mohdel 2.0.0 → 3.0.0

package/README.md

@@ -276,7 +276,7 @@ const result = await mo.use('anthropic/claude-sonnet-4-6').answer('Hello')
 console.log(result.output, result.cost)
 ```
 
-No subprocess, no setup beyond your API key. Right for CLI tools (`mo ask`), scripts, tests, and single-process services — which is most projects. Pass an `AbortSignal` as `answer(prompt, { signal })` to cancel in flight.
+No subprocess, no setup beyond your API key. Right for CLI tools (`mo ask`), scripts, tests, and single-process services — which is most projects. Pass an `AbortSignal` as `answer(prompt, { signal })` to abort in flight.
 
 The factory reads the catalog from `~/.config/mohdel/curated.json` and keys from the environment, the same defaults a gate session starts from. `mohdel({ models })` replaces the catalog for the process, factory and session runtime alike, the way `set_catalog` replaces it in a gate session. `mohdel({ configurations: { openai: { apiKey } } })` overrides the key per provider.
 
@@ -333,7 +333,7 @@ Mohdel splits into three planes that can be deployed independently:
 ```
 
 - **`mohdel/client`** (JS) — thin stub that callers import. Opens a unix socket to thin-gate, sends a `CallEnvelope`, receives an async-iterable of `Event`s. Zero transitive provider-SDK imports — caller-side code stays light.
-- **`mohdel-thin-gate`** (Rust binary, prebuilt and shipped via the `mohdel-thin-gate-<platform>` npm sub-packages) — scheduler / state owner / supervisor. Binds the data-plane socket, validates the envelope, dispatches to a pooled session subprocess, relays events back, handles graceful cancellation on client disconnect. Binds the admin plane for `GET /v1/health`. Pushes OTLP metrics (sessions alive/respawned, calls by provider/status, call-duration histogram, cooldown / quota / policy rejections) when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. Internal trait hooks (`RoutePolicy`, `QuotaPolicy`, `ConfigSource`, `CachePolicy`) make the crate testable and fork-friendly for deployments that need bespoke policy — not a published-library surface.
+- **`mohdel-thin-gate`** (Rust binary, prebuilt and shipped via the `mohdel-thin-gate-<platform>` npm sub-packages) — scheduler / state owner / supervisor. Binds the data-plane socket, validates the envelope, dispatches to a pooled session subprocess, relays events back, aborts gracefully on client disconnect. Binds the admin plane for `GET /v1/health`. Pushes OTLP metrics (sessions alive/respawned, calls by provider/status, call-duration histogram, cooldown / quota / policy rejections) when `OTEL_EXPORTER_OTLP_ENDPOINT` is set. Internal trait hooks (`RoutePolicy`, `QuotaPolicy`, `ConfigSource`, `CachePolicy`) make the crate testable and fork-friendly for deployments that need bespoke policy — not a published-library surface.
 - **`mohdel/session`** (JS subprocess) — provider executor. Spawned by thin-gate, reads envelopes from stdin, dispatches to the matching adapter, writes events to stdout. A napi-rs addon was scoped for hot-loop optimization but current benchmarks show per-call JS CPU is not the bottleneck; the stub stays under `rust/napi-addon/` for future reactivation.
 
 ### Running thin-gate
@@ -355,7 +355,7 @@ With no session-bin configured, thin-gate runs in demo mode: `POST /v1/call` ret
 
 ### Calling from JS
 
-The client snippet under [Library Usage](#library-usage) above is the full surface: `call(envelope, { socketPath, signal?, headers? })` returns an async iterable of events. `headers` go with the request, for a router in front of the gate that authenticates its callers. Pass an `AbortSignal` to cancel in flight; thin-gate forwards a cancel control message to the session and reuses it on the pool, and the client ends the stream with the same cancelled `done` the in-process path returns (status `incomplete`, warning `cancelled`, the partial output it relayed, zero tokens). The envelope is the flat `answer(prompt, options)` surface plus transport metadata (`callId`, `authId`, `auth.key`, optional `traceparent`); see [`js/core/envelope.js`](js/core/envelope.js) for the full field list.
+The client snippet under [Library Usage](#library-usage) above is the full surface: `call(envelope, { socketPath, signal?, headers? })` returns an async iterable of events. `headers` go with the request and with its abort, for a router in front of the gate that authenticates its callers. Pass an `AbortSignal` to abort in flight; the client posts `/v1/abort`, thin-gate forwards an abort control message to the session and reuses it on the pool, and the stream ends with the session's aborted `done`, the one the in-process path returns (status `incomplete`, warning `aborted`, the partial output and the usage reported before the cut). The envelope is the flat `answer(prompt, options)` surface plus transport metadata (`callId`, `authId`, `auth.key`, optional `traceparent`); see [`js/core/envelope.js`](js/core/envelope.js) for the full field list.
 
 ### Other languages
 
@@ -376,7 +376,7 @@ end
 
 ### Canonical types (frozen wire contract)
 
-Wire format is JSON over NDJSON frames, camelCase. Types are defined in `js/core/` (JSDoc) and mirrored in `rust/protocol/src/protocol.rs` (serde, the `mohdel-protocol` crate). Cross-language conformance tests enforce round-trip fidelity. The session-side protocol (envelopes in, events out, cancel control messages) is specified in [PROTOCOL.md](PROTOCOL.md) — read that to implement a session in another language.
+Wire format is JSON over NDJSON frames, camelCase. Types are defined in `js/core/` (JSDoc) and mirrored in `rust/protocol/src/protocol.rs` (serde, the `mohdel-protocol` crate). Cross-language conformance tests enforce round-trip fidelity. The session-side protocol (envelopes in, events out, abort control messages) is specified in [PROTOCOL.md](PROTOCOL.md) — read that to implement a session in another language.
 
