pi-durable-subagents 1.0.25 → 1.0.27

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 1.0.27
+
+- `hold --no-wait` (or `--max-wait 0`) takes the lease at once or exits 75
+  without ever being queued: the decision is made under the resource's lock
+  and a refused request writes nothing, so `leases`, `status` and other
+  waiters never see it. Before, `--max-wait 0` queued a ticket, checked, and
+  removed it. A no-wait request also no longer ends processes left by a
+  killed holder (a queued waiter still does); it is refused while they remain.
+- Release check: `pack:smoke` waits for its orchestrator to exit before
+  removing its temporary directory, and a failed removal is a warning. The
+  1.0.26 release stopped at this step on macOS (`ENOTEMPTY` after
+  `pack-smoke ok`), so 1.0.26 was never published; 1.0.27 includes its
+  changes.
+
+## 1.0.26
+
+- A daily quota message in Chinese ("remaining quota is 0, resets at 00:00 the
+  next day") is a used-up usage window: a pool call moves to its next candidate
+  and a single-model call waits, instead of failing at once as a balance error
+  (the word for "balance" occurs inside "remaining quota"). Checked against the 7,941 provider errors
+  recorded on a working machine: this was the only usage-window text misread,
+  and no rate limit or transient error is read as one.
+- `answered.by` is `call:<wid>/<key>` for a subagent answering through the CLI
+  (the CLI now sends its `DSA_CALL` as `caller`). The caller is provenance and
+  not part of `spec_digest`: retrying a request id with or without it is the
+  same request. A pi session still running an older extension computes the
+  digest with the caller included and would see such a retry as a conflict.
+- Tests: an end-to-end pool failover through the CLI and a detached
+  orchestrator; the effects fixtures use a unique workflow id, since gate
+  processes are found by tag across the whole machine and parallel test files
+  shared one; the CI runner also reruns files reported in nested tests.
+
 ## 1.0.25
 
 - `restart` refusals show what a fence would cut short: each lease a running

package/README.md

@@ -55,7 +55,7 @@ the npx cache, so `install-service` refuses to run from there.
 | You steer a subagent while it is asking you a question | Your message reaches it, in order. Nothing is rejected or lost. |
 | Two steers arrive out of order and the second replaces the first | Only the second one applies. |
 | A step is refused, or a dependency fails | The workflow stops that branch cleanly. Nothing is retried in vain. |
-| A provider's usage window runs out (`No available accounts`, usage limit, quota exceeded) | Found at the second refusal in a row, while pi is still retrying. A call in a pool continues **in the same session** on the pool's next model (within pi's next retry or two); new calls skip that provider. After 15 minutes the next call that wants it tries it once; when it answers, new calls and new generations use it again. A call with a single model waits for it instead of failing. Billing errors (402, insufficient balance) still fail at once. |
+| A provider's usage window runs out (`No available accounts`, usage limit, quota exceeded, a daily quota at 0) | Found at the second refusal in a row, while pi is still retrying. A call in a pool continues **in the same session** on the pool's next model (within pi's next retry or two); new calls skip that provider. After 15 minutes the next call that wants it tries it once; when it answers, new calls and new generations use it again. A call with a single model waits for it instead of failing. Billing errors (402, insufficient balance) still fail at once. |
 | Two subagents would write in the same worktree | Only one runs there at a time. A call that can write (its tools include `edit` or `write`, which pi's default tools do) holds its git worktree's writer lock from its launch until it ends, also while it waits for an answer. Another writer for that worktree waits in order, and status shows `waiting for writer lock: <root> held by <wid>/<key>`. `writer: false` (a call that does not write there), `isolation: "worktree"` and `"writerLock": "off"` opt out. |
 | A subagent waits for an answer for a long time | It releases its model slot and memory, then resumes exactly once when you answer. The question survives orchestrator restarts (also forced ones) and crashes, including one that hits before the subagent released its slot. |
 | A subagent's work ends (finished, stopped, or cut off) | Every process its tools started ends with that execution, also ones started with `nohup`, `setsid` or `&`: they carry the execution's tag (see the limit below). Anything that must outlive the subagent has to be started by you or the parent session. A command run under `hold` is no exception: a forced restart stops it and its lease is released. |
@@ -254,7 +254,7 @@ pi-durable-subagents stop-all           pause every existing workflow now; journ
 pi-durable-subagents prune [wid] [--older-than <days>]
                                         delete finished workflows (done, failed, stopped); prints count and bytes freed
 pi-durable-subagents restart [--force <token> --reason <text>]  switch to the installed version (see "Updating Durable Subagents")
-pi-durable-subagents hold <resource> [--shared] [--max-wait <s>] [--note <text>] -- <command…>
+pi-durable-subagents hold <resource> [--shared] [--max-wait <s> | --no-wait] [--note <text>] -- <command…>
                                         run one command while holding a resource lease (see below)
 pi-durable-subagents leases [--json]    who holds and who waits for each resource
 pi-durable-subagents doctor [--json]    read-only health check; exits 1 when something needs you
@@ -361,9 +361,9 @@ Every event has `id`, `cursor`, `ts` (when the milestone happened), `type`,
 
 Readers must ignore types they do not know (`waiting`/`moving` follow).
