geny-executor 2.65.2__tar.gz → 2.65.4__tar.gz

{geny_executor-2.65.2 → geny_executor-2.65.4}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: geny-executor
-Version: 2.65.2
+Version: 2.65.4
 Summary: Harness-engineered agent pipeline library with 21-stage dual-abstraction architecture, built on the Anthropic API
 Project-URL: Homepage, https://github.com/CocoRoF/geny-executor
 Project-URL: Repository, https://github.com/CocoRoF/geny-executor

{geny_executor-2.65.2 → geny_executor-2.65.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "geny-executor"
-version = "2.65.2"
+version = "2.65.4"
 description = "Harness-engineered agent pipeline library with 21-stage dual-abstraction architecture, built on the Anthropic API"
 readme = "README.md"
 license = "Apache-2.0"

{geny_executor-2.65.2 → geny_executor-2.65.4}/src/geny_executor/memory/_locks.py

@@ -70,7 +70,56 @@ class LoopAgnosticLock:
         # Contended: wait in a worker thread so the event loop keeps running
         # (and the current holder — possibly a coroutine on THIS loop that
         # yielded mid-critical-section — can make progress and release).
-        await asyncio.to_thread(self._lock.acquire)
+        #
+        # CANCELLATION LEAKS THE MUTEX unless it is handled here, and the
+        # leak is permanent. A worker thread blocked in ``lock.acquire()``
+        # cannot be cancelled: cancelling the *await* abandons the waiter
+        # while the thread goes on to take the lock, on behalf of a caller
+        # that no longer exists. ``__aenter__`` never returns, so
+        # ``__aexit__`` never runs, and the mutex is held forever by
+        # nobody. Every later acquirer — the turn's own memory write, the
+        # compaction kick, the conversation archiver — then parks on it,
+        # so the session stops answering until the process restarts.
+        #
+        # Production, 2026-08-11: turns were being abandoned by a
+        # host-side stall guard, and each abandonment leaked this lock, so
+        # one stall turned into every later turn stalling. Observed as
+        # three separate stacks parked in this method with no holder
+        # anywhere in the task list.
+        #
+        # So the WORKER decides what to do with the lock it just took, and
+        # decides it in the worker. Handing back via a loop callback would
+        # work only while the loop is still running — and "the loop is
+        # going away" is exactly one of the situations that cancels an
+        # acquire. ``handoff`` guards the one race that matters: the
+        # instant between the thread taking the mutex and the caller
+        # deciding it no longer wants it.
+        handoff = threading.Lock()
+        state = {"cancelled": False, "held": False}
+
+        def _take() -> bool:
+            self._lock.acquire()
+            with handoff:
+                if state["cancelled"]:
+                    self._lock.release()   # nobody is waiting for it now
+                    return False
+                state["held"] = True
+                return True
+
+        waiter = asyncio.ensure_future(asyncio.to_thread(_take))
+        try:
+            # shield: cancelling the inner task would not stop the thread,
+            # it would only hide what the thread went on to do.
+            await asyncio.shield(waiter)
+        except asyncio.CancelledError:
+            with handoff:
+                if state["held"]:
+                    # The thread already took it for us; give it straight
+                    # back, here, without needing the loop again.
+                    self._lock.release()
+                else:
+                    state["cancelled"] = True
+            raise
 
     async def __aenter__(self) -> "LoopAgnosticLock":
         await self._acquire_without_blocking_loop()

{geny_executor-2.65.2 → geny_executor-2.65.4}/src/geny_executor/memory/providers/file/notes_store.py