 - **`CallEnvelope`** — flat `answer()` options plus transport metadata: `callId`, `authId`, `auth.key`, `traceparent?`, `baggage?`, `provider`, `model`, `prompt`, `outputBudget?`, `outputType?`, `outputStyle?`, `outputEffort?`, `images?`, `videos?`, `cache?`, `tools?`, `toolChoice?`, `parallelToolCalls?`, `identifier?`.
 - **`Event`** — three-variant union discriminated on `type`:
@@ -385,10 +385,10 @@ Wire format is JSON over NDJSON frames, camelCase. Types are defined in `js/core
   - `{ type: 'error', error: TypedError }`
 - **`AnswerResult`** — `status`, `output`, `inputTokens`, `outputTokens`, `thinkingTokens`, `cost` (single number), `timestamps`, `warning?`, `toolCalls?`.
 - **`Status`** — `'completed' | 'tool_use' | 'incomplete'`.
-- **`Warning`** — additive string union: `'insufficientOutputBudget'`, `'cancelled'`, ...
+- **`Warning`** — additive string union: `'insufficientOutputBudget'`, `'aborted'`, ...
 - **`TypedError`** — `{ message, detail?, severity, retryable, type }`. `type` is the canonical tag callers branch on (e.g. `'AUTH_INVALID'`, `'PROVIDER_COOLDOWN'`), optional on the wire; `message` is a short human-readable label; `detail` is the provider's own rejection text; `severity` is `'trace' | 'debug' | 'info' | 'warn' | 'error' | 'fatal'`.
 
-A `cancel` control message `{ op: "cancel", callId }` on session stdin aborts the matching in-flight call.
+An `abort` control message `{ op: "abort", callId }` on session stdin aborts the matching in-flight call.
 
 Extending the frozen wire types is breaking — additive changes only on trait method sets and non-frozen internals. See [ARCHITECTURE.md §What isn't frozen](ARCHITECTURE.md#what-isnt-frozen) for the refinable-vs-frozen split.
 
@@ -398,8 +398,8 @@ See [CONTRIBUTING.md](CONTRIBUTING.md#adding-a-session-adapter). Short version:
 
 1. Create `js/session/adapters/<provider>.js` exporting `async function* <provider>(envelope, { client?, signal? })`.
 2. Map provider-native events to the canonical Event union.
-3. Pass `{ signal }` to the SDK's streaming method so cancellation aborts in-flight HTTP.
-4. On SDK throw: if `signal?.aborted`, return silently (run() emits call.cancelled); else yield `call.error` via `classifyProviderError(e)` from `./_errors.js`.
+3. Pass `{ signal }` to the SDK's streaming method so an abort tears down in-flight HTTP.
+4. On SDK throw: if `signal?.aborted`, return silently (run() yields the aborted `done`); else yield `{ type: 'error', error: classifyProviderError(e) }` from `./_errors.js`.
 5. Register in `js/session/adapters/index.js`.
 6. Write unit tests with a dependency-injected mock client.
 7. Optionally add a gated live test in `test/live/<provider>.live.test.js`.
@@ -492,11 +492,12 @@ Test files under `rust/thin-gate/tests/`:
 | `conformance.rs` | JS↔Rust protocol round-trip |
 | `protocol.rs` | serde (de)serialization of envelope/events/results |
 | `server.rs` | HTTP layer, synthetic dispatch, 404/400 paths |
-| `session_dispatch.rs` | real `node js/session/bin.js` spawn + dispatch + graceful cancel |
+| `session_dispatch.rs` | real `node js/session/bin.js` spawn + dispatch + graceful abort + `/v1/abort` |
+| `oneshot_abandon.rs` | one-shot handler dropped mid-exchange: the session finishes and returns to the pool |
 | `policy.rs` | `RoutePolicy` + `QuotaPolicy` + `Enforcer` end-to-end |
 | `config.rs` | TOML `ConfigSource` parsing, defaults, malformed, env override |
 | `supervision.rs` | readiness ping/pong + readiness timeout + garbage-response handling |
-| `stress.rs` | 100 concurrent calls, cancel storm, session-death-under-load |
+| `stress.rs` | 100 concurrent calls, abort storm, session-death-under-load |
 
 Spawning tests require `node` in PATH.
 
