open-multi-agent-kit 0.99.0 → 1.2.0

package/dist/core/agent-session.js

@@ -18,7 +18,7 @@ import { basename, dirname, join as joinPath } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { getVisionRouteModel } from "omk-agent-core";
 import { clampThinkingLevel, cleanupSessionResources, deriveContextPromptCacheKey, getSupportedThinkingLevels, isBuiltinStreamFn, modelsAreEqual, resetApiProviders, } from "omk-ai";
-import { APP_NAME, VERSION } from "../config.js";
+import { APP_NAME, getAgentDir, VERSION } from "../config.js";
 import { theme } from "../modes/interactive/theme/theme.js";
 import { stripFrontmatter } from "../utils/frontmatter.js";
 import { resolvePath } from "../utils/paths.js";
@@ -31,8 +31,9 @@ import { formatNoApiKeyFoundMessage, formatNoModelSelectedMessage } from "./auth
 import { parseBangInvocation } from "./bang-skill-invocation.js";
 import { getCompactionHeadroomThreshold } from "./compaction/compaction.js";
 import { createCompactionHysteresisConfig, createCompactionHysteresisState, stepCompactionHysteresis, } from "./compaction/hysteresis.js";
-import { calculateContextTokens, collectEntriesForBranchSummary, compact, estimateContextTokens, estimateProjectedContextTokens, generateBranchSummary, prepareCompaction, resolveCompactionModel, } from "./compaction/index.js";
+import { calculateContextTokens, collectEntriesForBranchSummary, compact, estimateContextTokens, estimateProjectedContextTokens, generateBranchSummary, prepareCompaction, resolveCompactionModel, summarizeWithFallback, } from "./compaction/index.js";
 import { summarizeWithOAuthRecovery } from "./compaction/oauth-recovery.js";
+import { overflowRetryBlocked } from "./compaction/overflow-retry-guard.js";
 import { compactionEmitWillRetry } from "./compaction/resume-policy.js";
 import { isSessionModelOverflow, shouldSkipCompactionCheck } from "./compaction-gate.js";
 import { estimateToolResultReserve, } from "./context-budget-reserved-tokens.js";
@@ -47,11 +48,14 @@ import { ExtensionRunner, wrapRegisteredTools, } from "./extensions/index.js";
 import { emitSessionShutdownEvent } from "./extensions/runner.js";
 import { assertTextChatModelForCompletion, grokHarnessAutoApplyEnabled, isGrokOAuthProvider, selectGrokHarnessSkills, } from "./grok-harness.js";
 import { grokPlaybookAppendForProvider } from "./grok-playbook.js";
+import { loadHookInventory } from "./hook-inventory.js";
 import { captureHostResourceSnapshot } from "./host-resource-snapshot.js";
 import { decideLoadoutAccess } from "./loadout-access-policy.js";
+import { buildCapabilityInventory } from "./loadout-runtime.js";
 import { loadMcpServerConfigs } from "./mcp/config.js";
 import { McpManager } from "./mcp/manager.js";
 import { buildRuntimeProvenance } from "./runtime-provenance.js";
+import { createSubagentLaneAuthority } from "./subagent-lane-authority.js";
 import { TurnMetricsSink } from "./turn-metrics.js";
 /** Values that disable a session-level feature through its environment variable. */
 const DISABLED_ENV_VALUES = new Set(["0", "false", "off", "disable", "disabled"]);
@@ -94,12 +98,12 @@ import { classifyPromptCacheTransition } from "./prompt-cache.js";
 import * as promptSettlement from "./prompt-settlement.js";
 import { expandPromptTemplate } from "./prompt-templates.js";
 import { isQuotaExhaustionMessage, isStickySafetyModel, isUpstreamUnavailableMessage, pickFailoverCandidate, resolveFailoverCandidates, resolveProviderResilience, sameModelRouteCandidates, shouldEjectStickySafetyModel, shouldHonorSafetyFailover, stickySafetyBlockMessage, } from "./provider-resilience.js";
-import { computeRetryDelayMs, failoverModelKey, isFailoverTriggerError, isRetryableAssistantError, nextRetryAttempt, retryBudgetForAssistantError, } from "./provider-retry.js";
+import { computeRetryDelayMs, failoverModelKey, isEmptyStreamedCompletion, isFailoverTriggerError, isRetryableAssistantError, nextRetryAttempt, retryBudgetForAssistantError, } from "./provider-retry.js";
 import { getBiasStepsForCell, parseRouterBiasSnapshot } from "./reasoning-router-bias.js";
 import { classifyTaskV4, deriveRouterFeedbackFeaturesV4, resolveThinkingLevelV4WithUncertainty, TASK_CLASS_THINKING_LEVELS_V4, } from "./reasoning-router-v4.js";
 import { redactSensitiveText, redactSensitiveTextForced } from "./redaction.js";
