tumwater 0.2.0 → 0.3.0

package/dist/src/doctor/image-probe.js

@@ -11,14 +11,17 @@ import os from "node:os";
 import path from "node:path";
 import { randomInt } from "node:crypto";
 import zlib from "node:zlib";
+import { DAY_MS } from "../text/datetime.js";
 import { PiStreamParser } from "../pi/pi-stream.js";
-import { resolveAgentBin } from "../pi/pi-bin.js";
+import { resolveBackendBin } from "../pi/pi-bin.js";
 import { imageProbesPath } from "../paths.js";
+import { removeTree } from "../files/files.js";
 import { readJsonFile, writeJsonAtomic } from "../files/json-files.js";
+import { isJsonObject, validEntries } from "../files/json-object.js";
 import { boundedProbe } from "./probe.js";
 /** How long a cached image-probe verdict stays valid while the claim is unchanged (7 days) —
  * a model's endpoint can change underneath a stale pass, so the answer is dated. */
-export const IMAGE_PROBE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+export const IMAGE_PROBE_TTL_MS = 7 * DAY_MS;
 /** The probe's deadline (90 s): a local model may need to load, far beyond the quick credential
  * probes, but a doctor run is still a pre-flight — a hung backend must lose, not stall the
  * report. */
@@ -41,10 +44,20 @@ export function imageProbeEntryFresh(entry, now = Date.now()) {
         entry.claim &&
         now - entry.at <= IMAGE_PROBE_TTL_MS);
 }
+/** Whether a parsed cache entry has the shape of an `ImageProbeCacheEntry`. */
+function isImageProbeCacheEntry(value) {
+    return (isJsonObject(value) &&
+        (value.verdict === "pass" || value.verdict === "fail") &&
+        typeof value.detail === "string" &&
+        typeof value.at === "number" &&
+        Number.isFinite(value.at) &&
+        typeof value.claim === "boolean");
+}
 /** Read the probe cache, or an empty cache when the file is missing or torn (the harness's
- * no-data policy: a crashed writer never takes down a reader). */
+ * no-data policy: a crashed writer never takes down a reader). An entry of a foreign shape is
+ * dropped, so it reads as unprobed, and the doctor's next cache write leaves it out. */
 export function readImageProbeCache(root) {
-    return readJsonFile(imageProbesPath(root)) ?? {};
+    return validEntries(readJsonFile(imageProbesPath(root)), isImageProbeCacheEntry);
 }
 /** Write the probe cache atomically (tmp+rename) so a concurrent reader never sees a torn
  * file. */
@@ -167,7 +180,7 @@ function isFourDigitNumber(text) {
 /** Probe one claimed pi seam with a real image (plans/image-input.md "Doctor"). Runs the
  * resolved pi binary in a run's environment (the caller passes `env`, typically
  * `childEnv({ PATH: pathEnv })` which inherits `PI_CODING_AGENT_DIR`, so the probe reads the
- * same models.json a real tick would):
+ * same models.json a real run would):
  *
  *   `pi --print --mode json --no-session --no-tools --no-mcp --provider P --model M
  *        --thinking <level> @<png> "Reply with only the 4-digit number shown in the image."`
@@ -183,13 +196,13 @@ function isFourDigitNumber(text) {
  * injectable so tests need no real pi. */
 export async function runImageProbe(config, seam, env, timeoutMs = PROBE_TIMEOUT_MS, code) {
     const envBin = env.TUMWATER_PI_BIN?.trim();
-    // Resolve from the run's own environment (env override → config), exactly as a real tick's
+    // Resolve from the run's own environment (env override → config), exactly as a real run's
     // spawn would rather than only the harness process env — so tests can point a fake pi there.
     const bin = envBin
         ? envBin.includes("/")
             ? path.resolve(envBin)
             : envBin
-        : resolveAgentBin(config).bin;
+        : resolveBackendBin(config).bin;
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "tumwater-image-probe-"));
     const wrong = []; // the per-attempt "answered …" detail for a wrong answer
     const misread = []; // whether each wrong answer was a (wrong) 4-digit number
@@ -239,6 +252,6 @@ export async function runImageProbe(config, seam, env, timeoutMs = PROBE_TIMEOUT
             : { verdict: "fail", detail: `two wrong answers (${wrong[1]})` };
     }
     finally {
-        fs.rmSync(dir, { recursive: true, force: true });
+        removeTree(dir);
     }
 }

package/dist/src/doctor/outcome.js

@@ -1,8 +1,9 @@
 /** The doctor report's one-line outcome contract, in its own module so every check module
  * shares the shape and its constructors without a runtime import cycle: doctor-checks.ts
  * value-imports claudeSeamsInUse from doctor-model-checks.ts, so that pair cannot value-import
- * each other. doctor-checks.ts, doctor-model-checks.ts, doctor-orphans.ts, doctor-backlog.ts,
- * doctor-holds.ts, and doctor-launch-services.ts all import from here. */
+ * each other. doctor-checks.ts, doctor-project-checks.ts, doctor-contention-checks.ts,
+ * doctor-model-checks.ts, doctor-orphans.ts, doctor-backlog.ts, doctor-holds.ts, and
+ * doctor-launch-services.ts all import from here. */
 /** Constructors for the one CheckOutcome shape, so each check names its verdict
  * (`okOutcome(detail)`) instead of repeating the two-field literal. */
 export function okOutcome(detail) {

package/dist/src/doctor/probe.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { releaseChildHandles, signalTree } from "../process/process.js";
+import { captureCappedOutput, releaseChildHandles, signalTree } from "../process/process.js";
 /** One bounded probe of a resolved binary: `null` when the spawn threw, the child errored,
  * the deadline passed, or stdout overran `maxOutputBytes` — every case the caller must read as
  * "could not check", never as a verdict. The child runs detached and at the deadline (or on
@@ -29,8 +29,6 @@ export function boundedProbe(bin, args, env, timeoutMs, maxOutputBytes) {
             resolve(null);
             return;
         }
-        let out = "";
-        let bytes = 0;
         let settled = false;
         let timer;
         const settle = (result) => {
@@ -46,19 +44,17 @@ export function boundedProbe(bin, args, env, timeoutMs, maxOutputBytes) {
             resolve(result);
         };
         // Deadline or runaway output: kill the whole group, tear down the handles, and settle —
-        // do not wait for a `'close'` the group may never deliver.
+        // do not wait for a `'close'` the group may never deliver. Overrun shares the path: it
+        // passes `abort` as captureCappedOutput's onOverflow.
         const abort = () => {
             signalTree(child, "SIGKILL");
             settle(null);
         };
         timer = setTimeout(abort, timeoutMs);
-        child.stdout?.on("data", (chunk) => {
-            out += chunk.toString("utf8");
-            bytes += chunk.length;
-            if (bytes > maxOutputBytes)
-                abort();
-        });
+        // Captured stdout is capped at maxOutputBytes (reads past it abort); stderr was piped to
+        // ignore at spawn, so captureCappedOutput attaches nothing to it.
+        const captured = captureCappedOutput(child, maxOutputBytes, abort);
         child.on("error", () => settle(null));
-        child.on("close", (code) => settle({ code, stdout: out }));
+        child.on("close", (code) => settle({ code, stdout: captured.stdout }));
     });
 }