@@ -528,11 +529,11 @@ For deterministic stress, benchmark, and bug-repro work, register `provider: "fa
 { mode: 'volume',       tokens: 1000 }              // throughput stress
 { mode: 'slow',         tokens: 50, delayMs: 100 }  // streaming cadence
 { mode: 'error',        type: 'AUTH_INVALID' }      // error classification
-{ mode: 'hang' }                                    // cancel / timeout plumbing
+{ mode: 'hang' }                                    // abort / timeout plumbing
 { mode: 'tool',         name: 'f', args: { x: 1 } } // tool round-trip
 { mode: 'incomplete' }                              // status contract
 { mode: 'crash' }                                   // process isolation (exits the adapter process)
-{ mode: 'cancel_after', tokens: 5 }                 // cancel mid-stream
+{ mode: 'abort_after', tokens: 5 }                 // abort mid-stream
 ```
 
 All modes honor `AbortSignal`. The benchmarks in `bench/` use this to pin adapter work to a fixed shape and isolate what's being measured — see `bench/bench.js` (throughput) and `bench/isolation.js` (crash containment).

package/js/client/call.js

@@ -1,57 +1,90 @@
 /**
  * Send a CallEnvelope to thin-gate; returns an async iterable of Events.
  *
- * Cancellation: pass an AbortSignal. Aborting closes the HTTP request;
- * thin-gate infers cancel from connection close and sends the session a
- * cancel control message. The session's own cancelled terminal is drained
- * gate-side, so the client synthesizes the same cancelled `done` here —
- * partial output from the deltas it relayed, zero tokens, zero cost —
- * giving a caller the same terminal on this path as on the in-process one.
+ * Abort: pass an AbortSignal. Once the gate has answered, an abort
+ * posts `/v1/abort` for this call and the stream keeps flowing until the
+ * session's own aborted `done` — partial output and the usage reported
+ * before the cut, as on the in-process path. That wait has no limit of
+ * its own: to stop waiting, stop iterating, which abandons the call. An
+ * abort before the gate answered drops the request instead; nothing has
+ * been reported yet, so the client ends with an aborted `done` of its
+ * own, zero usage.
  * @module client/call
  */
 
 import { requestUnix } from './transport.js'
 import { readAll, parseErrorBody } from './response.js'
 import { parseNDJSON } from './ndjson.js'
-import { isEvent, MohdelError, STATUS_INCOMPLETE, WARNING_CANCELLED } from '#core'
+import { isEvent, MohdelError, STATUS_INCOMPLETE, WARNING_ABORTED } from '#core'
+
+const ABORT_PATH = '/v1/abort'
+const GATE_HEADER = 'mohdel-gate'
 
 /**
  * @param {string} start
- * @param {string | null} first
- * @param {string} output
  * @returns {import('#core/events.js').DoneEvent}
  */
-function cancelledDone (start, first, output) {
+function abortedDone (start) {
   const end = String(process.hrtime.bigint())
   return {
     type: 'done',
     result: {
       status: STATUS_INCOMPLETE,
-      output: output || null,
+      output: null,
       inputTokens: 0,
       outputTokens: 0,
       thinkingTokens: 0,
       cost: 0,
-      timestamps: { start, first: first ?? end, end },
-      warning: WARNING_CANCELLED
+      timestamps: { start, first: end, end },
+      warning: WARNING_ABORTED
     }
   }
 }
 
+/**
+ * `CALL_NOT_FOUND` means the call ended before the abort reached it; its
+ * terminal is already on the stream.
+ *
+ * @param {import('#core/envelope.js').CallEnvelope} envelope
+ * @param {string | string[] | undefined} gate  the call response's `mohdel-gate`
+ * @param {string} socketPath
+ * @param {Record<string, string> | undefined} headers
+ */
+async function requestAbort (envelope, gate, socketPath, headers) {
+  if (typeof gate !== 'string') {
+    throw new MohdelError(
+      `the /v1/call response carries no ${GATE_HEADER} header`,
+      { type: 'PROTOCOL_GATE_UNIDENTIFIED', retryable: false }
+    )
+  }
+  const res = await requestUnix({
+    socketPath,
+    path: ABORT_PATH,
+    method: 'POST',
+    body: { callId: envelope.callId, authId: envelope.authId, gate },
+    headers
+  })
+  const body = await readAll(res)
+  if (res.statusCode === 202) return
+  const error = parseErrorBody(body, res.statusCode ?? 0)
+  if (error.type === 'CALL_NOT_FOUND') return
+  throw MohdelError.fromJSON(error)
+}
+
 /**
  * @param {import('#core/envelope.js').CallEnvelope} envelope
  * @param {object} options
  * @param {string} options.socketPath
  * @param {AbortSignal} [options.signal]
  * @param {string} [options.path]  HTTP path; defaults to '/v1/call'
- * @param {Record<string, string>} [options.headers]  sent with the request, for a router in front of the gate;
- *   `content-type`, `content-length`, `transfer-encoding`, `connection` and `host` are the transport's
+ * @param {Record<string, string>} [options.headers]  sent with the request and with its abort, for a router in
+ *   front of the gate; `content-type`, `content-length`, `transfer-encoding`, `connection` and `host` are the transport's
  * @returns {AsyncGenerator<import('#core/events.js').Event>}
  */
 export async function * call (envelope, { socketPath, signal, path = '/v1/call', headers }) {
   const start = String(process.hrtime.bigint())
   if (signal?.aborted) {
-    yield cancelledDone(start, null, '')
+    yield abortedDone(start)
     return
   }
 
@@ -67,7 +100,7 @@ export async function * call (envelope, { socketPath, signal, path = '/v1/call',
     })
