talon-agent 5.1.0 → 5.2.1

package/src/util/log.ts

@@ -18,6 +18,7 @@ import {
   unlinkSync,
   createWriteStream,
 } from "node:fs";
+import { Writable } from "node:stream";
 import { dirs, files } from "./paths.js";
 
 export type LogComponent =
@@ -30,6 +31,7 @@ export type LogComponent =
   | "media"
   | "notify"
   | "agent"
+  | "agents"
   | "pulse"
   | "userbot"
   | "users"
@@ -126,23 +128,249 @@ const streams: pino.StreamEntry[] = [];
 
 // Console output (disabled in quiet mode), pretty-printed.
 if (!quiet) {
-  streams.push({
-    level: "trace",
-    stream: prettyStream({
-      colorize: true,
-      ignore: "pid,hostname",
-      translateTime: "HH:MM:ss",
-    }),
+  const consoleStream = prettyStream({
+    colorize: true,
+    ignore: "pid,hostname",
+    translateTime: "HH:MM:ss",
   });
+  // pino-pretty writes through a SonicBoom on fd 1 whose own error
+  // handler removes itself after the first non-EPIPE failure
+  // (pino-pretty/lib/utils/build-safe-sonic-boom.js). With stdout
+  // redirected to a file on a full disk that leaves the pipeline's next
+  // error unhandled — i.e. an uncaught exception raised from inside a
+  // log call. One permanent listener closes that door; a dead console
+  // is not worth a dead daemon.
+  consoleStream.on("error", () => {});
+  streams.push({ level: "trace", stream: consoleStream });
+}
+
+/** How long to wait before the first attempt to reopen a failed log file. */
+const SINK_RETRY_MS = 30_000;
+/** Ceiling for the doubling backoff between reopen attempts. */
+const SINK_MAX_RETRY_MS = 5 * 60_000;
+
+export type ResilientFileSinkOptions = {
+  /** Opens the underlying file stream. Injection seam for tests. */
+  open?: (path: string) => Writable;
+  /** Where the pause/resume notices go. Defaults to the console sink. */
+  notify?: (level: "warn" | "info", message: string) => void;
+  /** First backoff step (default 30s). */
+  retryMs?: number;
+  /** Backoff ceiling (default 5 min). */
+  maxRetryMs?: number;
+};
+
+/**
+ * A log file destination that cannot take the process down.
+ *
+ * A bare `createWriteStream` handed to `pino.multistream` is a loaded
+ * gun: when the disk fills (ENOSPC), or the file is unlinked under a
+ * rotation (EBADF), or the fd goes bad (EIO), the stream emits `error`.
+ * With no listener that is an uncaught exception — and it fires from
+ * inside a log call, so the crash handler's own `logError` runs on a
+ * logger that is already broken. That is how a full disk killed the
+ * daemon on 2026-09-18: the process aborted mid-`/update` with no
+ * shutdown, no pidfile cleanup, and no successor.
+ *
+ * This sink owns the file stream instead of exposing it. pino only ever
+ * sees this object, which never emits `error` and never blocks:
+ *   - write failures pause file logging and destroy the broken stream,
+ *   - lines written while paused are DROPPED and counted (never
+ *     buffered — the failure mode here is "no space", so growing a
+ *     buffer is the last thing to do),
+ *   - an unref'd timer retries the open on a 30s → 5min backoff,
+ *   - the first write to land again resumes logging and reports how
+ *     many lines were lost.
+ * The console sink keeps working throughout, and carries the two
+ * notices.
+ */
+export class ResilientFileSink extends Writable {
+  private readonly path: string;
+  private readonly openStream: (path: string) => Writable;
+  private readonly notify: (level: "warn" | "info", message: string) => void;
+  private readonly baseRetryMs: number;
+  private readonly maxRetryMs: number;
+  private inner: Writable | null = null;
+  private retryMs: number;
+  private retryTimer: ReturnType<typeof setTimeout> | null = null;
+  private droppedWhileDown = 0;
+  private down = false;
+
+  constructor(path: string, opts: ResilientFileSinkOptions = {}) {
+    // decodeStrings:false keeps pino's serialized lines as strings;
+    // autoDestroy:false means a downstream failure can never tear this
+    // object down — it is the only thing standing between a broken file
+    // and the process.
+    super({ decodeStrings: false, autoDestroy: false });
+    this.path = path;
+    this.openStream = opts.open ?? openLogFile;
+    this.notify = opts.notify ?? notifyViaConsoleSink;
+    this.baseRetryMs = opts.retryMs ?? SINK_RETRY_MS;
+    this.maxRetryMs = opts.maxRetryMs ?? SINK_MAX_RETRY_MS;
+    this.retryMs = this.baseRetryMs;
+    this.openInner();
+  }
+
+  /** Lines discarded since the sink went down; cleared on recovery. */