 `by` is the sender of the answer: `session:<id>` for a pi session (with
-`via: "ui"` when it came from the subagent list), `cli:<user>@<host>` for the
-CLI (a subagent answering through the CLI also shows as `cli:…`), else
-`unknown`. `fenced` is emitted when the call's next execution begins (right
+`via: "ui"` when it came from the subagent list), `call:<wid>/<key>` for a
+subagent answering through the CLI (its `DSA_CALL`; provenance, not
+authority), `cli:<user>@<host>` for any other CLI use, else `unknown`. `fenced` is emitted when the call's next execution begins (right
 after recovery, before it waits for a slot) and only when the fence
 interrupted work, exactly as `describe`'s `lastFence`: a turn that had ended,
 a hibernated question, an answer's resume or a seal are no `fenced`. A `once`
@@ -473,6 +473,14 @@ pi-durable-subagents hold machine --max-wait 600 --note "profile" -- ./measure.s
   everything before it, and keeps later shared requests out (no starvation).
   A waiting `hold` prints who holds the resource; `--max-wait` gives up with
   exit 75 without running the command.
+- `--no-wait` (same as `--max-wait 0`) takes the lease now or not at all.
+  It decides under the resource's lock. If it can run now, its request is
+  written already granted. Otherwise nothing is written, and it exits 75
+  naming who holds or waits, without running the command. It is never
+  listed as a waiter, even for a moment, so it can probe a resource whose
+  owner treats any queued request as interference. It also leaves the
+  resource alone: unlike a queued waiter, it does not end processes left
+  by a holder whose `hold` was killed, and is refused while they remain.
 - The command runs without a shell (write `-- sh -c '…'` for one) in its
   own process group; signals to `hold` go to it and its exit status is
   returned. When it exits, whatever it left in its process group is ended
@@ -514,7 +522,8 @@ State lives in `~/.pi/durable-subagents`; set `DSA_HOME` to move it.
 }
 ```
 
-- **Pools:** a model can name a pool. The first candidate with a free slot is
+- **Pools:** a model can name a pool (the `model` of a call, a `run --spec`
+  file or a model send). The first candidate with a free slot is
   used, and a candidate that keeps failing is skipped for 10 minutes. The
   order is the preference: list the provider you want to use first.
 - **A used-up provider** is not sent new calls until its next try, 15 minutes

package/dist/cli/hold.js

@@ -1,13 +1,14 @@
 // `pi-durable-subagents hold <resource> [--shared] [--max-wait <s>] [--note <text>] -- <command> [args…]`
 // Waits for the lease (strict FIFO), runs the command in its own process group, ends what the command left in that
-// group, then releases. See src/platform/lease.ts for the ticket protocol.
+// group, then releases. `--max-wait 0` (or `--no-wait`) takes the lease at once or exits 75 without ever being queued.
+// See src/platform/lease.ts for the ticket protocol.