@@ -45,7 +45,40 @@ logger = logging.getLogger(__name__)
 # the vector layer can keep its index in lockstep with markdown disk
 # state. Returning the chunk count is informational; failures are
 # swallowed (logger.warning) to keep markdown writes authoritative.
-VectorIndexer = Callable[[NoteRef, str], Awaitable[int]]
+#: ``(ref, body)`` — and, for indexers that want it, the Note itself as a
+#: third positional argument. Passing it is what lets a vector store index
+#: what the note IS (title, tags, importance) and not merely what it says.
+#:
+#: It matters that BOTH write paths agree. A store whose idempotence digest
+#: covers that metadata will re-index a note forever if the write hook sends
+#: a bare row and a later reconciliation sends a rich one: the digests never
+#: settle. Observed in production 2026-08-18 as freshly written notes
+#: showing a blank title in the catalogue while the reconciled ones had it.
+VectorIndexer = Callable[..., Awaitable[int]]
+
+def _indexer_takes_note(indexer: Any) -> bool:
+    """Whether *indexer* has room for the note as a third argument.
+
+    Asked by signature rather than by try/except so a genuine TypeError
+    raised INSIDE the indexer is never mistaken for "wrong arity" and
+    silently retried with less information.
+    """
+    import inspect
+
+    # NOT unwrapped to ``__func__``: ``signature`` on a BOUND method already
+    # omits ``self``, and unwrapping puts it back — which counted a plain
+    # ``index(self, ref, text)`` as having room for a third argument.
+    try:
+        params = inspect.signature(indexer).parameters
+    except (TypeError, ValueError):  # pragma: no cover — builtins
+        return False
+    if any(p.kind is inspect.Parameter.VAR_POSITIONAL for p in params.values()):
+        return True
+    positional = [p for p in params.values()
+                  if p.kind in (inspect.Parameter.POSITIONAL_ONLY,
+                                inspect.Parameter.POSITIONAL_OR_KEYWORD)]
+    return len(positional) >= 3
+
 
 
 _WIKILINK = re.compile(r"\[\[([^\]\|]+)(?:\|([^\]]+))?\]\]")
@@ -187,11 +220,13 @@ class _FilesystemNotesStore(NotesHandle):
             self._refresh_backlinks()
             indexer = self._vector_indexer
             ref_for_index, body_for_index = note.ref, note.body
+            note_for_index = note
             note_meta = note.as_meta()
         # Run auto-vector outside the write lock — embedding the body
         # is an HTTP round-trip and must never block other note ops.
         if indexer is not None and body_for_index:
-            await self._safe_index(indexer, ref_for_index, body_for_index)
+            await self._safe_index(indexer, ref_for_index, body_for_index,
+                                   note_for_index)
         await self._refresh_index_for(note.category)
         await _fire_hook(
             self._hooks.after_note_write,
@@ -230,9 +265,11 @@ class _FilesystemNotesStore(NotesHandle):
             self._refresh_backlinks()
             indexer = self._vector_indexer
             ref_for_index, body_for_index = current.ref, current.body
+            note_for_index = current
             note_meta = current.as_meta()
         if indexer is not None and body_for_index:
-            await self._safe_index(indexer, ref_for_index, body_for_index)
+            await self._safe_index(indexer, ref_for_index, body_for_index,
+                                   note_for_index)
         await self._refresh_index_for(current.category)
         await _fire_hook(
             self._hooks.after_note_update,
@@ -257,7 +294,8 @@ class _FilesystemNotesStore(NotesHandle):
             logger.debug("index refresh callback failed for category=%r", category, exc_info=True)
 
     @staticmethod
-    async def _safe_index(indexer: VectorIndexer, ref: NoteRef, body: str) -> None:
+    async def _safe_index(indexer: VectorIndexer, ref: NoteRef, body: str,
+                          note: Any = None) -> None:
         """Best-effort indexer call — markdown writes win on any
         embedding failure.
 
@@ -274,7 +312,14 @@ class _FilesystemNotesStore(NotesHandle):
         from geny_executor.memory.embedding.client import EmbeddingError
 
         try:
-            await indexer(ref, body)
+            # Offer the note; fall back for indexers written to the older
+            # two-argument shape. Every VectorStore in this package takes
+            # (ref, text), so the fallback is the normal path for them —
+            # only a host store that opted in receives the metadata.
+            if note is not None and _indexer_takes_note(indexer):
+                await indexer(ref, body, note)
+            else:
+                await indexer(ref, body)
         except EmbeddingError as exc:
             if getattr(exc, "category", "unknown") == "unknown":
                 logger.warning(