 import { getRepositoryRouterLearningPaths } from "./repository-learning-scope.js";
-import { decideResourceAdmission } from "./resource-admission.js";
+import { createResourcePressureStabilizer, decideResourceAdmission, evaluateResourcePressure, rederiveResourceAdmissionForPressure, } from "./resource-admission.js";
 import { resolveResourceGovernorSettings } from "./resource-governor-settings.js";
 import { admissionObservationFacts, classificationObservationFacts, ResourceObservationJournal, settledObservationFacts, snapshotObservationFacts, soundObservationFacts, } from "./resource-observation-journal.js";
 import { decideResourceSafetyGate, RESOURCE_PRESSURE_REQUIRED_ACTION } from "./resource-safety-gate.js";
@@ -120,6 +124,7 @@ import { assembleSessionSystemPrompt } from "./session-system-prompt.js";
 import { classifySessionTermination, } from "./session-termination.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
 import { buildSystemPromptPlan } from "./system-prompt.js";
+import { todoControlState } from "./todo-runtime-state.js";
 import { createLocalBashOperations } from "./tools/bash.js";
 import { createAllToolDefinitions } from "./tools/index.js";
 import { createToolDefinitionFromAgentTool } from "./tools/tool-definition-wrapper.js";
@@ -289,6 +294,10 @@ export class AgentSession {
     _resourceObservationJournals = new Map();
     _latestResourcePromptRunId = null;
     _lastResourceAdmission = null;
+    // Per-session pressure hysteresis (audit §16.1): escalation is immediate,
+    // recovery requires consecutive healthier probes so the applied cap does
+    // not flap around a threshold between prompts.
+    _resourcePressureStabilizer;
     _workloadPermitPool;
     _pendingRuntimeTerminationCause;
     _activeRunToolTermination;
@@ -392,6 +401,10 @@ export class AgentSession {
             pendingToolCallIds: () => this.agent.state.pendingToolCalls,
             getUserMessageText: (message) => this._getUserMessageText(message),
             cwd: this._cwd,
+            // Host control authority for preserved provenance: the TODO ledger is
+            // the only production producer today; the service binds its snapshot to
+            // the compaction commit boundary and discards stale summaries.
+            controlState: todoControlState,
             invalidateContextBudget: () => this._invalidateContextBudgetCache({ type: "transcriptRepair" }),
             refreshAgentMessages: () => {
                 this.agent.state.messages = this.sessionManager.buildSessionContext().messages;
@@ -861,8 +874,13 @@ export class AgentSession {
                     this._overflowRecoveryAttempts = 0;
                 }
                 // Reset retry counter immediately on successful assistant response
-                // This prevents accumulation across multiple LLM calls within a turn
-                if (assistantMsg.stopReason !== "error" && this._retryAttempt > 0) {
+                // This prevents accumulation across multiple LLM calls within a turn.
+                // An empty streamed completion wears a success shape (stop=stop, zero
+                // usable output) but is a dead stream — counting it as success reset
+                // the budget every cycle and retried forever (union-alpha relay loop).
+                if (assistantMsg.stopReason !== "error" &&
+                    !isEmptyStreamedCompletion(assistantMsg) &&
+                    this._retryAttempt > 0) {
                     this._emit({
                         type: "auto_retry_end",
                         success: true,
@@ -1371,16 +1389,19 @@ export class AgentSession {
      * Extract the most recent user query text from conversation messages.
      * Returns undefined when no user message exists or content is empty.
      * Handles both string content and multimodal (array) content.
+     *
+     * The scan walks the whole transcript backwards and stops at the first user
+     * message. A fixed tail window cannot work here: tool results are their own
+     * messages, so a single turn that calls two tools already leaves
+     * `[user, assistant, toolResult, toolResult]` and buries the task four deep.
+     * Losing it mid-turn collapses every skill to the neutral relevance score and
+     * degrades ranking to catalogue order, precisely while tools are running and
+     * a matching skill matters most.
