mixdog 0.9.96 → 0.9.97

package/src/runtime/channels/lib/memory-client.mjs

@@ -1,145 +1,37 @@
-import http from 'node:http'
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { createStandaloneMemoryRuntime } from '../../../standalone/memory-runtime-proxy.mjs'
-import { readServicePort, markServiceUnreachable, isConnRefuseError } from '../../shared/service-discovery.mjs'
+import { getStandaloneMemoryRuntime } from '../../../standalone/memory-runtime-proxy.mjs'
 
 const RUNTIME_ROOT = process.env.MIXDOG_RUNTIME_ROOT
   ? path.resolve(process.env.MIXDOG_RUNTIME_ROOT)
   : path.join(os.tmpdir(), 'mixdog')
-const ACTIVE_INSTANCE_FILE = path.join(RUNTIME_ROOT, 'active-instance.json')
-
-let _portCache = null // { port, mtime, ts }
-
-// Shared memory-runtime proxy handle for respawn. The channels worker is the
-// one process that can find the daemon dead (no port / ECONNREFUSED) while a
-// remote session is still alive. Rather than dead-lettering forever, it asks
-// the SAME proxy the host uses (createStandaloneMemoryRuntime.start()) to
-// re-ensure the singleton daemon. Owner-claim + fork logic is NOT duplicated
-// here — start() reuses the on-disk singleton owner file, so a live daemon is
-// reused and only a genuinely dead one is respawned.
+let _memoryRuntimePromise = null
 const MEMORY_ENTRY = fileURLToPath(new URL('../../memory/index.mjs', import.meta.url))
-const MEMORY_DATA_DIR = process.env.MIXDOG_DATA_DIR
-  ? path.resolve(process.env.MIXDOG_DATA_DIR)
-  : RUNTIME_ROOT
-let _memoryProxy = null
-let _ensuringDaemon = null
-function getMemoryProxy() {
-  if (!_memoryProxy) {
-    _memoryProxy = createStandaloneMemoryRuntime({ entry: MEMORY_ENTRY, dataDir: MEMORY_DATA_DIR })
-  }
-  return _memoryProxy
-}
-// Ensure the daemon exists via the shared proxy. Reentrancy-guarded so a burst
-// of failed appends/drains coalesces into a single start(). On success the
-// port cache is invalidated so the next getMemoryPort() re-reads the freshly
-// published active-instance.json. Never throws — callers keep buffering on
-// failure, so a respawn miss degrades to the existing retry path, not a crash.
-async function ensureMemoryDaemon() {
-  if (_ensuringDaemon) return _ensuringDaemon
-  _ensuringDaemon = (async () => {
-    try {
-      const res = await getMemoryProxy().start()
-      _portCache = null
-      return res?.port ?? null
-    } catch (e) {
-      process.stderr.write(`[memory-client] ensureMemoryDaemon failed (${e.message})\n`)
-      return null
-    } finally {
-      _ensuringDaemon = null
-    }
-  })()
-  return _ensuringDaemon
-}
-
-function isConnRefusedLike(err) {
-  const code = String(err?.code || '')
-  const msg = String(err?.message || err || '')
-  return code === 'ECONNREFUSED'
-    || /ECONNREFUSED|missing memory_port|memory-service timeout/i.test(msg)
-}
 
-// A discovery advert validates only the owner pid, which can be a recycled pid
-// living on an unrelated process while its advertised port is dead. This client
-// has no separate /health probe, so on a connect-level failure we distrust the
-// port: mark it unreachable (readServicePort then skips it → legacy fallback)
-// and drop the port cache so the next getMemoryPort re-resolves.
-function _distrustMemoryPort(port, err) {
-  // Connection-level failures ONLY. A 'memory-service timeout' means the daemon
-  // is slow-but-alive — distrusting it would false-route to legacy/buffer.
-  if (port && isConnRefuseError(err)) {
-    markServiceUnreachable('memory', port)
-    _portCache = null
-  }
-}
-
-async function getMemoryPort() {
-  const now = Date.now()
-  if (_portCache && (now - _portCache.ts) < 5_000) return _portCache.port
-  // Prefer the single-writer discovery advert (discovery/memory.json), which
-  // validates the owner pid is alive. Fall back to the legacy
-  // active-instance.json memory_port field for cross-version compat.
-  const advertPort = readServicePort('memory', { requirePid: false })
-  if (advertPort) { _portCache = { port: advertPort, mtime: 0, ts: now }; return advertPort }
+async function memoryRuntime() {
+  _memoryRuntimePromise ??= Promise.resolve(getStandaloneMemoryRuntime({
+    entry: MEMORY_ENTRY,
+    dataDir: process.env.MIXDOG_DATA_DIR,
+  }))
   try {
-    const stat = await fs.promises.stat(ACTIVE_INSTANCE_FILE)
-    const mtime = stat.mtimeMs
-    if (_portCache && _portCache.mtime === mtime) {
-      _portCache.ts = now
-      return _portCache.port
-    }
-    const raw = await fs.promises.readFile(ACTIVE_INSTANCE_FILE, 'utf8')
-    const active = JSON.parse(raw)
-    const port = Number(active && active.memory_port)
-    if (!Number.isFinite(port) || port <= 0) return null
-    _portCache = { port, mtime, ts: now }
-    return port
-  } catch {
-    return null
+    const runtime = await _memoryRuntimePromise
+    await runtime.init()
+    return runtime
+  } catch (error) {
+    _memoryRuntimePromise = null
+    throw error
   }
 }
 