+  get dropped(): number {
+    return this.droppedWhileDown;
+  }
+
+  /** True while file logging is paused (the console sink still runs). */
+  get isDown(): boolean {
+    return this.down;
+  }
+
+  override _write(
+    chunk: unknown,
+    _encoding: BufferEncoding,
+    callback: (error?: Error | null) => void,
+  ): void {
+    const inner = this.inner;
+    if (inner === null) {
+      this.droppedWhileDown++;
+    } else {
+      try {
+        inner.write(chunk as string, (err) => {
+          if (!err) this.markHealthy();
+        });
+      } catch (err) {
+        // Synchronous throw (write-after-destroy on a stream we have not
+        // been told about yet) — same handling as an `error` event.
+        this.fail(err);
+      }
+    }
+    // Always report success: pino must never see this sink fail, and
+    // backpressure here would stall whoever called log().
+    callback();
+  }
+
+  override _final(callback: (error?: Error | null) => void): void {
+    this.clearRetry();
+    try {
+      this.inner?.end();
+    } catch {
+      /* going away anyway */
+    }
+    callback();
+  }
+
+  override _destroy(
+    _err: Error | null,
+    callback: (error?: Error | null) => void,
+  ): void {
+    this.clearRetry();
+    this.detachInner();
+    callback(null);
+  }
+
+  private openInner(): void {
+    try {
+      const inner = this.openStream(this.path);
+      inner.on("error", (err: Error) => {
+        // Ignore errors from a stream we have already given up on.
+        if (this.inner === inner) this.fail(err);
+      });
+      this.inner = inner;
+    } catch (err) {
+      this.fail(err);
+    }
+  }
+
+  /** Give up on the current stream and arm a reopen. Never throws. */
+  private fail(err: unknown): void {
+    const firstFailure = !this.down;
+    this.detachInner();
+    this.down = true;
+    const delay = this.retryMs;
+    this.retryMs = Math.min(this.retryMs * 2, this.maxRetryMs);
+    this.scheduleRetry(delay);
+    if (!firstFailure) return; // a failed reopen is not news
+    const code =
+      (err as NodeJS.ErrnoException | undefined)?.code ??
+      (err instanceof Error ? err.message : String(err));
+    this.emitNotice(
+      "warn",
+      `Log file sink failed (${code}) — file logging paused, ` +
+        `retrying in ${Math.round(delay / 1000)}s`,
+    );
+  }
+
+  /** A write landed: the file is usable again. */
+  private markHealthy(): void {
+    if (!this.down) return;
+    this.down = false;
+    this.retryMs = this.baseRetryMs;
+    const dropped = this.droppedWhileDown;
+    this.droppedWhileDown = 0;
+    this.emitNotice(
+      "info",
+      `Log file sink recovered — file logging resumed ` +
+        `(${dropped} line(s) dropped while it was down)`,
+    );
+  }
+
+  private detachInner(): void {
+    const inner = this.inner;
+    this.inner = null;
+    if (inner === null) return;
+    try {
+      inner.removeAllListeners("error");
+      // destroy() can surface one last error — swallow it here rather
+      // than let it reach process-level uncaughtException.
+      inner.on("error", () => {});
+      inner.destroy();
+    } catch {
+      /* best effort */
+    }
+  }
+
+  private scheduleRetry(delay: number): void {
+    this.clearRetry();
+    const timer = setTimeout(() => {
+      this.retryTimer = null;
+      this.openInner();
+    }, delay);
+    // A paused log sink must not hold the event loop open.
+    timer.unref();
+    this.retryTimer = timer;
+  }
+
+  private clearRetry(): void {
+    if (this.retryTimer === null) return;
+    clearTimeout(this.retryTimer);
+    this.retryTimer = null;
+  }
+
+  /**
+   * Notices are deferred: `fail()` can run inside pino's multistream
+   * write loop, and logging re-entrantly from there would scramble the
+   * metadata pino hangs off the stream for the rest of that loop.
+   */
+  private emitNotice(level: "warn" | "info", message: string): void {
+    queueMicrotask(() => {
+      try {
+        this.notify(level, message);
+      } catch {
+        /* the notice is the least important thing here */
+      }
+    });
+  }
+}
+
+function openLogFile(path: string): Writable {
+  // 0600: turns and tool output land here — same sensitivity as history.
+  return createWriteStream(path, { flags: "a", mode: 0o600 });
+}
+
+function notifyViaConsoleSink(level: "warn" | "info", message: string): void {
+  if (level === "warn") logWarn("file", message);
+  else log("file", message);
 }
 