 import { spawn } from "node:child_process";
 import { watch } from "node:fs";
 import { constants } from "node:os";
 import { dsaHome } from "../paths.js";
 import { captureStart } from "../platform/proctable.js";
-import { blockers, enqueue, groupAlive, leaseDir, liveTickets, orphaned, removeTicket, RESOURCE, who, writeTicket } from "../platform/lease.js";
-export const HOLD_USAGE = "usage: pi-durable-subagents hold <resource> [--shared] [--max-wait <seconds>] [--note <text>] -- <command> [args…]";
+import { blockers, enqueue, groupAlive, tryGrant, leaseDir, liveTickets, orphaned, removeTicket, RESOURCE, who, writeTicket } from "../platform/lease.js";
+export const HOLD_USAGE = "usage: pi-durable-subagents hold <resource> [--shared] [--max-wait <seconds> | --no-wait] [--note <text>] -- <command> [args…]";
 /** Exit status when --max-wait expires before the lease is granted (EX_TEMPFAIL). */
 export const WAIT_EXPIRED = 75;
 export function parseHold(args) {
@@ -20,6 +21,8 @@ export function parseHold(args) {
         const a = opts[i];
         if (a === "--shared")
             mode = "shared";
+        else if (a === "--no-wait")
+            maxWaitMs = 0;
         else if (a === "--max-wait" || a === "--note") {
             const v = opts[++i];
             if (v === undefined)
@@ -54,13 +57,21 @@ const SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 export async function hold(args, options = {}) {
     const env = options.env ?? process.env, home = dsaHome(env), say = options.stderr ?? (l => process.stderr.write(`${l}\n`));
     const pollMs = options.pollMs ?? 250, graceMs = options.graceMs ?? 2000;
-    const ticket = await enqueue(home, {
+    const request = {
         resource: args.resource, mode: args.mode,
         wrapper: { pid: process.pid, start: (await captureStart(process.pid)) || undefined },
         argv: args.argv.map(a => a.length > 200 ? `${a.slice(0, 199)}…` : a).slice(0, 32), cwd: process.cwd(),
         ...(args.note ? { note: args.note.slice(0, 300) } : {}), since: Date.now(),
         ...(env.DSA_EXEC ? { exec: env.DSA_EXEC } : {}), ...(env.DSA_CALL ? { call: env.DSA_CALL } : {}),
-    });
+    };
+    // No wait: granted now, or refused without a ticket — never listed as a waiter, even for a moment.
+    const granted = args.maxWaitMs === 0 ? await tryGrant(home, request) : undefined;
+    if (granted && "busy" in granted) {
+        const now = Date.now(), by = granted.busy.map(t => `${who(t)} (${t.mode}${t.grantedAt === undefined ? ", waiting" : ""}, ${age(now - (t.grantedAt ?? t.since))})`).join(", ");
+        say(`hold: ${args.resource} is not free now (${by}); not running the command (exit ${WAIT_EXPIRED})`);
+        return WAIT_EXPIRED;
+    }
+    const ticket = granted ?? await enqueue(home, request);
     // Signals: while waiting they withdraw the request; while the command runs they go to its process group.
     let child, interrupted, wake = () => { };
     const onSignal = (signal) => {
@@ -125,7 +136,7 @@ export async function hold(args, options = {}) {
         }
         watcher?.close();
         watcher = undefined;
-        ticket.grantedAt = Date.now();
+        ticket.grantedAt ??= Date.now();
         await writeTicket(home, ticket);
         if (interrupted) {
             removeTicket(home, ticket);

package/dist/cli/main.js

@@ -132,7 +132,7 @@ export function serviceEntryError(entry) {
         return `install-service refuses to run from an npx cache (${entry}); the cache can be pruned and the service would break. Install the CLI with \`npm i -g pi-durable-subagents\` and run \`pi-durable-subagents install-service\` again.`;
     return undefined;
 }
-export const HELP = "pi-durable-subagents: smoke | status [wid] [--json] | events <wid> [--json] | events --all [--since <cursor>] [--limit <n>] [--json] [--wait-ms <n>] | tail [wid] [--json] | start | resume [wid] | drain | stop <wid|callId> | stop-all | run --request <id> --spec <file|-> [--labels <json>] [--cwd <dir>] [--json] [--wait-ms <n>] | send --request <id> --to <run-id|wid/key> [--call <key>] --kind follow-up|answer|steer|model [--qid <qid> --rev <n>] [--message <text|@file>] [--model <m>] [--json] [--wait-ms <n>] | stop --request <id> <run-id|wid|wid/key> [--json] [--wait-ms <n>] | describe --key <id> | describe <wid> [--json] | prune [wid] [--older-than <days>] | restart [--force <token> --reason <text>] | hold <resource> [--shared] [--max-wait <s>] [--note <text>] -- <command…> | leases [--json] | doctor [--json] | install-service [--dry-run] | uninstall-service [--dry-run] | chaos [--scenario <1-9>] [--keep] [--json]";