   } catch (e) {
     if (signal?.aborted) {
-      yield cancelledDone(start, null, '')
+      yield abortedDone(start)
       return
     }
     throw e
@@ -78,9 +111,19 @@ export async function * call (envelope, { socketPath, signal, path = '/v1/call',
     throw MohdelError.fromJSON(parseErrorBody(body, res.statusCode ?? 0))
   }
 
-  const outputParts = []
-  let first = null
+  /** @type {unknown} */
+  let abortError = null
   let sawTerminal = false
+  const onAbort = () => {
+    if (sawTerminal) return
+    requestAbort(envelope, res.headers[GATE_HEADER], socketPath, headers).catch((e) => {
+      abortError = e
+      res.destroy()
+    })
+  }
+  if (signal?.aborted) onAbort()
+  else signal?.addEventListener('abort', onAbort, { once: true })
+
   try {
     for await (const obj of parseNDJSON(res)) {
       if (!isEvent(obj)) {
@@ -89,19 +132,13 @@ export async function * call (envelope, { socketPath, signal, path = '/v1/call',
           { type: 'PROTOCOL_INVALID_EVENT', retryable: false }
         )
       }
-      if (obj.type === 'delta') {
-        if (first === null) first = String(process.hrtime.bigint())
-        if (obj.delta?.type === 'message') outputParts.push(obj.delta.delta)
-      } else if (obj.type === 'done' || obj.type === 'error') {
-        sawTerminal = true
-      }
+      if (obj.type === 'done' || obj.type === 'error') sawTerminal = true
       yield /** @type {import('#core/events.js').Event} */(obj)
     }
   } catch (e) {
-    if (!signal?.aborted) throw e
-  }
-
-  if (signal?.aborted && !sawTerminal) {
-    yield cancelledDone(start, first, outputParts.join(''))
+    throw abortError ?? e
+  } finally {
+    signal?.removeEventListener('abort', onAbort)
   }
+  if (abortError) throw abortError
 }

package/js/client/transport.js

@@ -30,7 +30,11 @@ export function requestUnix ({ socketPath, path, method, body, signal, headers }
     const h = { ...(headers || {}) }
     if (body !== undefined) h['content-type'] = 'application/json'
 
-    const req = http.request({ socketPath, path, method, headers: h }, resolve)
+    const onAbort = () => req.destroy(new Error('aborted'))
+    const req = http.request({ socketPath, path, method, headers: h }, (res) => {
+      signal?.removeEventListener('abort', onAbort)
+      resolve(res)
+    })
     req.on('error', reject)
 
     if (signal) {
@@ -39,11 +43,7 @@ export function requestUnix ({ socketPath, path, method, body, signal, headers }
         reject(new Error('aborted'))
         return
       }
-      const onAbort = () => req.destroy(new Error('aborted'))
       signal.addEventListener('abort', onAbort, { once: true })
-      // Released on `close` rather than on resolve: the promise
-      // resolves at response headers, and cancellation has to stay
-      // live for the streaming body that follows.
       req.on('close', () => signal.removeEventListener('abort', onAbort))
     }
 

package/js/core/events.js

@@ -98,7 +98,7 @@
  *   USD, computed from curated pricing. Single number (not a breakdown).
  * @property {Timestamps} timestamps
  * @property {string} [warning]
- *   `'insufficientOutputBudget' | 'cancelled' | ...` additive union.
+ *   `'insufficientOutputBudget' | 'aborted' | ...` additive union.
  * @property {ToolCall[]} [toolCalls]
  *   Present when `status === 'tool_use'`.
  * @property {number} [maxInterFrameMs]

package/js/core/status.js

@@ -5,7 +5,7 @@
  *   - `completed`  — the call finished normally.
  *   - `tool_use`   — the model emitted tool calls; the caller is
  *                    expected to round-trip results back.
- *   - `incomplete` — the call was cut short (budget, cancel, policy).
+ *   - `incomplete` — the call was cut short (budget, abort, policy).
  *
  * Rust mirror: `rust/thin-gate/src/protocol.rs::Status`.
  *
@@ -18,13 +18,13 @@
  * Warning values emitted on `AnswerResult.warning` when status is
  * `incomplete`:
  *   - `insufficientOutputBudget` — the model hit `max_tokens`.
- *   - `cancelled` — the call was aborted via a cancel control
+ *   - `aborted` — the call was aborted via an abort control
  *     message or `AbortSignal`.
  *
  * Additive: future releases may add new warning strings; consumers
  * should treat unknown warnings as pass-through metadata.
  *
- * @typedef {('insufficientOutputBudget'|'cancelled'|string)} Warning
+ * @typedef {('insufficientOutputBudget'|'aborted'|string)} Warning
  */
 
 export const STATUS_COMPLETED = 'completed'
@@ -37,4 +37,4 @@ export const STATUSES = Object.freeze([
 ])
 
 export const WARNING_INSUFFICIENT_OUTPUT_BUDGET = 'insufficientOutputBudget'
-export const WARNING_CANCELLED = 'cancelled'
+export const WARNING_ABORTED = 'aborted'

package/js/session/adapters/{_cancelled.js → _aborted.js}

@@ -1,11 +1,11 @@
 /**
- * Shared `cancelledDone` helper for adapters that need to synthesize
+ * Shared `abortedDone` helper for adapters that need to synthesize
  * a terminal `done` event on `signal.aborted` mid-stream.
  *
- * @module session/adapters/_cancelled
+ * @module session/adapters/_aborted
  */
 
-import { STATUS_INCOMPLETE, WARNING_CANCELLED } from '#core/status.js'
+import { STATUS_INCOMPLETE, WARNING_ABORTED } from '#core/status.js'
 import { costFor } from './_pricing.js'
 
 /**
@@ -16,12 +16,12 @@ import { costFor } from './_pricing.js'
  * @param {number} inputTokens
  * @param {number} outputTokens
  * @param {{cacheWriteInputTokens?: number, cacheReadInputTokens?: number}} [extra]