 // JSON file output (always active outside test runs).
 if (!IS_VITEST) {
-  streams.push({
-    level: "trace",
-    // 0600: turns and tool output land here — same sensitivity as history.
-    stream: createWriteStream(LOG_FILE, { flags: "a", mode: 0o600 }),
-  });
+  streams.push({ level: "trace", stream: new ResilientFileSink(LOG_FILE) });
 }
 
 const logger =
@@ -150,8 +378,24 @@ const logger =
     ? pino({ level: "trace" }, pino.multistream(streams))
     : pino({ level: "silent" });
 
+/**
+ * Emit one record. A logger that throws is worse than a silent one: the
+ * throw lands on whoever called log(), which at shutdown is a signal
+ * handler or a crash handler, and a throw there takes the daemon down —
+ * pino-pretty's SonicBoom, for one, throws "SonicBoom destroyed"
+ * synchronously on every write once a failure has destroyed it. Nothing
+ * a sink does may escape this module.
+ */
+function emit(write: () => void): void {
+  try {
+    write();
+  } catch {
+    /* a broken logger must never become a broken daemon */
+  }
+}
+
 export function log(component: LogComponent, message: string): void {
-  logger.info({ component }, message);
+  emit(() => logger.info({ component }, message));
 }
 
 export function logError(
@@ -163,20 +407,22 @@ export function logError(
     // Capture both the concise message (for log consumers that look at `err`)
     // and the full stack (for diagnostics). pino-pretty renders the `stack`
     // field on its own line; JSON consumers can read either field.
-    logger.error({ component, err: err.message, stack: err.stack }, message);
+    emit(() =>
+      logger.error({ component, err: err.message, stack: err.stack }, message),
+    );
   } else if (err !== undefined) {
-    logger.error({ component, err: String(err) }, message);
+    emit(() => logger.error({ component, err: String(err) }, message));
   } else {
-    logger.error({ component }, message);
+    emit(() => logger.error({ component }, message));
   }
 }
 
 export function logWarn(component: LogComponent, message: string): void {
-  logger.warn({ component }, message);
+  emit(() => logger.warn({ component }, message));
 }
 
 export function logDebug(component: LogComponent, message: string): void {
-  logger.debug({ component }, message);
+  emit(() => logger.debug({ component }, message));
 }
 