+export const HELP = "pi-durable-subagents: smoke | status [wid] [--json] | events <wid> [--json] | events --all [--since <cursor>] [--limit <n>] [--json] [--wait-ms <n>] | tail [wid] [--json] | start | resume [wid] | drain | stop <wid|callId> | stop-all | run --request <id> --spec <file|-> [--labels <json>] [--cwd <dir>] [--json] [--wait-ms <n>] | send --request <id> --to <run-id|wid/key> [--call <key>] --kind follow-up|answer|steer|model [--qid <qid> --rev <n>] [--message <text|@file>] [--model <m>] [--json] [--wait-ms <n>] | stop --request <id> <run-id|wid|wid/key> [--json] [--wait-ms <n>] | describe --key <id> | describe <wid> [--json] | prune [wid] [--older-than <days>] | restart [--force <token> --reason <text>] | hold <resource> [--shared] [--max-wait <s> | --no-wait] [--note <text>] -- <command…> | leases [--json] | doctor [--json] | install-service [--dry-run] | uninstall-service [--dry-run] | chaos [--scenario <1-9>] [--keep] [--json]";
 /** Restart: the orchestrator exits when no execution runs (or `force`) and the installed version takes over. */
 async function restartCommand(home, env, write, options) {
     const body = { ...(typeof options.force === "string" ? { token: options.force } : options.force === true ? { force: true } : {}), ...(options.reason !== undefined ? { reason: options.reason } : {}), initiator: cliInitiator(env) };

package/dist/cli/requests.js

@@ -373,7 +373,9 @@ async function sendRequest(args, ctx, seen) {
     const normalized = request({ action: "send", to: where.to, kind, ...(message !== undefined ? { message } : {}), ...(text(values, "model") !== undefined ? { model: text(values, "model") } : {}),
         ...(qid !== undefined ? { qid } : {}), ...(revision !== undefined ? { rev: revision } : {}) }, ctx.cwd ?? process.cwd());
     seen.digest = specDigest({ kind: "send", body: normalized.body, cond: normalized.cond });
-    const done = await submitAndWait(ctx, seen, id, "send", normalized.body, normalized.cond, wait, json);
+    // Inside a subagent the CLI names its call (provenance for `answered.by`; spec_digest ignores it).
+    const body = ctx.env.DSA_CALL ? { ...normalized.body, caller: ctx.env.DSA_CALL } : normalized.body;
+    const done = await submitAndWait(ctx, seen, id, "send", body, normalized.cond, wait, json);
     if ("code" in done)
         return done.code;
     return decided(ctx, id, done, json);

package/dist/events/derive.js

@@ -23,11 +23,15 @@ export function labelsOf(body) {
     return entries.length && entries.every(([, v]) => typeof v === "string") ? Object.fromEntries(entries) : undefined;
 }
 /** `answered.by` from the answer request's sender: a pi session `main:<id>` → `session:<id>` (+ via "ui" when the
- *  subagent list sent it, SendBody.by "user"); the CLI sender `cli:<user>@<host>` as is; anything else `unknown`. */
+ *  subagent list sent it, SendBody.by "user"); the CLI run inside a subagent (SendBody.caller `<wid>@<rev>/<key>@<gen>`)
+ *  → `call:<wid>/<key>`; any other CLI sender `cli:<user>@<host>` as is; anything else `unknown`. */
 export function answeredBy(req) {
-    const from = req?.from ?? "";
+    const from = req?.from ?? "", body = req?.body;
     if (from.startsWith("main:"))
-        return { by: `session:${from.slice(5)}`, ...(req.body?.by === "user" ? { via: "ui" } : {}) };
+        return { by: `session:${from.slice(5)}`, ...(body?.by === "user" ? { via: "ui" } : {}) };
+    const caller = typeof body?.caller === "string" ? /^([^/@]+)@\d+\/(.+)@\d+$/.exec(body.caller) : null;
+    if (from.startsWith("cli:") && caller)
+        return { by: `call:${caller[1]}/${caller[2]}` };
     if (/^cli:[^@]+@.+$/.test(from))
         return { by: from };
     return { by: "unknown" };

package/dist/orchestrator/executor/session.js

@@ -136,7 +136,9 @@ export function evidence(entries, exec) {
 /** Only explicit payment failures are terminal; rate limits, overload and transport errors still retry, and a used-up
  *  usage window (`quotaExhausted`) waits for the provider or moves to another one. */
 export function fatalProviderError(text) {
-    return /\b402\b|insufficient[_ ]?(quota|balance|funds)|billing|credit balance|余额/i.test(text);
+    // Chinese "balance", but not inside "remaining quota": "remaining quota is 0, resets at 00:00 the next day" is a daily
+    // window. CJK text is written as \u escapes (the repository is ASCII-only English).
+    return /\b402\b|insufficient[_ ]?(quota|balance|funds)|billing|credit balance|(?<!\u5269)\u4f59\u989d/i.test(text);
 }
 /** A provider's usage window is used up: its requests are refused (and not counted) until the window resets, hours
  *  later. Seen as a gateway's `503 No available accounts` once pi's own retries are spent, or a usage-limit message.