      */
     _extractCurrentQuery() {
         const messages = this.messages;
-        if (messages.length === 0) {
-            return undefined;
-        }
-        // Scan recent messages (last 3) for the most recent user message
-        const recent = messages.slice(-3);
-        for (let i = recent.length - 1; i >= 0; i--) {
-            const msg = recent[i];
+        for (let i = messages.length - 1; i >= 0; i--) {
+            const msg = messages[i];
             if (!msg || !("role" in msg) || msg.role !== "user") {
                 continue;
             }
@@ -1576,8 +1597,12 @@ export class AgentSession {
             }
             const snapshot = await captureHostResourceSnapshot(probeOptions);
             const decision = decideResourceAdmission({ snapshot, config: resolved.admission, configuredCaps });
+            const stabilized = this._stabilizeResourcePressure(snapshot, resolved);
+            const appliedDecision = stabilized === decision.pressure
+                ? decision
+                : rederiveResourceAdmissionForPressure(decision, resolved.admission.caps, configuredCaps, stabilized);
             if (this._latestResourcePromptRunId === promptRunId) {
-                this._lastResourceAdmission = decision;
+                this._lastResourceAdmission = appliedDecision;
             }
             resourceObservations?.record("resource_snapshot_v1", snapshotObservationFacts(snapshot));
             resourceObservations?.record("resource_admission_v1", admissionObservationFacts(decision));
@@ -1587,7 +1612,7 @@ export class AgentSession {
                     this.agent.maxToolConcurrency = cap;
                 },
             });
-            const lease = this._resourceLeaseController.acquire({ promptRunId, decision });
+            const lease = this._resourceLeaseController.acquire({ promptRunId, decision: appliedDecision });
             resourceObservations?.record("resource_lease_acquired_v1", {
                 decisionId: decision.decisionId,
                 appliedToolCap: decision.maxToolConcurrency,
@@ -1598,6 +1623,15 @@ export class AgentSession {
             return null;
         }
     }
+    /**
+     * Feed one snapshot's raw pressure through the per-session stabilizer.
+     * Created lazily so sessions that never probe carry no state; the first
+     * observation installs its own level directly (no warmup lag).
+     */
+    _stabilizeResourcePressure(snapshot, resolved) {
+        this._resourcePressureStabilizer ??= createResourcePressureStabilizer();
+        return this._resourcePressureStabilizer.observe(evaluateResourcePressure(snapshot, resolved.admission.thresholds));
+    }
     _openResourceObservations(promptRunId) {
         this._latestResourcePromptRunId = promptRunId;
         try {
@@ -1633,6 +1667,30 @@ export class AgentSession {
     getCurrentResourceAdmission() {
         return this._lastResourceAdmission;
     }
+    /**
+     * Spec 020 Req1 — canonical subagent lane authority bound to this session.
+     * Rebuilt on each call so it tracks the live admission decision, shared
+     * permit pool, and open prompt run. Extension tool contexts read it through
+     * `ctx.getSubagentLaneAuthority()`.
+     */
+    _getSubagentLaneAuthority() {
+        const hookInventory = loadHookInventory(getAgentDir());
+        const sessionView = {
+            _baseToolDefinitions: this._baseToolDefinitions,
+            _extensionRunner: this._extensionRunner,
+            _customTools: this._customTools,
+        };
+        const inventory = buildCapabilityInventory(sessionView, this._resourceLoader, this._cwd, hookInventory);
+        return createSubagentLaneAuthority({
+            runId: this._activeRunId ?? `session-${this.sessionManager.getSessionId() ?? "unknown"}`,
+            promptRunId: this._promptLifecycle.activePromptRunId,
+            decision: this._lastResourceAdmission,
+            permitPool: this.workloadPermitPool,
+            inventory,
+            signal: this.agent?.signal,
+            noteDetachedChild: () => this._promptLifecycle.noteDetachedChild(),
+        });
+    }
     /** §19.4 read-only SDK surface: capture a fresh host resource snapshot. */
     async getHostResourceSnapshot() {
         const resolved = resolveResourceGovernorSettings(this.settingsManager.getResourceGovernorSettings());
@@ -1741,12 +1799,15 @@ export class AgentSession {
         if (this._isRetryableError(msg) && (await this._prepareRetry(msg))) {
             return true;
         }
-        if (msg.stopReason === "error" && this._retryAttempt > 0) {
+        // The retry budget is exhausted without a real answer. This covers the
+        // empty-streamed-completion path whose success-shaped stopReason
+        // otherwise left the UI pinned in the retrying state forever.
+        if (this._retryAttempt > 0) {
             this._emit({
                 type: "auto_retry_end",
                 success: false,
                 attempt: this._retryAttempt,
-                finalError: msg.errorMessage,
+                finalError: msg.errorMessage ?? "The provider returned an empty response.",
             });
             this._retryAttempt = 0;
             this._refusedModels.clear();
@@ -3008,8 +3069,13 @@ export class AgentSession {
     /**
      * Effective context window for the upcoming turn.
      * Image-bearing turns with a text-only session model are auto-routed to the
-     * vision model (gpt-5.6-luna, 1M) — that window is the real limit. Text-only
-     * turns keep the session model's (typically much larger) window.
+     * vision model (gpt-5.6-luna, 1M), so the request has to fit both windows and
+     * the binding limit is the smaller one. Session windows fall on both sides of
+     * 1M: most catalogued models are smaller (median near 300K) and keep their own
+     * window as the limit, while the larger-than-1M models are the ones the clamp
+     * exists for — without it their threshold is computed against a window the
+     * vision route will not honour, and the request overflows before compaction
+     * fires. Text-only turns keep the session model's window untouched.