 // Expose logger to plugins running in the same process

package/src/backend/kilo/factory.ts

@@ -1,53 +0,0 @@
-/**
- * Kilo backend factory — wires Kilo into the registry.
- *
- * Side-effect import (`import "./factory.js"` from `bootstrap.ts`) calls
- * `registerBackend(...)` at module load, making Kilo available under
- * `config.backend === "kilo"`. The capability wiring is the shared
- * remote-server composition; only the bound functions are Kilo's.
- */
-
-import { registerBackend } from "../../core/agent-runtime/backend-registry.js";
-import { createRemoteBackendFactory } from "../remote-server/factory.js";
-import {
-  initKiloAgent,
-  stopKiloServer,
-  handleMessage,
-  runOneShotAgent,
-  getKiloSessionSnapshot,
-  resolveModel,
-  getModelInfo,
-  getSettingsPresentation,
-  getProviders,
-  getProviderModels,
-  formatModelError,
-  listModels,
-  refreshPluginMcpServers,
-  updateSystemPrompt,
-  warmSession,
-} from "./index.js";
-
-registerBackend(
-  createRemoteBackendFactory({
-    id: "kilo",
-    label: "Kilo",
-    sdkPackage: "@kilocode/sdk",
-    init: initKiloAgent,
-    stop: stopKiloServer,
-    handleMessage,
-    runOneShotAgent,
-    getSessionSnapshot: getKiloSessionSnapshot,
-    models: {
-      resolveModel,
-      getModelInfo,
-      getSettingsPresentation,
-      getProviders,
-      getProviderModels,
-      formatModelError,
-      listModels,
-    },
-    refreshPluginMcpServers,
-    warmSession,
-    updateSystemPrompt,
-  }),
-);

package/src/backend/kilo/handler/index.ts

@@ -1,2 +0,0 @@
-/** Kilo message handler barrel. */
-export { handleMessage } from "./message.js";

package/src/backend/kilo/handler/message.ts

@@ -1,44 +0,0 @@
-/**
- * Kilo main message handler — the shared remote-server chat turn bound to
- * Kilo's server bindings.
- */
-
-import type {
-  QueryParams,
-  QueryResult,
-} from "../../runtime/turn/handler-types.js";
-import { runRemoteChatTurn } from "../../remote-server/chat-turn.js";
-import {
-  ensureServer,
-  trackActiveTurn,
-  ensureSession,
-  ensureChatMcpServer,
-  ensurePluginMcpServers,
-  buildToolOverrides,
-  resolveProviderID,
-  parseStoredKiloModelSelection,
-  getConfig,
-  kiloSystemPromptSuffix,
-} from "../server.js";
-
-export function handleMessage(params: QueryParams): Promise<QueryResult> {
-  // Assembled per call, not at module load: tests mock `../server.js`
-  // with a partial surface and only touch the members they need.
-  return runRemoteChatTurn(
-    {
-      id: "kilo",
-      label: "Kilo",
-      getConfig,
-      ensureServer,
-      trackActiveTurn,
-      parseModelSelection: parseStoredKiloModelSelection,
-      resolveProviderID,
-      ensureSession,
-      ensureChatMcpServer,
-      ensurePluginMcpServers,
-      buildToolOverrides,
-      systemPromptSuffix: kiloSystemPromptSuffix,
-    },
-    params,
-  );
-}

