mixdog 0.9.174 → 1.0.0

package/src/standalone/session-runtime-provider-cooldown.mjs

@@ -1,78 +0,0 @@
-// Cross-shard provider cooldown encoding.
-//
-// Fast-mode capacity cooldown is an ACCOUNT-wide fact kept in process-local
-// policy state. With the runtime split across several shard processes, a
-// cooldown discovered by one shard must reach the others or its siblings keep
-// hammering a pool that is already known to be drained.
-//
-// The policy module owns the decision rules, so a replay is expressed through
-// its PUBLIC API as the same capacity rejection the discovering shard saw:
-// this file only encodes/decodes that fact. The policy applies its own minimum
-// window, so a replay can only ever be equal or MORE conservative than the
-// observation — never a shorter or cleared cooldown.
-
-const ECHO_TOLERANCE_MS = 1_000;
-
-/** Read this process's live cooldown as a wire-safe record. */
-export function readProviderCooldown(policy, now = Date.now()) {
-  if (!policy) return null;
-  let remaining = 0;
-  let disabledReason = null;
-  try {
-    remaining = policy.fastModeCooldownRemainingMs(now);
-    disabledReason = policy.fastModeDisabledReason();
-  } catch {
-    return null;
-  }
-  return {
-    untilMs: Number.isFinite(remaining) && remaining > 0 ? now + remaining : 0,
-    disabledReason: disabledReason || null,
-    observedAt: now,
-  };
-}
-
-/** True only for a materially LONGER cooldown or a newly disabled pool. */
-export function providerCooldownAdvanced(previous, next) {
-  const priorUntil = Number(previous?.untilMs) || 0;
-  const nextUntil = Number(next?.untilMs) || 0;
-  const nextReason = next?.disabledReason ? String(next.disabledReason) : null;
-  const priorReason = previous?.disabledReason ? String(previous.disabledReason) : null;
-  return nextUntil > priorUntil + ECHO_TOLERANCE_MS || (Boolean(nextReason) && nextReason !== priorReason);
-}
-
-export function mergeKnownProviderCooldown(previous, next) {
-  return {
-    untilMs: Math.max(Number(previous?.untilMs) || 0, Number(next?.untilMs) || 0),
-    disabledReason:
-      (next?.disabledReason ? String(next.disabledReason) : null) ||
-      (previous?.disabledReason ? String(previous.disabledReason) : null),
-  };
-}
-
-/** Replay a sibling shard's cooldown into this process's policy state. */
-export function applyProviderCooldown(policy, cooldown, now = Date.now()) {
-  if (!policy) return false;
-  const untilMs = Number(cooldown?.untilMs) || 0;
-  const disabledReason = cooldown?.disabledReason ? String(cooldown.disabledReason) : '';
-  const policyLimits = policy._FAST_MODE_POLICY || {};
-  let applied = false;
-  if (disabledReason && policyLimits.OVERAGE_DISABLED_HEADER) {
-    policy.noteFastModeCapacityError(
-      {
-        httpStatus: 429,
-        headers: { [policyLimits.OVERAGE_DISABLED_HEADER]: disabledReason },
-      },
-      { fast: true, now }
-    );
-    applied = true;
-  }
-  const remainingMs = untilMs - now;
-  // Below the policy's short-retry bound the discovering shard itself keeps
-  // fast mode, so there is nothing to replicate.
-  const shortRetryMs = Number(policyLimits.SHORT_RETRY_THRESHOLD_MS) || 0;
-  if (remainingMs >= shortRetryMs && remainingMs > 0) {
-    policy.noteFastModeCapacityError({ httpStatus: 429, retryAfterMs: remainingMs }, { fast: true, now });
-    applied = true;
-  }
-  return applied;
-}