-async function memoryFetch(method, endpoint, body = null, timeoutMs = 10_000, { throwOnError = false } = {}) {
-  const port = await getMemoryPort()
-  return new Promise((resolve, reject) => {
-    if (!port) { reject(new Error('active-instance.json missing memory_port')); return }
-    const payload = body ? JSON.stringify(body) : null
-    const req = http.request({
-      hostname: '127.0.0.1',
-      port,
-      path: endpoint,
-      method,
-      headers: payload
-        ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) }
-        : {},
-      timeout: timeoutMs,
-    }, res => {
-      let data = ''
-      res.on('data', chunk => { data += chunk })
-      res.on('end', () => {
-        const status = res.statusCode || 0
-        let parsed
-        try { parsed = JSON.parse(data) }
-        catch { parsed = { raw: data } }
-        // Live callers keep lenient semantics (resolve on any response).
-        // Drain replay passes throwOnError so a non-2xx status or an
-        // {error} body is treated as a FAILED replay — the buffer file is
-        // then kept for retry instead of being unlinked (data-loss guard).
-        if (throwOnError && (status < 200 || status >= 300 || (parsed && parsed.error != null))) {
-          const detail = parsed && parsed.error != null ? String(parsed.error) : `HTTP ${status}`
-          reject(new Error(`memory replay rejected: ${detail}`))
-          return
-        }
-        resolve(parsed)
-      })
-    })
-    req.on('error', err => { _distrustMemoryPort(port, err); reject(err) })
-    req.on('timeout', () => { req.destroy(); const err = new Error('memory-service timeout'); _distrustMemoryPort(port, err); reject(err) })
-    if (payload) req.write(payload)
-    req.end()
-  })
+async function replayBuffered(kind, payload) {
+  const module = await memoryRuntime()
+  const result = kind === 'ingest'
+    ? await module.ingestTranscript(payload.filePath, { cwd: payload.cwd })
+    : await module.appendEntry(payload)
+  if (result?.error) throw new Error(`memory replay rejected: ${result.error}`)
+  return result
 }
 
 const BUFFER_DIR = path.join(RUNTIME_ROOT, 'memory-buffer')
@@ -166,18 +58,12 @@ export async function appendEntry(data) {
     cwd: data.cwd ?? null,
   }
   // Bounded fast attempt. On failure, buffer to disk immediately and let
-  // the periodic drainer ship buffered entries when the service is back.
-  // Caller is fire-and-forget (channels worker), so capping the tail at
-  // ~3s prevents promises from lingering on minute-long timeouts.
+  // the periodic drainer retry after the in-process runtime recovers.
   try {
-    return await memoryFetch('POST', '/entry', payload, 3_000)
+    const module = await memoryRuntime()
+    return await module.appendEntry(payload)
   } catch (e) {
     process.stderr.write(`[memory-client] appendEntry failed (${e.message}) — buffering\n`)
-    // No-port / connection-refused means the daemon is likely dead. Ask the
-    // shared proxy to re-ensure the singleton (reentrancy-guarded, non-throwing)
-    // so buffered entries have a live target on the next periodic drain instead
-    // of being retried against nothing until quarantine.
-    if (isConnRefusedLike(e)) void ensureMemoryDaemon()
     const bufferPath = bufferToDisk('entry', payload)
     return bufferPath ? { ok: false, buffered: true, path: bufferPath } : { ok: false }
   }
@@ -185,7 +71,8 @@ export async function appendEntry(data) {
 
 export async function ingestTranscript(filePath, { cwd } = {}) {
   try {
-    return await memoryFetch('POST', '/ingest-transcript', { filePath, ...(cwd ? { cwd } : {}) })
+    const module = await memoryRuntime()
+    return await module.ingestTranscript(filePath, { cwd })
   } catch (e) {
     process.stderr.write(`[memory-client] ingestTranscript failed (${e.message}) — buffering\n`)
     // Dedupe by transcriptPath: replace any already-buffered ingest for the
@@ -306,8 +193,8 @@ function enforceBufferCap() {
 
