mixdog 0.9.94 → 0.9.96

package/src/runtime/agent/orchestrator/providers/retry-classifier.mjs

@@ -104,6 +104,15 @@ export function classifyError(err) {
   if (err.truncatedStream === true || err.code === 'TRUNCATED_STREAM') return 'transient'
 
   if (TRANSIENT_STATUSES.has(status) || (status >= 500 && status < 600)) return 'transient'
+  // A stream that closed WITHOUT its terminal frame is a transport symptom,
+  // not a model verdict: the socket carries no HTTP status and no Node errno,
+  // so without this it classified as 'unknown' and no loop-level replay was
+  // ever attempted (observed live: pooled WS retired by the server between
+  // turns → close 1000 before response.created → the whole turn failed).
+  // Reference behavior retries the same disconnect (codex `CodexErr::Stream`
+  // is_retryable, cc falls back/retries the stream); the exposure deny above
+  // still fails closed for anything already relayed or dispatched.
+  if (isNonTerminalStreamClose(err)) return 'transient'
 
   // Socket-level codes (Node errno) — DNS / reset / refused / timeout are all
   // transient: we can retry the same request and may succeed.
@@ -124,6 +133,50 @@ const TRANSIENT_ERROR_CODES = new Set([
   'EPROVIDERTIMEOUT', 'EGEMINITIMEOUT', 'ESTREAMSTALL', 'EWSACQUIRETIMEOUT',
 ])
 
+// WebSocket close codes that can end a Responses stream BEFORE its terminal
+// frame. 1000/1001/1005 are "nominal" closes the server sends when it retires
+// a pooled socket; 1006/1011/1012 are abnormal/overload closes. None of them
+// is a completed turn, and all are safe to re-issue when nothing was exposed.
+// 4000 is our own local stall close and keeps the stall classification path.
+const NON_TERMINAL_STREAM_CLOSE_CODES = new Set([1000, 1001, 1005, 1006, 1011, 1012])
+
+/**
+ * True when the error describes a stream socket that closed without the
+ * provider's terminal frame (response.completed / message_stop). Replay
+ * PERMISSION is still owned by the stream-outcome contract; this predicate
+ * only answers "was this a transport-level disconnect".
+ */
+export function isNonTerminalStreamClose(err) {
+  if (!err || typeof err !== 'object') return false
+  const code = Number(err.wsCloseCode ?? err.streamCloseCode ?? 0) || 0
+  if (!NON_TERMINAL_STREAM_CLOSE_CODES.has(code)) return false
+  return readStreamOutcome(err).terminalObserved !== true
+}
+
+/**
+ * Should this failed stream be re-issued as a NON-STREAMING request?
+ *
+ * cc's last safety net: when a stream dies it repeats the same request with
+ * `stream:false` instead of failing the turn (claude.ts, gated off only when
+ * streaming tool execution could double-run a tool). MixDog dispatches tools
+ * eagerly, so this stays deliberately narrower than cc: only a stream that
+ * exposed NOTHING qualifies. An exposed stream is already covered by the
+ * loop-level retraction replay (send-with-recovery), which asks the owner to
+ * withdraw the rendered characters first.
+ */
+export function canFallbackNonStreaming(err, { signal } = {}) {
+  if (!err || signal?.aborted) return false
+  const outcome = readStreamOutcome(err)
+  // A completed turn needs no fallback; a user cancel must never be re-issued.
+  if (outcome.terminalObserved || outcome.userAbort) return false
+  // Exposure/dispatch fails closed — re-running would duplicate output or a
+  // side effect.
+  if (outcome.replaySafe !== true) return false
+  return classifyError(err) === 'transient'
+    || outcome.stallObserved === true
+    || outcome.truncatedStream === true
+}
+
 function boundedCauseChain(err) {
   const chain = []
   const seen = new Set()
@@ -252,7 +305,7 @@ function isRetryable(err) {
   return classifyError(err) === 'transient'
 }
 
