dsh-ptc-plus 0.5.1 → 0.5.3

package/internal/session-cell-executor.js

@@ -26,9 +26,11 @@ import {
 import { assertStateName, LIVE_USER_BINDINGS_REUSE_POLICY } from './session-journal.js'
 import { LIVE_USER_BINDINGS_SHADOW_POLICY, normalizeUserBindingNames } from './session-journal-schema.js'
 import { PreflightError, prepareProgram } from './compiler-service.js'
+import { UNANSWERED_SAMPLE_CODE } from './isolated-worker.js'
 import { executionPolicies } from './binding-update-policy.js'
+import { resultEnvelopeText, resolvePromptTextConfig, rewriteDescriptions } from './prompt-text.js'
 import { createReplMemorySnapshot } from './repl-memory-projection.js'
-import { ModuleRewriteError } from './cell-error.js'
+import { CellAdmissionBlocked, ModuleRewriteError } from './cell-error.js'
 import { mapSourcePosition } from './source-position-map.js'
 import { durabilityState, transitionDurability } from './session-state.js'
 import { dynamicBindingOrigin } from './dynamic-binding-evidence.js'
@@ -38,7 +40,6 @@ import {
   selectUserBindingsSnapshot,
 } from './user-bindings.js'
 
-const OUTPUT_LIMIT_MESSAGE = bytes => `output exceeded ${bytes} bytes; this cell was discarded and the worker reset. Only bindings in the verified recovery frontier can be restored. External effects may already have occurred and are not undone. For future cells, bound console output and return a smaller value; do not assume this cell's values remain available.`
 
 function earlyResult(kind, message) {
   return { logs: [], error: { kind, message } }
@@ -94,7 +95,7 @@ function parseDiagnostic(error, source, position, repair) {
         : ['this cell was not executed; correct the reported syntax and retry only this cell with run_code']
       : [
           `this cell was not executed; validated syntax repair: append ${JSON.stringify(repair.delimiter)} at the end of this cell`,
-          `when this correction matches your intent and tools.edit_run_code is available in the program SDK, use ${repair.invocation} inside a new run_code cell with its target guard; the accepted edit runs the complete corrected cell after that new cell finishes; validation proves syntax/preflight acceptance, not intended behavior; otherwise submit corrected source in run_code`,
+          `when this correction matches your intent, tools.edit_run_code can apply it to call_seq ${repair.targetCallSeq} (same anchor with ${JSON.stringify(repair.delimiter)} appended); the accepted edit reruns the corrected cell after this one, otherwise submit corrected source in run_code`,
         ],
   })
 }
@@ -366,6 +367,35 @@ function stateArguments(value) {
 export class SessionCellExecutor {
   constructor(kernel) {
     this.kernel = kernel
+    this.pendingRestore = undefined
+  }
+
+  /**
+   * Install recorded values into the worker without running any program.
+   *
+   * Recovery restores a cell the journal recorded as volatile from the values
+   * that cell produced. Sending its source instead would redispatch whatever
+   * ambient source made it volatile, so this path carries values only: the
+   * worker commits each one as a declaration and reports the names it could
+   * not install. A missing worker is reported the same way rather than thrown,
+   * because the caller has to tell the model which bindings it lost.
+   */
+  async restoreBindings(values, config = this.kernel.config) {
+    const kernel = this.kernel
+    const failedAll = reason => values.map(entry => ({ name: entry.name, reason }))
+    if (kernel.disposed) return { restored: [], failed: failedAll('session kernel disposed') }
+    if (kernel.client.worker === undefined) return { restored: [], failed: failedAll('no live worker') }
+    const id = ++kernel.sequence
+    const valueLimits = kernel.valueLimits(config)
+    return new Promise(resolve => {
+      this.pendingRestore = { id, resolve }
+      try {
+        kernel.client.post({ type: 'restore', id, values, valueLimits })
+      } catch (error) {
+        this.pendingRestore = undefined
+        resolve({ restored: [], failed: failedAll(error instanceof Error ? error.message : String(error)) })
+      }
+    })
   }
 
   async executeCell(request, replayRecord = undefined, config = this.kernel.config) {
@@ -380,6 +410,24 @@ export class SessionCellExecutor {
       kernel.completeJournal(request.journal, 'noop', result)
       return result
     }
+    // A restore-only request installs recorded values: it must not compile or run
+    // the node's program. Preparing it first could reject source that is dead by
+    // definition — the node is not on the path to the head, so it may reference
+    // bindings a recorded rewind ended — and a rejected preparation is what made
+    // the off-path repair install nothing. The catalog advances from the recorded
+    // names instead, so later cells still compile against them.
+    if (request.restoreValues !== undefined) {
+      try {
+        await kernel.prepareWorker()
+        await kernel.ensureWorker(config.maxOldGenerationSizeMb)
+      } catch (error) {
+        if (error instanceof CellAdmissionBlocked) throw error
+        return earlyResult('worker-exit', messageOf(error))
+      }
+      const outcome = await this.restoreBindings(request.restoreValues, config)
+      kernel.bindingCatalog = kernel.bindingCatalog.restore(outcome.restored)
+      return { logs: [], restored: outcome.restored, failed: outcome.failed }
+    }
 