- *   Optional cache token counts captured before cancellation. Threaded through
- *   so the cancellation-cost calculation prices any cache writes/reads that
+ *   Optional cache token counts captured before the abort. Threaded through
+ *   so the abort-cost calculation prices any cache writes/reads that
  *   already happened before the abort.
  * @returns {import('#core/events.js').DoneEvent}
  */
-export function cancelledDone (start, first, envelope, output, inputTokens, outputTokens, extra = {}) {
+export function abortedDone (start, first, envelope, output, inputTokens, outputTokens, extra = {}) {
   const end = String(process.hrtime.bigint())
   const cacheWriteInputTokens = extra.cacheWriteInputTokens || 0
   const cacheReadInputTokens = extra.cacheReadInputTokens || 0
@@ -40,7 +40,7 @@ export function cancelledDone (start, first, envelope, output, inputTokens, outp
         { inputTokens, outputTokens, thinkingTokens: 0, cacheWriteInputTokens, cacheReadInputTokens }
       ),
       timestamps: { start, first: first ?? end, end },
-      warning: WARNING_CANCELLED
+      warning: WARNING_ABORTED
     }
   }
 }

package/js/session/adapters/_chat_completions.js

@@ -22,7 +22,7 @@ import { classifyProviderError } from './_errors.js'
 import { hasImagePart, loadImage, loadImageParts } from './_images.js'
 import { isTrustedMedia, mediaError, mediaScheme } from './_media.js'
 import { costFor } from './_pricing.js'
-import { cancelledDone } from './_cancelled.js'
+import { abortedDone } from './_aborted.js'
 import { catalogKey, bareOf } from '#core/model-id.js'
 import {
   STATUS_COMPLETED,
@@ -116,7 +116,7 @@ export async function * runChatCompletions (envelope, client, config, deps = {})
     response = await client.chat.completions.create(args, { signal: deps.signal })
   } catch (e) {
     if (deps.signal?.aborted) {
-      yield cancelledDone(start, null, envelope, '', 0, 0)
+      yield abortedDone(start, null, envelope, '', 0, 0)
       return
     }
     deps.log?.warn({ err: e }, `[mohdel:${config.provider}] request failed`)
@@ -182,7 +182,7 @@ async function * runStreaming (envelope, client, args, config, start, deps) {
     stream = await client.chat.completions.create(args, { signal: deps.signal })
   } catch (e) {
     if (deps.signal?.aborted) {
-      yield cancelledDone(start, null, envelope, '', 0, 0)
+      yield abortedDone(start, null, envelope, '', 0, 0)
       return
     }
     deps.log?.warn({ err: e }, `[mohdel:${config.provider}] request failed`)
@@ -193,7 +193,7 @@ async function * runStreaming (envelope, client, args, config, start, deps) {
   try {
     for await (const chunk of stream) {
       if (deps.signal?.aborted) {
-        yield cancelledDone(start, first, envelope, contentParts.join(''), 0, 0)
+        yield abortedDone(start, first, envelope, contentParts.join(''), 0, 0)
         return
       }
       const choice = chunk.choices?.[0]
@@ -249,7 +249,7 @@ async function * runStreaming (envelope, client, args, config, start, deps) {
     }
   } catch (e) {
     if (deps.signal?.aborted) {
-      yield cancelledDone(start, first, envelope, contentParts.join(''), 0, 0)
+      yield abortedDone(start, first, envelope, contentParts.join(''), 0, 0)
       return
     }
     deps.log?.warn({ err: e }, `[mohdel:${config.provider}] stream failed`)
@@ -258,7 +258,7 @@ async function * runStreaming (envelope, client, args, config, start, deps) {
   }
 
   if (deps.signal?.aborted) {
-    yield cancelledDone(start, first, envelope, contentParts.join(''), 0, 0)
+    yield abortedDone(start, first, envelope, contentParts.join(''), 0, 0)
     return
   }
 

package/js/session/adapters/_dispatcher.js

@@ -7,11 +7,12 @@
  * phase, so any non-trivial task on a thinking-capable provider can
  * blow that limit and surface as a `NET_ERROR / "terminated"` mid-run.
  *
- * We disable the inter-chunk idle timeout. Cancellation comes from
- * three layers above us:
- *   1. caller's `AbortSignal` (per-run timeout, user cancel)
- *   2. SDK request-level timeout (OpenAI/Anthropic/Groq default 600 s)
- *   3. provider-side stream limits
+ * We disable the inter-chunk idle timeout, so nothing in this process
+ * bounds a stream once its headers have arrived: the SDKs' request
+ * timeout is armed around `fetch` only and cleared when the headers
+ * land. What can still end a stream:
+ *   1. caller's `AbortSignal` (per-run timeout, user abort)
+ *   2. provider-side stream limits
  *
  * Headers timeout stays bounded — connect + first response must be
  * fast even when the body afterwards may be slow.

package/js/session/adapters/_videos.js

@@ -288,7 +288,7 @@ async function uploadFile (filePath, mimeType, ctx) {
 /**
  * Raise an `AbortError` when `signal` is aborted. The gemini
  * adapter's video-load catch block already converts this shape to
- * the standard cancelled terminal via the outer `signal?.aborted`
+ * the standard aborted terminal via the outer `signal?.aborted`
  * check in `run.js`.
  *
  * @param {AbortSignal | undefined} signal

package/js/session/adapters/anthropic.js

@@ -24,7 +24,7 @@ import {
   WARNING_INSUFFICIENT_OUTPUT_BUDGET
 } from '#core/status.js'
 
-import { cancelledDone } from './_cancelled.js'
+import { abortedDone } from './_aborted.js'
 import { getSpec } from './_catalog.js'
 import { classifyProviderError } from './_errors.js'
 import { hasImagePart, loadImageParts, loadImages } from './_images.js'
@@ -58,7 +58,7 @@ import { streamingDispatcher } from './_dispatcher.js'