package/src/standalone/session-runtime-proxy.mjs

@@ -1,164 +0,0 @@
-// One session's view of a runtime that lives in another process: the method
-// surface it projects, the revision contract its state frames follow, the
-// argument shape the IPC link can carry, and how that view is rebuilt after
-// its shard recovers. The child process itself is owned by the shard.
-import { SESSION_CONFIGURE_ACTIONS, SESSION_READ_ACTIONS } from './session-protocol.mjs';
-import { applySessionStatePatch } from './session-state-patch.mjs';
-
-const RUNTIME_METHODS = new Set([
-  ...SESSION_READ_ACTIONS,
-  ...SESSION_CONFIGURE_ACTIONS,
-  'readModelMessages',
-  'reserveSession',
-  'resume',
-  'submitAsync',
-  'submitAndWait',
-  'abort',
-  'closeCanonicalSession',
-  'resolveToolApproval',
-  'dispose',
-]);
-
-function applyRuntimeStateFrame(previous, frame) {
-  if (frame?.full && typeof frame.full === 'object') return frame.full;
-  const patch = frame?.patch;
-  if (!patch || typeof patch !== 'object') return previous || {};
-  return applySessionStatePatch(previous, patch);
-}
-
-// Wire contract for runtime calls: the fork IPC link serializes frames
-// as JSON, which cannot represent `undefined` and would fabricate `null` in
-// its place — turning an omitted optional argument (e.g. `resume(id)`) into a
-// bogus `resume(id, null)` that bypasses callee default parameters. Trim
-// trailing `undefined` arguments before transport so an omitted argument stays
-// omitted on the wire and worker-side defaults apply exactly as in-process.
-// Interior `undefined` holes cannot be omitted positionally and keep their
-// pre-existing JSON behavior.
-function wireCallArgs(args) {
-  const out = Array.isArray(args) ? [...args] : [];
-  while (out.length > 0 && out[out.length - 1] === undefined) out.pop();
-  return out;
-}
-
-export class SessionRuntimeProxy {
-  constructor(id, shard, options, routingKey = '') {
-    this.id = id;
-    this.shard = shard;
-    // Stable ownership key (sessionId when known): recovery, resume and every
-    // later view of this session resolve to the same shard. The claim is
-    // released exactly once, by whichever settle path runs first.
-    this.routingKey = String(routingKey || id);
-    this.ownershipReleased = false;
-    this.options = { ...(options || {}) };
-    this.state = {};
-    this.revision = 0;
-    this.listeners = new Set();
-    this.failure = null;
-    this.recovering = false;
-    this.isWireSafe = true;
-    for (const method of RUNTIME_METHODS) {
-      this[method] = (...args) => this.call(method, args);
-    }
-  }
-
-  getState() {
-    return this.state;
-  }
-
-  subscribe(listener) {
-    this.listeners.add(listener);
-    return () => this.listeners.delete(listener);
-  }
-
-  applyFrame(frame) {
-    const revision = Number(frame.revision) || 0;
-    if (revision <= this.revision) return;
-    if (frame.patch && revision !== this.revision + 1) {
-      void this.shard.request('snapshot', { runtimeId: this.id }, 5_000).catch(() => {});
-      return;
-    }
-    this.state = applyRuntimeStateFrame(this.state, frame);
-    this.revision = revision;
-    this.failure = null;
-    this.recovering = false;
-    this.#notifyListeners();
-  }
-
-  fail(error) {
-    this.failure = error instanceof Error ? error : new Error(String(error));
-    this.recovering = false;
-    this.#notifyListeners();
-  }
-
-  #notifyListeners() {
-    for (const listener of [...this.listeners]) {
-      try {
-        listener();
-      } catch {}
-    }
-  }
-
-  beginRecovery(error) {
-    this.failure = error instanceof Error ? error : new Error(String(error));
-    this.recovering = true;
-  }
-
-  async recreate() {
-    const previousSessionId = String(this.state?.sessionId || this.options.sessionId || '');
-    this.revision = 0;
-    await this.shard.requestRaw(
-      'create',
-      {
-        runtimeId: this.id,
-        options: this.options,
-      },
-      120_000
-    );
-    if (previousSessionId) {
-      const resumed = await this.shard.requestRaw(
-        'call',
-        {
-          runtimeId: this.id,
-          method: 'resume',
-          args: [previousSessionId],
-        },
-        120_000
-      );
-      if (resumed !== true) {
-        await this.shard.requestRaw(
-          'call',
-          {
-            runtimeId: this.id,
-            method: 'reserveSession',
-            args: [previousSessionId],
-          },
-          30_000
-        );
-      }
-    }
-    await this.shard.requestRaw('snapshot', { runtimeId: this.id }, 5_000);
-    this.failure = null;
-    this.recovering = false;
-  }
-
-  async call(method, args) {
-    if (this.recovering && this.shard.recovery) await this.shard.recovery;
-    if (this.failure) throw this.failure;
-    try {
-      const value = await this.shard.request(
-        'call',
-        {
-          runtimeId: this.id,
-          method,
-          args: wireCallArgs(args),
-        },
-        method === 'abort' ? 15_000 : 10 * 60_000
-      );
-      if (method === 'dispose') this.shard.releaseProxy(this.id);
-      return value;
-    } catch (error) {
-      if (method === 'dispose') this.shard.releaseProxy(this.id);
-      throw error;
-    }
-  }
-}

