn({
+        llmCalls: earlyBridgeResult.llmCalls,
+        finishReason: earlyBridgeResult.finishReason,
+        hint: "LLM resolved without error but produced empty response; treating as failure",
+        errorKind: "dependency",
+    }, "Silent LLM failure detected");
+    retryState.promptSucceeded = false;
+    // Include the bridge's LLM error message so classifyError can
+    // pattern-match on the real provider error (e.g. billing, auth).
+    const llmDetail = earlyBridgeResult.lastLlmErrorMessage
+        ? ` — ${earlyBridgeResult.lastLlmErrorMessage}`
+        : "";
+    retryState.promptError = new Error(`Silent LLM failure: ${earlyBridgeResult.llmCalls} LLM call(s) produced empty response (finishReason: ${earlyBridgeResult.finishReason ?? "unknown"})${llmDetail}`);
+}
+/**
+ * Strip trailing assistant messages with no visible text content. Walks
+ * backward from the end, removing assistant messages where every content
+ * block is thinking-only or has no visible text. Stops at the last
+ * non-assistant message (user or toolResult).
+ */
+export function stripTrailingEmptyAssistantTurns(session) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const msgs = session.messages ?? [];
+    for (let i = msgs.length - 1; i >= 0; i--) {
+        const m = msgs[i]; // eslint-disable-line security/detect-object-injection
+        if (m?.role !== "assistant")
+            break;
+        const blocks = Array.isArray(m.content) ? m.content : [];
+        const hasVisibleText = blocks.some(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- SDK interop boundary
+        (b) => b.type === "text" && typeof b.text === "string" && b.text.trim() !== "");
+        if (!hasVisibleText) {
+            msgs.splice(i, 1);
+        }
+        else {
+            break;
+        }
+    }
+}
+/**
+ * Last-known-working fallback for silent auth failures. Some providers
+ * return 403 as an empty response (SDK doesn't throw), so model-retry's
+ * LKW block never fires. Detect auth errors here and try the LKW model
+ * as a final attempt before giving up.
+ */
+async function attemptLkwFallback(params, messageText, promptImages, retryBridgeResult, retryState) {
+    const { session, config, agentId, effectiveTimeout, deps } = params;
+    const silentAuthErr = retryBridgeResult.lastLlmErrorMessage ?? "";
+    if (!isAuthError(new Error(silentAuthErr)) || !deps.lastKnownModel) {
+        return;
+    }
+    const lkw = deps.lastKnownModel.getLastKnown(agentId ?? "") ??
+        deps.lastKnownModel.getAnyKnown(config.provider);
+    if (!lkw || (lkw.provider === config.provider && lkw.model === config.model)) {
+        return;
+    }
+    deps.logger.info({ lkwProvider: lkw.provider, lkwModel: lkw.model, silentAuthErr }, "Silent auth failure — attempting last-known-working model");
+    try {
+        const normalizedLkw = normalizeModelId(lkw.provider, lkw.model);
+        const lkwModelObj = deps.modelRegistry.find(lkw.provider, normalizedLkw.modelId);
+        if (lkwModelObj) {
+            await session.setModel(lkwModelObj);
+        }
+        // Strip trailing empty assistant turns before the LKW attempt
+        stripTrailingEmptyAssistantTurns(session);
+        await withPromptTimeout(session.prompt(messageText, { expandPromptTemplates: false, images: promptImages }), effectiveTimeout.retryPromptTimeoutMs, () => session.abort(), deps.timers);
+        const lkwText = getVisibleAssistantText(session);
+        if (lkwText !== "") {
+            retryState.promptSucceeded = true;
+            retryState.promptError = undefined;
+            deps.lastKnownModel.recordSuccess(agentId ?? "default", lkw.provider, lkw.model);
+            deps.logger.info({ lkwProvider: lkw.provider, lkwModel: lkw.model }, "LKW silent-failure fallback succeeded");
+        }
+        else {
+            deps.logger.warn({
+                lkwProvider: lkw.provider, lkwModel: lkw.model,
+                hint: "LKW model also produced empty response",
+                errorKind: "dependency",
+            }, "LKW silent-failure fallback produced empty response");
+        }
+    }
+    catch (lkwErr) {
+        deps.logger.warn({
+            err: lkwErr, lkwProvider: lkw.provider, lkwModel: lkw.model,
+            hint: "LKW model threw during silent-failure fallback",
+            errorKind: "dependency",
+        }, "LKW silent-failure fallback failed");
+    }
+}

