klyro 1.0.0 → 1.0.2

package/dist/agent/retry.js

@@ -15,10 +15,11 @@
  *
  *   delay = min(maxMs, baseMs * 2^attempt) ± jitter
  *
- * The default policy matches the L6 plan: 3 attempts, 500ms base, 8s cap.
+ * The default policy matches the L6 plan: 5 attempts, 500ms base, 8s cap.
  */
+import { acquireStreamSlot, noteRateLimited } from './stream-budget.js';
 export const DEFAULT_RETRY = {
-    maxAttempts: 3,
+    maxAttempts: 5,
     baseMs: 500,
     maxMs: 8_000,
     sleep: defaultSleep,
@@ -88,6 +89,28 @@ export function computeBackoff(attempt, baseMs, maxMs) {
     const jitter = exp * 0.25 * (Math.random() * 2 - 1);
     return Math.max(0, Math.floor(exp + jitter));
 }
+/**
+ * True when a retryable error event carries a 429 rate-limit signal.
+ * Checks the `status` field first, then `code`; accepts numeric values
+ * and `'429'` substrings (e.g. `'429'`, `'HTTP_429'`).
+ */
+function isRateLimitedError(ev) {
+    if (ev.kind !== 'error')
+        return false;
+    const rec = ev;
+    for (const key of ['status', 'code']) {
+        const value = rec[key];
+        if (typeof value === 'string' && value.includes('429'))
+            return true;
+        if (typeof value === 'number' && String(value).includes('429'))
+            return true;
+    }
+    return false;
+}
+function rateLimitDelayMs(ev) {
+    const raw = ev['retryAfterMs'];
+    return typeof raw === 'number' && Number.isFinite(raw) && raw >= 0 ? raw : undefined;
+}
 export function retryingAdapter(inner, opts = {}) {
     const cfg = { ...DEFAULT_RETRY, ...opts };
     const sleep = opts.sleep ?? defaultSleep;
@@ -129,20 +152,39 @@ export function retryingAdapter(inner, opts = {}) {
                 opts.onAttempt?.(attempt);
                 if (effectiveSignal?.aborted)
                     return;
+                // Rate-limit scheduler: hold one stream slot for the duration of
+                // this attempt's inner.stream consumption. Abort while queued ends
+                // the stream promptly with no inner call.
+                let release;
                 let sawRetryable = false;
                 let lastError = null;
-                for await (const ev of streamWithAbort(inner.stream(attemptReq), effectiveSignal)) {
-                    if (effectiveSignal?.aborted)
+                try {
+                    try {
+                        release = await acquireStreamSlot(effectiveSignal);
+                    }
+                    catch {
                         return;
-                    if (ev.kind === 'error' && ev.retryable) {
-                        // Buffer the retryable error; don't yield it yet. We'll either
-                        // re-issue (and the caller will never see the error) or, on
-                        // final attempt, yield it as the terminal error.
-                        sawRetryable = true;
-                        lastError = ev;
-                        break; // stop consuming; the stream is dead on retryable errors.
                     }
-                    yield ev;
+                    for await (const ev of streamWithAbort(inner.stream(attemptReq), effectiveSignal)) {
+                        if (effectiveSignal?.aborted)
+                            return;
+                        if (ev.kind === 'error' && ev.retryable) {
+                            // Adaptive throttling: a 429 collapses the global stream cap
+                            // to 1 for retryAfterMs (or 60s) — see stream-budget.ts.
+                            if (isRateLimitedError(ev))
+                                noteRateLimited(rateLimitDelayMs(ev));
+                            // Buffer the retryable error; don't yield it yet. We'll either
+                            // re-issue (and the caller will never see the error) or, on
+                            // final attempt, yield it as the terminal error.
+                            sawRetryable = true;
+                            lastError = ev;
+                            break; // stop consuming; the stream is dead on retryable errors.
+                        }
+                        yield ev;
+                    }
+                }
+                finally {
+                    release?.();
                 }
                 if (!sawRetryable)
                     return; // success or non-retryable error — done.

