pi-durable-subagents 1.0.7 → 1.0.9

package/dist/orchestrator/executor/index.js

@@ -22,7 +22,7 @@ import { buildCallResult } from "../../compat/result.js";
 import createEffects from "./effects/index.js";
 import { continueSession } from "./generation.js";
 import { hibernation, openQuestion } from "./hibernate.js";
-import { evidence, fatalProviderError, forgetSession, readSessionState, receiptId, sessionModel } from "./session.js";
+import { evidence, fatalProviderError, refusedByProvider, forgetSession, readSessionState, receiptId, sessionModel } from "./session.js";
 import { activeTotal } from "./time.js";
 import { observeExecution } from "./observe.js";
 import { availableMemory } from "./memory.js";
@@ -41,6 +41,39 @@ const entriesFor = (journal, call) => journal.entries().filter(e => e.call === c
 const current = (journal, call) => entriesFor(journal, call).findLast(e => e.type === JT.exec)?.exec;
 const sealed = (journal, call) => entriesFor(journal, call).find(e => e.type === JT.sealed)?.result;
 const has = (journal, type, exec) => journal.entries().some(e => e.type === type && e.exec === exec);
+/** The rid of the model request a follow-up naming a model makes (P12): derived, so withdrawing or replacing the
+ *  follow-up withdraws its model request too. */
+export const modelRid = (rid) => contentHash([rid, "model"]);
+/** The model a call was asked to use and has not used yet: a follow-up's `model`, then each model send in order. One the
+ *  child rejected or that was withdrawn does not count; one already used does not either — the child applied it, or an
+ *  execution of the call answered with it — so the session's model and the pool's fallback rule again after that.
+ *  Its next execution launches on it (P12, P37). */
+export function requestedModel(journal, call, followUp) {
+    const all = journal.entries(), execs = new Set(all.filter(e => e.type === JT.exec && e.call === call).map(e => String(e.exec)));
+    const same = (a, b) => b?.provider === a.provider && b?.id === a.id;
+    const usedAfter = (m, index) => all.some((e, i) => i > index && (e.type === "selected" || e.type === "model-used") && execs.has(String(e.exec)) && same(m, e.model));
+    let wanted;
+    if (followUp) {
+        const m = parseModel(followUp);
+        if (!usedAfter(m, -1))
+            wanted = m;
+    }
+    for (const [index, e] of all.entries()) {
+        if (e.type !== "forward" || e.dest !== call || e.envelope?.kind !== "model")
+            continue;
+        const delivered = all.find(r => r.type === "forward-delivered" && r.call === call && r.rid2 === e.rid2);
+        if (delivered) {
+            wanted = undefined;
+            continue;
+        } // applied by the child (now the session's model) or refused by it
+        if (all.some(r => r.type === "forward" && r.dest === call && r.envelope.kind === "withdraw" && r.envelope.body.rids?.includes(String(e.rid2))))
+            continue;
+        const body = e.envelope.body;
+        const m = { provider: body.provider, id: body.model, ...(body.thinking ? { thinking: body.thinking } : {}) };
+        wanted = usedAfter(m, index) ? undefined : m;
+    }
+    return wanted;
+}
 function address(call) {
     const match = /^(.*)@(\d+)\/(.*)@(\d+)$/.exec(call);
     if (!match)
@@ -261,6 +294,11 @@ export default function createExecutor(ledgers, options = {}) {
         }
     }
     /** P7, P27: Record forward-delivered once when a forward's child receipt is first observed; serial sections only. */
+    /** The reply to a model send says which model and when it applies (orchestrator ledger `send-note`, once per rid). */
+    async function note(rid, model, effect) {
+        if (!orch.entries().some(e => e.type === "send-note" && e.rid === rid))
+            await orch.append("send-note", { rid, model, effect });
+    }
     async function forwardsDelivered(journal, call, entries) {
         const all = journal.entries();
         const open = all.filter(e => e.type === "forward" && e.dest === call &&
@@ -461,6 +499,10 @@ export default function createExecutor(ledgers, options = {}) {
         const candidates = raw ? resolveModel(raw, config.pools) : [{ id: "" }];
         const candidate = recorded && candidates.some(m => m.provider === recorded.provider && m.id === recorded.id);
         const skip = previous && ownSegment && pool && candidate && skipped(pool, recorded);
+        // A model the call was asked to use replaces the session's: launched with it, and holding its provider's slot.