-/** Claude Code compatible Anthropic request budget: 10 retries (11 attempts).
+/** Anthropic request budget: 10 retries (11 attempts).
  * CLAUDE_CODE_MAX_RETRIES is intentionally read per request for reload/tests.
  * The upper bound prevents an accidental unbounded retry loop. */
 export function anthropicMaxAttempts() {
@@ -262,16 +315,16 @@ export function anthropicMaxAttempts() {
   return retries + 1
 }
 
-// Claude Code request defaults (withRetry.ts): 500ms exponential backoff,
+// Anthropic retry defaults: 500ms exponential backoff,
 // capped at 32s, with positive-only jitter up to 25% of the base delay.
-// The leading duplicate accounts for withRetry's sleep-before-attempt index:
+// The leading duplicate accounts for the sleep-before-attempt index:
 // retry attempt 2 reads index 1.
 export const ANTHROPIC_RETRY_BACKOFF_MS = Object.freeze([
   500, 500, 1000, 2000, 4000, 8000, 16000, 32000, 32000, 32000, 32000,
 ])
 export const ANTHROPIC_RETRY_JITTER_RATIO = 0.25
 
-// Claude Code's Anthropic SDK client defaults API_TIMEOUT_MS to ten minutes.
+// The Anthropic SDK client defaults API_TIMEOUT_MS to ten minutes.
 // Read per request, like CLAUDE_CODE_MAX_RETRIES, so env reload/tests work.
 export function anthropicRequestTimeoutMs() {
   const parsed = Number.parseInt(process.env.API_TIMEOUT_MS || '', 10)
@@ -318,10 +371,10 @@ export function jitterDelayMs(ms, ratio = PROVIDER_RETRY_JITTER_RATIO, mode = 's
 // Mid-stream 'stream_stalled' recoveries retry in place, which is right for a
 // one-off blip but lets a chronically dying stream burn a whole task budget
 // slowly (observed live: one send stretched 149s→298s→556s across stall
-// retries before the agent deadline killed the task). Reference stacks bound
-// this instead of retrying forever: Claude Code caps each request at ~300s
-// wall clock (API_TIMEOUT_MS) and Codex kills a stream after one 300s silent
-// gap (stream_idle_timeout). This guard is the equivalent for our in-place
+// retries before the agent deadline killed the task). A stalling stream is
+// bounded instead of retried forever: a request is capped at ~300s wall
+// clock (API_TIMEOUT_MS) and a stream dies after one 300s silent gap
+// (stream idle timeout). This guard is the equivalent for our in-place
 // recovery: the clock starts at the FIRST stall of a send, and stall-classified
 // retries are allowed only inside that window; past it the stall error
 // surfaces so loop-level transport retry issues a FRESH request. Healthy
@@ -357,7 +410,7 @@ export function createStallRetryBudget(budgetMs = STREAM_STALL_RETRY_BUDGET_MS,
 // branched on a hardcoded provider name.
 
 // F) Retry-budget profiles as DATA. The numbers live ONLY here now.
-//    ws.*Retries (5)              — one Codex Responses stream retry budget.
+//    ws.*Retries (5)              — one Responses stream retry budget.
 //    sse.defaultRetries (3)       — anthropic single-shot SSE mid-stream budget.
 export const MIDSTREAM_RETRY_POLICY = {
   ws: { transientCloseRetries: 5, defaultRetries: 5, backoff: [250, 1000, 2000, 4000, 5000] },
@@ -435,11 +488,13 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
   }
   if (!state.sawResponseCreated) {
     const closeCode = Number(err?.wsCloseCode || state.wsCloseCode || 0)
-    // An abnormal close before response.created has not produced any response
-    // bytes to the caller. It is therefore safe to reconnect and replay under
-    // the normal ws_1006 bounded retry policy (text/tool emission was denied
-    // above before reaching this gate).
-    if (closeCode !== 1006 && closeCode !== 1011 && closeCode !== 1012) return null
+    // A close before response.created has not produced any response bytes to
+    // the caller, so it is safe to reconnect and replay under the bounded
+    // retry policy (text/tool emission was denied above before this gate).
+    // NOMINAL closes count too: a pooled socket the server retires between
+    // turns closes with 1000/1001/1005 and must reconnect fresh — treating
+    // that as terminal killed the turn instead of reissuing it.
+    if (!NON_TERMINAL_STREAM_CLOSE_CODES.has(closeCode)) return null
   }
   if (state.userAbort) return null
 