 // Replay buffered entry-*/ingest-* files once the memory port is live.
 // Oldest-first (filename carries a ms timestamp), dedupe-safe (each file is
-// deleted only after a 2xx replay — memoryFetch(throwOnError) rejects on
-// non-2xx/{error}, so a rejected replay keeps the file for retry, no data
+// deleted only after a successful in-process replay; a rejected replay keeps
+// the file for retry, so no data
 // loss). Retry count is PERSISTED in the filename suffix (`.rN`) so process
 // restarts don't reset the poison cap; after MAX_DRAIN_ATTEMPTS the file is
 // MOVED to memory-buffer/dead/ (not deleted, not left blocking the queue).
@@ -325,14 +212,8 @@ function retryName(name, n) {
 }
 export async function drainBuffer() {
   if (_draining) return { ok: true, skipped: 'in-progress' }
-  const port = await getMemoryPort()
-  if (!port) {
-    // No published port: the daemon is down while buffered work is waiting.
-    // Respawn it via the shared proxy (reused singleton — no fork dup) and
-    // let the next tick drain against the freshly published port.
-    void ensureMemoryDaemon()
-    return { ok: false, reason: 'no-port' }
-  }
+  try { await memoryRuntime() }
+  catch (error) { return { ok: false, reason: error?.message || 'memory runtime unavailable' } }
   _draining = true
   let drained = 0
   let failed = 0
@@ -362,11 +243,9 @@ export async function drainBuffer() {
         if (!moveToDead(name, 'unparseable buffer file')) skipThisPass.add(name)
         continue
       }
-      const endpoint = name.startsWith('ingest-') ? '/ingest-transcript' : '/entry'
+      const kind = name.startsWith('ingest-') ? 'ingest' : 'entry'
       try {
-        // throwOnError: non-2xx status or an {error} body REJECTS, so the
-        // file is kept/aged for retry instead of unlinked (HIGH: data loss).
-        await memoryFetch('POST', endpoint, payload, 10_000, { throwOnError: true })
+        await replayBuffered(kind, payload)
         try {
           fs.unlinkSync(bufferPath)
           dropDedupeIndexForPath(bufferPath)
@@ -375,10 +254,6 @@ export async function drainBuffer() {
       } catch (e) {
         const attempts = parseRetry(name) + 1
         failed++
-        // Connection-refused mid-drain: the daemon died between the port read
-        // and this POST. Re-ensure it via the shared proxy so the next tick
-        // has a live target (the file is aged/kept below, never dropped here).
-        if (isConnRefusedLike(e)) void ensureMemoryDaemon()
         if (attempts >= MAX_DRAIN_ATTEMPTS) {
           // Quarantine, don't drop: move to dead/ so a poison record neither
           // wedges the queue nor silently vanishes (recoverable for triage).
@@ -413,4 +288,3 @@ export async function drainBuffer() {
   }
   return { ok: failed === 0, drained, failed }
 }
-

package/src/runtime/channels/lib/output-forwarder.mjs

@@ -29,15 +29,15 @@ import {
   buildToolLine
 } from "./tool-format.mjs";
 