package/src/backend/kilo/index.ts

@@ -1,61 +0,0 @@
-/**
- * Kilo backend — barrel re-export.
- *
- * Uses the `@kilocode/sdk` (a fork of `@opencode-ai/sdk`) and exposes a
- * Backend-compatible API. The implementation is split across
- * focused modules for readability:
- *
- *   - `models.ts`         — model catalog, search, resolution, presentation
- *   - `sessions.ts`       — message parsing, usage summaries, snapshots
- *   - `server.ts`         — server lifecycle, MCP, session management
- *   - `events.ts`         — Kilo-side configurator over shared SSE events
- *   - `handler.ts`        — main message handler (streaming, end_turn,
- *                           delivery routing)
- *   - `one-shot.ts`       — heartbeat / dream one-shot runner
- *   - `model-provider.ts` — adapts the catalog to the Backend interface
- *
- * Note: internal `OpenCode*` type names in `models.ts` (e.g.
- * `OpenCodeModelCatalogEntry`) are retained on purpose — Kilo's
- * provider-bucket API is forked from OpenCode's wire shape, so the
- * names match what the upstream actually emits.
- */
-
-// ── Models ─────────────────────────────────────────────────────────────────
-export {
-  getOpenCodeModelSelectionValue,
-  resolveOpenCodeModelInput,
-  getOpenCodeQuickPickModels,
-  formatOpenCodeSelectionError,
-} from "./models/index.js";
-
-// ── Sessions ───────────────────────────────────────────────────────────────
-export {
-  summarizeKiloAssistantMessages,
-  getKiloSessionSnapshot,
-} from "./sessions.js";
-
-// ── Server / lifecycle ─────────────────────────────────────────────────────
-export {
-  initKiloAgent,
-  stopKiloServer,
-  refreshPluginMcpServers,
-  updateSystemPrompt,
-  warmSession,
-} from "./server.js";
-
-// ── Handler ────────────────────────────────────────────────────────────────
-export { handleMessage } from "./handler/index.js";
-
-// ── Model provider (Backend adapter) ──────────────────────────────────
-export {
-  resolveModel,
-  getModelInfo,
-  getSettingsPresentation,
-  getProviders,
-  getProviderModels,
-  listModels,
-  formatModelError,
-} from "./model-provider.js";
-
-// ── One-shot agent runner ──────────────────────────────────────────────────
-export { runOneShotAgent } from "./one-shot.js";

package/src/backend/kilo/model-provider.ts

@@ -1,36 +0,0 @@
-/**
- * Kilo model provider — adapts the internal catalog to the Backend model
- * interface via the shared remote-server factory. Each export matches a
- * method on `Backend.models`.
- */
-
-import { createRemoteModelProvider } from "../remote-server/model-catalog/index.js";
-import {
-  getOpenCodeModelCatalog,
-  getOpenCodeModelInfo,
-  getOpenCodeModelSelectionValue,
-  resolveOpenCodeModelInput,
-  getOpenCodeSettingsPresentation,
-  formatOpenCodeUnavailableModel,
-} from "./models/index.js";
-
-const provider = createRemoteModelProvider({
-  label: "Kilo",
-  getCatalog: (forceRefresh) => getOpenCodeModelCatalog(forceRefresh),
-  getModelInfo: (id) => getOpenCodeModelInfo(id),
-  resolveModelInput: (query, catalog) =>
-    resolveOpenCodeModelInput(query, catalog),
-  getSelectionValue: (model, catalog) =>
-    getOpenCodeModelSelectionValue(model, catalog),
-  formatUnavailableModel: (model) => formatOpenCodeUnavailableModel(model),
-  getSettingsPresentation: (activeModel, callbackPrefix) =>
-    getOpenCodeSettingsPresentation(activeModel, callbackPrefix),
-});
-
-export const resolveModel = provider.resolveModel;
-export const getModelInfo = provider.getModelInfo;
-export const getSettingsPresentation = provider.getSettingsPresentation;
-export const getProviders = provider.getProviders;
-export const getProviderModels = provider.getProviderModels;
-export const listModels = provider.listModels;
-export const formatModelError = provider.formatModelError;