@@ -465,7 +520,11 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
   if (closeCode === 1012) return _allowMidstream('ws_1012', attemptIndex, policy)
   if (closeCode >= 4000 && closeCode < 5000 && closeCode !== 4000) return null
   if (closeCode === 4000) return _allowMidstream('ws_4000', attemptIndex, policy)
-  if (closeCode === 1000 && state.sawResponseCreated && !state.sawCompleted) return _allowMidstream('ws_1000', attemptIndex, policy)
+  // Nominal close without the terminal frame — before OR after
+  // response.created. Only a completed turn is terminal here.
+  if ((closeCode === 1000 || closeCode === 1001 || closeCode === 1005) && !state.sawCompleted) {
+    return _allowMidstream(`ws_${closeCode}`, attemptIndex, policy)
+  }
 
   const failed = err?.responseFailed || state.responseFailedPayload
   if (failed) {
@@ -490,7 +549,7 @@ function _classifyMidstreamWs(err, state, attemptIndex, policy) {
 }
 
 // Explicit `response.failed` error codes/types that describe a transport-level
-// interruption (Codex retries these); every other code is terminal.
+// interruption (these are retryable); every other code is terminal.
 const RESPONSE_FAILED_CODE_CLASSIFIERS = new Map([
   ['stream_disconnected', 'response_failed_disconnected'],
   ['network_error', 'response_failed_network'],
@@ -536,7 +595,8 @@ function _classifyMidstreamSse(err, state, attemptIndex, policy) {
 const TRANSPORT_FALLBACK_CLASSIFIERS = new Set([
   'timeout', 'reset', 'dns', 'refused', 'network', 'acquire_timeout', 'http_5xx',
   'first_byte_timeout',
-  'ws_1006', 'ws_1011', 'ws_1012', 'ws_1000', 'ws_4000', 'agent_stall', 'stream_stalled',
+  'ws_1006', 'ws_1011', 'ws_1012', 'ws_1000', 'ws_1001', 'ws_1005', 'ws_4000',
+  'agent_stall', 'stream_stalled',
   'response_failed_disconnected', 'response_failed_network', 'response_failed_auth_expired',
   'ws_send_failed',
 ])
@@ -550,7 +610,7 @@ export function shouldFallbackTransport(err, { signal, enabled = true } = {}) {
   if (signal?.aborted) return false
   // Transport fallback re-issues the request on another transport: it is a
   // replay, so the exposure deny applies. Eligibility itself stays typed
-  // (status / errno / classifier), matching Codex's WS→HTTPS switch.
+  // (status / errno / classifier) for the WS→HTTPS switch.
   if (readStreamOutcome(err).replaySafe !== true) return false
   const status = Number(err?.httpStatus || err?.status || 0)
   // 401 is auth recovery, never transport fallback. 426 is the explicit
@@ -660,7 +720,7 @@ function _sleepChunkWithAbort(ms, signal, sleepFn, abortMessage) {
 // E) Handshake classifier (moved here from openai-oauth-ws). Default-deny:
 //    anything not recognized as transient returns null. HTTP 401 is reserved
 //    for auth recovery and 426 for immediate HTTPS fallback. The OpenAI OAuth
-//    caller opts out of 429 retries (Codex retry_429:false); all other callers
+//    caller opts out of 429 retries (retry429:false); all other callers
 //    retain the historical retryable UnexpectedStatus policy.
 export function classifyHandshakeError(err, { retry429 = true } = {}) {
   if (!err) return null
@@ -764,8 +824,8 @@ export async function withRetry(fn, opts = {}) {
       // an eligible failure is actually retried remains the typed question
       // resolved by classifyError()/status below.
       if (readStreamOutcome(caught).replaySafe !== true) throw caught
-      // Claude Code treats x-should-retry:false as an explicit server veto
-      // (except an internal-only 5xx override that Mixdog does not have).
+      // x-should-retry:false is an explicit server veto on retrying and is
+      // honored as-is.
       // Keep this ahead of status defaults, including the request-local 429 path.
       const shouldRetryHeader = _headerValue(
         caught?.headers || caught?.response?.headers || caught?.data?.responseHeaders,
@@ -786,7 +846,7 @@ export async function withRetry(fn, opts = {}) {
         }
         continue
       }
-      // Claude Code's optional model fallback fires on the third 529. This
+      // The optional model fallback fires on the third 529. This
       // remains opt-in: providers pass fallbackModel only when the caller set
       // one. The hard progress veto above must run first so fallback can never
       // replay partial thinking/tool output.