+        const wanted = requestedModel(t.journal, t.callId, t.model);
+        if (wanted && !(recorded && !freshFork && recorded.provider === wanted.provider && recorded.id === wanted.id))
+            return { candidates: [wanted], continuation: false, pool: undefined };
         if (recorded && !freshFork && !skip)
             return { candidates: [recorded], continuation: true, pool: candidate ? pool : undefined };
         return { candidates, continuation: false, pool };
@@ -487,11 +529,26 @@ export default function createExecutor(ledgers, options = {}) {
             }
         });
     }
-    async function switched(exec, event) {
-        const provider = event.message?.provider;
+    /** The model each execution last answered with (`selected`, then `model-used`), cached per execution. */
+    const inUse = new Map();
+    async function switched(exec, journal, event) {
+        const message = event.message, provider = message?.provider;
         if (!provider)
             return;
         await serial(async () => {
+            // Evidence of the model in use: the provider and model of each assistant message, recorded when it changes.
+            if (message.role === "assistant" && message.model) {
+                const name = `${provider}/${message.model}`;
+                if (!inUse.has(exec)) {
+                    const last = journal.entries().findLast(e => (e.type === "selected" || e.type === "model-used") && e.exec === exec)?.model;
+                    if (last)
+                        inUse.set(exec, `${last.provider}/${last.id}`);
+                }
+                if (inUse.get(exec) !== name) {
+                    await journal.append("model-used", { exec, model: { provider, id: message.model } });
+                    inUse.set(exec, name);
+                }
+            }
             const target = holdings().find(h => h.exec === exec && h.pool === provider && h.reserved);
             if (!target)
                 return;
@@ -579,6 +636,9 @@ export default function createExecutor(ledgers, options = {}) {
                         return finish(journal, t.callId, exec, makeResult("unknown", "", `Unknown tool outcomes: ${dangling.join(", ")}`));
                     if (has(journal, "settled", exec) && !ev.text && ev.error && fatalProviderError(ev.error))
                         return finish(journal, t.callId, exec, makeResult("failed", "", `Provider error: ${ev.error}`));
+                    // A refusal of the content is deterministic: the same request is refused again, so it is reported, not retried.
+                    if (has(journal, "settled", exec) && !ev.text && ev.error && refusedByProvider(ev.error))
+                        return finish(journal, t.callId, exec, makeResult("failed", "", `Refused by the provider (not retried): ${ev.error.slice(0, 500)}`));
                     await serial(async () => {
                         if (!has(journal, "loss", exec))
                             await journal.append("loss", { exec });
@@ -679,7 +739,7 @@ export default function createExecutor(ledgers, options = {}) {
                             }
                         });
                     }, recordUsage: values => recordUsage(t, values),
-                    switched: event => switched(exec, event), pendingSwitch: () => pendingSwitch(exec),
+                    switched: event => switched(exec, journal, event), pendingSwitch: () => pendingSwitch(exec),
                 });
             }
             finally {
@@ -716,6 +776,9 @@ export default function createExecutor(ledgers, options = {}) {
                 finally {
                     active.delete(ticket.callId);
                     collected.delete(ticket.callId);
+                    for (const e of inUse.keys())
+                        if (callOf(e) === ticket.callId)
+                            inUse.delete(e);
                     forgetSession(callSession(home, ticket.wid, ticket.key, ticket.gen));
                     wake();
                 }
@@ -763,28 +826,70 @@ export default function createExecutor(ledgers, options = {}) {
                         return { action: "apply" };
                     }
                 }
+                /** P12: a model request to this call, recorded with the rid given; a reject has no effect. */
+                const requestModel = async (rid, model, hash, cond) => {
+                    let body;
+                    try {
+                        const m = parseModel(model);
+                        if (!m.provider)
+                            throw new Error("Missing provider");
+                        body = { provider: m.provider, model: m.id, ...(m.thinking ? { thinking: m.thinking } : {}) };
+                    }
+                    catch {
+                        return { action: "reject", reason: "unknown-model" };
+                    }
+                    const envelope = { to: dest, kind: "model", body, ...(cond && Object.keys(cond).length ? { cond } : {}) };
+                    const rid2 = forwardRid(rid, ctx.widRev, ctx.key, hash);
+                    const exec = current(ctx.journal, dest), provider = body.provider;
+                    // P28: with no live execution (not started yet, between executions, hibernated while asking) the model is
+                    // recorded and the next execution launches on it (`requestedModel`); its slot is acquired then, as for any launch.