     let userBindings
     const userBindingsShadowPolicy = replayRecord?.userBindingsShadowPolicy ?? LIVE_USER_BINDINGS_SHADOW_POLICY
@@ -425,6 +473,7 @@ export class SessionCellExecutor {
     const moduleDirectory = executionCwd ?? process.cwd()
     const moduleFilename = resolve(moduleDirectory, 'repl')
     const prepareCell = program => prepareProgram(program, {
+      rewriteDescriptions: rewriteDescriptions(resolvePromptTextConfig(config)),
       knownBindings: catalog.knownBindings,
       bindingPolicy,
       languageSemantics,
@@ -483,8 +532,12 @@ export class SessionCellExecutor {
     let worker
     try {
       await kernel.prepareWorker()
-      worker = await kernel.client.ensure(config.maxOldGenerationSizeMb)
+      worker = await kernel.ensureWorker(config.maxOldGenerationSizeMb)
     } catch (error) {
+      // An admission block is the kernel's own lifecycle fact, so the kernel
+      // settles the cell: it must not be read as a failure of recorded history
+      // or of this source.
+      if (error instanceof CellAdmissionBlocked) throw error
       const result = earlyResult('worker-exit', messageOf(error))
       kernel.completeJournal(request.journal, 'discarded', result)
       kernel.rollbackToDurable()
@@ -510,6 +563,7 @@ export class SessionCellExecutor {
       const active = {
         id,
         started: false,
+        dispatched: false,
         request: { ...request, bindings: bindings.namespaces },
         finish: resolve,
         computeTimer: undefined,
@@ -561,23 +615,57 @@ export class SessionCellExecutor {
         // cache. Work that completed before this request must not be charged to
         // the new cell, and work after the sample must remain counted.
         active.wallTimer = setTimeout(() => {
+          // A cell that never reached the runtime has executed nothing, so this
+          // failure cannot discard an earlier settlement or justify rebuilding the
+          // worker on its own; SessionRuntime owns how many such cells it keeps.
+          if (active.dispatched !== true) {
+            kernel.abandonCell(active, earlyResult(
+              'budget-unavailable',
+              `wall-clock ceiling reached (${config.maxWallMs}ms) before this cell was dispatched; no code from it ran; retry the cell or raise maxWallMs`,
+            ))
+            return
+          }
           active.resolve(earlyResult('timeout', `wall-clock ceiling reached (${config.maxWallMs}ms); split long-running work into smaller cells`), true)
         }, config.maxWallMs)
         active.budgetsReady = (async () => {
           let started
           try {
+            // How long this environment may wait for an answer belongs to the
+            // cell's configuration; the transport reads its bound per request.
+            if (Number.isSafeInteger(config.sampleBoundMs) && config.sampleBoundMs > 0) {
+              worker.sampleBoundMs = config.sampleBoundMs
+            }
             started = await worker.sampleUtilization()
           } catch (error) {
-            // No fresh baseline means this request cannot be measured. Use the
-            // existing worker-exit route instead of pretending the last cache
-            // sample is this request's starting point.
-            active.resolve(earlyResult('worker-exit', messageOf(error)), true)
+            // No fresh baseline means this request cannot be measured: the
+            // helper's periodic cache may predate work that already finished, so
+            // it is not a substitute start point. A helper that is still trusted
+            // has not failed, and no frame was dispatched yet, so the unmeasured
+            // cell settles without execution. Only a helper the transport reports
+            // as lost takes the worker-exit route.
+            if (safeProperty(error, 'code') === UNANSWERED_SAMPLE_CODE) {
+              kernel.abandonCell(active, earlyResult(
+                'budget-unavailable',
+                `${messageOf(error)}; this cell was not dispatched and no code from it ran; retry the cell`,
+              ))
+            } else {
+              active.resolve(earlyResult('worker-exit', messageOf(error)), true)
+            }
             return
           }
           if (active.settled) return
           active.computeTimer = setInterval(() => {
             if (active.settled) return
             if (worker.performance.eventLoopUtilization(started).active > config.computeMs) {
+              // Nothing from this cell was dispatched, so an exhausted budget
+              // measures earlier work on this worker, not this cell's source.
+              if (active.dispatched !== true) {
+                kernel.abandonCell(active, earlyResult(
+                  'budget-unavailable',
+                  `compute budget exhausted (${config.computeMs}ms event-loop active) before this cell was dispatched; no code from this cell ran; a callback from earlier work may still be blocking the worker; retry the cell or restart the session`,
+                ))
+                return
+              }
               active.resolve(earlyResult('timeout', `compute budget exhausted (${config.computeMs}ms event-loop active, including synchronous blocking); this measure does not establish CPU use or the specific cause. Use asynchronous waiting for long waits, or a DSH-owned managed job if available. This cell was discarded and the worker reset; external effects or processes may continue.`), true)
             }
           }, Math.min(100, config.computeMs))
@@ -604,6 +692,12 @@ export class SessionCellExecutor {
             returnSignal: prepared.returnSignal,
             asyncCompletion: prepared.asyncCompletion,
             commitSignal: prepared.commitSignal,
+            // Compile-time evidence that a binding's initializer is a bounded
+            // object literal. Nothing records from it yet; settlement will use
+            // it to decide whether a value can be captured without walking it.
+            declarationEvidence: prepared.declarations
+              .filter(declaration => declaration.boundedLiteral !== undefined)
+              .map(declaration => [declaration.name, declaration.boundedLiteral]),
             maxOutputBytes: config.maxOutputBytes,
             valueLimits,
             durability,
@@ -624,6 +718,9 @@ export class SessionCellExecutor {
               ...request.bindingDescriptors.reservedNames,
             ])],
           })
+          // The run frame is with the worker now, so a later failure may have
+          // executed this cell's source and cannot settle as an unmeasured cell.
+          active.dispatched = true
         } catch (error) {
           active.resolve(earlyResult('worker-exit', messageOf(error)), true)
         }
@@ -689,7 +786,7 @@ export class SessionCellExecutor {
         throw new Error(`cannot save a durable REPL state from a volatile segment; volatile reason: ${active.durability.reason ?? 'replayability is unproved'}. This save rejection leaves live bindings usable in the current worker; continue computation from them. It does not undo external effects.`)
       }
       active.control.names.add(name)
-      active.journal.operations.push({ action, name })
+      active.journal.operations.push({ action, name, kind: 'checkpoint' })
       return { action, name, saved: true }
     }
     if (action === 'delete') {
@@ -703,6 +800,18 @@ export class SessionCellExecutor {
   }
 
