scalix 1.5.1 → 1.6.0

package/dist/api-client.js

@@ -12,6 +12,62 @@ export class ApiError extends Error {
         this.retryAfterMs = retryAfterMs;
     }
 }
+// ─── Request body guards ───
+// Two confirmed ways a request dies with the gateway's generic
+// "invalid JSON body" (400) before the model ever sees it:
+//
+// 1. A body over the wall. The gateway and the proxies in front of it
+//    refuse bodies past ~200KB — measured 192KB passing and 256KB
+//    failing — and the refusal is "invalid JSON body", not 413, which
+//    reads like a truncated stream. A single tool result is allowed to
+//    reach 500K chars, so one fat command output is enough to cross it.
+//
+// 2. A lone surrogate escape. JSON.stringify serializes half of a cut
+//    surrogate pair as \ud83d. JavaScript's JSON.parse accepts that;
+//    strict parsers (serde_json, Go's encoding/json) reject it. undici
+//    would silently map it to U+FFFD on the wire anyway, so the model
+//    never saw the half a character either.
+//
+// Both are fixed here rather than at every truncation site: the body
+// is sanitized, and tool results are shrunk until the request fits.
+const MAX_BODY_BYTES = 180_000;
+function utf8ByteLength(s) {
+    if (typeof Buffer !== 'undefined')
+        return Buffer.byteLength(s, 'utf8');
+    return new TextEncoder().encode(s).length;
+}
+function sanitizeLoneSurrogates(body) {
+    return body.replace(/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g, '\uFFFD');
+}
+/** Cut tool-result contents, largest first, until the serialized
+ *  request fits. Tool results are the bulk of an oversized request,
+ *  and trimming their text keeps tool_call/result pairing intact —
+ *  dropping whole messages would break the pairing the wire requires.
+ *  Rounds, not one pass: a single command output can be many times
+ *  the wall, so the largest result is re-halved until the check
+ *  converges. */
+function shrinkToFit(req, maxBytes) {
+    let out = req;
+    for (;;) {
+        if (utf8ByteLength(JSON.stringify(out)) <= maxBytes)
+            return out;
+        const biggest = out.messages
+            .map((m, i) => ({ m, i }))
+            .filter(({ m }) => m.role === 'tool' && typeof m.content === 'string' && m.content.length > 400)
+            .sort((a, b) => b.m.content.length - a.m.content.length)[0];
+        // Nothing left worth cutting — the request is over for a reason
+        // this pass cannot fix, so send what remains.
+        if (!biggest)
+            return out;
+        const text = biggest.m.content;
+        const messages = [...out.messages];
+        messages[biggest.i] = {
+            ...biggest.m,
+            content: text.slice(0, Math.max(200, Math.floor(text.length / 2))) + '\n...[trimmed so the request fits the endpoint]',
+        };
+        out = { ...out, messages };
+    }
+}
 /**
  * Parse a Retry-After header value into milliseconds. Accepts both forms from
  * RFC 9110: delta-seconds ("120") and HTTP-date. Returns undefined for absent
@@ -31,7 +87,9 @@ export function parseRetryAfter(value) {
 // Per-request abort. 300s matches the platform's own proxy walls; the old
 // 120s default aborted the client before a slow first token could arrive on
 // CPU-served models (the request was fine, we hung up on it). For reference,
-// the OpenAI and Anthropic SDKs both default to 600s.
+// the OpenAI and Anthropic SDKs both default to 600s. The default applies
+// when SCALIX_REQUEST_TIMEOUT_MS is unset — 0 would mean "no timeout", which
+// lets a wedged connection hang the turn forever.
 const DEFAULT_TIMEOUT_MS = (() => {
     const v = process.env.SCALIX_REQUEST_TIMEOUT_MS;
     const n = v ? parseInt(v, 10) : NaN;
@@ -123,9 +181,10 @@ export class ScalixClient {
         // as many times as there are narrowings left.
         for (;;) {
             const prepared = this.prepareRequest(req);
-            const body = JSON.stringify(prepared);
-            const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
-            const combined = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+            const wire = shrinkToFit(prepared, MAX_BODY_BYTES);
+            const body = sanitizeLoneSurrogates(JSON.stringify(wire));
+            const timeoutSignal = this.timeoutMs > 0 ? AbortSignal.timeout(this.timeoutMs) : undefined;
+            const combined = signal && timeoutSignal ? AbortSignal.any([signal, timeoutSignal]) : (signal || timeoutSignal);
             const response = await fetch(url, {
                 method: 'POST',
                 headers: {
@@ -135,7 +194,7 @@ export class ScalixClient {
                     'x-client-type': 'cli',
                 },
                 body,
-                signal: combined,
+                signal: combined || undefined,
             });
             if (!response.ok) {
                 const text = await response.text().catch(() => '');