package/node_modules/@comis/agent/dist/executor/prompt-timeout.d.ts

@@ -8,6 +8,7 @@
  * @module
  */
 import { TimeoutError } from "@comis/shared";
+import type { TimerPort } from "@comis/core";
 /**
  * Error thrown when a session.prompt() call exceeds its wall-clock timeout.
  *
@@ -34,7 +35,7 @@ export declare class PromptTimeoutError extends TimeoutError {
  * @param timeoutMs - Timeout in milliseconds.
  * @param abort - Function to call on timeout (typically session.abort()).
  */
-export declare function withPromptTimeout<T>(promise: Promise<T>, timeoutMs: number, abort: () => void | Promise<void>): Promise<T>;
+export declare function withPromptTimeout<T>(promise: Promise<T>, timeoutMs: number, abort: () => void | Promise<void>, timers: TimerPort): Promise<T>;
 /** Return type of withResettablePromptTimeout -- includes a resetTimer callback. */
 export interface ResettableTimeout<T> {
     /** The raced promise (resolves/rejects like withPromptTimeout). */
@@ -54,4 +55,4 @@ export interface ResettableTimeout<T> {
  * @param timeoutMs - Timeout in milliseconds (full budget per reset).
  * @param abort - Function to call on timeout (typically session.abort()).
  */
-export declare function withResettablePromptTimeout<T>(promise: Promise<T>, timeoutMs: number, abort: () => void | Promise<void>): ResettableTimeout<T>;
+export declare function withResettablePromptTimeout<T>(promise: Promise<T>, timeoutMs: number, abort: () => void | Promise<void>, timers: TimerPort): ResettableTimeout<T>;

package/node_modules/@comis/agent/dist/executor/prompt-timeout.js

@@ -38,10 +38,10 @@ export class PromptTimeoutError extends TimeoutError {
  * @param timeoutMs - Timeout in milliseconds.
  * @param abort - Function to call on timeout (typically session.abort()).
  */
-export function withPromptTimeout(promise, timeoutMs, abort) {
+export function withPromptTimeout(promise, timeoutMs, abort, timers) {
     let timer;
     const timeoutPromise = new Promise((_resolve, reject) => {
-        timer = setTimeout(() => {
+        timer = timers.setTimeout(() => {
             // abort() may return Promise<void> -- handle both sync throw and async rejection
             try {
                 // eslint-disable-next-line no-restricted-syntax -- intentional fire-and-forget
@@ -54,7 +54,7 @@ export function withPromptTimeout(promise, timeoutMs, abort) {
         }, timeoutMs);
     });
     return Promise.race([promise, timeoutPromise]).finally(() => {
-        clearTimeout(timer);
+        timer.cancel();
         // Suppress unhandled rejection when the original promise rejects after timeout wins
         // eslint-disable-next-line no-restricted-syntax -- intentional fire-and-forget
         promise.catch(() => { });
@@ -72,13 +72,14 @@ export function withPromptTimeout(promise, timeoutMs, abort) {
  * @param timeoutMs - Timeout in milliseconds (full budget per reset).
  * @param abort - Function to call on timeout (typically session.abort()).
  */
-export function withResettablePromptTimeout(promise, timeoutMs, abort) {
+export function withResettablePromptTimeout(promise, timeoutMs, abort, timers) {
     let settled = false;
     let timer;
     let rejectFn;
     function startTimer() {
-        clearTimeout(timer);
-        timer = setTimeout(() => {
+        if (timer)
+            timer.cancel();
+        timer = timers.setTimeout(() => {
             if (settled)
                 return;
             settled = true;
@@ -99,7 +100,8 @@ export function withResettablePromptTimeout(promise, timeoutMs, abort) {
     });
     const racedPromise = Promise.race([promise, timeoutPromise]).finally(() => {
         settled = true;
-        clearTimeout(timer);
+        if (timer)
+            timer.cancel();
         // eslint-disable-next-line no-restricted-syntax -- intentional fire-and-forget
         promise.catch(() => { });
     });