      */
     _effectiveTurnContextWindow(pendingMessages, sessionWindow) {
         // Vision routing keys off the full transcript, not just the pending turn:
@@ -3246,13 +3312,29 @@ export class AgentSession {
                 details = extensionCompaction.details;
             }
             else {
-                const compactResult = await this._summarizeCompaction({
+                // Summarization can fail in a way no retry fixes (quota). The ladder
+                // tries the live session model, then a deterministic trim, because a
+                // failed compaction over the context window strands the whole run.
+                const signal = this._autoCompactionAbortController.signal;
+                const primaryModel = compactionModel;
+                const compactResult = await summarizeWithFallback({
                     preparation,
-                    model: compactionModel,
-                    apiKey,
-                    headers,
-                    signal: this._autoCompactionAbortController.signal,
-                    reason,
+                    primaryModel,
+                    sessionModel: this.model,
+                    isAborted: () => signal.aborted,
+                    summarize: async (model) => {
+                        const auth = model.provider === primaryModel.provider && model.id === primaryModel.id
+                            ? { apiKey, headers }
+                            : await this._getCompactionRequestAuth(model);
+                        return this._summarizeCompaction({
+                            preparation,
+                            model,
+                            apiKey: auth.apiKey,
+                            headers: auth.headers,
+                            signal,
+                            reason,
+                        });
+                    },
                 });
                 summary = compactResult.summary;
                 firstKeptEntryId = compactResult.firstKeptEntryId;
@@ -3288,16 +3370,25 @@ export class AgentSession {
             // the compaction_end event (so the TUI flushes its queued messages
             // correctly) and the return value below.
             const resumeMessages = this.agent.state.messages;
-            let lastAssistantMsg;
-            for (let i = resumeMessages.length - 1; i >= 0; i--) {
-                const candidate = resumeMessages[i];
-                if (candidate.role === "assistant") {
-                    lastAssistantMsg = candidate;
-                    break;
-                }
-            }
+            const lastAssistantMsg = this._findLastAssistantMessage();
             const endedCleanly = lastAssistantMsg?.stopReason === "stop";
             const willResume = this.agent.hasQueuedMessages() || !endedCleanly;
+            // overflow-retry-guard 배선: 압축 후 재전송 컨텍스트가 창을 확실히 초과하면
+            // 재시도는 프로바이더 왕복만 소모한다 — 정확한 수치 진단과 함께 차단한다.
+            const overflowBlock = willRetry
+                ? overflowRetryBlocked(resumeMessages, this.model?.contextWindow ?? 0)
+                : undefined;
+            if (overflowBlock !== undefined) {
+                this._emit({
+                    type: "compaction_end",
+                    reason,
+                    result,
+                    aborted: false,
+                    willRetry: false,
+                    errorMessage: overflowBlock,
+                });
+                return false;
+            }
             const emitWillRetry = compactionEmitWillRetry(willRetry, willResume);
             this._emit({ type: "compaction_end", reason, result, aborted: false, willRetry: emitWillRetry });
             if (willRetry) {
@@ -3534,6 +3625,10 @@ export class AgentSession {
             },
             getSystemPrompt: () => this.systemPrompt,
             getSystemPromptOptions: () => this._baseSystemPromptOptions,
+            // Spec 020 Req1 — session-bound lane authority for extension tool
+            // contexts (subagent spawn funnel). Rebuilt on demand so it always
+            // sees the live admission decision, permit pool, and prompt run.
+            getSubagentLaneAuthority: () => this._getSubagentLaneAuthority(),
         }, {
             registerProvider: (name, config) => {
                 this._modelRegistry.registerProvider(name, config);
@@ -3965,10 +4060,13 @@ export class AgentSession {
         if (attempt === undefined)
             return false;
         this._retryAttempt = attempt;
-        // Upstream-unavailable (gateway 5xx / dropped stream): rotate to another
-        // authenticated route of the SAME model family so the retry lands on a
-        // live endpoint instead of hammering the dead one.
-        const rotatedTo = isUpstreamUnavailableMessage(message.errorMessage)
+        // Upstream-unavailable (gateway 5xx / dropped stream / dead relay stream):
+        // rotate to another authenticated route of the SAME model family so the
+        // retry lands on a live endpoint instead of hammering the dead one. An
+        // empty streamed completion is the same dead-stream signature wearing a
+        // success stopReason, so it rotates too — otherwise the retry re-hits the
+        // route that just returned nothing.
+        const rotatedTo = isUpstreamUnavailableMessage(message.errorMessage) || isEmptyStreamedCompletion(message)
             ? await this._maybeRotateModelRoutes()
             : undefined;
         // Content/safety stop (Fable/Opus/Sonnet): switch model BEFORE delay so retry is not same-model refusal.