geny_executor-2.65.4/tests/unit/test_lock_cancel_leak.py

@@ -0,0 +1,153 @@
+"""A cancelled acquirer must not walk off with the lock.
+
+Production, 2026-08-11. Turns stopped answering and stayed that way
+until a restart. Three separate stacks — the turn's own memory write,
+the compaction kick, the conversation archiver — were all parked in
+``LoopAgnosticLock._acquire_without_blocking_loop``, and no task in the
+process held the lock.
+
+A worker thread blocked in ``lock.acquire()`` cannot be cancelled.
+Cancelling the *await* abandoned the waiter while the thread went on to
+take the mutex on behalf of a caller that no longer existed:
+``__aenter__`` never returned, so ``__aexit__`` never ran, and the lock
+was held forever by nobody. Every later acquirer parked behind it.
+
+The trigger was mundane and frequent — a host-side stall guard
+abandoning a slow turn. One stall leaked the lock; from then on every
+turn stalled.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "src"))
+
+import pytest
+
+from geny_executor.memory._locks import LoopAgnosticLock
+
+
+async def _acquire_and_release(lock: LoopAgnosticLock) -> None:
+    async with lock:
+        pass
+
+
+@pytest.mark.asyncio
+async def test_cancelling_a_contended_acquire_does_not_strand_the_lock():
+    """The exact production shape, minimised."""
+    lock = LoopAgnosticLock()
+    holder_may_release = asyncio.Event()
+    holder_has_lock = asyncio.Event()
+
+    async def holder():
+        async with lock:
+            holder_has_lock.set()
+            await holder_may_release.wait()
+
+    h = asyncio.create_task(holder())
+    await holder_has_lock.wait()
+
+    c = asyncio.create_task(_acquire_and_release(lock))
+    await asyncio.sleep(0.05)          # let it reach the thread hop
+    c.cancel()                          # ← the stall guard, in production
+    with pytest.raises(asyncio.CancelledError):
+        await c
+
+    holder_may_release.set()
+    await h
+
+    # The lock must be free. Before the fix the worker thread took it on
+    # behalf of the cancelled contender and nothing ever released it.
+    await asyncio.wait_for(_acquire_and_release(lock), timeout=5.0)
+    assert not lock.locked()
+
+
+@pytest.mark.asyncio
+async def test_repeated_cancellations_do_not_accumulate():
+    """One leak is already fatal; ten makes sure the release path itself
+    does not go wrong under repetition."""
+    lock = LoopAgnosticLock()
+    release = asyncio.Event()
+    got_it = asyncio.Event()
+
+    async def holder():
+        async with lock:
+            got_it.set()
+            await release.wait()
+
+    h = asyncio.create_task(holder())
+    await got_it.wait()
+
+    for _ in range(10):
+        c = asyncio.create_task(_acquire_and_release(lock))
+        await asyncio.sleep(0.01)
+        c.cancel()
+        with pytest.raises(asyncio.CancelledError):
+            await c
+
+    release.set()
+    await h
+    await asyncio.wait_for(_acquire_and_release(lock), timeout=5.0)
+    assert not lock.locked()
+
+
+@pytest.mark.asyncio
+async def test_uncancelled_contention_still_works():
+    """The fix must not break what the lock is for: a contended acquirer
+    waits, then gets it, and not before."""
+    lock = LoopAgnosticLock()
+    order = []
+    release = asyncio.Event()
+    got_it = asyncio.Event()
+
+    async def holder():
+        async with lock:
+            got_it.set()
+            order.append("holder-in")
+            await release.wait()
+            order.append("holder-out")
+
+    async def waiter():
+        async with lock:
+            order.append("waiter-in")
+
+    h = asyncio.create_task(holder())
+    await got_it.wait()
+    w = asyncio.create_task(waiter())
+    await asyncio.sleep(0.05)
+    assert order == ["holder-in"], "the waiter took a held lock"
+    release.set()
+    await asyncio.wait_for(asyncio.gather(h, w), timeout=5.0)
+    assert order == ["holder-in", "holder-out", "waiter-in"]
+
+
+@pytest.mark.asyncio
+async def test_the_loop_keeps_running_while_contended():
+    """The reason for the thread hop in the first place — a contended
+    acquire must not freeze the event loop."""
+    lock = LoopAgnosticLock()
+    release = asyncio.Event()
+    got_it = asyncio.Event()
+    ticks = 0
+
+    async def ticker():
+        nonlocal ticks
+        for _ in range(5):
+            await asyncio.sleep(0.01)
+            ticks += 1
+
+    async def holder():
+        async with lock:
+            got_it.set()
+            await release.wait()
+
+    h = asyncio.create_task(holder())
+    await got_it.wait()
+    w = asyncio.create_task(_acquire_and_release(lock))
+    await ticker()
+    assert ticks == 5, "the loop stopped while an acquire was contended"
+    release.set()
+    await asyncio.wait_for(asyncio.gather(h, w), timeout=5.0)