package/src/backend/kilo/models/index.ts

@@ -1,55 +0,0 @@
-/**
- * Kilo model catalog — binder over the shared remote-server model-catalog
- * module (see `backend/remote-server/model-catalog/`).
- *
- * Kilo's provider-bucket API is forked from OpenCode's, so the catalog,
- * resolution, and presentation logic is the shared implementation; this file
- * only binds the Kilo SDK client + presentation knobs and re-exports the
- * result under the historical `OpenCode*`-prefixed names (retained on
- * purpose — the names match the wire shape the upstream actually emits).
- *
- * Knobs: Kilo's model picker renders through Discord StringSelectMenus,
- * which allow 25 options and values up to 100 chars with any characters —
- * Kilo ids routinely contain "/" and ":" (e.g. "inclusionai/ling-2.6-1t:free").
- */
-
-import { ensureServer, onServerStop } from "../server.js";
-import { createRemoteModelCatalogModule } from "../../remote-server/model-catalog/index.js";
-
-export type {
-  RemoteModelCatalogEntry as OpenCodeModelCatalogEntry,
-  RemoteModelCatalog as OpenCodeModelCatalog,
-  RemoteModelResolution as OpenCodeModelResolution,
-  ModelButton,
-} from "../../remote-server/model-catalog/index.js";
-export {
-  sortCatalogModels,
-  getRemoteModelSelectionValue as getOpenCodeModelSelectionValue,
-  resolveRemoteModelInput as resolveOpenCodeModelInput,
-  guessProviderID,
-  getBucketPriority,
-  normalizeModelLookup,
-  parseRemoteModelQuery as parseOpenCodeModelQuery,
-  formatRemoteUnavailableModel as formatOpenCodeUnavailableModel,
-} from "../../remote-server/model-catalog/index.js";
-
-const kiloModels = createRemoteModelCatalogModule({
-  label: "Kilo",
-  getClient: () => ensureServer(),
-  maxCallbackIdLength: 90,
-  allowCallbackSeparators: true,
-  quickPickLimit: 24,
-});
-
-// A stopped server invalidates the catalog it served.
-onServerStop(kiloModels.clearCache);
-
-export const getOpenCodeModelCatalog = kiloModels.getCatalog;
-export const clearModelCatalogCache = kiloModels.clearCache;
-export const getOpenCodeModelInfo = kiloModels.getModelInfo;
-export const getOpenCodeQuickPickModels = kiloModels.getQuickPickModels;
-export const getOpenCodeSettingsPresentation =
-  kiloModels.getSettingsPresentation;
-export const renderOpenCodeModelSummary = kiloModels.renderModelSummary;
-export const renderOpenCodeModelList = kiloModels.renderModelList;
-export const formatOpenCodeSelectionError = kiloModels.formatSelectionError;

package/src/backend/kilo/one-shot.ts

@@ -1,42 +0,0 @@
-/**
- * Kilo one-shot agent runner — used by heartbeat & dream.
- *
- * Thin binding over the shared remote-server runner (see
- * `backend/remote-server/one-shot.ts` for the design notes): Kilo
- * supplies its server bootstrap, model-selection parser, and delivery
- * suffix; everything else is the shared lifecycle.
- */
-
-import type { OneShotAgentParams, OneShotUsage } from "../../core/types.js";
-import { runRemoteOneShotAgent } from "../remote-server/one-shot.js";
-import {
-  ensureServer,
-  ensureChatMcpServer,
-  ensurePluginMcpServers,
-  buildToolOverrides,
-  disconnectChatMcpServer,
-  resolveProviderID,
-  parseStoredKiloModelSelection,
-  KILO_SYSTEM_PROMPT_SUFFIX,
-  errMsg,
-} from "./server.js";
-
-export function runOneShotAgent(
-  params: OneShotAgentParams,
-): Promise<OneShotUsage | void> {
-  return runRemoteOneShotAgent(
-    {
-      label: "Kilo",
-      systemPromptSuffix: KILO_SYSTEM_PROMPT_SUFFIX,
-      ensureServer,
-      parseModelSelection: parseStoredKiloModelSelection,
-      resolveProviderID,
-      ensureChatMcpServer,
-      ensurePluginMcpServers,
-      buildToolOverrides,
-      disconnectChatMcpServer,
-      errMsg,
-    },
-    params,
-  );
-}