  *
  * **Cost impact:** provably zero when `thinkingPrice == outputPrice`
  * (true for every Anthropic entry in the curated catalog today) —
- * the heuristic error cancels in `cost = i*ip + o*op + t*tp` because
+ * the heuristic error drops out of `cost = i*ip + o*op + t*tp` because
  * `o*op + t*op = (o+t)*op = totalOutput*op`. If a catalog maintainer
  * ever sets asymmetric Anthropic pricing, cost drifts by
  * `estimate_error × (thinkingPrice − outputPrice)` — that's a
@@ -134,7 +134,7 @@ export async function * anthropic (envelope, deps = {}) {
 
     for await (const event of stream) {
       if (signal?.aborted) {
-        yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens, { cacheWriteInputTokens: cacheWriteTokens, cacheReadInputTokens: cacheReadTokens })
+        yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens, { cacheWriteInputTokens: cacheWriteTokens, cacheReadInputTokens: cacheReadTokens })
         return
       }
       switch (event.type) {
@@ -208,7 +208,7 @@ export async function * anthropic (envelope, deps = {}) {
     }
   } catch (e) {
     if (signal?.aborted) {
-      yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens, { cacheWriteInputTokens: cacheWriteTokens, cacheReadInputTokens: cacheReadTokens })
+      yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens, { cacheWriteInputTokens: cacheWriteTokens, cacheReadInputTokens: cacheReadTokens })
       return
     }
     log?.warn({ err: e }, '[mohdel:anthropic] stream failed')
@@ -217,7 +217,7 @@ export async function * anthropic (envelope, deps = {}) {
   }
 
   if (signal?.aborted) {
-    yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens, { cacheWriteInputTokens: cacheWriteTokens, cacheReadInputTokens: cacheReadTokens })
+    yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens, { cacheWriteInputTokens: cacheWriteTokens, cacheReadInputTokens: cacheReadTokens })
     return
   }
 

package/js/session/adapters/echo.js

@@ -1,14 +1,14 @@
 /**
  * Echo adapter — deterministic stub. Emits two message deltas and a
  * `done` event with a synthetic `AnswerResult`. Honors `signal` for
- * test-controlled cancellation.
+ * test-controlled aborts.
  *
  * @module session/adapters/echo
  */
 
 import { STATUS_COMPLETED } from '#core/status.js'
 
-import { cancelledDone } from './_cancelled.js'
+import { abortedDone } from './_aborted.js'
 
 /**
  * @param {import('#core/envelope.js').CallEnvelope} envelope
@@ -22,7 +22,7 @@ export async function * echo (envelope, { signal } = {}) {
 
   for (const delta of ['Hello', ', world.']) {
     if (signal?.aborted) {
-      yield cancelledDone(start, first, envelope, output, 0, 0)
+      yield abortedDone(start, first, envelope, output, 0, 0)
       return
     }
     if (first === null) first = String(process.hrtime.bigint())
@@ -31,7 +31,7 @@ export async function * echo (envelope, { signal } = {}) {
   }
 
   if (signal?.aborted) {
-    yield cancelledDone(start, first, envelope, output, 0, 0)
+    yield abortedDone(start, first, envelope, output, 0, 0)
     return
   }
 

package/js/session/adapters/fake.js

@@ -18,11 +18,11 @@
  * | `incomplete`  | `warning`                      | `done` with status=incomplete + warning              |
  * | `error`       | `type`, `message`, `retryable` | yield typed error event                              |
  * | `hang`        | –                              | never emits a terminal (caller aborts via signal)    |
- * | `cancel_after`| `tokens`                       | emit N deltas then wait for `signal.aborted`         |
+ * | `abort_after`| `tokens`                       | emit N deltas then wait for `signal.aborted`         |
  * | `crash`       | `code`                         | `process.exit(code\|1)` — kills whichever process is running the adapter. Used by the isolation benchmark to demonstrate that via-gate the crash stays in the session subprocess, in-process it takes down the caller. |
  *
  * Every mode honors `deps.signal`: when aborted mid-stream, emits a
- * `cancelled` done event. That keeps consumer behavior uniform with
+ * `aborted` done event. That keeps consumer behavior uniform with
  * the real provider adapters.
  *
  * @module session/adapters/fake
@@ -35,7 +35,7 @@ import {
   WARNING_INSUFFICIENT_OUTPUT_BUDGET
 } from '#core/status.js'
 
-import { cancelledDone } from './_cancelled.js'
+import { abortedDone } from './_aborted.js'
 
 /**
  * @param {import('#core/envelope.js').CallEnvelope} envelope
@@ -63,7 +63,7 @@ export async function * fake (envelope, deps = {}) {
 
     case 'hang':
       await waitForAbort(signal)
-      yield cancelledDone(start, first, envelope, '', 0, 0)
+      yield abortedDone(start, first, envelope, '', 0, 0)
       return
 
     case 'crash': {
@@ -120,7 +120,7 @@ export async function * fake (envelope, deps = {}) {
       let output = ''
       for (let i = 0; i < total; i++) {
         if (signal?.aborted) {
-          yield cancelledDone(start, first, envelope, output, approxTokens(output), approxTokens(output))
+          yield abortedDone(start, first, envelope, output, approxTokens(output), approxTokens(output))
           return
         }
         if (first === null) first = String(process.hrtime.bigint())
@@ -130,7 +130,7 @@ export async function * fake (envelope, deps = {}) {
         if (delayMs > 0) {
           await sleep(delayMs, signal)
           if (signal?.aborted) {