package/src/runtime/agent/orchestrator/providers/stream-json-pool.mjs

@@ -0,0 +1,291 @@
+import { availableParallelism } from 'node:os';
+import { Worker } from 'node:worker_threads';
+import { currentProviderAdmissionOwner } from './admission-scheduler.mjs';
+
+const DEFAULT_MIN_BATCH_BYTES = 32 * 1024;
+
+function positiveInt(value, fallback) {
+    const parsed = Math.floor(Number(value));
+    return Number.isFinite(parsed) && parsed >= 1 ? parsed : fallback;
+}
+
+function configuredWorkerCount(env = process.env) {
+    const configured = Number(env.MIXDOG_PROVIDER_STREAM_WORKERS);
+    if (configured === 0) return 0;
+    if (Number.isFinite(configured) && configured > 0) return Math.floor(configured);
+    return Math.max(1, Math.min(4, availableParallelism() - 1));
+}
+
+function abortError(signal) {
+    return signal?.reason instanceof Error
+        ? signal.reason
+        : new Error(String(signal?.reason || 'provider stream parse canceled'));
+}
+
+function syntaxError(details) {
+    const error = new SyntaxError(String(details?.message || 'invalid JSON'));
+    error.name = String(details?.name || 'SyntaxError');
+    return error;
+}
+
+/**
+ * Reusable worker pool for the CPU part of provider SSE handling.
+ *
+ * Small deltas stay inline because a Worker round-trip costs more than parsing
+ * them. Large events and multi-event network chunks are parsed off the daemon
+ * event loop. Calls are never admission-capped: every request is posted
+ * immediately and workers consume their independent message queues.
+ */
+export function createStreamJsonPool({
+    maxWorkers = configuredWorkerCount(),
+    minBatchBytes = Number(process.env.MIXDOG_PROVIDER_STREAM_WORKER_MIN_BYTES)
+        || DEFAULT_MIN_BATCH_BYTES,
+    maxPendingBytes = (Number(process.env.MIXDOG_PROVIDER_STREAM_PENDING_MB) || 32)
+        * 1024 * 1024,
+    WorkerImpl = Worker,
+} = {}) {
+    const workerMax = Math.max(0, Math.floor(Number(maxWorkers) || 0));
+    const inlineBelowBytes = Math.max(0, Math.floor(Number(minBatchBytes) || 0));
+    const slots = [];
+    const ownerAffinities = new Map();
+    const waiting = [];
+    const pendingByteMax = Math.max(1024 * 1024, Math.floor(Number(maxPendingBytes) || 0));
+    let pendingBytes = 0;
+    let waitingBytes = 0;
+    let sequence = 0;
+    let closed = false;
+    const stats = {
+        inlineBatches: 0,
+        offloadedBatches: 0,
+        fallbackBatches: 0,
+        parsedBytes: 0,
+    };
+
+    function parseInline(payloads) {
+        return payloads.map((payload) => JSON.parse(payload));
+    }
+
+    function removeSlot(slot) {
+        const index = slots.indexOf(slot);
+        if (index >= 0) slots.splice(index, 1);
+        for (const [owner, assigned] of ownerAffinities) {
+            if (assigned === slot) ownerAffinities.delete(owner);
+        }
+    }
+
+    function failSlot(slot) {
+        if (slot.failed) return;
+        slot.failed = true;
+        removeSlot(slot);
+        for (const task of slot.tasks.values()) {
+            pendingBytes = Math.max(0, pendingBytes - task.bytes);
+            task.detach();
+            if (task.aborted) continue;
+            stats.fallbackBatches += 1;
+            try { task.resolve(parseInline(task.payloads)); }
+            catch (error) { task.reject(error); }
+        }
+        slot.tasks.clear();
+        try { slot.worker.terminate(); } catch {}
+        drainWaiting();
+    }
+
+    function createSlot() {
+        const worker = new WorkerImpl(new URL('./stream-json-worker.mjs', import.meta.url), {
+            execArgv: [],
+        });
+        worker.unref?.();
+        const slot = { worker, tasks: new Map(), failed: false };
+        worker.on('message', (message) => {
+            const task = slot.tasks.get(Number(message?.id));
+            if (!task) return;
+            slot.tasks.delete(Number(message.id));
+            pendingBytes = Math.max(0, pendingBytes - task.bytes);
+            task.detach();