package/src/standalone/session-runtime-record.mjs

@@ -1,18 +0,0 @@
-/** Dispose one worker-owned runtime and release every projection even when the
- * runtime's own dispose hook fails. The parent drops its proxy after a dispose
- * response, so leaving the worker record behind would make it unreachable and
- * retain the transcript for the worker process lifetime. */
-export async function disposeSessionRuntimeRecord(records, record, args = []) {
-  if (!record || record.disposed) return undefined;
-  record.disposed = true;
-  try {
-    return await record.runtime?.dispose?.(...args);
-  } finally {
-    try {
-      record.unsubscribe?.();
-    } catch {}
-    record.unsubscribe = null;
-    record.publishedSource = null;
-    records?.delete?.(record.id);
-  }
-}

package/src/standalone/session-runtime-shard-router.mjs

@@ -1,151 +0,0 @@
-// Deterministic routing for the session runtime SHARD host.
-//
-// One child process owning every session runtime, every agent dispatch, every
-// provider parse and every tool result is a single event-loop failure domain:
-// one slow parse or one runaway tool stalls unrelated sessions and their
-// control/abort path. The host therefore runs a BOUNDED set of identical
-// runtime children ("shards") and routes work to them deterministically.
-//
-// Routing rules (all pure, all testable here):
-//   * Ownership is keyed by session identity (sessionId), not by arrival
-//     order, so every view/recovery/resume of one session lands on the SAME
-//     shard and its in-process session store stays authoritative.
-//   * A key's home shard is a stable hash; probing continues in a stable
-//     rotation only while the home shard is not placeable (lagging/quarantined).
-//   * Once a key is claimed it keeps its shard until the last holder releases
-//     it — health changes never migrate live work, which would strand accepted
-//     input in the abandoned child.
-
-import { mergeKnownProviderCooldown, providerCooldownAdvanced } from './session-runtime-provider-cooldown.mjs';
-
-const MAX_SESSION_RUNTIME_SHARDS = 16;
-
-/**
- * The external-host compatibility seam defaults to one shared runtime process.
- * Production sessions now use the daemon's in-process actor host instead.
- *
- * The legacy MIXDOG_SESSION_RUNTIME_SHARDS env is intentionally ignored. Explicit multi-process counts stay
- * available only through createSessionRuntimeHost({ shardCount }) as a test
- * seam for recovery and routing contracts.
- */
-export function resolveShardCount() {
-  return 1;
-}
-
-/** FNV-1a (32-bit): stable across processes and daemon restarts. */
-export function hashRoutingKey(key) {
-  const text = String(key ?? '');
-  let hash = 0x811c9dc5;
-  for (let index = 0; index < text.length; index += 1) {
-    hash ^= text.charCodeAt(index) & 0xff;
-    hash = Math.imul(hash, 0x01000193) >>> 0;
-  }
-  return hash >>> 0;
-}
-
-export function normalizeShardCount(shardCount) {
-  const count = Math.floor(Number(shardCount) || 1);
-  return Math.max(1, Math.min(MAX_SESSION_RUNTIME_SHARDS, count));
-}
-
-/** Home shard for a routing key. */
-export function shardIndexForKey(key, shardCount) {
-  const count = normalizeShardCount(shardCount);
-  return hashRoutingKey(key) % count;
-}
-
-/** Home shard first, then a stable rotation over the remaining shards. */
-export function shardProbeOrder(key, shardCount) {
-  const count = normalizeShardCount(shardCount);
-  const home = shardIndexForKey(key, count);
-  const order = [];
-  for (let step = 0; step < count; step += 1) order.push((home + step) % count);
-  return order;
-}
-
-/**
- * Placement for a NEW key. Falls back through the probe order while shards are
- * not placeable; when every shard is unplaceable the home shard still owns the
- * work (queued, never dropped).
- */
-export function selectShardIndex(key, shardCount, isPlaceable = () => true) {
-  const order = shardProbeOrder(key, shardCount);
-  for (const index of order) {
-    let ok = true;
-    try {
-      ok = isPlaceable(index) !== false;
-    } catch {
-      ok = true;
-    }
-    if (ok) return index;
-  }
-  return order[0];
-}
-
-/** Routing key for a session runtime: session identity when known. */
-export function runtimeRoutingKey(options, fallbackKey = '') {
-  const sessionId = String(options?.sessionId || '').trim();
-  return sessionId || String(fallbackKey || '');
-}
-
-/**
- * Refcounted key -> shard ownership. Ownership is sticky for as long as any
- * holder exists so recovery/resume of the same session never changes shard.
- */
-export function createShardOwnership() {
-  const owners = new Map(); // key -> { index, refs }
-  return {
-    claim(key, resolve) {
-      const id = String(key || '');
-      const existing = owners.get(id);
-      if (existing) {
-        existing.refs += 1;
-        return existing.index;
-      }
-      const index = Math.max(0, Math.floor(Number(resolve(id)) || 0));
-      owners.set(id, { index, refs: 1 });
-      return index;
-    },
-    peek(key) {
-      const existing = owners.get(String(key || ''));
-      return existing ? existing.index : null;
-    },
-    release(key) {
-      const id = String(key || '');
-      const existing = owners.get(id);
-      if (!existing) return null;
-      existing.refs -= 1;
-      if (existing.refs <= 0) owners.delete(id);
-      return existing.index;
-    },
-    get size() {
-      return owners.size;
-    },
-    entries() {
-      return [...owners].map(([key, value]) => ({ key, ...value }));
-    },
-  };
-}
-
-/**
- * Provider capacity cooldown is an ACCOUNT-wide fact, but each shard discovers
- * it in its own process. The host merges the strongest known cooldown and
- * replays it to the other shards; merging must be monotonic so a replay can
- * never shorten or clear a live cooldown (that would re-open the hammering
- * window this state exists to close).
- */
-export function mergeProviderCooldown(current, incoming) {
-  const base = {
-    untilMs: Number(current?.untilMs) || 0,
-    disabledReason: current?.disabledReason ? String(current.disabledReason) : null,
-    updatedAt: Number(current?.updatedAt) || 0,
-  };
-  if (!providerCooldownAdvanced(base, incoming)) return { changed: false, cooldown: base };
-  return {
-    changed: true,
-    cooldown: {
-      ...mergeKnownProviderCooldown(base, incoming),
-      updatedAt: Number(incoming?.observedAt) || Date.now(),
-    },
-  };
-}