@@ -150,7 +152,7 @@ export function quotaExhausted(text) {
     // per minute"): pi's retries and the lost-execution path handle it; it must not take the provider out for minutes.
     if (/rate.?limit|too many requests|request limit|per (second|minute)|\b[RT]PM\b|resets? in \d+ ?(ms|s|secs?|seconds?|minutes?)\b/i.test(text))
         return false;
-    return /usage limit|quota (exceeded|exhausted)|exceeded your (current )?(usage|quota)|limit (reached|exceeded)[^.]*resets?\b|额度/i.test(text);
+    return /usage limit|quota (exceeded|exhausted)|exceeded your (current )?(usage|quota)|limit (reached|exceeded)[^.]*resets?\b|\u989d\u5ea6/i.test(text);
 }
 /** A refusal of the request's content (terms of service, usage or content policy): the same request is refused again,
  *  on this provider and usually on another, so it is reported at once instead of retried as a lost execution. */

package/dist/platform/lease.js

@@ -159,6 +159,16 @@ export function removeTicket(home, t) {
 /** Queue a request: number it under the resource's kernel lock and write its ticket before the lock is released, so a
  *  later request always sees it. */
 export async function enqueue(home, ticket, lock = new OsLock()) {
+    return (await numbered(home, ticket, false, lock));
+}
+/** Take the lease now or not at all (`hold --max-wait 0`): under the resource's kernel lock, either no live ticket
+ *  blocks it and its ticket is written already granted, or nothing is written and the blockers are returned. A refused
+ *  request is never visible as a waiter, and a granted one never was one. Granting needs no more than the lock: a later
+ *  request gets a higher number and waits behind this ticket, and earlier tickets can only disappear. */
+export async function tryGrant(home, ticket, lock = new OsLock()) {
+    return numbered(home, ticket, true, lock);
+}
+async function numbered(home, ticket, now, lock) {
     const dir = leaseDir(home, ticket.resource);
     mkdirSync(dir, { recursive: true });
     let handle = await lock.tryAcquire(path.join(dir, ".lock"));
@@ -171,6 +181,12 @@ export async function enqueue(home, ticket, lock = new OsLock()) {
         const last = Number.parseInt(await readFile(counter, "utf8").catch(() => "0"), 10) || 0;
         const highest = readTickets(home, ticket.resource).reduce((m, t) => Math.max(m, t.seq), last);
         const t = { ...ticket, seq: highest + 1 };
+        if (now) {
+            const busy = blockers(t, liveTickets(home, ticket.resource));
+            if (busy.length)
+                return { busy };
+            t.grantedAt = Date.now();
+        }
         await writeFile(`${counter}.tmp`, String(t.seq));
         renameSync(`${counter}.tmp`, counter);
         writeTicketSync(home, t);

package/dist/requests.js

@@ -29,6 +29,10 @@ export function specDigest(req) {
         const { origin: _, ...rest } = body;
         body = rest;
     }
+    if (req.kind === 'send' && body && typeof body === 'object' && !Array.isArray(body)) {
+        const { caller: _, ...rest } = body;
+        body = rest;
+    }
     return contentHash({ kind: req.kind, body, cond: req.cond });
 }
 /** The envelope recorded for `rid`: the orchestrator's admitted copy (ledger `request`, kept after prune), else any

package/dist/ui/session.js

@@ -86,8 +86,8 @@ export function thoughtSummary(text) {
         return (headings.at(-1)[1] ?? headings.at(-1)[2]).trim();
     return lastSentence(text);
 }
-const STOPS = new Set([...".!?。！？"]);
-/** The last match of /[^.!?。！？]+[.!?。！？](?=\s|$)/gu without the regex: a long thought with no sentence end made
+const STOPS = new Set([...".!?\u3002\uff01\uff1f"]);
+/** The last match of /[^.!?\u3002\uff01\uff1f]+[.!?\u3002\uff01\uff1f](?=\s|$)/gu without the regex: a long thought with no sentence end made
  *  that regex retry from every position (quadratic), which stalled pi's startup on long histories. Such a match is a
  *  whole run of non-stop characters followed by one stop that ends the text or precedes whitespace. */
 function lastSentence(text) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-durable-subagents",
-  "version": "1.0.25",
+  "version": "1.0.27",
   "description": "Subagents for pi that never lose work and never do it twice. Crash-safe workflows, automatic recovery, and a live view just like the main agent.",
   "type": "module",
   "license": "MIT",