+            if (task.aborted) return;
+            if (message?.ok === true) task.resolve(message.values);
+            else task.reject(syntaxError(message?.error));
+            drainWaiting();
+        });
+        worker.on('error', () => failSlot(slot));
+        worker.on('exit', () => {
+            if (!closed) failSlot(slot);
+            else removeSlot(slot);
+        });
+        slots.push(slot);
+        return slot;
+    }
+
+    function pickSlot(ownerKey) {
+        const ready = slots.filter((slot) => !slot.failed);
+        const owner = String(ownerKey || '').trim().slice(0, 240);
+        const assigned = owner ? ownerAffinities.get(owner) : null;
+        if (assigned && !assigned.failed) return assigned;
+        const least = ready.sort((left, right) => left.tasks.size - right.tasks.size)[0] || null;
+        const slot = ready.length < workerMax && (!least || least.tasks.size > 0)
+            ? createSlot()
+            : least || createSlot();
+        if (owner) {
+            ownerAffinities.set(owner, slot);
+            while (ownerAffinities.size > 4096) {
+                ownerAffinities.delete(ownerAffinities.keys().next().value);
+            }
+        }
+        return slot;
+    }
+
+    function removeWaiting(task) {
+        const index = waiting.indexOf(task);
+        if (index < 0) return false;
+        waiting.splice(index, 1);
+        waitingBytes = Math.max(0, waitingBytes - task.bytes);
+        return true;
+    }
+
+    function postTask(task) {
+        const slot = pickSlot(task.ownerKey);
+        task.slot = slot;
+        slot.tasks.set(task.id, task);
+        pendingBytes += task.bytes;
+        try {
+            slot.worker.postMessage({ id: task.id, payloads: task.payloads });
+        } catch {
+            slot.tasks.delete(task.id);
+            pendingBytes = Math.max(0, pendingBytes - task.bytes);
+            task.detach();
+            stats.fallbackBatches += 1;
+            try { task.resolve(parseInline(task.payloads)); }
+            catch (error) { task.reject(error); }
+            drainWaiting();
+        }
+    }
+
+    function drainWaiting() {
+        while (waiting.length > 0) {
+            const task = waiting[0];
+            if (pendingBytes > 0 && pendingBytes + task.bytes > pendingByteMax) return;
+            waiting.shift();
+            waitingBytes = Math.max(0, waitingBytes - task.bytes);
+            if (task.aborted) continue;
+            postTask(task);
+        }
+    }
+
+    function parseBatch(values, {
+        signal = null,
+        ownerKey = currentProviderAdmissionOwner(),
+    } = {}) {
+        const payloads = (Array.isArray(values) ? values : [values]).map((value) => String(value));
+        if (signal?.aborted) return Promise.reject(abortError(signal));
+        const bytes = payloads.reduce((sum, payload) => sum + Buffer.byteLength(payload), 0);
+        stats.parsedBytes += bytes;
+        if (workerMax === 0 || bytes < inlineBelowBytes) {
+            stats.inlineBatches += 1;
+            try { return Promise.resolve(parseInline(payloads)); }
+            catch (error) { return Promise.reject(error); }
+        }
+        if (closed) return Promise.reject(new Error('provider stream JSON pool is closed'));
+        if (bytes > pendingByteMax) {
+            const error = new Error(
+                `provider stream JSON batch exceeded ${pendingByteMax} bytes`,
+            );
+            error.code = 'ERESOURCEPRESSURE';
+            return Promise.reject(error);
+        }
+
+        const id = ++sequence;
+        stats.offloadedBatches += 1;
+        return new Promise((resolve, reject) => {
+            const task = {
+                id,
+                ownerKey,
+                bytes,
+                payloads,
+                resolve,
+                reject,
+                aborted: false,
+                onAbort: null,
+                detach() {
+                    if (!task.onAbort || !signal) return;