-            yield cancelledDone(start, first, envelope, output, approxTokens(output), approxTokens(output))
+            yield abortedDone(start, first, envelope, output, approxTokens(output), approxTokens(output))
             return
           }
         }
@@ -145,7 +145,7 @@ export async function * fake (envelope, deps = {}) {
       return
     }
 
-    case 'cancel_after': {
+    case 'abort_after': {
       const total = clampPositive(spec.tokens, 3)
       let output = ''
       for (let i = 0; i < total; i++) {
@@ -155,7 +155,7 @@ export async function * fake (envelope, deps = {}) {
         yield { type: 'delta', delta: { type: 'message', delta: chunk } }
       }
       await waitForAbort(signal)
-      yield cancelledDone(start, first, envelope, output, approxTokens(output), approxTokens(output))
+      yield abortedDone(start, first, envelope, output, approxTokens(output), approxTokens(output))
       return
     }
 

package/js/session/adapters/gemini.js

@@ -25,7 +25,7 @@ import {
   WARNING_INSUFFICIENT_OUTPUT_BUDGET
 } from '#core/status.js'
 
-import { cancelledDone } from './_cancelled.js'
+import { abortedDone } from './_aborted.js'
 import { getSpec } from './_catalog.js'
 import { classifyProviderError } from './_errors.js'
 import { loadImageParts, loadImages } from './_images.js'
@@ -80,7 +80,7 @@ export async function * gemini (envelope, deps = {}) {
       if (parts.length) injectParts(contents, parts)
     } catch (e) {
       if (signal?.aborted) {
-        yield cancelledDone(start, first, envelope, '', 0, 0)
+        yield abortedDone(start, first, envelope, '', 0, 0)
         return
       }
       log?.warn({ err: e }, '[mohdel:gemini] video load failed')
@@ -98,7 +98,7 @@ export async function * gemini (envelope, deps = {}) {
   // from `params.config.abortSignal` — a second-arg `{signal}` is
   // dropped (verified against the compiled SDK at
   // node_modules/@google/genai/dist/index.cjs). Merge into config
-  // so cancellation actually tears down the HTTPS request, not just
+  // so an abort actually tears down the HTTPS request, not just
   // the local loop.
   if (signal) {
     request.config = { ...(request.config ?? {}), abortSignal: signal }
@@ -122,7 +122,7 @@ export async function * gemini (envelope, deps = {}) {
 
     for await (const chunk of stream) {
       if (signal?.aborted) {
-        yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
+        yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
         return
       }
 
@@ -178,7 +178,7 @@ export async function * gemini (envelope, deps = {}) {
     }
   } catch (e) {
     if (signal?.aborted) {
-      yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
+      yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
       return
     }
     log?.warn({ err: e }, '[mohdel:gemini] stream failed')
@@ -187,7 +187,7 @@ export async function * gemini (envelope, deps = {}) {
   }
 
   if (signal?.aborted) {
-    yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
+    yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
     return
   }
 

package/js/session/adapters/openai.js

@@ -25,7 +25,7 @@ import {
   WARNING_INSUFFICIENT_OUTPUT_BUDGET
 } from '#core/status.js'
 
-import { cancelledDone } from './_cancelled.js'
+import { abortedDone } from './_aborted.js'
 import { getSpec } from './_catalog.js'
 import { classifyProviderError } from './_errors.js'
 import { hasImagePart, loadImageParts, loadImages } from './_images.js'
@@ -99,7 +99,7 @@ export async function * openai (envelope, deps = {}) {
 
     for await (const event of stream) {
       if (signal?.aborted) {
-        yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
+        yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
         return
       }
       switch (event.type) {
@@ -170,7 +170,7 @@ export async function * openai (envelope, deps = {}) {
     }
   } catch (e) {
     if (signal?.aborted) {
-      yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
+      yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
       return
     }
     log?.warn({ err: e }, '[mohdel:openai] stream failed')
@@ -179,7 +179,7 @@ export async function * openai (envelope, deps = {}) {
   }
 
   if (signal?.aborted) {
-    yield cancelledDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
+    yield abortedDone(start, first, envelope, currentOutput(), inputTokens, outputTokens)
     return
   }
 

package/js/session/driver.js

@@ -4,7 +4,7 @@
  * Reads lines from stdin concurrently with running calls:
  *   - Envelope line (no `op` field): queued for sequential dispatch
  *     via `run()`. Events written to stdout as NDJSON.
- *   - Control message `{op:"cancel", callId}`: if it matches the
+ *   - Control message `{op:"abort", callId}`: if it matches the
  *     in-flight call, aborts via AbortController.
  *
  * Single-call-at-a-time per process.
@@ -22,9 +22,9 @@ import { runEmbedding } from './run_embedding.js'
 import { runInfo } from './run_info.js'
 import { setCatalog } from './adapters/_catalog.js'
 
-// Bounded memory for pre-dequeue cancels. Hostile/buggy supervisors
+// Bounded memory for pre-dequeue aborts. Hostile/buggy supervisors
 // spamming random callIds can't grow the set without bound.
-const PRECANCEL_CAP = 128
+const EARLY_ABORT_CAP = 128
 
 /**
  * @param {NodeJS.ReadableStream} stdin
@@ -40,17 +40,17 @@ export async function drive (stdin, stdout) {
   let queueNotify = null
   let stdinClosed = false
   let framingError = null