package/src/standalone/session-runtime-spawn-leases.mjs

@@ -1,82 +0,0 @@
-// The machine-wide child-spawn budget as one shard's child sees it.
-//
-// The gate itself is daemon-side and single-instance; a runtime child asks for
-// a slot over IPC ('spawn-lease') and gives it back ('spawn-release'). This
-// broker holds the leases granted on that child's behalf and guarantees the
-// budget is returned exactly once — on release, on a superseded child, and on
-// shard death.
-import { acquire as acquireMachineSpawnSlot } from '../runtime/shared/child-spawn-gate.mjs';
-import { safeIpcSend } from '../runtime/shared/safe-ipc-send.mjs';
-
-export class ShardSpawnLeases {
-  /** @param shard the owning shard; its current `child` and `closed` decide
-   *  whether a granted slot still has a live requester. */
-  constructor(shard) {
-    this.shard = shard;
-    this.leases = new Map(); // leaseId -> { release, controller, settled }
-  }
-
-  get size() {
-    return this.leases.size;
-  }
-
-  /** Grant one machine-wide spawn lease from the daemon-side gate (the single
-   *  budget authority; daemon-hosted work uses the same instance locally). */
-  async grant(message) {
-    const leaseId = String(message.leaseId || '');
-    if (!leaseId || this.leases.has(leaseId)) return;
-    const child = this.shard.child;
-    const controller = new AbortController();
-    const record = { release: null, controller, settled: false };
-    this.leases.set(leaseId, record);
-    const reply = (body) => {
-      if (this.shard.child !== child || !child || child.killed) return false;
-      return safeIpcSend(child, { type: 'spawn-lease-result', leaseId, ...body }, { onError: () => {} });
-    };
-    try {
-      const release = await acquireMachineSpawnSlot(controller.signal, message.lane, {
-        ownerKey: `runtime:${String(message.ownerKey || 'anonymous')}`,
-        waitTimeoutMs: Number(message.waitTimeoutMs) > 0 ? Number(message.waitTimeoutMs) : undefined,
-      });
-      if (record.settled || this.shard.closed || this.shard.child !== child) {
-        release();
-        this.leases.delete(leaseId);
-        return;
-      }
-      record.release = release;
-      if (!reply({ ok: true })) this.settle(leaseId);
-    } catch (error) {
-      this.leases.delete(leaseId);
-      if (!record.settled) {
-        reply({
-          ok: false,
-          error: String(error?.message || error),
-          code: error?.code || null,
-          statusCode: Number(error?.statusCode) || null,
-        });
-      }
-    }
-  }
-
-  settle(leaseId) {
-    const record = this.leases.get(leaseId);
-    if (!record || record.settled) return;
-    record.settled = true;
-    if (record.release) {
-      try {
-        record.release();
-      } catch {
-        /* idempotent */
-      }
-      this.leases.delete(leaseId);
-      return;
-    }
-    // Still queued on the machine gate: cancel the waiter; grant's
-    // catch path removes the record.
-    record.controller.abort(new Error('spawn lease released while queued'));
-  }
-
-  releaseAll() {
-    for (const leaseId of [...this.leases.keys()]) this.settle(leaseId);
-  }
-}