-// Per-item send watchdog. drainQueue awaits ONE backend send at a time; a hung
+// Per-item send watchdog. drainQueue awaits ONE provider send at a time; a hung
 // send would otherwise never settle, so drainQueue never returns and `sending`
 // stays true forever — wedging ALL outbound behind the queue head. The watchdog
 // does NOT abandon the send (racing a still-running send against a retry would
-// double-deliver): it only pokes the backend to reset its wedged client so the
+// double-deliver): it only pokes the provider to reset its wedged client so the
 // AWAITED send fails fast and `sending` releases on real settlement. Sized above
-// the backend's worst-case per-attempt retries.
+// the provider's worst-case per-attempt retries.
 const SEND_ITEM_TIMEOUT_MS = 120_000;
-// After the watchdog resets the backend, wait at most this long for the
+// After the watchdog resets the provider, wait at most this long for the
 // abandoned send to actually settle before releasing the queue.
 const SEND_SETTLE_CAP_MS = 15_000;
 const TAIL_RECOVERY_BYTES = 256 * 1024;
@@ -403,8 +403,8 @@ class OutputForwarder {
       this.commitReadProgress(item.nextFileSize);
       return;
     }
-    // Formatting is routed through the active backend via the send-callback so
-    // the forwarder stays backend-agnostic (Discord/Telegram/etc). Preformatted
+    // Formatting is routed through the active provider via the send-callback so
+    // the forwarder stays provider-agnostic (Discord/Telegram/etc). Preformatted
     // items (tool logs) are sent as-is. Fallback to raw text when no hook.
     const formatted = item.preformatted
       ? item.text
@@ -419,18 +419,18 @@ class OutputForwarder {
       return;
     }
     // The active transcript/turn owns Discord continuation spacing. A daemon
-    // backend is shared by every client and scheduler, so backend-global send
+    // provider is shared by every client and scheduler, so provider-global send
     // counts cannot decide whether THIS session's item is its first response.
     // Freeze the decision on the queue item so retries remain byte-identical.
     if (typeof item._continuation !== "boolean") {
       item._continuation = this.sentCount > 0;
     }
-    // Backend owns chunking + send retry: pass the whole (unchunked) text once.
-    // On failure the backend has already exhausted its per-chunk retries and
+    // Provider owns chunking + send retry: pass the whole (unchunked) text once.
+    // On failure the provider has already exhausted its per-chunk retries and
     // throws; we re-throw so drainQueue/scheduleRetry requeues the whole item.
     try {
       // Hand back any opaque resume token stored from a prior partial-send
-      // failure so the backend resumes at the failed chunk instead of
+      // failure so the provider resumes at the failed chunk instead of
       // re-sending chunks that already landed. The token is opaque here —
       // the forwarder only stores/passes/clears it, never interprets it.
       await this.cb.send(targetChannelId, formatted, {
@@ -462,7 +462,7 @@ class OutputForwarder {
 ${_bt.trim()}` : _bt.trim();
     }
     // sentCount now tracks delivered items (the forwarder no longer knows the
-    // backend's chunk count). Increment by 1 per delivered item.
+    // provider's chunk count). Increment by 1 per delivered item.
     this.sentCount += 1;
     this.commitReadProgress(item.nextFileSize);
   }
@@ -507,7 +507,7 @@ ${_bt.trim()}` : _bt.trim();
     const ftLen = this.finalLane.length;
     // A partially-delivered item carries an opaque _resumeToken pinned (by
     // hash) to its exact text. Mutating its text here would break that hash on
-    // the next retry, forcing the backend to full-resend from chunk 0 and
+    // the next retry, forcing the provider to full-resend from chunk 0 and
     // duplicate the chunks already delivered. Treat any tokenized item as
     // sealed: never coalesce/cap-merge into it; new text goes behind it as a
     // separate item.
@@ -569,15 +569,15 @@ ${_bt.trim()}` : _bt.trim();
   /** Supervise a per-item send. The underlying promise is AWAITED to real
    *  settlement so `sending` is never released early (no unsupervised send
    *  racing a retry → duplicate). The watchdog's only job is to reset the
-   *  backend's wedged client so the awaited send fails fast. */
+   *  provider's wedged client so the awaited send fails fast. */
   _sendSupervised(promise, label) {
     const settled = Promise.resolve(promise);
     settled.catch(() => {}); // never leak an unhandled rejection on late settle
     return new Promise((resolve, reject) => {
       let capTimer = null;
       const watchdog = setTimeout(() => {
-        process.stderr.write(`[output-forwarder] ${label} watchdog fired after ${SEND_ITEM_TIMEOUT_MS}ms; resetting backend\n`);
-        Promise.resolve(this.cb?.resetBackend?.()).catch(() => {});
+        process.stderr.write(`[output-forwarder] ${label} watchdog fired after ${SEND_ITEM_TIMEOUT_MS}ms; resetting provider\n`);
+        Promise.resolve(this.cb?.resetProvider?.()).catch(() => {});
         // Bound the post-reset settlement wait; past the cap, invalidate the
         // in-flight send (gen bump → zombie can't double-advance) and release.
         capTimer = setTimeout(() => {
@@ -705,7 +705,7 @@ ${_bt.trim()}` : _bt.trim();
             // Transient send failure: extractNewText already advanced the read
             // cursor past these bytes, so dropping the item here would lose the
             // final text. Requeue the WHOLE item and let drainQueue retry
-            // instead of silently discarding. The backend owns chunking+retry,
+            // instead of silently discarding. The provider owns chunking+retry,
             // so a requeued send restarts from chunk 0. pendingFinalFlush stays
             // set so a process restart can also resume the flush.
             this.finalLane.push(finalItem);