package/node_modules/@comis/agent/dist/executor/replay-drift-detector.d.ts

@@ -53,8 +53,8 @@ export interface DriftCheckInput {
     };
     /** Idle threshold from config (already resolved with default applied). */
     idleMs: number;
-    /** Now() injection for testability. Default: `Date.now()`. */
-    now?: number;
+    /** Now() injection for testability. */
+    now: number;
 }
 /** Result of `shouldDropSignedFields`. */
 export interface DriftCheck {

package/node_modules/@comis/agent/dist/executor/replay-drift-detector.js

@@ -32,8 +32,7 @@
  * tested explicitly so future refactors cannot silently change it.
  */
 export function shouldDropSignedFields(input) {
-    const { fileEntries, currentModel, idleMs } = input;
-    const now = input.now ?? Date.now();
+    const { fileEntries, currentModel, idleMs, now } = input;
     if (!Array.isArray(fileEntries) || fileEntries.length === 0) {
         return { drop: false };
     }

package/node_modules/@comis/agent/dist/executor/session-snapshot-cleanup.d.ts

@@ -2,7 +2,7 @@
  * Session state cleanup: wires `session:expired` event to all 17
  * module-level `clearSession*()` functions in prompt-assembly.ts,
  * pi-executor.ts, tool-lifecycle.ts, discovery-tracker.ts,
- * cache-break-detection.ts, ttl-guard.ts, stream-wrappers.ts,
+ * cache-detection/, ttl-guard.ts, stream-wrappers.ts,
  * and block-stability-tracker.ts.
  *
  * Provides clearSessionState() as the single authoritative cleanup

package/node_modules/@comis/agent/dist/executor/session-snapshot-cleanup.js

@@ -3,7 +3,7 @@
  * Session state cleanup: wires `session:expired` event to all 17
  * module-level `clearSession*()` functions in prompt-assembly.ts,
  * pi-executor.ts, tool-lifecycle.ts, discovery-tracker.ts,
- * cache-break-detection.ts, ttl-guard.ts, stream-wrappers.ts,
+ * cache-detection/, ttl-guard.ts, stream-wrappers.ts,
  * and block-stability-tracker.ts.
  *
  * Provides clearSessionState() as the single authoritative cleanup
@@ -18,9 +18,9 @@ import { clearSessionToolNameSnapshot, clearSessionBootstrapFileSnapshot, clearS
 import { clearSessionDeliveredGuides, clearSessionToolSchemaSnapshot, clearSessionToolSchemaSnapshotHash, clearSessionBreakpointIndex, clearSessionCacheWarm, clearSessionLatches, clearSessionEvictionCooldown, clearSessionCacheSavings } from "./executor-session-state.js";
 import { clearSessionTracker } from "./tool-lifecycle.js";
 import { clearDiscoveryTracker } from "./discovery-tracker.js";
-import { clearCacheBreakDetectorSession } from "./cache-break-detection.js";
+import { clearCacheBreakDetectorSession } from "./cache-detection/index.js";
 import { clearSessionLastResponseTs } from "./ttl-guard.js";
-import { clearSessionBetaHeaderLatches, clearSessionPrefixStability, clearSessionCadenceTracker } from "./stream-wrappers/request-body-injector.js";
+import { clearSessionBetaHeaderLatches, clearSessionPrefixStability, clearSessionCadenceTracker } from "./stream-wrappers/request-body/index.js";
 import { clearSessionRenderedToolCache, clearSessionPerToolCache } from "./stream-wrappers/tool-schema-cache.js";
 import { clearSessionBlockStability } from "./block-stability-tracker.js";
 /**