package/dist/board-context.js

@@ -0,0 +1,81 @@
+/**
+ * Crew board context (scalix-org roadmap/SCALIX-CREW.md, T2.2/T2.3).
+ *
+ * BOARD.md is a READ-ONLY projection of a crew's notice board, written into
+ * the workspace by whoever runs the session (the orchestrator's CrewHydrator
+ * for cloud sessions; the cockpit for local ones) and refreshed before each
+ * turn. The engine never writes it — posting goes through the
+ * scalix_crew_board_post platform tool, the board's only write path.
+ *
+ * Durable lessons do not live here either: a member that learns something
+ * permanent from a board note promotes it into project memory (/remember),
+ * deliberately. Board = news; memory = knowledge.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+export const BOARD_FILE = 'BOARD.md';
+/** A board is news, not a document dump — cap what lands in context so a
+ *  runaway board cannot crowd the task out of the window. */
+export const BOARD_CONTEXT_MAX_CHARS = 16 * 1024;
+/** Read the workspace board projection. Null when absent or empty — those
+ *  mean "this session has no crew board", which is different from a board
+ *  with no notes (that renders its own explicit empty state). */
+export async function readBoardFile(cwd) {
+    try {
+        const raw = await fs.readFile(path.join(cwd, BOARD_FILE), 'utf-8');
+        const trimmed = raw.trim();
+        if (!trimmed)
+            return null;
+        return trimmed.length > BOARD_CONTEXT_MAX_CHARS
+            ? trimmed.slice(0, BOARD_CONTEXT_MAX_CHARS) + '\n…(board truncated for context)'
+            : trimmed;
+    }
+    catch {
+        return null;
+    }
+}
+export function boardToContext(board) {
+    if (!board)
+        return '';
+    return [
+        '## Crew Board (read-only projection)',
+        'Shared coordination state from your crew, current as of session start.',
+        'Post updates with the scalix_crew_board_post tool. Never edit BOARD.md —',
+        'it is overwritten on every refresh and your edit would be silently lost.',
+        '',
+        board,
+    ].join('\n');
+}
+/**
+ * Turn-start freshness for a session whose system prompt is assembled once:
+ * tracks the last projection seen and, when the file moves, hands back a
+ * system note carrying the new copy for the conversation history. One file
+ * read per turn; a quiet board costs nothing else.
+ */
+export class BoardTurnRefresher {
+    cwd;
+    lastSeen = null;
+    constructor(cwd) {
+        this.cwd = cwd;
+    }
+    /** Baseline — call once near session start, after the system prompt has
+     *  embedded the board, so the first turnNote() only fires on real change. */
+    async prime() {
+        this.lastSeen = await readBoardFile(this.cwd);
+    }
+    /** Null when nothing changed (or the file vanished — a removed projection
+     *  is a session-plumbing event, not news to tell the model about). */
+    async turnNote() {
+        const current = await readBoardFile(this.cwd);
+        if (current === this.lastSeen)
+            return null;
+        this.lastSeen = current;
+        if (current === null)
+            return null;
+        return [
+            '## Crew Board (updated since your last turn — supersedes earlier copies)',
+            '',
+            current,
+        ].join('\n');
+    }
+}