   onMessage(message) {
+    if (message?.type === 'restored') {
+      const pending = this.pendingRestore
+      if (pending === undefined || pending.id !== message.id) return
+      this.pendingRestore = undefined
+      const restored = Array.isArray(message.restored) ? message.restored.filter(name => typeof name === 'string') : []
+      const failed = Array.isArray(message.failed)
+        ? message.failed.filter(entry => entry !== null && typeof entry === 'object' && typeof entry.name === 'string')
+          .map(entry => ({ name: entry.name, reason: typeof entry.reason === 'string' ? entry.reason : 'the worker did not report a reason' }))
+        : []
+      pending.resolve({ restored, failed })
+      return
+    }
     if (message?.type === 'observation-started') {
       const kernel = this.kernel
       const observation = kernel.workerObservation
@@ -759,7 +868,7 @@ export class SessionCellExecutor {
     const logs = Array.isArray(message.logs) && message.logs.every(log => typeof log === 'string') ? message.logs : []
     active.resolve({
         logs: limitLogs(logs),
-        error: { kind: 'output-limit', message: OUTPUT_LIMIT_MESSAGE(active.config.maxOutputBytes) },
+        error: { kind: 'output-limit', message: resultEnvelopeText(resolvePromptTextConfig(active.config), active.config.maxOutputBytes) },
     }, true)
   }
 
@@ -791,6 +900,18 @@ export class SessionCellExecutor {
         reason: typeof message.volatileReason === 'string' ? message.volatileReason : undefined,
       })
     }
+    // The worker sends the values this settlement produced, durable or volatile, so
+    // the journal can keep them; recovery installs them instead of re-running the
+    // cell when its replay path does not reach it. A value the worker could not
+    // transfer arrives in `unrecorded` and is named in the record.
+    const recorded = message.bindingValues ?? message.volatileBindingValues
+    if (recorded !== undefined && typeof recorded === 'object'
+      && Array.isArray(recorded.values) && Array.isArray(recorded.unrecorded)
+      && recorded.values.every(entry => entry !== null && typeof entry === 'object'
+        && typeof entry.name === 'string' && entry.wire !== undefined)
+      && recorded.unrecorded.every(name => typeof name === 'string')) {
+      active.bindingValues = recorded
+    }
     if (active.replay !== undefined && active.durability.status !== 'durable') {
       active.resolve({ logs, error: { kind: 'recovery', message: 'durable history requested a volatile capability during replay' } }, true)
       return
@@ -851,7 +972,7 @@ export class SessionCellExecutor {
     if (bytes > active.config.maxOutputBytes) {
       active.resolve({
         logs: limitLogs(logs),
-        error: { kind: 'output-limit', message: OUTPUT_LIMIT_MESSAGE(active.config.maxOutputBytes) },
+        error: { kind: 'output-limit', message: resultEnvelopeText(resolvePromptTextConfig(active.config), active.config.maxOutputBytes) },
       }, true)
       return
     }