+                    try { signal.removeEventListener('abort', task.onAbort); } catch {}
+                    task.onAbort = null;
+                },
+            };
+            if (signal) {
+                task.onAbort = () => {
+                    if (task.aborted) return;
+                    task.aborted = true;
+                    task.detach();
+                    if (removeWaiting(task)) {
+                        reject(abortError(signal));
+                        return;
+                    }
+                    reject(abortError(signal));
+                };
+                signal.addEventListener('abort', task.onAbort, { once: true });
+            }
+            if (pendingBytes > 0 && pendingBytes + bytes > pendingByteMax) {
+                if (waitingBytes + bytes > pendingByteMax) {
+                    task.detach();
+                    const error = new Error(
+                        `provider stream JSON backlog exceeded ${pendingByteMax} bytes`,
+                    );
+                    error.code = 'ERESOURCEPRESSURE';
+                    reject(error);
+                    return;
+                }
+                waiting.push(task);
+                waitingBytes += bytes;
+                return;
+            }
+            postTask(task);
+        });
+    }
+
+    async function close(reason = 'provider stream JSON pool closed') {
+        if (closed) return;
+        closed = true;
+        const error = new Error(reason);
+        for (const task of waiting.splice(0)) {
+            task.detach();
+            if (!task.aborted) task.reject(error);
+        }
+        waitingBytes = 0;
+        const workers = [];
+        for (const slot of slots.splice(0)) {
+            for (const task of slot.tasks.values()) {
+                task.detach();
+                if (!task.aborted) task.reject(error);
+            }
+            slot.tasks.clear();
+            workers.push(Promise.resolve(slot.worker.terminate()).catch(() => {}));
+        }
+        ownerAffinities.clear();
+        await Promise.all(workers);
+    }
+
+    function snapshot() {
+        return {
+            workers: slots.filter((slot) => !slot.failed).length,
+            workerMax,
+            activeBatches: slots.reduce((sum, slot) => sum + slot.tasks.size, 0),
+            pendingBytes,
+            waitingBatches: waiting.length,
+            waitingBytes,
+            maxPendingBytes: pendingByteMax,
+            ownerAffinities: ownerAffinities.size,
+            inlineBatches: stats.inlineBatches,
+            offloadedBatches: stats.offloadedBatches,
+            fallbackBatches: stats.fallbackBatches,
+            parsedBytes: stats.parsedBytes,
+        };
+    }
+
+    return { parseBatch, close, snapshot };
+}
+
+export const providerStreamJsonPool = createStreamJsonPool();
+export const parseProviderJsonBatch = (payloads, options) =>
+    providerStreamJsonPool.parseBatch(payloads, options);
+export const providerStreamJsonSnapshot = () => providerStreamJsonPool.snapshot();
+export const closeProviderStreamJsonPool = (reason) => providerStreamJsonPool.close(reason);

package/src/runtime/agent/orchestrator/providers/stream-json-worker.mjs

@@ -0,0 +1,21 @@
+import { parentPort } from 'node:worker_threads';
+
+if (!parentPort) throw new Error('provider stream JSON worker requires parentPort');
+
+parentPort.on('message', (message) => {
+    const id = Number(message?.id);
+    const payloads = Array.isArray(message?.payloads) ? message.payloads : [];
+    try {
+        const values = payloads.map((payload) => JSON.parse(String(payload)));
+        parentPort.postMessage({ id, ok: true, values });
+    } catch (error) {
+        parentPort.postMessage({
+            id,
+            ok: false,
+            error: {
+                name: String(error?.name || 'SyntaxError'),
+                message: String(error?.message || error || 'invalid JSON'),
+            },
+        });
+    }
+});