+                    // Launching (`selected`, not `tracked` yet): the child may start on the old model; ask again in a moment.
+                    const idle = !exec || has(ctx.journal, JT.fenced, exec) || !has(ctx.journal, "selected", exec);
+                    if (!idle && !has(ctx.journal, "tracked", exec))
+                        return { action: "reject", reason: "call-starting" };
+                    if (!idle && pendingSwitch(exec))
+                        return { action: "reject", reason: "switch-pending" };
+                    if (!idle) {
+                        const held = holdings().filter(h => h.exec === exec);
+                        if (!held.some(h => h.pool === provider)) {
+                            const target = holdings().filter(h => h.pool === provider);
+                            if (!capacity({ kind: "provider", holders: target.length, capacity: config.providers?.[provider]?.slots ?? Infinity }))
+                                return { action: "reject", reason: "provider-full" };
+                            let slot = 0;
+                            while (target.some(h => h.slot === slot))
+                                slot++;
+                            await orch.append("hold", { pool: provider, slot, exec, reserved: true, rid });
+                        }
+                    }
+                    await note(req.rid, model, idle ? "next-execution" : "next-request");
+                    const entry = await ctx.journal.append("forward", { rid, rid2, dest, hash, envelope });
+                    await replayForward(entry);
+                    if (idle) {
+                        active.get(dest)?.wake();
+                        wake();
+                    }
+                    return undefined;
+                };
                 let kind, body;
+                if (req.kind === "send" && req.body.kind === "follow-up" && req.body.model !== undefined) {
+                    // A follow-up naming a model, queued on unfinished work: the model request and the message are recorded in one
+                    // section, so a seal cannot come between them (both or neither). A replay finds the model request recorded.
+                    const mrid = modelRid(req.rid);
+                    if (!ctx.journal.entries().some(e => e.type === "forward" && e.rid === mrid && e.dest === dest)) {
+                        const refused = await requestModel(mrid, req.body.model, contentHash([hash, "model"]));
+                        if (refused)
+                            return { action: "reject", reason: `model: ${refused.reason}` };
+                    }
+                }
                 if (req.kind === "withdraw") {
                     kind = "withdraw";
-                    const targets = req.body.rids;
+                    const targets = req.body.rids.flatMap(rid => [rid, modelRid(rid)]);
                     body = { rids: ctx.journal.entries().filter(e => e.type === "forward" && e.dest === dest && targets.includes(String(e.rid))).map(e => String(e.rid2)) };
                 }
                 else if (req.kind === "send") {
                     const send = req.body;
                     kind = send.kind;
-                    if (kind === "model") {
-                        try {
-                            const m = parseModel(send.model ?? "");
-                            if (!m.provider)
-                                throw new Error("Missing provider");
-                            body = { provider: m.provider, model: m.id, ...(m.thinking ? { thinking: m.thinking } : {}) };
-                        }
-                        catch {
-                            return { action: "reject", reason: "unknown-model" };
-                        }
-                    }
-                    else
-                        body = { message: send.message ?? "" };
+                    body = kind === "model" ? undefined : { message: send.message ?? "" };
                 }
                 else
                     return { action: "reject", reason: "unsupported" };
@@ -797,30 +902,15 @@ export default function createExecutor(ledgers, options = {}) {
                     else
                         delete cond.after;
                 }
+                if (kind === "model")
+                    return (await requestModel(req.rid, req.body.model ?? "", hash, cond)) ?? { action: "apply" };
                 const envelope = { to: dest, kind, body, ...(Object.keys(cond).length ? { cond } : {}) };