-  /** Cancel messages received before their envelope was dequeued.
+  /** Abort messages received before their envelope was dequeued.
    *  JS Sets are insertion-ordered, so `values().next()` is the
    *  oldest entry — cheap FIFO eviction at cap. */
-  const precancelled = new Set()
+  const earlyAborted = new Set()
 
-  function recordPrecancel (callId) {
-    if (precancelled.has(callId)) return
-    if (precancelled.size >= PRECANCEL_CAP) {
-      precancelled.delete(precancelled.values().next().value)
+  function recordEarlyAbort (callId) {
+    if (earlyAborted.has(callId)) return
+    if (earlyAborted.size >= EARLY_ABORT_CAP) {
+      earlyAborted.delete(earlyAborted.values().next().value)
     }
-    precancelled.add(callId)
+    earlyAborted.add(callId)
   }
 
   /**
@@ -94,13 +94,13 @@ export async function drive (stdin, stdout) {
       return
     }
 
-    if (obj && typeof obj === 'object' && obj.op === 'cancel') {
+    if (obj && typeof obj === 'object' && obj.op === 'abort') {
       if (currentCall && currentCall.callId === obj.callId) {
         currentCall.controller.abort()
       } else {
-        // Pre-dequeue cancel: remember the callId so the envelope
+        // Pre-dequeue abort: remember the callId so the envelope
         // aborts immediately on dispatch. Honored once then cleared.
-        recordPrecancel(obj.callId)
+        recordEarlyAbort(obj.callId)
       }
       return
     }
@@ -197,7 +197,7 @@ export async function drive (stdin, stdout) {
 
     const envelope = envelopeQueue.shift()
     const controller = new AbortController()
-    if (precancelled.delete(envelope.callId)) controller.abort()
+    if (earlyAborted.delete(envelope.callId)) controller.abort()
     currentCall = { callId: envelope.callId, controller }
 
     try {

package/js/session/run.js

@@ -14,7 +14,7 @@
  *     skipped for non-retryable provider errors). Span ends with
  *     `gen_ai.*` + `mohdel.*` attributes.
  *
- * Terminal events are `done` (success / incomplete / cancelled /
+ * Terminal events are `done` (success / incomplete / aborted /
  * tool_use) and `error`. The adapter is expected to emit exactly
  * one terminal per call. If it returns without one, `run()`
  * synthesizes an `error`.
@@ -37,7 +37,7 @@ import {
   endSpanError,
   remoteParentFromTraceparent
 } from './_tracing.js'
-import { STATUS_INCOMPLETE, WARNING_CANCELLED } from '#core/status.js'
+import { STATUS_INCOMPLETE, WARNING_ABORTED } from '#core/status.js'
 
 /**
  * @param {import('#core/envelope.js').CallEnvelope} envelope
@@ -227,12 +227,12 @@ export async function * run (envelope, {
         sawDelta = true
       } else if (ev.type === 'done') {
         sawTerminal = true
-        // A cancelled terminal is the caller's action, not evidence
+        // An aborted terminal is the caller's action, not evidence
         // of provider recovery — don't wipe an accumulated failure
         // streak. Every other `done` state (completed /
         // incomplete-budget / tool_use) IS a genuine provider-side
         // success and resets the streak.
-        if (ev.result?.warning !== WARNING_CANCELLED) {
+        if (ev.result?.warning !== WARNING_ABORTED) {
           cooldown.reset(provider)
         }
         if (tpmLimit != null && ev.result) {
@@ -267,7 +267,7 @@ export async function * run (envelope, {
     }
   } catch (e) {
     if (signal?.aborted && !sawTerminal) {
-      const fallback = cancelledFallback()
+      const fallback = abortedFallback()
       if (fallback.result) fallback.result.maxInterFrameMs = maxInterFrameMs
       finalizeSpanOk(span, fallback.result, sawDelta, maxInterFrameMs)
       yield fallback
@@ -281,7 +281,7 @@ export async function * run (envelope, {
 
   if (!sawTerminal) {
     if (signal?.aborted) {
-      const fallback = cancelledFallback()
+      const fallback = abortedFallback()
       if (fallback.result) fallback.result.maxInterFrameMs = maxInterFrameMs
       finalizeSpanOk(span, fallback.result, sawDelta, maxInterFrameMs)
       yield fallback
@@ -561,7 +561,7 @@ function recordFailureFromError (cooldown, provider, err) {
 }
 
 /** @returns {import('#core/events.js').DoneEvent} */
-function cancelledFallback () {
+function abortedFallback () {
   const now = String(process.hrtime.bigint())
   return {
     type: 'done',
@@ -573,7 +573,7 @@ function cancelledFallback () {
       thinkingTokens: 0,
       cost: 0,
       timestamps: { start: now, first: now, end: now },
-      warning: WARNING_CANCELLED
+      warning: WARNING_ABORTED
     }
   }
 }

package/js/session/run_embedding.js

@@ -3,7 +3,7 @@
  * returns either a result or a typed error, never throwing.
  *
  * Mirrors `run_transcription.js`: one synchronous request, no streaming, no
- * cancellation path beyond the caller's own signal. Rate limits are enforced
+ * abort path beyond the caller's own signal. Rate limits are enforced
  * as in `run.js`, minus the speed lanes embeddings do not have.
  *
  * @module session/run_embedding

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mohdel",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "license": "MIT",
   "author": {
     "name": "Christophe Le Bars",
@@ -136,7 +136,7 @@
     "@opentelemetry/exporter-trace-otlp-grpc": "^0.222.0",
     "@opentelemetry/sdk-node": "^0.222.0",
     "chalk": "^6.0.0",
-    "mohdel-thin-gate-linux-x64-gnu": "2.0.0"
+    "mohdel-thin-gate-linux-x64-gnu": "3.0.0"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.128.0",