geny_executor-2.65.4/tests/unit/test_write_hook_carries_the_note.py

@@ -0,0 +1,123 @@
+"""A note's write hook must offer the note, not just its body.
+
+Production 2026-08-18: freshly written notes showed a blank title in the
+catalogue while reconciled ones had it. Two write paths, two shapes —
+the auto-vector hook sent ``(ref, body)`` while the host's periodic
+reconciliation sent the whole note.
+
+That is not merely a lost field. A vector store whose idempotence digest
+covers title/tags/importance will never settle: the hook writes digest A,
+the reconciliation rewrites digest B, the next edit writes A again, and
+the note re-indexes forever.
+
+Indexers are asked by SIGNATURE, never by try/except, so a genuine
+TypeError raised inside an indexer is never mistaken for "wrong arity"
+and silently retried with less information.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "src"))
+
+import pytest
+
+from geny_executor.memory.providers.file.notes_store import _indexer_takes_note
+
+
+# ── arity detection ──────────────────────────────────────────────────
+
+def test_a_two_argument_indexer_is_left_alone():
+    async def old(ref, text):
+        return 1
+
+    assert _indexer_takes_note(old) is False
+
+
+def test_a_three_argument_indexer_is_offered_the_note():
+    async def new(ref, text, note=None):
+        return 1
+
+    assert _indexer_takes_note(new) is True
+
+
+def test_a_bound_method_is_measured_without_self():
+    """`signature` on a bound method already omits `self`; unwrapping to
+    `__func__` puts it back and made every two-arg store look three-arg."""
+    class _Old:
+        async def index(self, ref, text):
+            return 1
+
+    class _New:
+        async def index(self, ref, text, note=None):
+            return 1
+
+    assert _indexer_takes_note(_Old().index) is False
+    assert _indexer_takes_note(_New().index) is True
+
+
+def test_star_args_counts_as_room():
+    async def flexible(ref, *args):
+        return 1
+
+    assert _indexer_takes_note(flexible) is True
+
+
+def test_an_unreadable_signature_is_treated_as_narrow():
+    """Never guess wide: an indexer we cannot measure gets the old shape."""
+    assert _indexer_takes_note(object()) is False
+
+
+# ── end-to-end through the store ─────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_the_write_hook_hands_the_note_to_a_willing_indexer(tmp_path):
+    from datetime import timezone
+
+    from geny_executor.memory.provider import NoteDraft, Scope
+    from geny_executor.memory.providers.file.notes_store import _FilesystemNotesStore
+    from geny_executor.memory.providers.file.layout import DirectoryLayout
+
+    got = []
+
+    async def indexer(ref, text, note=None):
+        got.append(note)
+        return 1
+
+    layout = DirectoryLayout(tmp_path)
+    layout.ensure()
+    store = _FilesystemNotesStore(layout=layout, tz=timezone.utc, scope=Scope.SESSION)
+    store.attach_vector_indexer(indexer)
+
+    await store.write(NoteDraft(title="제목", body="본문입니다", category="daily",
+                                tags=["work"]))
+    assert got and got[0] is not None, "the hook indexed without the note"
+    assert got[0].title == "제목"
+    assert list(got[0].tags) == ["work"]
+
+
+@pytest.mark.asyncio
+async def test_an_old_two_argument_indexer_still_works(tmp_path):
+    """Every VectorStore in this package takes (ref, text) — the common
+    path must not break to serve the new one."""
+    from datetime import timezone
+
+    from geny_executor.memory.provider import NoteDraft, Scope
+    from geny_executor.memory.providers.file.notes_store import _FilesystemNotesStore
+    from geny_executor.memory.providers.file.layout import DirectoryLayout
+
+    calls = []
+
+    async def old_indexer(ref, text):
+        calls.append(ref.filename)
+        return 1
+
+    layout = DirectoryLayout(tmp_path)
+    layout.ensure()
+    store = _FilesystemNotesStore(layout=layout, tz=timezone.utc, scope=Scope.SESSION)
+    store.attach_vector_indexer(old_indexer)
+
+    await store.write(NoteDraft(title="제목", body="본문입니다", category="daily"))
+    assert len(calls) == 1