package/dist/agent/runtime.d.ts

@@ -19,22 +19,58 @@ import type { Message } from './message.js';
 import type { ToolRegistry } from '../tools/registry.js';
 import type { PolicyEngine } from '../policy/engine.js';
 import type { ApprovalPrompt } from '../policy/approval.js';
+/**
+ * Verification mode. The canonical definition lives in verification/engine.ts
+ * (sibling-owned: `export type VerifyMode = 'strict'|'advisory'|'off'`). It is
+ * resolved conditionally here so this file typechecks regardless of sibling
+ * landing order — and converges to the sibling type automatically once the
+ * sibling export exists.
+ */
+export type VerifyMode = typeof import('../verification/engine.js') extends {
+    VerifyMode: infer V;
+} ? V : 'strict' | 'advisory' | 'off';
 export interface RuntimeDeps {
     adapter: ProviderAdapter;
+    /**
+     * Ordered failover adapters (L15). When the active adapter ends a step
+     * with a terminal provider error, the runtime swaps to the next entry
+     * and re-issues the step (bounded by chain length, never loops).
+     * Optional — single-adapter callers behave exactly as before.
+     */
+    failoverAdapters?: ProviderAdapter[];
     registry: ToolRegistry;
     policy: PolicyEngine;
     approval: ApprovalPrompt;
     /**
      * Build a system prompt given cwd + the current Level-7 runtime telemetry.
-     * The telemetry block is a compact, in-memory summary of the run so far
-     * (step count, last tool calls, recent errors). Injected as part of the
-     * system prompt so the model can see its own state mid-run.
+     *
+     * TELEMETRY SPLIT: the fn may return either a plain string (legacy —
+     * telemetry already concatenated, cache-unfriendly) or
+     * `{system, suffix}` where `suffix` is the volatile telemetry block.
+     * The runtime forwards both halves via CallRequest (`system` +
+     * `systemSuffix`) so adapters can keep the suffix out of the cacheable
+     * prefix (Anthropic array form) or concatenate it (OpenAI — unchanged).
+     * Both shapes are accepted so custom fns keep compiling.
      */
-    systemPrompt: (ctx: {
-        cwd: string;
-        telemetry?: string;
-    }) => string;
+    systemPrompt: SystemPromptFn;
 }
+/** Split system-prompt result: stable prefix + volatile telemetry suffix. */
+export interface SystemPromptResult {
+    system: string;
+    suffix?: string;
+}
+export type SystemPromptFn = (ctx: {
+    cwd: string;
+    telemetry?: string;
+}) => string | SystemPromptResult;
+/** Normalize either systemPrompt shape into {system, suffix}. */
+export declare function resolveSystemPrompt(fn: SystemPromptFn, ctx: {
+    cwd: string;
+    telemetry?: string;
+}): {
+    system: string;
+    suffix?: string;
+};
 export type Phase = 'understanding' | 'exploring' | 'planning' | 'implementing' | 'verifying' | 'done' | 'blocked' | 'limit';
 export interface RunOptions {
     task: string;
@@ -77,6 +113,9 @@ export interface RunOptions {
         maxRepairAttempts?: number;
         timeoutMs?: number;
         requireVerify?: boolean;
+        /** Verification mode (default 'strict'). 'off' skips the pipeline;
+         * 'advisory' runs verify once on completion without repair turns. */
+        mode?: VerifyMode;
     };
     /**
      * Level 9 — persistence. When a SessionStore is provided, every message
@@ -99,6 +138,8 @@ export interface RunOptions {
         depth: number;
         maxDepth: number;
         allowedTools?: ReadonlySet<string>;
+        /** Path allow-set inherited from the parent (sibling C contract). */
+        allowedPaths?: readonly string[];
         model?: string;
     };
     /**
@@ -160,6 +201,8 @@ export type RuntimeEvent = {
     input: number;
     output: number;
     estimated?: boolean;
+    cacheRead?: number;
+    cacheWrite?: number;
 } | {
     kind: 'final_text';
     text: string;
@@ -190,6 +233,22 @@ export type RuntimeEvent = {
 } | {
     kind: 'checkpoint_saved';
     sessionId: string;
+} | {
+    kind: 'status';
+    message: string;
+} | {
+    kind: 'budget_warning';
+    ratio: number;
+    threshold: number;
+} | {
+    kind: 'provider_failover';
+    from: string;
+    to: string;
+    reason: string;
+} | {
+    kind: 'model_override';
+    requested: string;
+    effective: string;
 };
 export interface RunResult {
     status: 'complete' | 'max_steps' | 'aborted' | 'no_final' | 'verify_failed' | 'limit' | 'blocked' | 'stuck';
@@ -203,6 +262,8 @@ export interface RunResult {
         input: number;
         output: number;
         estimated?: boolean;
+        cacheRead?: number;
+        cacheWrite?: number;
     };
     /** Number of policy-driven user prompts the user accepted. */
     repairs?: number;
@@ -212,6 +273,10 @@ export interface RunResult {
         command?: string;
         attempts: number;
         failureType?: string;
+        repairTokens?: {
+            input: number;
+            output: number;
+        };
     };
     /** 5.1 phase */
     phase?: Phase;
@@ -222,10 +287,21 @@ export declare function toolDefinitions(registry: ToolRegistry): ToolDefinition[
 export declare function estimateCost(model: string, usage: {
     input: number;
     output: number;
+    cacheRead?: number;
+    cacheWrite?: number;
 }): number;
+/**
+ * Parallel fan-out cap: approved concurrencySafe tool calls execute in
+ * sequential chunks of at most this size. Commit order stays identical
+ * (commits run sequentially after execution), so the transcript reads as
+ * if the calls ran in order.
+ */
+export declare const MAX_PARALLEL_TOOLS = 8;
+/** Progressive budget-warning thresholds (fraction of maxCost), fired once each per run. */
+export declare const BUDGET_WARNING_THRESHOLDS: readonly [0.4, 0.7, 0.9];
 /** Run the autonomous loop. */
 export declare function run(opts: RunOptions, deps: RuntimeDeps): Promise<RunResult>;
 export declare function defaultSystemPrompt(ctx: {
     cwd: string;
     telemetry?: string;
-}): string;
+}): SystemPromptResult;