                 const rid2 = forwardRid(req.rid, ctx.widRev, ctx.key, hash);
-                if (kind === "model") {
-                    const exec = current(ctx.journal, dest), provider = body.provider;
-                    if (!exec || has(ctx.journal, JT.fenced, exec) || !has(ctx.journal, "tracked", exec))
-                        return { action: "reject", reason: "call-not-running" };
-                    if (pendingSwitch(exec))
-                        return { action: "reject", reason: "switch-pending" };
-                    const held = holdings().filter(h => h.exec === exec);
-                    if (!held.some(h => h.pool === provider)) {
-                        const target = holdings().filter(h => h.pool === provider);
-                        if (!capacity({ kind: "provider", holders: target.length, capacity: config.providers?.[provider]?.slots ?? Infinity }))
-                            return { action: "reject", reason: "provider-full" };
-                        let slot = 0;
-                        while (target.some(h => h.slot === slot))
-                            slot++;
-                        await orch.append("hold", { pool: provider, slot, exec, reserved: true, rid: req.rid });
-                    }
-                }
                 const entry = await ctx.journal.append("forward", { rid: req.rid, rid2, dest, hash, envelope });
                 await replayForward(entry);
                 if (kind === "withdraw") {
                     const exec = current(ctx.journal, dest), reservation = exec && pendingSwitch(exec);
-                    if (reservation && req.body.rids.includes(String(reservation.rid)))
+                    if (reservation && req.body.rids.some(rid => rid === reservation.rid || modelRid(rid) === reservation.rid))
                         active.get(dest)?.wake();
                 }
                 return { action: "apply" };

package/dist/orchestrator/executor/session.js

@@ -111,6 +111,14 @@ export function evidence(entries, exec) {
 export function fatalProviderError(text) {
     return /\b402\b|insufficient[_ ]?(quota|balance|funds)|quota (exceeded|exhausted)|billing|credit balance|额度|余额|usage limit/i.test(text);
 }
+/** A refusal of the request's content (terms of service, usage or content policy): the same request is refused again,
+ *  on this provider and usually on another, so it is reported at once instead of retried as a lost execution. */
+export function refusedByProvider(text) {
+    // A content filter that is down ("temporarily unavailable, please retry") is a transient failure, not a refusal.
+    if (/temporar|unavailable|try again|retry|timed? ?out|overloaded/i.test(text))
+        return false;
+    return /terms of service|usage polic(y|ies)|acceptable use|content[_ ]?(policy|filter|management policy)|safety (system|filter)|flagged as (unsafe|harmful)/i.test(text);
+}
 /** P13, C8: Restore the effective provider from the native session's model changes. */
 export function sessionModel(entries) {
     const last = entries.findLast(e => e.type === "model_change" && e.provider && e.modelId);

package/dist/orchestrator/main.js

@@ -14,7 +14,7 @@ import { dsaHome, orchLedger, orchLock } from "../paths.js";
 import { openJournal } from "../kernel/journal.js";
 import { OsLock } from "../platform/lock.js";
 import { Engine } from "./engine.js";
-import { configPath, configProblem, configStamp, readConfig, recordConfig, watchConfig } from "./config.js";
+import { configPath, configProblem, configStamp, recordConfig, stampedConfig, watchConfig } from "./config.js";
 /** P2, C4, K6: Acquire the single authority before opening ledgers, recover, and idle-exit. */
 export async function main(options = {}) {
     const home = options.home ?? dsaHome();
@@ -26,9 +26,10 @@ export async function main(options = {}) {
     try {
         let config = options.config, stamp;
         if (!config) {
-            // The stamp is taken before the read: a change made while reading is applied by the first check.
+            // One read gives both the version and the settings: with two, a file changed and changed back in between kept
+            // the second version in effect while the watcher saw no change.
             stamp = await configStamp(configPath(home));
-            const raw = await readConfig(configPath(home));
+            const raw = stampedConfig(stamp);
             const problem = configProblem(raw);
             if (problem)
                 console.error(`durable-subagents: config.json: ${problem}`);